Just thought this may be an issue, since we do not want to expose user passwords that can give full access to remote desktop etc.
Does windows protect the password at all?
Well yes, I believe it doesn't protect the password in a FTP session. The FTP Protocol defines clear text for username and password info, so any FTP server and any FTP client will expect passwords to be sent in clear text in order to adhere to the standard. If Microsoft were to change that then it wouldn't be a FTP server any more.
This is a weakness in the FTP protocol (actually in fairness it's less a weakness and more a reminder that several internet protocols were designed in kinder gentler days when security was less of a pressing issue than it is now) that Microsoft or any other vendor has very little choice about.
It's documented reasonably clearly here if you fancy a read but I've included the most relevant extract below:
I suggest the same as them, FTP over SSL. Also consider not using domain accounts for FTP access; we've setup local accounts on the FTP server for employees and students who require FTP accounts.