How to set up an FTP server on Windows 10 and 11 (IIS)

FTP is the right choice when something on the other end only speaks FTP: a scanner that saves to a folder, a camera, an old program or a script you can't change. If the clients can use SFTP, an SFTP server is simpler: one port, always encrypted, and also built into Windows. See how to set up an SFTP server, and SFTP vs SCP vs FTP for the differences.

1. 1

   Step 1: Turn on FTP Server in Windows Features

   Press Win+R, type optionalfeatures and press Enter. Expand Internet Information Services, tick FTP Server (with FTP Service inside it), and under Web Management Tools tick IIS Management Console. Click OK. Or do the same in PowerShell as administrator:

   # Windows 10 and 11
   Enable-WindowsOptionalFeature -Online -FeatureName IIS-FTPServer, IIS-FTPSvc, IIS-ManagementConsole -All
   
   # Windows Server
   Install-WindowsFeature Web-Ftp-Server -IncludeManagementTools

2. 2

   Step 2: Create a folder and a user for FTP

   Use a local account just for FTP, so the FTP password isn't your Windows password. In PowerShell as administrator:

   $pw = Read-Host "Password for ftpuser" -AsSecureString
   New-LocalUser -Name "ftpuser" -Password $pw -PasswordNeverExpires
   New-Item -ItemType Directory C:\FTP
   icacls C:\FTP /grant "ftpuser:(OI)(CI)M"

   The last line lets that user read, write and delete in C:\FTP. Use (OI)(CI)RX instead for read-only access.

3. 3

   Step 3: Add the FTP site in IIS Manager

   Press Win+R, type inetmgr and press Enter. Under your PC's name, right-click Sites and choose Add FTP Site…. Give it a name and set the physical path to C:\FTP. On the next page keep the IP address as All Unassigned and port 21, and choose Allow SSL for now. On the last page tick Basic authentication, set Authorization to Specified users: ftpuser, and tick Read and Write. Click Finish.

4. 4

   Step 4: Set the passive port range

   FTP sends files over extra connections. In IIS Manager, click your PC's name (the server node, not the site), open FTP Firewall Support, enter a Data Channel Port Range such as 50000-50100 and click Apply. Leave External IP Address of Firewall empty for use on your own network. Then restart the FTP service:

   Restart-Service ftpsvc

5. 5

   Step 5: Allow FTP through Windows Firewall

   Installing the FTP Server usually adds firewall rules for it. If other PCs can't connect, or once you turn on FTPS (the firewall can't read encrypted FTP to open data ports by itself), add the rules yourself:

   New-NetFirewallRule -DisplayName "FTP (port 21)" -Direction Inbound -Protocol TCP -LocalPort 21 -Action Allow
   New-NetFirewallRule -DisplayName "FTP passive ports" -Direction Inbound -Protocol TCP -LocalPort 50000-50100 -Action Allow

Plain FTP sends the user name and password unencrypted. On the FTP server, add a certificate and require TLS:

1. 1

   Step 1: Get a certificate

   In IIS Manager, click your PC's name and open Server Certificates. For use on your own network, choose Create Self-Signed Certificate…, give it a name and pick the Personal store. For a server on the internet, import a certificate for its domain instead.

2. 2

   Step 2: Require TLS on the site

   Click your FTP site, open FTP SSL Settings, pick the certificate, choose Require SSL connections and click Apply. Clients now connect with FTPS using explicit TLS on port 21.

Replace files-pc with the server's name or local address:

Test-NetConnection files-pc -Port 21
curl.exe -u ftpuser ftp://files-pc/                      # plain FTP: lists the folder
curl.exe --ssl-reqd -k -u ftpuser ftp://files-pc/        # FTPS (explicit TLS), self-signed certificate

• TcpTestSucceeded : False: the firewall blocks port 21, or the FTP site isn't started (check it in IIS Manager).
• 530 User cannot log in: the user name or password is wrong, Basic authentication is off, or the user isn't allowed under FTP Authorization Rules.
• Signs in, then hangs on the listing: the passive ports aren't open in the firewall, or the range wasn't applied (restart ftpsvc).
• 534 Policy requires SSL: the site requires FTPS; connect with TLS turned on.

In the RemoteAccessApp Console, go to Connections, add a host, choose FTP, and enter the server's address, port 21, ftpuser and its password. Under More options, set Encryption to FTPS (explicit TLS). The first time, you see the certificate's fingerprint and choose Trust and connect. The server's files open next to your PC's in two panes: drag files either way, or use Upload to servers… to send the same files to several servers.

The Console is free on Windows and Linux for up to 5 saved hosts: download RemoteAccessApp.

For FTP to work from the internet, you'd forward port 21 and the whole passive range on your router, set the router's public address under External IP Address of Firewall, and use FTPS so nothing travels in the clear. That's a lot of open ports for one folder.

An SFTP server on the same PC is easier to reach safely. RemoteAccessApp can reach SSH and SFTP hosts through one of your own PCs on that network, with nothing forwarded. FTP can't go that way, because it opens a new connection for every file. You can also send files to your own PCs directly, with no server at all: see send large files between your PCs.