To allow remote users to download files via an FTP server hosted on Windows IIS, you must install the FTP Service feature, create a dedicated physical folder with appropriate NTFS permissions, and configure the FTP site binding in IIS Manager. Finally, ensure that Windows Firewall rules permit inbound traffic on port 21 so that external clients can successfully connect and retrieve data.
Installing the FTP Service Feature
The foundation of any FTP server on Windows is the installation of the correct role services within Internet Information Services (IIS). By default, many Windows Server installations include the web hosting components but omit the file transfer protocols. You need to explicitly add the FTP Service to your server environment to enable this functionality. Start by opening the Server Manager console from the Start menu or taskbar. Navigate to the Manage menu and select Add Roles and Features. This launches the Add Roles and Features wizard. Proceed through the initial screens until you reach the Roles section. Ensure that Web Server (IIS) is selected; if it is not already installed, you may need to check this box first. Once the Web Server role is confirmed, expand the Web Server node in the left-hand pane. Under the Role Services section, scroll down to find the FTP Server option. Check the box for FTP Service. It is highly recommended to also check FTP Extensibility, as this allows IIS to interact with other modules and provides better logging capabilities. Click Next to proceed through the remaining configuration steps and complete the installation. A restart is rarely required immediately after this step, but the service must be started manually or via the next configuration phase.Creating the FTP Site and Directory Permissions
With the software component installed, the next step is to define where the files will live and who can access them. Security is paramount in FTP configurations because anonymous or poorly restricted access can expose sensitive data. You should create a specific directory structure that isolates FTP content from your primary web documents. Create a new folder on your drive, such asC:\FTPRoot\Downloads. This path will serve as the physical location for your files. Open IIS Manager by searching for it in the Start menu. In the Connections pane on the left, right-click on Sites and select Add FTP Site. Give the site a descriptive name, such as "Remote Downloads". For the physical path, browse to the folder you just created.
For the binding, enter the IP address of the server or leave it as All Unassigned if you want it accessible on all network interfaces. Set the SSL setting based on your security needs. If you are allowing remote users over the internet, selecting No SSL is less secure; however, for internal local program transfers, Basic authentication might suffice. More importantly, you must set the authorization rules. Click Edit... under Authorization Rules. Add an Allow rule for Users or a specific group. Grant Read permissions to allow downloads. Write permissions should generally be denied unless users need to upload files.
Before finalizing the site, you must ensure the Windows operating system itself grants access to these files. Right-click the C:\FTPRoot\Downloads folder and select Properties. Go to the Security tab. Click Edit and then Add. Enter the username that will be connecting via FTP (or the IUSR account if using anonymous access, though this is discouraged). Grant this user Read & execute, List folder contents, and Read permissions. Without these NTFS-level permissions, IIS will reject the connection even if the FTP configuration is correct.
Configuring Windows Firewall Rules
Even with perfect IIS configuration, the connection will fail if the operating system blocks incoming traffic. Windows Firewall acts as a gatekeeper and often blocks FTP ports by default, especially on fresh installations. You need to create an inbound rule to allow traffic on port 21, which is the standard control port for FTP. Open Windows Defender Firewall with Advanced Security. Right-click on Inbound Rules and select New Rule. Choose Port as the rule type. Select TCP and specify Specific local ports, entering21. Click Next. Select Allow the connection. Apply the rule to Domain, Private, and Public profiles depending on your network environment. Name the rule something identifiable like "FTP Server Port 21".
If you are using Passive Mode, which is common for modern clients behind NATs, you may also need to open a range of high-numbered ports. However, for simple download scenarios, port 21 is the critical entry point. Additionally, verify that the FTP service itself is enabled in the firewall settings by checking the Windows Features list again, ensuring the FTP Extensibility firewall exception is active.
Testing the Connection
After completing the setup, test the configuration from a remote machine. Use an FTP client such as FileZilla or the command-line toolftp.exe. Enter the server's IP address, the username, and the password configured earlier. Attempt to list the directory and download a test file. If the connection times out, revisit the Firewall settings. If you receive "Access Denied," re-check the NTFS permissions on the folder.
For more details on troubleshooting connectivity issues, see Windows Firewall Blocking IIS FTP Connection.