If the FTP Server functionality is used without appropriate values set for the User List and Domain variables, the FTP server will be vulnerable to attacks by unauthorized users. These variables are not set by default. An unauthorized user must only guess the device's password, the way it is set in Control Panel, to obtain access to the server.

To prevent such an attack, the user name in the UserList registry value must be set for each of the servers that are currently running. The user will then need to log in with the specified user name and appropriate password to use the server.

You can set the domain variable in the DefaultDomain registry value, which is located under the HKEY_LOCAL_MACHINE\Comm\Redir registry key. Setting the DefaultDomain registry value will require FTP clients to have valid domain credentials to log in. For more information on this registry value, see Windows Networking API/Redirector Registry Settings.

For enterprise environments, Microsoft recommends the use of a network firewall with intrusion protection, such as Microsoft Internet Security and Acceleration (ISA) Server. For more information, visit this Microsoft Web site.

For non-enterprise environments or for added protection, Microsoft recommends that you include and configure the Windows Embedded CE Firewall on the network device. For more information about the Windows Embedded CE IP Firewall and how to configure it, see Firewall.

For information about configuring the IP firewall to properly manage traffic destined for the internal network, see IP Firewall Reference.