FTP user isolation failing with access denied

This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.

Recently  I was working on a case where we wanted to setup  FTP User level isolation .

 We created test FTP site with basic authentication enabled  and created the folder structure required for User isolation  with “username directory(disable global virtual directory)

From  : https://docs.microsoft.com/en-us/iis/publish/using-the-ftp-service/configuring-ftp-user-isolation-in-iis-7

• User name directory (disable global virtual directories) :  This option specifies that you want to isolate FTP user sessions to the physical or virtual directory with the same name of the FTP user account. The user sees only their FTP root location and is, therefore, restricted from navigating higher up the physical or virtual directory tree
• To create home directories for each user, you first need to create a physical directory under your FTP server's root folder that is named after your domain or named LocalUser for local user accounts. Next, you need to create a physical directory for each user account that will access your FTP site. The following table lists the home directory syntax for the authentication providers that ship with the FTP service.

We started seeing issues where user isolation was not working and failing with “access denied” error. We checked and found  NTFS and  FTP default permissions to be ok and good.

We collected procmon   and found that there was No access denied errors but failing with  "PATH NOT FOUND"

3:02:25.5810043 PM svchost.exe 6128 TCP Accept ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 0, mss: 1380, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 262200, rcvwinscale: 8, sndwinscale: 8, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5934536 PM svchost.exe 6128 TCP Send ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 27, startime: 9113403, endtime: 9113405, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5934751 PM svchost.exe 6128 TCP Receive ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 35, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5987981 PM svchost.exe 6128 TCP Send ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 23, startime: 9113405, endtime: 9113405, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5988119 PM svchost.exe 6128 TCP Receive ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 21, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.5992702 PM svchost.exe 6128 CreateFile C:\FTPROOT\Contoso\abc.com\ PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, Impersonating: S-1-5-21-3402317017-4039385704-2910592383-7730 NT AUTHORITY\SYSTEM
3:02:25.6051110 PM svchost.exe 6128 TCP Send ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 54, startime: 9113405, endtime: 9113406, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.6051238 PM svchost.exe 6128 TCP Receive ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 0, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM
3:02:25.6103687 PM svchost.exe 6128 TCP Disconnect ITL-DC-SFTP-2.Contoso.lab.lan:2121 -> 172.21.12.104:50495 SUCCESS Length: 0, seqnum: 0, connid: 0 NT AUTHORITY\SYSTEM

We went back and checked our configuration and found that  we were giving user account details as  "Contoso.xxxx.xxxxx.com\user"  and path as “" C:\FTPROOT\ Contoso.xxxx.xxxxx.com\ abc\"

 SVCHOST.exe  is creating file and looking for Contoso path C:\FTPROOT\Contoso\abc\   and we were getting access denied as soon as the user isolation is enabled.

RESOLUTION:

We renamed the path to " C:\FTPROOT\Contoso\abc\ " and logged in with "Contoso\username (Contoso \abc)" and we were able to achieve user isolation and connection successfully.