Editing Securing your Windows Service installation (section)

== Configuration ==
To secure your Filezilla server we will assume you wish to run the Filezilla server program as a user with limited permissions on the Windows system. This will limit the potential damage that could be caused by someone compromising the Filezilla server program or a mistake made to file system permissions in parts of the system used by Filezilla.

You will need to create a user level account on the Windows system for FileZilla Server to run under. This account must NOT be a member of the Administrators group in Windows. For basic security requirements it should only be assigned to the Users group in Windows. If you are more security conscious then you should create a dedicated security group for use with Filezilla and assign the new user account to that group instead of Users. If you do this you may need to grant additional permissions within the operating system to that group to allow for proper operation of Filezilla. This article does not discuss what exact additional permissions may be required.

You will then need to configure your Filezilla Server FTP server service to use the new user level account you have created. To do this you will to go into the Services control panel and locate the service named "Filezilla Server FTP server". Edit the service properties and go the Log On tab. On this tab you change from the Log on as option from Local System account (the default) to "This account". You will then select the user level account you have created and enter the password you assigned to the account twice. Once you click OK you may be notified that this account has been granted "Logon as a service" rights. This is expected and required for the account to work properly.

Make sure you are logged in as '''Administrator'''.

=== Add filezilla user to Windows ===
In Windows Professional
# press '''&laquo;'''WINDOWS'''&raquo;''' + '''&laquo;'''R'''&raquo;'''; "Run" dialog appears
# type in "lusrmgr.msc" and hit '''&laquo;'''ENTER'''&raquo;'''; "Local Users and Groups" MMC Console appears
# navigate to "Users" folder, right click to white space and select "New User" from popup menu; "New User" dialog appears.
# fill-in the dialog like this:
#* user name "filezilla" 
#* type in password (this is required)
#* uncheck "User must change password at next logon",
#* check   "Password never expires"
#* check   "User cannot change password"
#* uncheck "Account is disabled"
# click "Create"; "filezilla" user is created
# right click "filezilla" user and select "Properties"; "Properties" dialog appears
# double check on the "Member Of" that only user group this account belongs to, is "Users"
# click "OK"; dialog closes
# close "Local Users and Groups" window

In Windows Home Edition
#press '''&laquo;'''WINDOWS'''&raquo;''' + '''&laquo;'''R'''&raquo;'''; "Run" dialog appears
#type in "netplwiz" and hit «ENTER»; the "User Accounts" window appears
#click "Add..."; a user creation blue wizard appears
#click "Access without a Microsoft Account"
#click the "Local Account" button
#add a new user, filling in the required field:
#*user name "filezilla"
#*type in password (this is required)
#*type in password again (this is required)
#*fill the password hint with some random characters
#click "Next"; "filezilla" user is created
#click "End"; "filezilla" uesr is listed together with the other user accounts 
#close "User Accounts"

Or, '''alternatively''', in any Windows Edition

don't do what follows, if you have already created a "filezilla" user with one of the procedures above. You may choose the following procedure as an alternative of the two previous, because it is safer: putting "filezilla" user in its' own group, is way better than adding it into the "Users" group.

#Copy and paste one by one the following commands, in a "CMD" window run as Administrator:
#*<code>net user filezilla * /add</code>; "filezilla" user is created in the "Users" group
#*when prompted, type a password for "filezilla" user (this is required)
#*<code>net localgroup filezilla-users /add</code>; "filezilla-users" group is created
#*<code>net localgroup filezilla-users filezilla /add</code>; "filezilla" user is added to "filezilla-users" group
#*<code>net localgroup users filezilla /delete</code>; "filezilla" user is deleted from "Users" group

Or, ''' alternatively'''. There is a mechanism for windows services to run in own isolated environment. For each installed service you can use its own SID based on its name. It is accesseble out the box. Then you setup service just specify 'nt service\servicename' in runas username section without specifying password. Filezilla install service with name 'filezilla-server' by default. You should use name 'nt service\filezilla-server' in this case. Then setting up acl permissions to the folders by 'prepare permissions' section described bellow you also should use 'nt service\filezilla-server' name. Caution: if service name changes SID changes too. In this case you should update permissions on the folders.
Also you should add 'nt service\filezilla-server' user in 'Local Policies\User Rights Assignment\Access this computer from the network' of security policy. Launch secpol.msc to access sec policy.
The server's settings in this case will be stored in %systemroot%\ServiceProfiles\filezilla-server\AppData\Local\filezilla-server. 'nt service\filezilla-server' should have all necessary permissions/ownership for files and folders.

=== Change FileZilla Server Service logon ===
# press '''&laquo;'''WINDOWS'''&raquo;''' + '''&laquo;'''R'''&raquo;'''; "Run" dialog appears
# type in "services.msc" and hit '''&laquo;'''ENTER'''&raquo;'''; "Services" MMC Console appears
# locate "FileZilla Server FTP server" service and double click; properties dialog appears
# click "Stop" to stop service if running
# switch to "Log On" tab and set following:
#* select "This account"
#* into the account field type in ".\filezilla"
#* type in both passwords defined in previous phase.
# click "OK" but '''DO NOT START''' the service (as it will fail and will be unkillable unless you use special tools)

=== Prepare permissions ===
# with Windows Explorer navigate to "FileZilla Server" installation directory
# locate "FileZilla Server.xml" file, service requires write permissions to this file
#* If you have "Simple File Sharing" enabled (no "Security" tab in file properties)
#*# click "Tools" in Explorer menu, select "Folder options"; "Folder Options" dialog appears
#*# select "View" tab
#*# uncheck "Use simple file sharing (Recommended)"
#*# click OK
#* right click "FileZilla Server.xml" select "Properties"; "Properties" dialog appears
#*# select "Security" tab, click "Add" button; "Select User or Group" dialog appears
#*# type "filezilla" into "Enter object names to select" textbox
#*# click "OK"; "filezilla" user is added to permissions list
#*# select "filezilla" user and check "Write" in "Allow" column
#*# click "OK"; permissions are now saved
# if you use logging, set "Write" access to "Logs" folder too
# if you upload to some folders set "Full Control" to each topmost writable folder you want to use, the changes are propagated to children
# if you use SSL, double check if both the SSL certificate file and private key file are readable by "filezilla" account, to not break the SSL connection
# if you want hide "Security" tab, enable "Simple File Sharing" back on
# switch to back to "Services" console and start "FileZilla Server FTP server" service; it should run now in "filezilla" account context
# verify FTP and FTPS/FTPES connection and check uploading to writable directories
# congratulations you have secured your FZS server!
# logout from Administrator account
# Windows Server >2012: Error 5: Access Denied -> your Filezilla User have to Access the "Filezilla server.exe" readable.