IIS: Attempt to Log On to FTP Server with Guest Account Generates "Guest Access Denied" Error (299256)


The information in this article applies to:

  • Microsoft Internet Information Services 5.0
  • Microsoft Internet Information Server 4.0
This article was previously published under Q299256
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SYMPTOMS

When the client attempts to use the built-in Guest account to log on to the FTP server, a 530 error occurs and the client receives the following error message:
User Cannot Login, Guest Access Not Allowed.
This occurs even though the password is known by the client and the Guest account has been enabled and granted the "Log on locally" right.

CAUSE

The default registry setting for Internet Information Services (IIS) 4.0 and 5.0 does not allow the Guest account to be used for logon purposes.

RESOLUTION

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



To correct this problem, follow these steps:
  1. Open the Registry Editor. To do this, click Start, click Run, type regedit, and then click Run.
  2. After the Registry Editor is open, expand HKEY_Local_Machine, expand System, expand CurrentControlSet, expand Services, and then expand MSFTPSVC.
  3. Under MSFTPSVC, select Parameter and find the DWord value for AllowGuestAccess.

    NOTE: The default setting is 0, or disabled.
  4. Double-click AllowGuestAccess. The Edit DWord Value dialog box opens.
  5. Under Base select Decimal, and then change the Value Data to 1. Click OK.
  6. For the changes to take effect, restart IIS by using the Net Stop IISADMIN /y command.

After you restart IIS, the system allows the Guest user account to successfully log on to the FTP server.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
Modification Type:MinorLast Reviewed:6/23/2005
Keywords:kbpending kbprb KB299256
©2004 Microsoft Corporation. All rights reserved.