I have been trying to create an FTP server on my new Server 2008.

I have been following both (very detailed and highly published here guides)

For setting up using IIS Manager http://learn.iis.net/page.aspx/321/configure-ftp-with-iis-7-manager-authentication/


For anonymous FTP http://www.trainsignaltraining.com/windows-server-2008-ftp-iis7

I am able to log as an anonymous user. My need is to use a named user, so I need to use the IIS Manager.

I get error 530 when trying to log as a user.

Connected to
220 Microsoft FTP Service
User ( ftpmanager
331 Password required for ftpmanager.
530-User cannot log in.
 Win32 error:   Logon failure: unknown user name or bad password.
 Error details: Filename:

530 End
Login failed.

I can not learn from this message anything.

My password is set to: 1234 (so I don't think I make a mistake here - testing purposes only ofc)

Thank you.

Note - I went over other posts on SE that I read, and couldn't get the result:

EDIT I think I found some errors with the physical path. Going to Basic settings, and Test Connection on the physical path, gave me the following error:

The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built-in account has access. Make sure that the application pool identity has Read access to the physical path. If this server is joined to a domain, and the application pool identity is NetworkService or LocalSystem, verify that \$ has Read access to the physical path. Then test these settings again.

I am not sure which/whom should get access to the Root folder !?

I want to point out, I managed to login with a domain user (change authorization and authentication methods) but this is NOT the requested solution. I checked to make sure that the FTP, folders, access is working properly.

I am bit lost here.

==== More tries: I have enabled another Allow rule for ALL Users. I still get the same error. It seems that it doesn't matter if i use a correct or wrong password, I still get Error 530.

  • I set the user to be a local domain\administrator - I still get the same error 530 when trying to login.
    – Saariko
    Jul 12, 2011 at 10:49
  • I tried to give full access to Network Service to the FTP site - did not help
    – Saariko
    Jul 12, 2011 at 10:51
  • Do you want each user to access its own files (isolated) .. or each user have access to all (same) files (shared)? I'm always doing isolated setup (each FTP user can access specific website) and can post the "algorithm" I'm using.
    – LazyOne
    Jul 12, 2011 at 11:40
  • I only going to have 1 user. so isolation is not needed. I am thinking to simply create another domain user: ftpuser. As much as I hate to do it. I will be happy for a IIS User solution that works.
    – Saariko
    Jul 12, 2011 at 11:43
  • @LazyOne Please post your algorithm, maybe I am still missing something. Even it maybe a small '.'.
    – Saariko
    Jul 12, 2011 at 12:03

2 Answers 2


I will describe how I do isolated setup of FTP server. This works fine for our needs (1 (or more) user per website). I understand that there maybe much better/quicker/secure setup, but that is what I have been using all the time without any issues so far (Keep in mind -- I'm programmer and not an pro admin and will be grateful for any comments and advices).

  1. Create new user: IUSR_ftpacc (will be used to run app pool).

    • Set "Deny this user permissions to log on to Terminal Services"
    • Member Of: remove "Users"; add "IIS_IUSRS"
  2. Create new user(s) that will be used to access FTP service: e.g. ftpuser

    • Set "Deny this user permissions to log on to Terminal Services"
    • Member Of: I always remove "Users" and add "FTP" group (which you have to create separately -- all users in FTP group will be allowed to use FTP later)
  3. Create folder for FTP: D:\websites\FTP and grant Read & Execute right to this folder.

  4. Create 2 subfolders: "localuser" (for user folders -- must be this name) and "logs" (for logs).

  5. Create individual folders inside D:\websites\FTP\localuser for each FTP account (folder must match user account): e.g. ftpuser, and grant Modify permission.

  6. Open IIS Manager and create new Application Pool: FTPServiceApp. Advanced Settings -> Identity -- set it up to use IUSR_ftpacc account.

  7. Sites -> Add FTP Site..

    • FTP site name: FTP
    • Physical path: D:\websites\FTP
    • Authentication: Basic
    • Allow access to: Specified roles or user groups; FTP (the group mentioned in #2)
    • Permissions: Read & Write
  8. Select newly created ftp site -> Actions -> Basic Settings: Change Application Pool to the one created at #6 (FTPServiceApp). If all setup properly you will see 2 green marks when clicking "Test Settings.." button. "Connect as.." should have "Application user (pass-through authentication)" selected by default.

  9. FTP User Isolation -- I'm always choosing "User name physical directory".

  10. The "FTP Authorisation Rules" should be configured already (from wizard step). "FTP Logging" -- set to write logs into D:\websites\FTP\logs folder.

If I need user to access some website (which located in D:\websites\mywebsite, for example) I create symlink (or directory junction) instead of folder at step #5.

  • Thanks for this workflow. I still want to use IIS_User_manager, and not the system users.
    – Saariko
    Jul 19, 2011 at 12:56

I had the same problem. What I did that fixed it is ran the following commands in the command prompt:

ICACLS "%SystemDrive%\Windows\System32\inetsrv\config" /Grant "Network Service":R /T

ICACLS "%SystemDrive%\Windows\System32\inetsrv\config\administration.config" /Grant "Network Service":R

ICACLS "%SystemDrive%\Windows\System32\inetsrv\config\redirection.config" /Grant "Network Service":R

That's from here: http://www.iis.net/learn/publish/using-the-ftp-service/configure-ftp-with-iis-manager-authentication-in-iis-7

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .