Member Avatar for MrDavo
MrDavo 0 Newbie Poster

Hi All,

I am new to this forum so I hope that I am posting in the correct topic space.

Currently I have a challenge with administering my IIS 5.0 installation. As I am running Windows 2000 Server I have no choice (to the best of my knowledge) but to use IIS 5, although I understand that it is recommended by Microsoft that at least version 6 be used.

I have successfully setup an FTP site within IIS. I have alocated the site a home directory, and I have accessed the site using the Administrator account and password.

Knowing that passwords are sent "across the wire" in plain text when accessing an FTP site within IIS I am not comfortable with using the Administrator account to access the site.

I have turned off "Allow Anonymous Connections" and I have created an account specifically for accessing the site. This account has been added to the FTP Site Operators list.

I have also set the Home Folder for the new account (within Active Directory) to the same Local Path as the FTP sites Home directory.

After all of the above I am receiving the following error message;

530 User <Domain>\<User Name> Cannot Login

As an attempt to resolve this error message I have performed all of the steps outlined at the following Microsoft Help page:

http://support.microsoft.com/kb/200475

Unfortunately I am still not able to login to the FTP site with the account that I created.

If anybody has any suggestions regarding a fix for the above they will be greatly appreciated.

Kind Regards,

Davo

  • 1 Contributor
  • 0 Replies
  • 129 Views

Dani AI

Generated

Notes for : a 530 error in an IIS5/Windows 2000 environment is almost always an authentication or file-access issue rather than an IIS bug. The following focused checks will quickly isolate the root cause and point to the right fix.

  • Verify the AD account state: enabled, not locked out, password not expired and not marked "must change password at next logon." Also check any "Logon To" workstation restrictions include the FTP server.
  • Test with a simple local account on the server. If a local account can log in but the domain account cannot, the problem is domain authentication or delegation rather than IIS configuration.
  • Confirm NTFS and share ACLs on the FTP root give the user (or a group they are in) the required rights. If the home folder is a UNC/share, grant the server computer account (DOMAIN\<ServerName>$) access or use a local path — services cannot forward the logged-on user credentials to a remote file server by default.
  • Turn on IIS FTP logging and examine the files in C:\WINNT\System32\LogFiles\FTPSVCx. Also review the Windows Security event log for failed logon entries; the failure reason there (locked, expired, workstation restriction, etc.) will tell exactly what to change.

A common, practical step that often fixes this class of problem is to remove any AD "Home folder" mapping on the user object (leave it blank) and let IIS point directly to the local folder, then ensure the AD account has NTFS rights on that folder. As a security note: plain FTP on Win2K/IIS5 sends passwords in clear text — consider an encrypted alternative (FTPS/SFTP) or a platform upgrade for production use.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.