IIS FTP Server on Windows VPS: Setup, FTPS Encryption, and User Isolation

Moving files between your workstation and a Windows VPS is a daily task, and IIS ships a fully supported FTP server that most administrators never configure properly. This guide walks through installing the IIS FTP role, creating an isolated site with correct NTFS permissions, locking it down with FTPS, and using PowerShell and FTP over TLS from the client side. The goal is a file-transfer channel that is encrypted, least-privilege, and scriptable rather than a plaintext port 21 open to the internet.

Why IIS FTP Instead of RDP Drag-and-Drop

Copying files through an RDP session works, but it routes data through the remote clipboard/redirect channel, breaks on large transfers, and gives every file the permissions of the interactive user. A dedicated FTP endpoint separates duties: developers push content over FTPS, the web application pool reads it from disk, and neither party needs interactive logon rights. For the hosting context this site covers, see the Windows VPS hosting plans on windows-vps.org to understand what baseline storage and bandwidth your plan provides before you expose a transfer service.

Step 1: Install the FTP Server Role

Install the role with PowerShell (elevated session). This pulls in the management console, the service, and the Web Management Tools dependency.

Install-WindowsFeature Web-Ftp-Server, Web-Ftp-Service, Web-Ftp-Ext -IncludeManagementTools

Confirm the service is running and set to automatic start:

Get-Service FTPSVC | Select-Object Name, Status, StartType
Set-Service FTPSVC -StartupType Automatic
Get-NetFirewallRule -DisplayName "*FTP*" | Select-Object DisplayName, Enabled, Direction

Step 2: Create an Isolated FTP Site

Use IIS Manager: Sites → Add FTP Site. Give it a name, point the physical path at a dedicated folder (for example D:\ftp\sites\app1), bind to your public IP on port 21, and start it immediately. Then switch to the SSL settings and require SSL — never leave Allow or No SSL selected on a public endpoint.

Setting	Recommended value	Why
SSL policy	Require SSL	Blocks plaintext credential capture
Authentication	Basic (over TLS only)	Works with isolated users and clients
Authorization	Read/Write for one local group	Least privilege, no Everyone access
Passive port range	50000–50100, firewall opened	Active mode rarely works through NAT
Idle timeout	120 seconds	Releases dead sessions

Step 3: Isolated Users and NTFS Permissions

IIS has a built-in FTP User Isolation feature. If you set isolation to User name physical directory, an account named deploy is automatically jailed to a folder called deploy under the root — it cannot walk up the tree. Create the local account, grant it only Modify on its own folder, and add it to the FTP authorization rule instead of granting Everyone access.

$pw = Read-Host "Password for deploy" -AsSecureString
New-LocalUser -Name "deploy" -Password $pw -PasswordNeverExpires -Description "FTPS content account"
New-Item -ItemType Directory -Force -Path "D:\ftp\sites\app1\deploy"
$acl = Get-Acl "D:\ftp\sites\app1\deploy"
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("deploy","Modify","ContainerInherit,ObjectInherit","None","Allow")
$acl.SetAccessRule($rule); Set-Acl "D:\ftp\sites\app1\deploy" $acl

Step 4: Generate a Self-Signed or CA Certificate

FTPS needs a certificate for the site binding. A self-signed certificate is fine for internal use but will trigger client warnings; use a public CA certificate if third parties connect. Create a self-signed one in one line:

New-SelfSignedCertificate -DnsName "ftp.yourdomain.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(2)

Then bind it in IIS Manager under the FTP site’s FTP SSL Settings by selecting the certificate thumbprint shown by Get-ChildItem Cert:\LocalMachine\My.

Step 5: Connect From the Client

In FileZilla or WinSCP, enter the host (the VPS public IP or FQDN), port 21, the deploy credentials, and explicitly select Require explicit FTP over TLS. Windows PowerShell cannot do implicit FTPS, so script transfers with WinSCP.com or curl instead:

curl.exe --ftp-ssl --ftp-pasv -u deploy -T .\app.zip ftp://ftp.yourdomain.com/deploy/app.zip

Common FTP Errors and What They Mean

Symptom	Cause	Fix
530 Login authentication failed	Bad credentials or User Isolation mismatch	Verify account name matches folder name, reset password
Connection timed out	Passive ports blocked	Open the 50000–50100 range in Windows Firewall and the provider firewall
425 Can’t open data connection	Client in active mode behind NAT	Switch client to passive mode
TLS handshake failure	Certificate not bound or expired	Re-bind a valid cert under FTP SSL Settings

Which Articles This Applies To and What It Costs

Running IIS FTP costs nothing beyond the VPS plan itself, but the operational overhead is real: a certificate to renew, a passive port range to keep open, and a log stream to monitor. If you only need occasional file drops, an SFTP endpoint over the existing SSH service is lighter to maintain. If you need structure — multiple isolated tenants, per-user jailed roots, and audit trails that map to accounts — IIS FTP with the isolation feature is the better fit.

Size the storage for the queue rather than the payload: larger uploads complete faster over the same link if the disk can absorb the write while the next file streams in.  

Hardening Checklist

• Require SSL/TLS for all connections; disable unencrypted basic auth.
• Restrict the passive port range and open only that range in the firewall.
• Enable FTP logging and ship logs off-box; audit 530 and 550 responses.
• Use IP restrictions on the site when only known offices upload content.
• Prefer SFTP (port 22) when the same job can be done over SSH — it is a different protocol and generally simpler to firewall.

Configured this way, IIS FTP becomes a controlled deployment channel rather than a liability. If you would rather not run the FTP role at all, the same file workflows can be handled over RDP with mapped drives or over a managed Windows VPS plan from windows-vps.org that includes preconfigured transfer tooling.