How to create domain user accounts with limited permission?

Hi guys,

I need to create two user accounts.

UserA should be a ‘pure’ FTP user account. This user should only be allowed to access a specific folder on our FTP but prohibited access to log on the domain and web. UserB should only allow access to a specific folder on the web etc. - but prohibited to access any other domain related issues.

I have tried to create a new OU, with the new users – but they can only work partly when they are members ‘domain users’ and by allowing them membership of this group, they have access just like the other domain users ;(

We’re running W2K servers/SP4, IIS 5.

Thanks in advance ;)
Who is Participating?
Chris DentPowerShell DeveloperCommented:


This is how I normally create FTP Acccounts:

1. Create the account in AD, adding it to an FTP Users Group.
2. Set FTP Users Group as Primary Group in Active Directory - This allows you to remove them from the Domain Users Group.
3. On the FTP Server, make sure FTP Users Group has Read access to the FTP Root Folder - For me this is just a seperate folder on the server - nothing inside it.
4. Give the users at least Read access to their home folder wherever you put it.

Web Users are easier, they don't really need anything but the right permissions on the web folders and making sure the anonymous user doesn't see what you don't want it to.


dsl77Author Commented:
Hi Chris,

I have created a new OU ‘FTP_GUESTS’ inside a single user ‘ftpguest’.

The user has read access to C:\Inetpub & C:\Inetpub\ftproot

I’m getting the ‘530 user … ‘ error

Don’t know if it’s worth mention that I’m now running 2003 Server all over the domain and IIS 6.

Wayne BarronAuthor, Web DeveloperCommented:
No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
I will leave the following recommendation for this question in the Cleanup topic area:
[Accept: Chris-Dent] (User changed Operating System's after getting Information from [Chris-Dent]
I suggest Awarding [Chris-Dent] the points for his information on setting up Win2k (not) Win2k3)

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

EE Cleanup Volunteer
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.