Related features:

Related Powershell Guides:

msIIS-FTPDir Attribute in Active Directory: How to View, Set, and Manage

Last updated on:

The msIIS-FTPDir attribute is a single-valued Unicode string field on user objects in Active Directory (AD) that stores the user-specific subdirectory portion of an FTP home directory path under IIS FTP Active Directory user isolation mode. It works exclusively in combination with msIIS-FTPRoot, which stores the share-level root path: IIS concatenates the two values at login time to form the complete home directory path the FTP user is locked into.

This article covers what msIIS-FTPDir is, how the IIS FTP isolation path is constructed, and how to manage it using three approaches: Active Directory Users and Computers (ADUC), PowerShell, and ManageEngine ADManager Plus.

msIIS-FTPDir at a glance

LDAP display name msIIS-FTPDir
CN ms-IIS-FTP-Dir
Syntax String (Unicode), attributeSyntax 2.5.5.12, omSyntax 64
Attribute ID (OID) 1.2.840.113556.1.4.1786
System ID GUID 8a5c99e9-2230-46eb-b8e8-e59d712eb9ee
Single- or multi-valued Single-valued
Maximum length 256 characters (recommended: 30-50 characters per Microsoft guidance)
Indexed No
In Global Catalog No
Replicated Yes, within the domain
System-Only (writable) False— writable by domain administrators and delegated accounts
Update frequency Set once when the FTP site is configured; rarely changes after that
Visible in ADUC UI No. Requires the Attribute Editor tab (Advanced Features enabled).
Applies to User class
First implemented Windows Server 2003
Source schema Microsoft core AD schema (IIS FTP)
Microsoft reference Win32 ADSchema · MS-ADA2 · IIS FTP AD isolation config

Important: msIIS-FTPDir cannot be used alone. If either msIIS-FTPDir or msIIS-FTPRoot is missing or null on a user account, IIS denies that user FTP access entirely with error 530 User cannot log in, home directory inaccessible. Both attributes must be populated before a user can log in to an AD-isolated FTP site.

How IIS FTP AD isolation constructs the home directory path

IIS FTP Active Directory user isolation mode (enabled by setting FTP home directory configured in Active Directory in IIS Manager) reads both msIIS-FTPRoot and msIIS-FTPDir from the authenticating user's AD object at login time. It then concatenates them as [msIIS-FTPRoot] + "\" + [msIIS-FTPDir] = effective home directory.

The FTP service appends a backslash and the msIIS-FTPDir value to the msIIS-FTPRoot value to form the full home directory path. The user is locked to this path and cannot navigate above it.

Examples:

msIIS-FTPRoot C:\FTPRoot
msIIS-FTPDir jsmith
Effective path C:\FTPRoot\jsmith
msIIS-FTPRoot \\fileserver\ftpshare
msIIS-FTPDir marketing\jsmith
Effective path \\fileserver\ftpshare\marketing\jsmith

Note: The effective home directory path must exist on the file system before the user attempts to log in. IIS does not create the directory automatically. If the path does not exist, the user receives the 530 error even when both AD attributes are correctly set. Pre-create the directory structure before populating the attributes.

What msIIS-FTPDir is used for

msIIS-FTPDir was introduced in Windows Server 2003 alongside the IIS 6.0 FTP service's Active Directory user isolation mode. The feature solved a multi-tenant FTP hosting problem: without isolation, all FTP users who authenticate to the same site land in the same root directory and can traverse each other's folders. AD isolation mode locks each user into their own subdirectory, and the msIIS-FTPDir attribute is the per-user part of that path definition.

Common deployment scenarios for this attribute:

  • Web hosting and shared FTP services: Hosting providers or internal IT teams that offer FTP access to multiple users or departments on a shared IIS server use msIIS-FTPDir and msIIS-FTPRoot to direct each user to their own subdirectory under a common root share, preventing cross-user directory traversal.
  • Department-scoped FTP access: Organizations that segment FTP access by department can set msIIS-FTPRoot to a department share (for example, \\fileserver\marketing) and msIIS-FTPDir to the individual user's subfolder within it.
  • UNC-path remote home directories: When msIIS-FTPRoot is a UNC path to a file server share, msIIS-FTPDir allows each user's FTP home to resolve to a different folder on that share, keeping all configuration centralized in AD without modifying the FTP site configuration per user.
  • Automated user provisioning: In environments where FTP access is part of the standard user provisioning workflow, both IIS FTP attributes are set via PowerShell scripts or provisioning tools at account creation time, alongside the physical directory creation on the file server.

If your IIS FTP site does not use Active Directory user isolation mode, msIIS-FTPDir has no effect. The attribute is only read by IIS when the site's user isolation mode is set to FTP home directory configured in Active Directory. On sites using standard isolation or no isolation, the attribute is ignored entirely.

  • ADUC
  • PowerShell
  • ADManager Plus
  • Troubleshooting
  • FAQ
 

How to manage msIIS-FTPDir using ADUC

msIIS-FTPDir is not surfaced in any standard ADUC user properties tab. You read and set it through the Attribute Editor, which requires Advanced Features to be enabled.

  1. Open Active Directory Users and Computers (dsa.msc).
  2. From the menu bar, select View > Advanced Features.
  3. Navigate to the user object. Right-click and select Properties, then select the Attribute Editor tab.
  4. Scroll to msIIS-FTPDir in the alphabetical list. The current value appears in the Value column. A value of <not set> means null.
  5. Click Edit. Enter the subdirectory name or relative path (for example, jsmith or dept\jsmith). Click OK twice to commit.
  6. Repeat the process for msIIS-FTPRoot on the same user, if not already set. Both attributes must be populated.

Note: After setting both attributes, confirm the corresponding directory path ([msIIS-FTPRoot]\[msIIS-FTPDir]) exists on the file system and that the IIS FTP service account has read access to it. The attribute values alone are not sufficient for the user to log in.

Limitations of ADUC

  • No bulk operations: Each user object must be edited individually. ADUC provides no mechanism for setting msIIS-FTPDir across multiple accounts simultaneously.
  • No path validation: The Attribute Editor accepts any string up to 256 characters without verifying that the corresponding path exists on the file system or that the IIS FTP service can access it.
  • No audit trail: ADUC does not record who changed the attribute value or what the previous value was. Directory Service Changes auditing must be enabled via Group Policy for change tracking.
  • Must set two attributes: ADUC requires separate edits for msIIS-FTPDir and msIIS-FTPRoot. There is no combined field. Both must be set before the user can log in to an AD-isolated FTP site.

How to manage msIIS-FTPDir using PowerShell

Because msIIS-FTPDir contains a hyphen in its LDAP name, you must always wrap the attribute name in single quotes when using it in Set-ADUser hash tables or Get-ADUser property lists. There is no named parameter for this attribute on Set-ADUser; always use the -Replace hash table syntax.

Read the current values for a single user

Get-ADUser -Identity jsmith `
-Properties 'msIIS-FTPDir', 'msIIS-FTPRoot' |
Select-Object SamAccountName, 'msIIS-FTPDir', 'msIIS-FTPRoot'

Returns the current msIIS-FTPDir and msIIS-FTPRoot values for the specified user. Both must be requested explicitly with -Properties.

Set msIIS-FTPDir and msIIS-FTPRoot on a single user

Set-ADUser -Identity jsmith -Replace @{
'msIIS-FTPDir' = 'jsmith'
'msIIS-FTPRoot' = 'C:\FTPRoot'
}

Sets both IIS FTP isolation attributes on the specified user in a single operation. Always set both attributes together to avoid a state where one is present and the other is not.

Set using a UNC root path

Set-ADUser -Identity jsmith -Replace @{
'msIIS-FTPDir' = 'jsmith'
'msIIS-FTPRoot' = '\\fileserver\ftpshare'
}

Sets msIIS-FTPRoot to a UNC path, placing the user's FTP home at \\fileserver\ftpshare\jsmith. The UNC path and the subdirectory must both exist and be accessible by the IIS FTP service account.

Clear both attributes

Set-ADUser -Identity jsmith -Clear 'msIIS-FTPDir', 'msIIS-FTPRoot'

Removes both FTP isolation attributes from the user, setting them to null. After this, the user will be denied access to any AD-isolated FTP site. Use -Clear rather than setting to an empty string to produce a true null value.

Bulk set from CSV

# CSV format: SamAccountName,FTPDir,FTPRoot
Import-Csv .\ftp-users.csv | ForEach-Object {
Set-ADUser -Identity $_.SamAccountName -Replace @{
'msIIS-FTPDir' = $_.FTPDir
'msIIS-FTPRoot' = $_.FTPRoot
}
}

Reads a CSV with SamAccountName, FTPDir, and FTPRoot columns and sets both IIS FTP attributes on each user. Validate the CSV data and confirm the corresponding directories exist before running in production.

Report all users with msIIS-FTPDir populated

Get-ADUser -Filter 'msIIS-FTPDir -like "*"' `
-Properties 'msIIS-FTPDir', 'msIIS-FTPRoot' |
Select-Object SamAccountName, DisplayName, 'msIIS-FTPDir', 'msIIS-FTPRoot' |
Export-Csv .\ftp-isolation-inventory.csv -NoTypeInformation

Finds all user accounts where msIIS-FTPDir is set and exports the results to CSV alongside the corresponding FTPRoot values. Useful as a premigration audit or coverage check.

Find users with msIIS-FTPDir set but msIIS-FTPRoot missing

Get-ADUser -Filter 'msIIS-FTPDir -like "*"' `
-Properties 'msIIS-FTPDir', 'msIIS-FTPRoot' |
Where-Object { -not $_.'msIIS-FTPRoot' } |
Select-Object SamAccountName, 'msIIS-FTPDir' |
Export-Csv .\ftp-incomplete-config.csv -NoTypeInformation

Identifies user accounts where msIIS-FTPDir is set but msIIS-FTPRoot is missing, which causes a 530 error at FTP login. Use this to find and fix incomplete configurations.

Common PowerShell errors

  • A parameter cannot be found that matches parameter name: You used -FTPDir or another shorthand that does not exist. The attribute has no named parameter on Set-ADUser. Always use -Replace @{'msIIS-FTPDir' = 'value'}.
  • The specified directory service attribute or value does not exist: The attribute name is misspelled. The correct casing is msIIS-FTPDir with a lowercase ms, uppercase IIS, and uppercase FTPDir. Check for typos, particularly around the hyphen.
  • A constraint violation occurred: The string value exceeds 256 characters. Shorten the path and retry.

Limitations of PowerShell

  • No path existence check: PowerShell writes the attribute value to AD regardless of whether the corresponding path on the file system exists. A successful Set-ADUser command does not guarantee the user can log in to the FTP site.
  • Both attributes must be managed together: A script that sets msIIS-FTPDir without also setting msIIS-FTPRoot (or vice versa) leaves the user in a broken state. Always set both in the same operation.
  • No built-in directory creation: PowerShell sets the AD attribute but does not create the corresponding directory on the file server. Directory creation must be handled separately, either in the same script using New-Item or as a pre-provisioning step.

How to manage msIIS-FTPDir using ADManager Plus

ADManager Plus can surface msIIS-FTPDir and msIIS-FTPRoot as custom attributes, making them available in user management screens, bulk update workflows, and creation templates without requiring administrators to use the Attribute Editor or PowerShell.

Configure msIIS-FTPDir as a custom attribute

  1. Log in to ADManager Plus.
  2. Navigate to Admin > Custom Settings > LDAP Attributes.
  3. Click + Add Attribute.
  4. Enter msIIS-FTPDir in the LDAP Name field.
  5. Enter a display label such as FTP Home Subdirectory in the Display Name field.
  6. Select Unicode String as the Data Type.
  7. Under Associated Reports, map it to User reports so the attribute appears as a column in custom user reports.
  8. Under Associated Management, map it to User Modification so it appears as an editable field in the user properties screen.
  9. Click Add to save. Repeat the same steps for msIIS-FTPRoot with display label FTP Root Path.
Adding msIIS-FTPDir as a custom attribute in ADManager Plus.

Set or update for a single user

  1. Navigate to Management > User Management > Modify Single User.
  2. Search for and select the user account.
  3. Go to the Custom Attributes tab and enter the subdirectory value in the FTP Home Subdirectory and the root path in the FTP Root Path fields.
  4. Click Update User to apply.

Bulk update via CSV

  1. Navigate to Management > Bulk User Modification > Custom Attributes.
  2. Enter msIIS-FTPDir in the LDAP Name field.
  3. Set Data Type to Unicode String.
  4. Enter the subdirectory value to apply in the Value field. This single value will be applied to all matched users.
  5. Under Show Users List, select the domain and OU scope, then select CSV Import.
  6. Upload a CSV containing the sAMAccountName values of the accounts to update.
  7. Click Search, review the matched users, then click Apply.
  8. Repeat the process for msIIS-FTPRoot to ensure both attributes are set.
Bulk updating msIIS-FTPDir for multiple users via CSV import in ADManager Plus.

Note: The Modify Custom Attributes of users workflow applies one value to all matched users. If different users need different msIIS-FTPDir values (for example, each user has their own username-based subdirectory), run the workflow once per distinct value, scoping each CSV to only the users who share that value.

Apply via user creation templates

If msIIS-FTPDir and msIIS-FTPRoot are part of your standard provisioning workflow for FTP-enabled users, add them to a user creation template:

  1. Navigate to Management > User Templates > User Creation Templates.
  2. Edit or create the relevant template.
  3. In the Custom Attributes tab, Add FTP Home Subdirectory and FTP Root Path to the template's attribute set.
  4. Set FTP Root Path to a fixed value (the shared root path is the same for all users in that template). Leave FTP Home Subdirectory as a required field, or use a token such as the user's sAMAccountName if the template supports attribute-based defaults.
  5. Save the template.

Report on msIIS-FTPDir values

  1. Navigate to Reports > Custom Reports and click + New Custom Report.
  2. Select User as the object type.
  3. Add FTP Home Subdirectory and FTP Root Path as columns alongside sAMAccountName, Display Name, and Office.
  4. Apply a filter for accounts where FTP Home Subdirectory is not empty to list only FTP-enabled users.
  5. Save and schedule the report for automated delivery.

Delegate FTP attribute management to non-admins

To allow a server administrator or help desk operator to set FTP isolation attributes for users in a specific OU without broader AD write access, use help desk delegation:

  1. Navigate to Delegation > Help Desk Roles.
  2. Enter a Role Name and Description.
  3. Under User Attribute Privileges, select FTP Home Subdirectory and FTP Root Path for write access.
  4. Save the role and assign it to the operator, scoped to the relevant OU.
Get started

Security and access considerations

By default, msIIS-FTPDir is readable by all authenticated domain users, consistent with the general AD read model for user attributes. The value is a directory path, which may reveal internal file system structure (server names, share names, folder naming conventions). In environments where this constitutes sensitive information, restrict read access to the attribute via the OU-level ACL.

  • FTP service account permissions: The account configured in IIS as the AD connection credential (specified in the Set Credentials dialog when enabling Active Directory isolation mode) must have read access to both msIIS-FTPDir and msIIS-FTPRoot on user objects, and must have at minimum Read permission on the physical directories that the paths resolve to. If this account's password expires or the account is locked, all AD-isolated FTP logins will fail.
  • Path traversal scope: IIS FTP AD isolation mode locks users to their computed home directory and prevents navigation above it. The security of this isolation depends on the IIS FTP configuration being set correctly to FTP home directory configured in Active Directory mode (userIsolation mode="ActiveDirectory"). If the IIS site is misconfigured to use a different isolation mode, the AD attributes are ignored and users may be able to traverse directories.
  • Attribute write access: Write access to msIIS-FTPDir on a user object gives an attacker the ability to redirect that user's FTP home directory to any path accessible by the IIS FTP service account. Scope delegation of write access to this attribute tightly, and audit changes via Directory Service Changes auditing (Event ID 5136).
  • Legacy FTP protocol considerations: FTP transmits credentials in cleartext unless explicitly configured with FTPS (FTP over TLS). IIS FTP AD isolation mode does not change this; it only controls directory isolation, not transport security. Always configure FTPS on any FTP site that authenticates against AD.

Troubleshooting

  1. FTP login fails with 530 User cannot log in, home directory inaccessible.

    The three most common causes:

    • msIIS-FTPDir or msIIS-FTPRoot is not set on the user object.
    • The effective path ([FTPRoot]\[FTPDir]) does not exist on the file system.
    • The IIS FTP service account does not have read permission on the physical path. Verify all three before looking further.
  2. msIIS-FTPDir does not appear in the Attribute Editor.

    Confirm that Advanced Features is enabled in ADUC (View > Advanced Features). The attribute is present on all User class objects from Windows Server 2003 onward, so it should always be visible once Advanced Features is on. If Advanced Features is enabled and the attribute still does not appear, confirm the domain schema version is at least Windows Server 2003 level.

  3. Get-ADUser returns null for msIIS-FTPDir even though a value is set in the Attribute Editor.

    The attribute must be requested explicitly. Confirm your command includes -Properties 'msIIS-FTPDir' with single quotes (required because the hyphen in the name would otherwise be interpreted as a subtraction operator).

  4. Set-ADUser with -Replace fails with The directory service cannot perform the requested operation.

    Confirm you are using single quotes around the attribute name: -Replace @{'msIIS-FTPDir' = 'value'}. Without quotes the hyphen is interpreted as syntax and the hash table is malformed. Also confirm the account running the command has write permission on the user object.

  5. The FTP site works for some users but not others despite all attributes being set.

    Verify that the physical directory path resolves correctly for the failing users. A common cause is users whose msIIS-FTPDir value contains a typo or a path that does not exist. Also check that the IIS FTP service account has read access to those specific subdirectories, not just the root. Run iisftp.vbs /GetADProp <username> FTPDir on Server 2003, or query AD directly on later versions, to confirm the stored value matches what you expect.

  6. Changes to msIIS-FTPDir take effect immediately or require a session reconnect.

    IIS FTP reads msIIS-FTPDir and msIIS-FTPRoot at authentication time. A user who is already connected when the attribute changes will not be affected until they disconnect and reconnect. New login attempts after the attribute change will use the updated value immediately, subject to AD replication latency to the DC the IIS server queries.

Related attributes

  • msIIS-FTPRoot: Stores the file server share root path that forms the first half of the IIS FTP isolation home directory. msIIS-FTPDir and msIIS-FTPRoot are always managed as a pair; neither has any effect without the other.
  • homeDirectory: Stores the user's Windows home directory path, surfaced natively in ADUC's Profile tab. Conceptually similar to msIIS-FTPDir but used by Windows logon rather than IIS FTP, and separate from the FTP path entirely.
  • profilePath: Stores the path to the user's roaming profile. Like msIIS-FTPDir, it is a UNC or local path attribute set on the user object to control where a service directs the user at login.
  • scriptPath: Sores the path to the user's logon script. Part of the same profile/path attribute cluster as msIIS-FTPDir in provisioning workflows that set multiple path-based attributes at user creation time.
  • userAccountControl: Controls account state flags. A disabled account (ACCOUNTDISABLE flag set) will be denied FTP login regardless of whether msIIS-FTPDir and msIIS-FTPRoot are correctly configured.

Manage msIIS-FTPDir and every AD attribute from one console

ADManager Plus gives you centralized control over IIS FTP isolation attributes, bulk provisioning via CSV, and delegated access for server administrators, without requiring the Attribute Editor or scripting for routine updates.

Frequently asked questions

No. The attribute is read only by the IIS FTP service when the site is configured for Active Directory user isolation mode. On FTP sites using other isolation modes, on SFTP servers, on SMB file shares, and in all other contexts, the attribute is ignored entirely.

IIS appends msIIS-FTPDir to msIIS-FTPRoot using a backslash separator. If you put an absolute path in msIIS-FTPDir (for example, C:\Users\jsmith), the concatenation produces a malformed path (C:\FTPRoot\C:\Users\jsmith). Keep msIIS-FTPDir as a relative subdirectory name or relative path only. Put the root share or drive in msIIS-FTPRoot.

The user is denied FTP access with a 530 error. IIS requires both attributes to be present and non-null to construct the home directory path. A missing msIIS-FTPRoot is treated the same as a missing path.

Yes. The attribute is defined in the base AD schema shipped with Windows Server and is present on all User class objects from Windows Server 2003 onward, regardless of whether IIS is installed on any server in the domain. Its presence on the schema does not indicate an IIS deployment.

No. msIIS-FTPDir is not included in the default Microsoft Entra Connect synchronization attribute set and does not sync to Entra ID or Microsoft 365. It is an on-premises AD DS attribute with no cloud equivalent.

IIS constructs the home path by concatenating msIIS-FTPRoot and msIIS-FTPDir with a single backslash. If you place a UNC path in msIIS-FTPDir, the result will be a malformed string. Place the UNC server and share in msIIS-FTPRoot (for example, \\fileserver\ftpshare) and put only the subdirectory name or relative path in msIIS-FTPDir (for example, jsmith).

Manage msIIS-FTPDir and any AD attribute at scale with ADManager Plus

Try it now for free
The one-stop solution to Active Directory Management and Reporting
Highlights AD Management Active Directory Reports Exchange Management Popular products
Email Download Link Email the ADManager Plus download link