FTP User Isolation Setup Each User Sees Only Their Own Folder
One FTP server, many users — and every user can currently wander through everyone else's folders. User isolation is the IIS feature that ends that, and it is mostly about folder names.
🎥 The full deployment is in the video — the FTP feature install, users, folder permissions, firewall and passive mode, shown live step by step
A shared FTP root is fine for one team folder. It is not fine when five branch offices, five clients or five departments upload to the same server and can all see and download each other's files. IIS solves this with FTP User Isolation: each user logs in and lands in a private home folder, and the rest of the tree simply does not exist for them. The setting itself is one radio button — the part everyone gets wrong is the folder structure it expects. Get that right and isolation just works.
FTP Root — The Folder Layout Isolation Expects
D:\FTPShare\
LocalUser\
ftp-delhi\
ftp-jaipur\
ftp-store\
Public (global virtual directory, optional)
For local accounts the middle folder must literally be named LocalUser; for domain accounts it takes the domain name.
1
The Three Modes, in Plain Words
Do not isolate users — everyone starts in the same root and can roam the whole tree. This is the default and the reason you are reading this page.
Isolate users — User name directory — each user is locked into a folder named after their account and cannot climb above it. Recommended for almost every real deployment.
Isolate all directories — the strictest mode, which also hides global virtual directories unless each user has their own. Choose it only when you truly need that last step.
2
Build the Folder Structure First
Isolation resolves the home folder by name, so build exactly this under your FTP root before changing any setting: a folder named LocalUser for local accounts (or the domain name for domain accounts), and inside it one folder per username, spelled exactly like the account — D:\FTPShare\LocalUser\ftp-delhi and so on. A single character difference means the user lands nowhere and logs the home directory 530 error from the previous page.
3
Turn Isolation On
IIS Manager → select the FTP site → FTP User Isolation.
Choose Isolate users, and under it User name directory (disable global virtual directories) for the standard behaviour.
Apply. There is no service restart drama — new logins use the new layout immediately.
From the command line the same setting is: appcmd set site /site.name:"Company FTP" /ftpServer.userIsolation.mode:IsolateUsers run from C:\Windows\System32\inetsrv.
4
NTFS Permissions — The Second Lock Still Applies
Isolation decides where a user lands; NTFS still decides what they can do there. On each user folder, give that user Modify and remove access for the other FTP users — otherwise a path-aware client can sometimes request files directly. Also give your admin account access to the whole tree for maintenance. Isolation plus clean NTFS is real separation; isolation alone is a locked front door with open windows.
5
Test With Two Users Before Announcing It
Log in as user one: upload a test file, then try to move up a level with CDUP or the client's parent-folder button — it must refuse or show an empty root.
Log in as user two: user one's file must be invisible and its folder unreachable.
Only then tell users the server is ready. Privacy features are announced after they are proven, not before.
🔴 One rule before anything else: classic FTP sends the username, the password and every file in plain readable text. Inside a trusted office LAN it still has honest uses. On the open internet it does not — there the answer is FTPS or SFTP, and these pages will keep saying so.
🎥 Watch the Complete FTP Server Deployment
The video sets up the whole FTP server on Windows live — including the fast automated route — so you can follow it on your own server, click by click.
Users get home directory inaccessible after I enable isolation — what broke
Almost always the folder layout. The account folder must sit inside LocalUser (or the domain-named folder) and be spelled exactly like the username. Check that first — it is the cause in the great majority of cases.
Can isolated users still share one common folder
Yes. Keep a shared area as a virtual directory under each user's home, or run a second site for shared files. In Isolate all directories mode, global virtual directories are hidden by design, so plan the shared area per user.
Does user isolation encrypt or protect files in transit
No. Isolation controls who can see which folder after login. The login password and the files still travel in plain text with classic FTP — for that protection you need FTPS or SFTP.
This guide is based on the Technical Anshu video — Windows FTP Server Deployment Guide for IT Admins • Stuck on a step — ask in the video comments and you will get an answer there 🙏