How to Install and Configure an IIS FTP Site with TLS
Applies to: Windows Server 2019, 2022 and 2025.
FTP without TLS exposes credentials and data. Use FTPS with a trusted certificate, passive port range and restricted user isolation.
Web-server changes can expose data or interrupt production traffic. Use backups, least privilege and a staged validation path. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Install FTP role services.
- Obtain a certificate matching the FTP hostname.
- Choose passive port range and firewall mappings.
- Create role-based access groups and folders.
Procedure
Step 1: Install FTP services
Add FTP server and service.
Install-WindowsFeature Web-Ftp-Server,Web-Ftp-Service -IncludeManagementToolsStep 2: Create content path
Prepare folder and least-privilege ACL.
New-Item -ItemType Directory -Path 'D:\FTP\Partners' -ForceStep 3: Create FTP site
Use IIS Manager Sites, Add FTP Site, choose hostname, port 21 and approved certificate.
Step 4: Require TLS
Select Require SSL and Basic authentication only through TLS; authorize the intended group.
Step 5: Configure passive range
Set FTP Firewall Support data-channel range and publish only that range through the firewall.
Step 6: Test external and internal paths
Verify authentication, upload, download and denied access.
Verification
Check FTP service, bindings and recent FTP logs.
Get-Service FTPSVC
Get-WebBinding
Get-ChildItem 'C:\inetpub\logs\LogFiles'Rollback
Stop and remove the FTP site, revert firewall mappings and revoke test-only credentials or certificates.
Security notes
SFTP is a different protocol and is not provided by IIS FTP.
Official references
Explore Netcloud24 Canada.
