Create the two other users in the same way.

Assign the Read&Write permissions on the directory C:\inetpub\ftproot for the ftp_users group.

Create a directory with the name LocalUser (the name must be the same, it’s important!!!) in the folder C:\inetpub\ftproot. Then make three directories under with the names ftp_user1, ftp_user2, ftp_user3 in the folder C:\inetpub\ftproot\LocalUser.

Return to the IIS console and create a new rule (Add AllowRules) in FTP Authorization Rules section of the site. Specify that ftp_users group must have the read and write permisions.

How to Configure FTP User Isolation on Windows Server 2016/2012 R2?

Let’s move to configuring FTP user isolation. The isolation of FTP users is configured on the FTP site level, not the entire server. FTP user isolation allows you to organize your ftp-home folder for each user.

Open FTP User Isolation in the settings of the FTP site.

This section contains several settings. The first two of them don’t suggest user isolation:

1. FTP root directory (an FTP session of a user starts in the root directory of the FTP site);
2. User name directory (the user starts with physical/virtual directory with the username. If the directory is missing, a session starts in the root FTP directory of the site).

The next three options are different modes of user isolation:

• User name directory (disable global virtual directories) suggests that the ftp session of a user is isolated in a physical/virtual directory that has the same name as the ftp user. Users see only their own directory (it is their root ftp-directory) and cannot go beyond it (to the upper directory of the FTP tree). Any global virtual directories are ignored;
• User name physical directory (enable global virtual directories) suggests that the ftp session of a user is isolated in a physical directory that has the same name as the name of the ftp user account. A user cannot go above its directory. However, all created global virtual directories are available to the user;
• FTP home directory configured in Active Directory – an FTP user is isolated within his home directory specified in the settings of his Active Directory account (FTPRoot and FTPDir properties).

Select the required isolation mode (I use the second option to isolate ftp users).

Configuring Windows Firewall Rules to Access the FTP Server

When you install the FTP server role, all necessary rules that are needed for users to access FTP are automatically activated in the Windows Firewall settings.

For FTP to work correctly in passive FTP mode, users need to connect to the RPC port range (1025-65535). In order not to open all these ports on an external firewall, you can limit the range of dynamic TCP ports used for FTP data transmission.

1. Open the FTP Firewall Support section in FTP site settings and in the Data Channel Port Range field specify the port range that you want to use for FTP connections. For example – 50000-50100;
2. Save the changes and restart IIS (iisreset);
3. Open the Windows Control Panel and go to the Control Panel\System and Security\Windows Firewall\Allowed apps;
4. Make sure that the list of applications that are allowed access through the firewall contains permissions for the FTP Server role.

Then check that the following rules are enabled in the settings of Windows Firewall with Advanced Security:

• FTP Server (FTP Traffic-In) – TCP protocol, port 21;
• FTP Server Passive (FTP Passive Traffic-In) – local port address 1024-65535 (50000-50100 in our case);
• FTP Server Secure (FTP SSL Traffic-In) –port 990 (when using FTP with SSL);
• FTP Server (FTP Traffic-Out) – port 20;
• FTP Server Secure (FTP SSL Traffic-Out) –port 989 (when using FTP with SSL).

Accordingly, these ports need to be opened on your router (gateway, firewall) so that external FTP users can connect to your site.

Testing an FTP Server Connection from Windows

You can check the availability of ports on an FTP server using the Test-NetConnection cmdlet:

Test-NetConnection -ComputerName yourftpservername -Port 21

Or using the ftp command:

ftp yourftpservername

Try to connect to your FTP site with any FTP client or directly from File Explorer (specify ftp://yourservername/ in the address bar).

Enter the user name and password.

And now you have access to the home directory with the user’s files (which is the root of the FTP site for the user). As we can see, the user session is isolated and the user sees only his files on the ftp server.

You can use FTP logs to view information about user access to the FTP server. The log files are stored by default in the c:\inetpub\logs\logfiles folder in the u_exYYMMDD.log files.

To view the active user connections to your FTP server, you can use the values of the IIS performance counters through PowerShell or the “Current FTP Sessions” section in the IIS console. In this console, you can view the names and the IP address of the FTP user’s and disconnect the ftp-session if necessary.

So, we have looked at how to configure an FTP site with the user isolation based on Windows Server 2016 / 2012 R2. In the isolation mode the users are authenticated on FTP using their local or domain credentials to access their root directory corresponding to the username.