Member Avatar for Formby

I have a Windows Server 2008 RC server running at the moment and want to know if it's a good idea to create a non-administrator user account to access the server for things like FTP.
It is only myself and another person who will be accessing the server via FTP, but I would like to know whether it is good practice to create a non-administrator account on the "User Accounts" section of the server in order to create login details for my FTP server?
Thanks!

  • 3 Contributors
  • 3 Replies
  • 274 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jlego

Dani AI

Generated

For : good direction — and building on points from and , here are practical, server-specific steps and cautions to make a non‑admin FTP account safe and usable on Windows Server 2008.

Create a dedicated account (local if standalone, or a domain account if joined to AD). Give it a clear name, a strong password and no membership in the Administrators group. Place the FTP site root in its own folder and set explicit NTFS ACLs so that only that account (and any service accounts) have the rights it actually needs. Use IIS/your FTP server’s “user isolation” or virtual folder features so that each user is jailed to their own directory.

Harden transport and access: never use plain FTP over the open Internet — require encryption (FTPS) or run an SFTP service (SSH) if you need SSH/SFTP. If you use passive FTP, pick and configure a tight passive port range and open those ports in Windows Firewall and any NAT/router. Disable anonymous logins, require SSL/TLS for credentials, enable account lockout thresholds, and add the FTP users to a restricted group with policies that deny interactive or RDP logons if they shouldn’t log on to the server console.

Operational controls and troubleshooting: keep a separate, tightly guarded administrative account for maintenance and use it only when needed (as suggested). Turn on FTP logging and Windows security auditing so you can track failed/successful logons and file activity. If a connection fails, check NTFS permissions, the FTP site’s user‑isolation settings, firewall/NAT passive ports and the FTP server logs first. Finally, keep the server patched, rotate passwords periodically, and consider VPN or secure file‑share alternatives if you don’t want to expose FTP externally.

Recommended Answers

All 3 Replies

Member Avatar for Member #857553

Creating a non Administrative account is a great idea. You should always follow the principle of least privileges. Only allow access to what is needed.

commented: wish i would have learned this alongggg time ago +5
Member Avatar for Formby

Creating a non Administrative account is a great idea. You should always follow the principle of least privileges. Only allow access to what is needed.

Okay, great. I'll make myself and my fellow administrator a normal user account to access FTP and other such protocols to improve security!

Member Avatar for jlego

i know this thread is solved - unhnd exception nailed it. but i wanted to add a small addition to it.

where i work we have a windows domain with roughly 100 a/d users
One one a/d user is actually an administrator

i dont allow myself or my coworkers to be administrators for security reasons. There is one admin account and only one that can be used if needed.

personally i feel that this is a good practice and adds an extra layer of security

commented: I agree, as little privileges as possible. +1
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.