{"id":288,"date":"2026-01-13T02:00:18","date_gmt":"2026-01-13T02:00:18","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=288"},"modified":"2026-09-25T22:07:44","modified_gmt":"2026-09-25T22:07:44","slug":"how-to-connect-to-windows-ftp-from-vps-a-step-by-step-expert-guide","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/how-to-connect-to-windows-ftp-from-vps-a-step-by-step-expert-guide\/","title":{"rendered":"IIS FTP Server on Windows VPS: Setup, FTPS Encryption, and User Isolation"},"content":{"rendered":"\n

Moving files between your workstation and a Windows VPS is a daily task, and IIS ships a fully supported FTP server that most administrators never configure properly. This guide walks through installing the IIS FTP role, creating an isolated site with correct NTFS permissions, locking it down with FTPS, and using PowerShell and FTP over TLS from the client side. The goal is a file-transfer channel that is encrypted, least-privilege, and scriptable rather than a plaintext port 21 open to the internet.<\/p>\n\n\n\n

Why IIS FTP Instead of RDP Drag-and-Drop<\/h2>\n\n\n\n

Copying files through an RDP session works, but it routes data through the remote clipboard\/redirect channel, breaks on large transfers, and gives every file the permissions of the interactive user. A dedicated FTP endpoint separates duties: developers push content over FTPS, the web application pool reads it from disk, and neither party needs interactive logon rights. For the hosting context this site covers, see the Windows VPS hosting plans on windows-vps.org<\/a> to understand what baseline storage and bandwidth your plan provides before you expose a transfer service.<\/p>\n\n\n\n

Step 1: Install the FTP Server Role<\/h2>\n\n\n\n

Install the role with PowerShell (elevated session). This pulls in the management console, the service, and the Web Management Tools dependency.<\/p>\n\n\n\n

Install-WindowsFeature Web-Ftp-Server, Web-Ftp-Service, Web-Ftp-Ext -IncludeManagementTools<\/code><\/pre>\n\n\n\n
Confirm the service is running and set to automatic start:<\/p>\n\n\n\n
Get-Service FTPSVC | Select-Object Name, Status, StartType\nSet-Service FTPSVC -StartupType Automatic\nGet-NetFirewallRule -DisplayName \"*FTP*\" | Select-Object DisplayName, Enabled, Direction<\/code><\/pre>\n\n\n\n
Step 2: Create an Isolated FTP Site<\/h2>\n\n\n\n
Use IIS Manager: Sites → Add FTP Site<\/strong>. Give it a name, point the physical path at a dedicated folder (for example D:\\ftp\\sites\\app1<\/code>), bind to your public IP on port 21, and start it immediately. Then switch to the SSL<\/strong> settings and require SSL \u2014 never leave Allow<\/em> or No SSL<\/em> selected on a public endpoint.<\/p>\n\n\n\n
Setting<\/th>Recommended value<\/th>Why<\/th><\/tr><\/thead>
SSL policy<\/td>Require SSL<\/td>Blocks plaintext credential capture<\/td><\/tr>
Authentication<\/td>Basic (over TLS only)<\/td>Works with isolated users and clients<\/td><\/tr>
Authorization<\/td>Read\/Write for one local group<\/td>Least privilege, no Everyone access<\/td><\/tr>
Passive port range<\/td>50000–50100, firewall opened<\/td>Active mode rarely works through NAT<\/td><\/tr>
Idle timeout<\/td>120 seconds<\/td>Releases dead sessions<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Step 3: Isolated Users and NTFS Permissions<\/h2>\n\n\n\n
IIS has a built-in FTP User Isolation<\/strong> feature. If you set isolation to User name physical directory<\/em>, an account named deploy<\/code> is automatically jailed to a folder called deploy<\/code> under the root \u2014 it cannot walk up the tree. Create the local account, grant it only Modify on its own folder, and add it to the FTP authorization rule instead of granting Everyone access.<\/p>\n\n\n\n
$pw = Read-Host \"Password for deploy\" -AsSecureString\nNew-LocalUser -Name \"deploy\" -Password $pw -PasswordNeverExpires -Description \"FTPS content account\"\nNew-Item -ItemType Directory -Force -Path \"D:\\ftp\\sites\\app1\\deploy\"\n$acl = Get-Acl \"D:\\ftp\\sites\\app1\\deploy\"\n$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(\"deploy\",\"Modify\",\"ContainerInherit,ObjectInherit\",\"None\",\"Allow\")\n$acl.SetAccessRule($rule); Set-Acl \"D:\\ftp\\sites\\app1\\deploy\" $acl<\/code><\/pre>\n\n\n\n
Step 4: Generate a Self-Signed or CA Certificate<\/h2>\n\n\n\n
FTPS needs a certificate for the site binding. A self-signed certificate is fine for internal use but will trigger client warnings; use a public CA certificate if third parties connect. Create a self-signed one in one line:<\/p>\n\n\n\n
New-SelfSignedCertificate -DnsName \"ftp.yourdomain.com\" -CertStoreLocation \"cert:\\LocalMachine\\My\" -NotAfter (Get-Date).AddYears(2)<\/code><\/pre>\n\n\n\n
Then bind it in IIS Manager under the FTP site’s FTP SSL Settings<\/strong> by selecting the certificate thumbprint shown by Get-ChildItem Cert:\\LocalMachine\\My<\/code>.<\/p>\n\n\n\n
Step 5: Connect From the Client<\/h2>\n\n\n\n
In FileZilla or WinSCP, enter the host (the VPS public IP or FQDN), port 21, the deploy<\/code> credentials, and explicitly select Require explicit FTP over TLS<\/strong>. Windows PowerShell cannot do implicit FTPS, so script transfers with WinSCP.com<\/code> or curl<\/code> instead:<\/p>\n\n\n\n
curl.exe --ftp-ssl --ftp-pasv -u deploy -T .\\app.zip ftp:\/\/ftp.yourdomain.com\/deploy\/app.zip<\/code><\/pre>\n\n\n\n
Common FTP Errors and What They Mean<\/h2>\n\n\n\n
Symptom<\/th>Cause<\/th>Fix<\/th><\/tr><\/thead>
530 Login authentication failed<\/td>Bad credentials or User Isolation mismatch<\/td>Verify account name matches folder name, reset password<\/td><\/tr>
Connection timed out<\/td>Passive ports blocked<\/td>Open the 50000–50100 range in Windows Firewall and the provider firewall<\/td><\/tr>
425 Can’t open data connection<\/td>Client in active mode behind NAT<\/td>Switch client to passive mode<\/td><\/tr>
TLS handshake failure<\/td>Certificate not bound or expired<\/td>Re-bind a valid cert under FTP SSL Settings<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Which Articles This Applies To and What It Costs<\/h2>\n\n\n\n
Running IIS FTP costs nothing beyond the VPS plan itself, but the operational overhead is real: a certificate to renew, a passive port range to keep open, and a log stream to monitor. If you only need occasional file drops, an SFTP endpoint over the existing SSH service is lighter to maintain. If you need structure — multiple isolated tenants, per-user jailed roots, and audit trails that map to accounts — IIS FTP with the isolation feature is the better fit.<\/p>\n\n\n\n
Size the storage for the queue rather than the payload: larger uploads complete faster over the same link if the disk can absorb the write while the next file streams in.  <\/p>\n\n\n\n
Hardening Checklist<\/h2>\n\n\n\n