Windows Forum

Ask something
Discussion Locked

FTP - URGENT

0 helpful
18 replies

by gregberry

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am trying to setup home directories for FTP in Windows 2000.

I created the subfolder "user" Created the domain user "user" gave "user" full control rights on the "user" folder in the ftproot folder. When I try to ftp in as user, I get a "530 user cannot login" error. The only way I can ftp in is if I use the Administrator. I also tried creating a virtual directly, but without luck. What am I doing wrong? Please help, I need to get this done today.

Thanks!

18 replies

by gregberry

I want to create ftp directories, so that my clients can ftp files into their own directories.

by gregberry

also tried logging in as domain\user. I gave the user log on locally rights in the system policy.

by maxwell edison

According to Microsoft article Q200475 titled "Err Msg: 530 User Cannot Log In. Login Failed"

CAUSE:
This problem can be caused by one of the following:

The "Allow only anonymous connections security" setting has been turned on in the MMC.

The username does not have the "Log on locally" permission in User Manager.

The username does not have the "Access this computer from the network" permission in User Manager.

The Domain Name was not specified along with the username (in the form of DOMAIN\USERNAME).

RESOLUTION:

Resolution 1

To clear the "Allow only anonymous connections security" check box, perform the following steps:
Start the Internet Service Manager (ISM), which loads the Internet Information Server snap-in for the Microsoft Management Console (MMC).

Right-click the default FTP site folder, and then click Properties.

On the Security Accounts tab, clear the Allow only anonymous connections security check box.

Click OK.

(continued...)

by maxwell edison

.
.
Resolution 2

To give the username the "Log On Locally" permission, perform the following steps:

Windows NT 4.0 Servers:
In the Administrative Tools group, select User Manager for Domains, click the Policies tab, and select User Rights.

NOTE: If the username is not a member of the default domain opened by User Manager, click the User menu, and then select Domain to specify the correct domain. If the username is a member of the local computer's user list, type \\in the Domain text box.

From the Policies menu, click User Rights.

On the Rights drop-down list, select Log on Locally.

Click Add, and add the appropriate username (or user group).

Click OK twice.

Windows 2000 Servers:

To configure the "Log on locally" right on a stand-alone server, follow these steps:

1. In the Microsoft Management Console (MMC), open the Local Computer Policy snap-in. To do this, follow these steps:

Click Start, type MMC, and then click OK.

Click Console, click Add/Remove Snap-in, and then click Add.

Select Group Policy, and then click Add.

Ensure that the Group Policy object says Local Computer, and then click Finish.

Click Close, and then click OK.

2. Grant users or groups the "Log on locally" right. To do this, follow these steps:

Expand the following path in the MMC:

Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Double-click Log onLocally.

Add any users or groups that will use Basic/Clear Text authentication.

NOTE: It is not recommended that you install an IIS Web server on a Windows 2000 domain controller. The following steps describe how to configure "Log on locally" right by using Group Policy if it is necessary that you install an IIS Web server on a Windows 2000 domain controller.

(continued...)

by maxwell edison

.
.
To configure the "Log on locally" right on a domain controller, follow these steps:

1. In MMC, open the Default Domain Controllers Policy snap-in. To do this, follow these steps:

Click Start, type MMC , and then click OK.

Click Console, click Add/Remove Snap-in, and then click Add.

Select Group Policy, and then click Add.

Click Browse.

Double-click the domain controller for the domain.

Double-click Default Domain Controllers Policy , and then click Finish .Click Close, and then click OK.

2. Grant users or groups the "Log on locally" right. To do this, follow these steps:

Expand the following path in the MMC:

Default Domain Controllers Policy\Computer Configuration\Windows Settings\SecuritySettings\Local Policies\User Rights Assignment
Double-click Log on Locally.

Add any users or groups that will use Basic/Clear Text authentication.

3. Open a command prompt, type secedit/refreshpolicy machine_policy , and then close the command prompt to refresh the policy.

Resolution 3:

To give the username the Access this computer from the network permission, perform the same steps outlined in Resolution 2 above, but select the Access this computer from the network advanced user right.

(continued...)

by maxwell edison

Resolution 4:

Try using the command line FTP utility and specifying the FTP username in the form of "DOMAIN\USERNAME" when you log into the FTP Site. If this works, then you can either instruct all users to log on using DOMAIN\USERNAME or youcan specify the default authentication domain that the FTP Service should use when authenticating accounts that do not exist locally and that were not entered in "DOMAIN\USERNAME" form. To do this you will need to make changes to the Metabase.

To specify a default logon domain so users do not have to type DOMAIN\USERNAME when logging on to the FTP Server, you can either use the Windows Script Host (if it was installed during the Windows NT Option Pack setup) or the NTOP utility Mdutil.exe.

Both methods are described below.

To use the Windows Script Host method, do one of the following (depending on the version of IIS that you are running):

IIS 5.0
Change to the %Systemroot%\Inetpub\Adminscripts directory.

Type the following:

Adsutil Set MSFTPSVC/DefaultLogonDomain "Domain Name"

Make sure when you type in the Domain Name that it is enclosed in quotation marks.

Stop and restart the FTP Service.

(continued..)

by maxwell edison

.
.
IIS 4.0
Change to the %systemroot%\system32\inetsrv\adminsamples directory.

Type the following:
cscript //h:cscript

This sets Cscript as the default WSH interpreter.

Type the following:
Adsutil Set MSFTPSVC/DefaultLogonDomain"Domain Name"

Make sure when you type in the Domain Name that it is enclosed in quotation marks.

Stop and restart the FTP Service.

If the Windows Script Host was not installed during the NTOP setup, use Mdutil.exe. as follows:

Copy Mdutil.exe. from the Windows NT Option Pack compact disc to the %WINDIR%\System32\ directory.

Make sure to copy Mdutil.exe. from the appropriate platform directory on the compact disc.

Open a command prompt, and change to the %WINDIR%\System32directory.

Execute the command below replacing with the name of the accounts domain you want to authenticate your user against by default:
mdutil set msftpsvc/DefaultLogonDomain -utype UT_Server -dtype String -value
Make sure that is typed without quotes.

When the command completes successfully, stop and restart the FTP Service.

----------

Good luck,

Maxwell

by shanghai sam

Within IIS, select the FTP server properties, and ensure you have disallowed anonymous access to the FTP site.

by joseph moore

How are the rights on the FTPROOT folder set up? I would check there to make sure it is not locked down too tight.
Because you have set it up right otherwise.

by vossige

Hi there,

look at the MS database:

Err Msg: 530...Home Directory Inaccessible (Q100319)

SYMPTOMS
When an FTP (file transfer protocol) client logs into a Windows NT FTP Server, the following message is displayed:

530 User cannot log in, home directory inaccessible.

CAUSE
This error message occurs when the home directory on the Windows NT FTP Server cannot be found.

RESOLUTION
To fix this problem:

From the FTP Server machine, run Control Panel and choose Networks. Choose FTP Server and then Configure to find out what directory is set to be the home directory for the FTP service. If that directory does not exist on the server, create it or change the path entry to reflect a directory that already exists on the drive.

Start the Server portion of Control Panel and choose Security to check the permissions on the home directory. In order for users to log in, Allow Read must be selected.

NOTE: By default, an FTP client is validated against the local accounts database. To enable a Windows NT Server domain member (non-DC) to validate ftp clients against the domain accounts data base, you must add the DefaultLogonDomain parameter (value type REG_SZ) to the following registry key location:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FTPSVC\Parameters

WARNING: Using Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.

To do this, run the Registry Editor (REGEDT32.EXE).

From the HKEY_LOCAL_MACHINE subtree, go to the key:

\System\CurrentControlSet\Services\FTPSVC\Parameters

Choose ADD VALUE from the Edit menu. Enter the value name as the name of the domain you want to use for validation. The Data type is REG_SZ.

This discussion is closed to new replies.