69.11 (L1) Ensure 'Microsoft FTP Service (FTPSVC)' is set to 'Disabled' or 'Not Installed'

Information

Enables the server to be a File Transfer Protocol (FTP) server.

The recommended state for this setting is: Disabled or Not Installed

Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (

Internet Information Services - FTP Server

).

Hosting an FTP server (especially a non-secure FTP server) from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased.

Note: This security concern applies to

any

FTP server application installed on a workstation, not just IIS.

Solution

To establish the recommended configuration, set the following Custom Configuration Policy to 4 or confirm that the service is Not installed :

Name: <Enter name>
Description: <Enter Description>
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/SystemServices/ConfigureMicrosoftFTPServiceStartupMode
Data Type: Integer
Value: 4

Note: As of January 2024, despite its inclusion in Microsoft's official documentation, using an OMI-URI to configure a Windows Service Startup Mode via a custom profile will lead to an error in Intune. This error will be logged in the local event log as 'The system cannot find the file specified.' Currently, the most reliable method for remediation is through PowerShell.

The recommended configuration can also be established via PowerShell by running the following cmdlet:

Set-Service -Name FTPSVC -StartupType Disabled

Impact:

The computer will not function as an FTP server.

See Also

https://workbench.cisecurity.org/benchmarks/16852

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 29f178a88caa418e7a065d0b63e17bcb4e0c84b33fc9375aaf89489c0bb996e2