All Products
Search

This Product

    :Use Windows IIS to access File Storage NAS

    Document Center

    :Use Windows IIS to access File Storage NAS

    Last Updated:Jun 05, 2026

    Internet Information Services (IIS) can access data on an SMB file system just as it would local data, decoupling website storage from compute resources. This topic shows how to configure IIS to access a File Storage NAS file system.

    Prerequisites

    Background information

    Windows Server remains a popular platform for building websites. Many users choose Alibaba Cloud ECS Windows instances to build web services, storing website content in a highly reliable, high-throughput SMB file system, where both compute and storage resources can be scaled on demand.

    The FTP service in IIS is also a popular feature. Many website administrators use FTP to manage site content remotely. Many users also want to use the FTP service on a Windows virtual machine to transfer and share files between a wide area network (WAN) and Alibaba Cloud.

    This topic uses IIS 7.5 on Windows Server 2008 R2 as an example to show how File Storage NAS provides single-node web and FTP services for an Alibaba Cloud ECS Windows instance. You can also use Server Load Balancer (SLB) to build an elastic, fault-tolerant site with multiple server nodes. For more information, see Server Load Balancer (SLB).

    Important

    • This topic provides security recommendations, but it is not a complete security configuration and implementation guide. You are ultimately responsible for your security posture. You must protect your web service and data at both the system level (for example, by configuring firewalls, ECS instance security groups, and promptly installing OS patches) and the service level (for example, by using various Alibaba Cloud security products).

    • For security and management purposes, this example creates a standard user account named iis_user. When you provide an FTP service or run an IIS web service on Windows Server 2016, use this user account instead of the system administrator to access data.

    IIS访问NAS结构图

    Install Windows IIS

    The following steps show how to use Server Manager on Windows Server 2008 R2 to add the IIS role and install IIS.

    Note

    To install IIS on other versions of Windows, see Install IIS and ASP.NET Modules (Windows Server 2012 and Windows Server 2012 R2).

    1. On the Windows client, choose .

    2. In the Server Manager window, click Roles in the left-side navigation pane, and then click Add Roles.

    3. In the Add Roles Wizard, click Server Roles in the left-side navigation pane, and then select the Web Server (IIS) checkbox.

    4. In the Add Roles Wizard, click Role Services in the left-side navigation pane, and then select the role services to install for Web Server (IIS).

      In addition to the default services, you must also select services such as ASP and FTP Server to enable the FTP service and run dynamic web page scripts.

      Under the Application Development category, in addition to ASP, you must also select ASP.NET, .NET Extensibility, ISAPI Extensions, and ISAPI Filters.

    5. Click Next and follow the prompts to complete the installation.

    Access the SMB file system

    You can store your web resources and configuration files in the shared directory (myshare by default) of the SMB file system. You can configure a permission group to ensure that the current web server has read and write access to the SMB file system.

    1. Open Windows File Explorer and enter \\file-system-id.region.nas.aliyuncs.com\myshare to access the SMB file system. The parameters are described as follows:

      • file-system-id.region.nas.aliyuncs.com is the mount target domain name of the SMB file system. To obtain the mount target domain name, see View mount targets.

      • myshare is the default shared directory of the SMB file system and cannot be modified.

    2. In the default shared directory (myshare), create a directory named www to store your website files.

      The following example shows how to create a static web page file, index.html, and a dynamic ASP script, test.asp, in the myshare\www directory.

      • Index.html 

        <HTML>
  <HEAD>
     <TITLE>Hello World in HTML</TITLE>
  </HEAD>
  <BODY>
     <CENTER><H1>Hello World!</H1></CENTER>
  </BODY>
</HTML>

        This example displays Hello World!.

      • Test.asp 

        <HTML>
  <BODY>
     This page was last refreshed on <%= Now() %>.
  </BODY>
</HTML>

        This example dynamically retrieves and displays the current time.

    Configure the Windows IIS web service

    1. On the Windows server, choose .

    2. In the left navigation bar, select , and click Basic Settings.

    3. In the Edit Site dialog box, configure the Physical path and click OK.

      In the Physical path text box, enter the UNC path of the web resources on File Storage NAS, such as \\file-system-id.region.nas.aliyuncs.com\myshare\www. Replace file-system-id.region.nas.aliyuncs.com with your actual mount target domain name.

      Note

      Windows IIS accesses resources by using the identity of its application pool, not the current logged-in user. Therefore, you cannot use mapped network drives (such as Z:) from a user's desktop session because they cause access errors. Always use the full UNC path.

    4. Optional: Modify the registry and add the iis_user user.

      On Windows Server 2016, you must modify the registry and add the iis_user user to allow IIS to access File Storage NAS. On Windows Server 2019, after you modify the registry and add the iis_user user, you must also run the New-SmbGlobalMapping PowerShell command to mount the file system. This resolves an issue where DLLs fail to load. Follow these steps:

      1. Modify the registry key of the SMB client.

        1. On the Windows server, choose .

        2. In the Registry Editor, navigate to . Right-click in the right pane and choose .

        3. Set the value name to AllowInsecureGuestAuth, set the value data to 1, and then click OK.

      2. Specify a local user to access the web resources stored on File Storage NAS.

        1. On the Windows server, choose .

        2. In the left navigation bar, select , and click Basic Settings.

        3. In the Edit Site dialog box, click Connect as.

        4. Select Specific user and click Set.

      3. Set the username and password, then click OK.

        In this example, the user is iis_user. In the Set Credentials dialog box, for User name, enter iis_user (the user created to access the NAS share) and enter the corresponding password.

      4. Use the New-SmbGlobalMapping PowerShell command to mount the SMB file system.

        # Define clear text string for username and password
[string]$userName = 'WORKGROUP\administrator'
[string]$userPassword = '****'
# Convert to SecureString
[securestring]$secStringPassword = ConvertTo-SecureString $userPassword -AsPlainText -Force
[pscredential]$credObject = New-Object System.Management.Automation.PSCredential ($userName, $secStringPassword)
New-SmbGlobalMapping -LocalPath z: -RemotePath \\file-system-id.region.nas.aliyuncs.com\myshare -Persistent $true -Credential $credObject

        In the code, replace **** with the password for the operating system administrator, and replace file-system-id.region.nas.aliyuncs.com with the mount target domain name of the SMB file system.

        Note

        • When IIS accesses a file in a NAS shared directory, it may make multiple backend requests. This can increase client-side wait times. For a solution, see How do I improve the performance of IIS when it accesses NAS?

        • For better performance, store frequently accessed assets, such as JavaScript and CSS files, on a local disk.

        • If write failures persist after you follow these steps, contact NAS technical support.

    5. Verify the results.

      In a local browser, access index.html and test.asp by navigating to localhost or 127.0.0.1. If the pages display correctly, IIS is serving the web content as expected. You can also configure Alibaba Cloud ECS security groups and Windows Firewall to secure web access.

      The body of the index.html page displays the text Hello World!. The test.asp page displays the current refresh time, for example, This page was last refreshed on 5/24/2017 10:48:12 AM..

    Configure the Windows IIS FTP service

    1. On the Windows server, choose .

    2. Install an SSL certificate.

      1. On the server's Home page, double-click Server Certificates.

      2. On the Server Certificates page, click Create Self-Signed Certificate in the Actions pane.

      3. Specify a name for the SSL certificate and click OK.

    3. Set up an FTP site.

      1. In the Connections pane, right-click the Sites folder.

      2. Click Add FTP Site.

      3. On the Site Information page of the Add FTP Site wizard, configure the required information and click Next.

        In the Physical path text box, enter the UNC path of the web resources on File Storage NAS, such as \\file-system-id.region.nas.aliyuncs.com\myshare\www. Replace file-system-id.region.nas.aliyuncs.com with your actual mount target domain name.

        You can select other directories within the myshare directory. You can also configure multiple FTP sites on different ports to access different directories.

        In the FTP site name field, enter ftp.

      4. In the Binding and SSL Settings dialog box, configure the required information and click Next.

        Use the following configuration:

        • Port: The default port is 21. For security, this example uses port 2222.

        • SSL Certificate: Select the SSL certificate that you created.

        Under SSL, select the Require SSL option.

      5. Configure authentication and authorization information, and then click Finish.

        Use the following configuration:

        • Authentication: Select Basic.

        • Authorization: Select the user allowed to access the site. In this example, select Specified users and enter iis_user.

        • Permissions: Set the read and write permissions for the user.

    4. Configure the FTP firewall.

      On the server's Home page, double-click FTP Firewall Support, set the Data Channel Port Range, and then click Apply.

      For example, set the range to 2223-2333.

    5. Return to the Server Manager page and restart the FTP service for the port range configuration to take effect.

      In the navigation tree on the left, expand the Web Server (IIS) node, select the Microsoft FTP Service, and then click Restart in the Actions pane on the right.

    6. In the ECS console, configure the security group for the ECS instance to restrict access from FTP clients. For more information, see Create a security group.

    7. Access the FTP site by using the WinSCP FTP client.

      1. Open WinSCP.

      2. Click Yes to accept the server certificate.

      3. Set the protocol type, port number, and login information.

        In the WinSCP Login dialog box, set File protocol to FTP, Encryption to TLS/SSL Explicit encryption, and Port number to 2222. For User name, enter iis_user, enter the password, and then click Login.

      4. Enter the password for the authorized user (iis_user).

      5. Establish a data connection, which lets the server read and transfer remote directory information.

        The connection log shows TLS connection established, which confirms that the FTPS encrypted connection is active.

      6. After the connection is established, you can upload or download files.

        After WinSCP connects successfully, it displays a dual-pane interface. The left pane shows the local directory (for example, C:\tmp), and the right pane shows the remote server's directory and file list (for example, index.html and test.asp). You can use the Upload and Download buttons in the toolbar to transfer files between your local machine and the remote server.