We're using Windows Server 2008 with Active Directory controlling access to a network share. We've setup FTP so that people can access that share from outside (we used to use the PPTP VPN but for various reasons we need to switch to FTP). So far here is what we've managed to implement on the FTP:
-The network share is used as the FTP root (defined as a UNC) and that is working fine.
-AD authentication is working fine (wrong password and you stay out, good password you're in, password management in AD correctly synched with the FTP).
-AD permissions are failing: the AD permissions on the content of the FTP root are ignored: it's either a user only has read or write access, but this applies to the whole FTP root, which obviously isn't suitable since that FTP root is initially our network share and files/folders have different AD permissions depending on people's groups...
Whether we set the permissions through the share OR the FTP management interface, AD permissions are never enforced.
Q1: Is that normal?
Q2: If so what solutions exist to combine AD permissions with FTP on MS server 2008?
Q3: If not, where should I look to fix the configuration?
Following MarkM's answer I did the following:
-Set the NTFS permissions on the share (which is also the FTP root) to
List folder contents for
FTP Authorization Rules to
Specified roles or user groups=
Domain Users with
write was also enabled hence why NTFS permissions were probably overwritten).
I then created 3 folders with the following NTFS permissions:
-folderA: inheritable, nothing else
-folderB: not inheritable,
Full control to
-folderC: not inheritable, no permissions for
Via FTP, the NTFS read permisisons are properly enforced, however the write permissions aren't:
-folderA: can see the folder, can open it and download it's content, can't upload to it
-folderB: can see the folder, can open it and download it's content, can't upload to it (NTFS
write permission is NOT enforced)
-folderC: can't even see the folder (NTFS
read permission is properly enforced)
Q4: What other settings should I be looking at?