IIS FTP on domain will not authenticate with local user accounts.

Question

IIS FTP on domain will not authenticate with local user accounts.

Karl Pedersen 5

I need to setup an FTP server on my domain to replace an old one. Server is 2019 and I configured standard IIS with FTP without issue (no isolation) and Basic Authentication. I can connect via FTP on port 21 using my domain account. I created a local computer account to the server and gave it Modify on the FTP root folder, but everytime I try to logon with the local user and password I get: 220 Microsoft FTP Service 200 OPTS UTF8 command successful - UTF8 encoding now ON. User (x.x.x.x:(none)): ftpupload 331 Password required Password: 530 User cannot log in. Login failed. ftp> I've tried changing permissions, resetting password setting to logon as service and can not figure it out.

Karl Pedersen 5 Reputation points

2024-02-14T18:04:58.9433333+00:00
I walked through this documentation already, and this did not resolve the issue. I can connect via Domain Users, just not Local User Accounts.

The user may not be have access to the home directory.

I am not using home directory or User Isolation, everyone lands on the root.

IIS may not be configured to use passive mode FTP.

It is using active mode for both server and client

Authorization rules.

A rule for "All Users" and the specified local account "ftpupload" are both set to allow Read,Write.

NTFS permissions.

Confirmed ftpupload has Modify permissions to the folder.

Locked account.

Confirmed The account is not locked

Other permission issues.

Confirmed user has log on locally permission set.

The log offers the same 530 error over and over again, which is not pointing me to any other solution unless you see something I do not:

[datetime] [client ip] - [destination ip] 21 ControlChannelOpened - - 0 0 ...

[datetime] [client ip] - [destination ip] 21 USER ftpupload 331 0 0 ...

[datetime] [client ip] - [destination ip] 21 PASS *** 530 1326 41 ...

[datetime] [client ip] - [destination ip] 21 ControlChannelClosed - - 0 0 ...
Anonymous

2024-02-15T09:31:51.3966667+00:00

Hi @Karl Pedersen, Thanks for your reply, can you find the sub-status code for this error in the log? This may help locate and resolve the problem.
Karl Pedersen 5 Reputation points

2024-02-16T03:18:07.4366667+00:00
I assumed we would find those in the log excerpt in what I provided, but your question revealed to me the concept of sub status and then win32status. If I use this reference (https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/ftp-service-svchost-inetinfo/ftp-status-codes-iis-7-and-later-versions) and do some googling about win32status, I think the only errors I get are the following:

"User ftpupload 331 0 0" is described as"331 - User name okay, need password", therefore can I assume this means it accepts the ftpupload user was found and valid?

"PASS *** 530 1326 41" then contains the actual failure codes:

Status = 530 - Not logged in

Common cause of "530 - This status code indicates that the user cannot log on because the user name and password combination is not valid. If you use a user account to log on, you may have mistyped the user name or password, or you may have chosen to allow only Anonymous access. If you log on with the Anonymous account, you may have configured IIS to deny Anonymous access.

Two different Win32Status codes

Win32Status = 1326 - unknown username or bad password.

Win32Status = 1385 - Logon failure: the user has not been granted the requested logon type at this computer

Sub-status = 41 - An error occurred during the authentication process.

So with that information, I assume sometimes I am putting the password in wrong and other times it is being blocked. Following up 1385, I did some more searching and found reference to Local security policy settings and sure enough "local accounts" are deny from logging in from the network. I will follow up with the team managing GPO to see why this is and if I can get an exception before following up here for a work around.

Policy reference: https://learn.microsoft.com/en-us/answers/questions/760241/the-user-has-not-been-granted-the-requested-logon
Anonymous

2024-02-16T06:21:37.3+00:00

Hi @Karl Pedersen, Yes, you are right, what you have done has effectively narrowed down the problem, and I look forward to your follow-up message on this issue. In addition, if you still can't resolve the issue after this, I recommend you open a support ticket as this issue involves a complex environment.

1 answer

Your answer

Karl Pedersen 5 Reputation points

2024-02-14T18:04:58.9433333+00:00

I walked through this documentation already, and this did not resolve the issue. I can connect via Domain Users, just not Local User Accounts.

The user may not be have access to the home directory.

I am not using home directory or User Isolation, everyone lands on the root.

IIS may not be configured to use passive mode FTP.

It is using active mode for both server and client

Authorization rules.

A rule for "All Users" and the specified local account "ftpupload" are both set to allow Read,Write.

NTFS permissions.

Confirmed ftpupload has Modify permissions to the folder.

Locked account.

Confirmed The account is not locked

Other permission issues.

Confirmed user has log on locally permission set.

The log offers the same 530 error over and over again, which is not pointing me to any other solution unless you see something I do not:

[datetime] [client ip] - [destination ip] 21 ControlChannelOpened - - 0 0 ...

[datetime] [client ip] - [destination ip] 21 USER ftpupload 331 0 0 ...

[datetime] [client ip] - [destination ip] 21 PASS *** 530 1326 41 ...

[datetime] [client ip] - [destination ip] 21 ControlChannelClosed - - 0 0 ...
Anonymous

2024-02-15T09:31:51.3966667+00:00

Hi @Karl Pedersen, Thanks for your reply, can you find the sub-status code for this error in the log? This may help locate and resolve the problem.
Karl Pedersen 5 Reputation points

2024-02-16T03:18:07.4366667+00:00

I assumed we would find those in the log excerpt in what I provided, but your question revealed to me the concept of sub status and then win32status. If I use this reference (https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/ftp-service-svchost-inetinfo/ftp-status-codes-iis-7-and-later-versions) and do some googling about win32status, I think the only errors I get are the following:

"User ftpupload 331 0 0" is described as"331 - User name okay, need password", therefore can I assume this means it accepts the ftpupload user was found and valid?

"PASS *** 530 1326 41" then contains the actual failure codes:

Status = 530 - Not logged in

Common cause of "530 - This status code indicates that the user cannot log on because the user name and password combination is not valid. If you use a user account to log on, you may have mistyped the user name or password, or you may have chosen to allow only Anonymous access. If you log on with the Anonymous account, you may have configured IIS to deny Anonymous access.

Two different Win32Status codes

Win32Status = 1326 - unknown username or bad password.

Win32Status = 1385 - Logon failure: the user has not been granted the requested logon type at this computer

Sub-status = 41 - An error occurred during the authentication process.

So with that information, I assume sometimes I am putting the password in wrong and other times it is being blocked. Following up 1385, I did some more searching and found reference to Local security policy settings and sure enough "local accounts" are deny from logging in from the network. I will follow up with the team managing GPO to see why this is and if I can get an exception before following up here for a work around.

Policy reference: https://learn.microsoft.com/en-us/answers/questions/760241/the-user-has-not-been-granted-the-requested-logon
Anonymous

2024-02-16T06:21:37.3+00:00

Hi @Karl Pedersen, Yes, you are right, what you have done has effectively narrowed down the problem, and I look forward to your follow-up message on this issue. In addition, if you still can't resolve the issue after this, I recommend you open a support ticket as this issue involves a complex environment.

Answer 1

Hi @Karl Pedersen,

While trying to connect to your FTP server hosted by IIS, there might be a few reasons for running into this error you are currently experiencing.

Here are the most common root causes and their solutions:

The user may not be have access to the home directory. Go to “IIS > FTP site > FTP User Isolation”. Select the directory that your users can access. More information about User Isolation settings
IIS may not be configured to use passive mode FTP. There are two types of FTP connections: Active mode and passive mode. In active mode, the client opens a port. The server connects to this port for transferring data. In passive mode, the server opens a port. The client connects to this port to transfer data. In order to use passive mode, enter a port range and IP address in “IIS > Server name > FTP Firewall Support” page.
Authorization rules. Make sure to have an Authorization rule that allows the user or anonymous access. Check “IIS > FTP site > FTP Authorization Rules” page to allow or deny access for certain or all users.
NTFS permissions. The FTP users (local or domain users) should have permissions on the physical folder. Right click the folder and go to Properties. In the Security tab, make sure the user has required permissions. You can ignore Shared tab. It is not used for FTP access.
Locked account. If you local or domain account is locked or expired, you may end up seeing “User cannot log in” error. Check local user properties or Active Directory user settings to make sure the user account is active.
Other permission issues. The user account may not have “Log on locally” or “Allow only anonymous connections security” rights.

Please check whether the above situations are the same or similar to your problem. If you are still seeing the issue, check IIS and FTP logs (c:\inetpub\logs\LogFiles\FTPSVC2).

Best regards,

Xudong Peng

If the answer is the right solution, please click "Accept Answer" and kindly upvote. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

IIS FTP on domain will not authenticate with local user accounts.

1 answer

Your answer