Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have setup an FTP site in IIS 7.5 with SSL using a self-signed certificate. I can login and view my view my virtual directories, which are all setup as UNC paths. The problem is that I cannot write to any location through FTP.

I have 3 Active Directory groups setup. Each group has permissions set properly at the folder level. These permissions are verified through the "Effective Permissions" tab where it shows permissions for a given user. But when I login as a user (designer1) that belongs to a group (Design) which has access to the folders that my virtual directories point to, I get Access is denied.

I tried nearly every configuration for this and cannot get it to work. The App Pool for my FTP site is it's own pool "FTP" with No Managed code, in Classic Pipeline Mode. What should the Application Pool Identity be?

In the FTP "site" properties, I have the "Conect As" set to "Application user (pass-through authentication)" so that the file permissions will dictate whether that user has access to write or not.

Also under the FTP site properties, I have Anonymous Authentication disabled and Basic Authentication enabled. I have had zero luck setting the FTP Authorization rules since I can type in anything into the Specific Roles and Specific Users field and it doesn't validate if they are real users or groups.

Is there a cache mechanism by which I cannot change the settings and then test them right away? I always restart the IIS service and restart the site and recycle the app pool.

share|improve this question
Happy to provide any further information if it will help diagnose the issues I'm having. –  MaseBase Jan 19 '10 at 20:51

2 Answers 2

up vote 1 down vote accepted

Ok, I have figured out my own problem. Wanted to share my insights briefly.

Application Pool : .NET = No Managed Code : Pipeline Mode = Integrated : Identity = NetworkService

The trick here is that the new FTP Authorization Rules do not verify Active Directory (or local) usernames or groups. Therefore, you could put in anything here, thinking you've got the right group name, and you wouldn't know except that permissions didn't work to allow the rule you've set.

I got this to work by

  1. Ensuring correct folder/file-level permissions per group or user
  2. Setting FTP Authentication to enable Basic and disable Anonymous
  3. Setting the Site Properties to "Connect As..." = "Application user (pass-through authentication)"
  4. Setting the FTP Authorization Rules as desired for each Virtual directory

I hope this helps someone!

share|improve this answer

OK, 1-3 set up just like you stated. Hoever I can not write to the file (virtual directory)

What FTP Authorization rule should be set for RW on the virutal directory if nothing is being passed throuh then it should be set to all user have RTW?


share|improve this answer
You need to essentially duplicate the file/folder level permissions on the FTP Authorization setup. Whether you are using groups or users, you first MUST make sure that the folder level permissions are right. Then you want to go into FTP Authorization and set them the same way. So let's say you have 2 users, Bill and Joe. Bill needs full access to everything in FTP and Joe only get read access. First you set that up on the folder level to make sure that is enforced. Then go into FTP Authorization and add Bill to get Full Access and Joe to get read only. Hope this helps. –  MaseBase Aug 6 '10 at 15:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.