IIS and FTP permissions

IIS and FTP Permissions: Common Issues and How to Fix Them

Incorrect IIS and FTP permissions are among the most common causes of website errors, authentication failures, and file access issues on Windows servers. This guide explains how to verify IIS user permissions, configure application access, and troubleshoot common FTP problems.

If you’re unable to resolve the issue, the ACTSupport team is available to assist with Windows Server and IIS administration.

1. Verify the IIS User (IUSR) Account

If anonymous authentication is enabled, IIS uses the IUSR account to access website content.

To verify the configured account:

1. Open Internet Information Services (IIS) Manager.
2. Select your website.
3. Open Authentication.
4. Double-click Anonymous Authentication.
5. Click Edit.

If a specific user is configured, ensure that account has the required Read & Execute permissions on the website folder.

2. Resolve “Server Application Unavailable” Errors

Missing permissions on the website directory can cause applications to stop responding.

Check the following:

• Open the website folder.
• Right-click → Properties → Security.
• Verify that the required IIS account has appropriate permissions.

Depending on your configuration, you may need to grant access to:

• IIS_IUSRS
• Application Pool Identity
• Network Service (if applicable)

You can identify the Application Pool by opening:
IIS Manager → Sites → Website → Basic Settings

Confirm the assigned Application Pool and ensure its identity has access to the website files.

3. Check FTP User Permissions

If FTP users cannot connect or upload files:

• Open Computer Management.
• Navigate to Local Users and Groups.
• Verify the FTP user account is enabled.
• Confirm the account has permission to access the FTP directory.

Also verify the FTP site authentication and authorization rules within IIS.

4. Website Requests Username and Password

If visitors are unexpectedly prompted for credentials:

• Open IIS Manager.
• Select the website.
• Open Authentication.
• Ensure Anonymous Authentication is enabled if public access is required.
• If using a custom IUSR account, verify the configured password matches the Windows account.

If the account is disabled, enable it before testing again.

5. Review Windows Event Viewer

If permission changes do not resolve the issue, review the server logs for additional details.

Open:
Event Viewer → Windows Logs → Application

Look for IIS, ASP.NET, or Windows Security events that may indicate permission or authentication failures.

Best Practices

• Assign only the permissions required by the application.
• Avoid granting Everyone or Full Control unless absolutely necessary.
• Use Application Pool Identities where possible instead of shared accounts.
• Review NTFS permissions after website migrations or server updates.
• Regularly audit FTP accounts and disable unused users.