Windows FTP Server Setup Complete Deployment Guide for IT Admins

Three decisions made now save an hour of debugging later.

1. Use Windows Server for a real deployment, or Windows 10/11 Pro for a lab — the FTP service is an IIS role in both.
2. Give the server a fixed IP address. FTP clients and firewall rules point at it; a changing DHCP address breaks everything silently.
3. Create the FTP root folder first, for example D:\FTPShare, ideally on a data drive and not inside the Windows folder.
4. Decide who gets access before creating the site — one named user per person or per device is the professional pattern.

On Windows Server, open Server Manager → Add Roles and Features → Web Server (IIS) and under Role Services tick FTP Server → FTP Service and the IIS Management Console. On Windows 10/11 use Turn Windows features on or off → Internet Information Services → FTP Server.

The same install from an admin PowerShell on a server is one line:

1. Install-WindowsFeature Web-FTP-Server -IncludeManagementTools

When it finishes, the FTP Publishing Service exists in services.msc and IIS Manager gains the FTP options. This feature install is exactly what the video's automation does first.

Never hand out your administrator account for FTP. Create a normal local user whose only job is FTP — the video creates the account as part of the setup, and here is the manual version:

1. Open lusrmgr.msc → Users → New User, or run net user ftpuser Pass@1234 /add from an admin command prompt (that password is only an example — set your own strong one).
2. Tick Password never expires only for service-style accounts like a scanner; for people, leave normal password rules.
3. The user needs no group membership and no logon rights beyond FTP.

IIS settings alone do not grant file access — NTFS permissions are the real lock. On the FTP root folder open Properties → Security and give the FTP user Modify for upload and download work, or Read for download-only shares. Remove broad entries like Everyone with Full Control. If this step is skipped, logins fail with 530 or uploads fail with 550 even when IIS looks perfect — the two error pages in this series explain that split.

1. Open IIS Manager, right-click Sites → Add FTP Site.
2. Name it, and point the physical path at your FTP root folder.
3. Binding: the server's fixed IP, port 21, and for a plain LAN site choose No SSL — knowingly, because FTP offers no encryption until you add a certificate (see the FTPS page).
4. Authentication: enable Basic, disable Anonymous unless you have read the anonymous-access page in this series and still mean it.
5. Authorization: allow Specified users, enter your FTP user, and tick Read and Write as needed. Finish.

Windows carries predefined rules for this. Enable the FTP Server rule group in Windows Defender Firewall with Advanced Security, or from an admin command prompt:

1. netsh advfirewall firewall add rule name="FTP Server Port 21" dir=in action=allow protocol=TCP localport=21
2. Scope the rule to your LAN subnet rather than Any — the firewall page in this series shows the exact scoping commands.
3. If clients will connect in passive mode (almost all do), the data port range must be opened too — that is the next step, not an afterthought.

An FTP login uses port 21, but the file data travels on separate ports the server picks. In IIS Manager, select the server name (not the site) → FTP Firewall Support and set a small fixed range such as 50000-50100, then open that same range in the firewall. Restart the FTP service afterwards with net stop ftpsvc and net start ftpsvc. The passive-mode page in this series walks through IIS, firewall and router together — keep all three in agreement or outside connections fail in a very specific way.