Setting Up and Managing FTP Servers in Windows 11

An FTP server on Windows 11 is already built in: turn on the IIS FTP Server feature, add an FTP site in IIS Manager and open port 21 in the firewall. Old problem, solved: USB drives get lost, and cloud storage fills up. Email attachments hit size limits fast. An FTP server on Windows 11 needs no extra software to get around all three. Nothing to download, nothing to pay.

• Switch on FTP Server in Windows Features.
• Create an FTP site in IIS Manager.
• Open port 21 and a passive range in the firewall.
• Connect from another PC.

The FTP Server feature of Internet Information Services, IIS for short, is built in.

You switch it on in Windows Features and create an FTP site in IIS Manager. Then you open the firewall and connect from another PC.

A typical use: a small office moving big CAD files and backups between machines. The whole setup takes about twenty minutes.

What an FTP server on Windows 11 is and when it’s worth it

It’s the IIS FTP service running on your PC. Other computers upload and download files over the File Transfer Protocol on port 21.

Many Windows 11 users don’t realize a decent alternative to the USB stick is already in the box.

FTP might sound dated. It still does the job.

For devices like those in the table, a desktop PC with the FTP service is the simplest target.

Windows offers two routes. IIS is Microsoft’s own, included with the system.

Third-party servers such as FileZilla Server are the other path, and some people find them easier to click through.

This page sticks to IIS. It’s free, already on your disk and managed with the same tools as Windows Server.

Plain FTP sends user names, passwords and files unencrypted. On a trusted home or office LAN that’s often acceptable. Over the internet, we’d turn on FTPS or use SFTP, both covered below.

How to install the FTP server feature in Windows 11

Admin rights are required. A restart is sometimes requested.

1. Press Win + R, type optionalfeatures and press Enter.
2. Expand Internet Information Services.
3. Expand FTP Server and tick FTP Service and FTP Extensibility.
4. Expand Web Management Tools and tick IIS Management Console.
5. Click OK. Restart if Windows asks.

The same dialog opens from Control Panel, Programs, Turn Windows features on or off.

PowerShell does it in one line from an elevated window:

Enable-WindowsOptionalFeature -Online -FeatureName IIS-FTPServer,IIS-FTPSvc,IIS-FTPExtensibility,IIS-ManagementConsole -All

After installation, search “IIS” in Start or type inetmgr in Run. IIS Manager is the command center for everything that follows.

The service itself is called Microsoft FTP Service, short name ftpsvc. It shows up in services.msc.

Creating an FTP site in IIS Manager

The wizard creates the site and starts it straight away.

• Create the folder you want to share first.
• Open IIS Manager and expand your computer name in the Connections pane. Right-click Sites and choose Add FTP Site.
• Enter a descriptive name such as “OfficeShare”, and select the folder as the physical path. Click Next.
• On Binding and SSL Settings, leave IP Address on All Unassigned and Port on 21. Tick Start FTP site automatically.
• For SSL, choose No SSL for a quick LAN test, or Require SSL with a certificate. Click Next.
• Under Authentication, tick Basic. Then choose Specified users, enter the account name and tick Read, Write or both. Click Finish.

If the local check returns a 220 greeting and a user prompt, the site is answering.

Pick the storage location with some thought. Consider free space and backup schedules if important data lands here.

We’d keep the FTP root away from the system drive if uploads can be large.

Opening the firewall for the FTP server on Windows 11

FTP uses two connections. A control channel on port 21 carries commands, and a data channel carries listings and file transfers.

Opening 21 alone is the classic mistake. The client logs in fine, then hangs when it tries to list the folder.

When the feature is installed, Windows adds inbound rules for port 21 and for passive data connections. Make sure they’re enabled for your network profile.

• Open Windows Defender Firewall with Advanced Security, wf.msc, and go to Inbound Rules.
• Check that the FTP Server rules are enabled for the profile your network uses. That’s Private for a home or office LAN.
• In IIS Manager, click the server node and open FTP Firewall Support. Enter a Data Channel Port Range and click Apply.
• Restart the Microsoft FTP Service in services.msc, so the range takes effect.

If the rules are missing or deleted, recreate them in wf.msc. Choose Inbound Rules, New Rule, Port, TCP, specific port 21.

Then choose the option that lets the connection through and tick the Private profile. Repeat for the passive range.

Microsoft’s FTP firewall guide for IIS does the same with two commands in an elevated Command Prompt.

netsh advfirewall firewall add rule name="FTP (no SSL)" action=allow protocol=TCP dir=in localport=21
netsh advfirewall set global StatefulFtp enable

FTPS is different. The firewall can’t read encrypted commands, so stateful filtering doesn’t help there.

For FTPS, create a Custom rule in wf.msc that applies to the service “Microsoft FTP Service”. Keep the data channel range open.

Securing an FTP server on Windows 11

An unsecured FTP site invites trouble. Four settings do most of the work.

Keep the NTFS permissions on the FTP root just as tight.

Which authentication to use

IIS offers Anonymous and Basic authentication for FTP. Skip Anonymous unless you’re building a public download area with read access only.

Basic checks a Windows user name and password, which is what you want. On its own it sends them in clear text.

Pair Basic with FTPS, and the credentials travel encrypted.

Turning on FTPS

• In IIS Manager, click the server node and open Server Certificates.
• For a LAN, Create Self-Signed Certificate is enough. For internet use, import a certificate from a public certificate provider.
• Select your FTP site and open FTP SSL Settings.
• Choose the certificate and select Require SSL connections. Click Apply.
• In your client, pick the explicit TLS option.

Clients will warn about a self-signed certificate the first time. Check the fingerprint and accept it once.

User isolation

User isolation gets overlooked frequently. It stops users from browsing each other’s files.

Select your site, open FTP User Isolation and pick “User name directory”. IIS then expects a folder per user.

Each login is then kept inside its own folder.

We’d create a dedicated local account for FTP, not use your everyday login. If that password ever leaks, the damage stops at the FTP folder. You can disable the account in seconds.

FTP users and permissions

FTP users here are ordinary local Windows accounts. Deciding who gets which files takes some thought.

Too strict, and colleagues can’t do their work. Too open, and anyone can overwrite the wrong folder.

• Run compmgmt.msc and go to Local Users and Groups, Users, New User.
• Optionally create a group such as “FTPUsers” and add the accounts to it.
• In IIS Manager, select the FTP site and open the FTP rules page for access. Click the first “Add … Rule” action, the one that grants access.
• Pick the user or group and tick Read for download, Write for upload, or both.
• Right-click the FTP folder in Explorer and open Properties, Security. Grant the same account matching NTFS rights.

On Home editions the users console is missing. There, one line in an elevated Command Prompt creates the account:

net user ftpuser1 * /add

Combine both layers for detailed control. A common pattern: everyone reads from a “Public” folder, and only one group writes to “Projects”.

Both the FTP rule and the NTFS permission must permit an action. Whichever is stricter wins.

IIS has no FTP quota setting of its own. NTFS disk quotas fill the gap.

Right-click the drive and open Properties, Quota. Enable quota management and set limits, so one user can’t fill the volume.

Connecting to the Windows 11 FTP server from another PC

First find the address of the machine that runs the service. Run ipconfig on it and note the IPv4 address, something like 192.168.1.20.

We’d give that PC a fixed address. A DHCP reservation in the router is easiest.

A working DNS setup on Windows 11 helps too, if you prefer names over numbers.

File Explorer is the easiest. Type the address, enter credentials when asked, and the folder opens almost like local storage.

You can also right-click This PC and choose Add a network location. That keeps the FTP site in Explorer permanently.

The command-line ftp client is fine for checking that a login works. Microsoft notes it has no passive mode, so listings can fail through some firewalls.

For automation, curl.exe ships with the system and handles FTP and FTPS uploads in one line. That makes it a natural fit for Task Scheduler.

Third-party clients such as FileZilla or WinSCP give the fullest experience.

• Bookmarks.
• Synchronized browsing.
• Transfer queues.
• Resume after a dropped connection.
• Detailed logs.

When the connection fails

Most connection problems come from four places. We’d check them in order and, as a rule, read the client log first.

The IIS FTP log usually tells you which one it is.

Checking the FTP server on Windows 11 with PowerShell

Quicker than clicking through three consoles. An elevated PowerShell window, then these, one at a time.

Get-WindowsOptionalFeature -Online -FeatureName IIS-FTPServer
Get-Service ftpsvc
Test-NetConnection 192.168.1.20 -Port 21

Swap in your own server address, of course. A True on port 21 says nothing about the passive range, so a hanging listing still means the data channel.

FTP server on Windows 11 Pro or Home

Pro makes the job easier. Not because of FTP itself.

• Local Users and Groups, lusrmgr.msc, is a Pro tool. On Home the accounts come from one command, shown in the users section.
• Group Policy, and with it a QoS limit on the FTP service, needs Pro too.
• Remote Desktop into the FTP box for upkeep? Hosting it needs Pro as well.

Check optionalfeatures on a Home PC first. If Internet Information Services is listed, the IIS steps on this page apply.

Reaching it from the internet

To reach the PC from outside, three things are needed.

• Forward port 21 and your passive data range on the router to the PC.
• Enter the router’s public IP address under FTP Firewall Support on the site.
• Require FTPS.

Many home connections change public IP addresses, so a dynamic DNS name helps.

Passive mode configuration matters most here. With the external IP address entered, clients get the right address for data connections.

A narrow port range is easier to forward and to audit than a wide one. A hundred ports is plenty for a small office.

Honestly, we’d think twice before exposing FTP on a desktop PC to the internet. Log files fill with automated login attempts within hours.

If remote access is the goal, a VPN into the office network or SFTP is in most cases the safer design.

SFTP as an alternative

SFTP is often the better choice when files cross the internet. It runs over SSH on a single port, 22, and encrypts everything.

It avoids FTP’s separate data channel and the passive port headaches.

Windows 11 includes OpenSSH Server as an optional feature, so you can offer SFTP without IIS.

• Open Settings, System, Optional features, View features.
• Search for OpenSSH Server and install it.
• Start the sshd service and open port 22 in the firewall.

WinSCP or FileZilla then connect with the same Windows account credentials.

The trade-off: older scanners and cameras rarely speak SFTP. That’s exactly why IIS FTP still earns its place for devices and LAN-only setups.

Managing the FTP server day to day

Day-to-day management happens in IIS Manager. You start and stop sites, check current sessions, change logging and adjust access rules.

Keep Windows updated too, because the FTP service gets security fixes through Windows Update.

For bigger needs, the service wants another home. That’s the case once you need domain accounts, many concurrent users or file server roles.

Then a Windows Server machine instead of Windows 11 is the better place for it.

Common FTP server mistakes on Windows 11

• Opening port 21 and forgetting the passive range.
• Leaving Anonymous access on for a private folder.
• Using the everyday Windows login as the FTP account.
• Granting Write in the FTP rule and not in NTFS, or the other way round.
• Running plain FTP across the internet.
• Testing passive listings with the command-line client, which has no passive mode.
• Leaving the network profile on Public, so the Private rules never apply.
• Forgetting to restart the service after changing the port range.

Terms used on this page

Typical FTP problems and fixes

The listing that hangs

A client logs in and then waits forever on the folder list. Only port 21 was open. With the passive range set and opened, the list appears.

The scanner

An office scanner can only send scans by FTP. A small FTP site on a desktop PC takes them. No cloud account is involved.

The upload that was denied

Downloads work, and uploads fail with 550. The FTP rule granted Write, and NTFS didn’t. With both in place, the upload goes through.

The Public network

Everything is configured, and nobody can connect. The PC’s network was marked Public, so the Private firewall rules never applied.

The exposed desktop

Someone forwards port 21 to a desktop PC. Within hours the log fills with login attempts. A VPN into the office replaces the port forward.

The isolated folders

Two users could read each other’s files. With user isolation on and a folder per user, each login sees only its own.

The certificate warning

After FTPS is switched on, the client shows a warning about the certificate. It’s self-signed, which is fine on a LAN. The fingerprint gets checked once and accepted.

The Home edition

On a Home PC the users console is missing. The account gets created from an elevated Command Prompt, and the rest works the same.

Windows versions this guide covers

Need a key? Our Windows 11 Pro comes as a genuine license, with Group Policy and Local Users and Groups for FTP account management. We email it instantly after payment.