# set "FTP Authorization Rules" on virtualdirectory

**URL:** <https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423>\
**Category:** PowerShell Help\
**Created:** [April 6, 2014, 7:23pm UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423 "2014-04-06T19:23:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tw-h](https://avatars.discourse-cdn.com/v4/letter/t/4da419/32.png) [@tw-h](https://forums.powershell.org/u/tw-h)\
**Post date:** [April 6, 2014, 7:23pm UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423/1 "2014-04-06T19:23:22Z")

</div>

I am trying to automate the creation of user ftp directories on IIS7 (w2008R2).  
The desired stucture is like:  
-ftp root (Allow “ftp users” Read)  
-usera (virtual folder,Allow “usera” Read,Write)  
-userb (virtual folder,Allow “userb” Read,Write)  
-userc (virtual folder,Allow “userc” Read,Write)  
I am almost there, except the setting of authorization is not working. Just the user needs to have read,write rights in its own ftp directory, not every “ftp user” read.  
In the GUI, I have to remove the inhereted right from “ftp root” (Allow “ftp users” Read), and add Allow Rule for the user with Read,Write. How can I script this ?  
I thought something like this:  
`add-webconfiguration “/system.ftpServer/security/authorization” -value (@{accessType=“Allow”;users=“usera”;permissions=“Read,Write”}) -PSPath “IIS:\sites\ftp root” -location usera`  
But it complains about some filename…???  
Add-WebConfiguration : Filename:  
Error: This configuration section cannot be used at this path. This happens when the section is locked at a parent leve  
l. Locking is either by default (overrideModeDefault=“Deny”), or set explicitly by a location tag with overrideMode=“De  
ny” or the legacy allowOverride=“false”.

I read somewhere that I cannot use set-webconfiguration.  
How can I set the correct right on the virtual ftp directory ?

---

<div class="post-metadata">

**Author:** ![vern\_anderson](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/vern_anderson/32/5140_2.png) [@vern\_anderson](https://forums.powershell.org/u/vern_anderson)\
**Post date:** [April 7, 2014, 11:05pm UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423/2 "2014-04-07T23:05:39Z")

</div>

Have you tried to stop the FTP site before running your commands?

Maybe IIS has the config locked for writing.

---

<div class="post-metadata">

**Author:** ![tw-h](https://avatars.discourse-cdn.com/v4/letter/t/4da419/32.png) [@tw-h](https://forums.powershell.org/u/tw-h)\
**Post date:** [April 8, 2014, 10:08pm UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423/3 "2014-04-08T22:08:42Z")

</div>

Thanks Vern for your input, but I solved it in a strange way:  
Experimenting with appcmd, I found the 2 commands to accomplish it:  
C:\windows\system32\inetsrv\appcmd.exe set config “ftp root/usera” -section:system.ftpServer/security/authorization /+“[accessType=‘Allow’,users=‘usera’,roles=‘\*’,permissions=‘Read,Write’]” /commit:apphost  
C:\windows\system32\inetsrv\appcmd.exe set config “ftp root/usera” -section:system.ftpServer/security/authorization /-“[accessType=‘Allow’,users=‘’,roles=‘ftp users’,permissions=‘Read’]” /commit:apphost  
Found on the internet how to add some config to IIS with powershell:  
Add-WebConfiguration “/system.ftpServer/security/authorization” -value @{accessType=‘Allow’;users=‘usera’;roles=‘’;permissions=‘Read, Write’} -PSPath "iis:" -location “ftp root/usera”  
In the get-help add-webconfiguration, there is a reference to remove-webconfiguration, but this command does not exist, so I changed it to “set-webconfiguration”, which deletes the inherited rights, and sets the user-rights. GREAT !  
Solution:  
**Set-WebConfiguration “/system.ftpServer/security/authorization” -value @{accessType=‘Allow’;users=‘usera’;roles=‘’;permissions=‘Read, Write’} -PSPath "iis:" -location “ftp root/usera”**

---

<div class="post-metadata">

**Author:** ![rahul-duggal](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@rahul-duggal](https://forums.powershell.org/u/rahul-duggal)\
**Post date:** [July 1, 2016, 5:18am UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423/4 "2016-07-01T05:18:37Z")

</div>

Thanks for solving this.

There should be a Remove-WebConfiguration cmdlet available.

The Get-WebConfiguration doesn’t allow filtering using pipeline. If I filter a user in pipeline, I still get all the users in the result.

---

<div class="post-metadata">

**Author:** ![ragnar](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@ragnar](https://forums.powershell.org/u/ragnar)\
**Post date:** [March 22, 2017, 1:31am UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423/5 "2017-03-22T01:31:27Z")

</div>

Hi tw h,

in this post your tryıng about to give permission to subfolders of FTP site?

i want to add permissin to folders but each folder must have permission of them user’s right.

for ex:  
FTP Site

**folders**** users**  
folder1 \> user1  
folder2 \> user2  
folder3 \> user3

user1 has right only on folder1,user2 on folder2 and user3 on folder3.

but when i try with powershell for do it, the permission given to FTP Site root and in this case all users have right on all folders.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:39pm UTC](https://forums.powershell.org/t/set-ftp-authorization-rules-on-virtualdirectory/2423/6 "2024-05-16T20:39:03Z")

</div>