diff --git a/core/includes/file.inc b/core/includes/file.inc
index 6e6611f..79c7098 100644
--- a/core/includes/file.inc
+++ b/core/includes/file.inc
@@ -470,15 +470,46 @@ function file_ensure_htaccess() {
 }
 
 /**
- * Creates an .htaccess file in the given directory.
+ * Creates a .htaccess file in the given directory.
+ *
+ * This feature can be controlled globally using the auto_create_htaccess
+ * variable. If this variable isn't explicitly set then .htaccess files are
+ * created, by default, on Apache web servers but not on any other web server.
+ *
+ * If you want .htaccess files to be automatically created on non-Apache web
+ * servers set auto_create_htaccess to TRUE.
+ * For example add the following to settings.php:
+ * @code
+ *   $conf['auto_create_htaccess'] = TRUE;
+ * @endcode
+ *
+ * If you don't want .htaccess files to be automatically created on Apache or
+ * wish to remove the .htaccess status report warning on non-Apache web servers
+ * set auto_create_htaccess to FALSE.
+ * For example add the following to settings.php:
+ * @code
+ *   $conf['auto_create_htaccess'] = FALSE;
+ * @endcode
  *
  * @param $directory
  *   The directory.
  * @param $private
  *   FALSE indicates that $directory should be an open and public directory.
  *   The default is TRUE which indicates a private and protected directory.
+ *
+ * @see http://drupal.org/node/66763
+ * @see http://drupal.org/documentation/modules/file
  */
 function file_save_htaccess($directory, $private = TRUE) {
+  // Don't create .htaccess files if auto_create_htaccess variable is FALSE.
+  // For non-Apache web servers, don't create .htaccess files unless
+  // auto_create_htaccess variable has been explicitly set to TRUE.
+  $not_apache = stripos($_SERVER['SERVER_SOFTWARE'], 'apache') === FALSE;
+  $htaccess_variable = variable_get('auto_create_htaccess');
+  if ($htaccess_variable === FALSE || ($not_apache && !isset($htaccess_variable))) {
+    return;
+  }
+
   if (file_uri_scheme($directory)) {
     $directory = file_stream_wrapper_uri_normalize($directory);
   }
diff --git a/core/modules/simpletest/tests/file.test b/core/modules/simpletest/tests/file.test
index 7496902..2b85b26 100644
--- a/core/modules/simpletest/tests/file.test
+++ b/core/modules/simpletest/tests/file.test
@@ -943,14 +943,28 @@ class FileDirectoryTest extends FileTestCase {
     // Test that the directory has the correct permissions.
     $this->assertDirectoryPermissions($directory, variable_get('file_chmod_directory', 0775));
 
-    // Remove .htaccess file to then test that it gets re-created.
+    // Remove .htaccess file to then test that it gets re-created when
+    // auto_create_htaccess=TRUE.
     @drupal_unlink(file_default_scheme() . '://.htaccess');
     $this->assertFalse(is_file(file_default_scheme() . '://.htaccess'), t('Successfully removed the .htaccess file in the files directory.'), 'File');
+    variable_set('auto_create_htaccess', TRUE);
     file_ensure_htaccess();
-    $this->assertTrue(is_file(file_default_scheme() . '://.htaccess'), t('Successfully re-created the .htaccess file in the files directory.'), 'File');
+    $this->assertTrue(is_file(file_default_scheme() . '://.htaccess'), t('Successfully re-created the .htaccess file in the files directory (auto_create_htaccess=TRUE).'), 'File');
     // Verify contents of .htaccess file.
     $file = file_get_contents(file_default_scheme() . '://.htaccess');
     $this->assertEqual($file, "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006\nOptions None\nOptions +FollowSymLinks", t('The .htaccess file contains the proper content.'), 'File');
+
+    // Remove .htaccess file to then test that it does not get re-created when
+    // auto_create_htaccess=FALSE.
+    @drupal_unlink(file_default_scheme() . '://.htaccess');
+    $this->assertFalse(is_file(file_default_scheme() . '://.htaccess'), t('Successfully removed the .htaccess file in the files directory.'), 'File');
+    variable_set('auto_create_htaccess', FALSE);
+    file_ensure_htaccess();
+    $this->assertFalse(is_file(file_default_scheme() . '://.htaccess'), t('Did not re-created the .htaccess file in the files directory (auto_create_htaccess=FALSE).'), 'File');
+
+    // Create .htaccess file for remaining tests.
+    variable_del('auto_create_htaccess');
+    file_ensure_htaccess();
   }
 
   /**
diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index 6711471..7228bed 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -356,6 +356,15 @@ function system_requirements($phase) {
         $requirements['file system']['value'] = $t('Writable (<em>private</em> download method)');
       }
     }
+
+    // For non-Apache web servers, add warning if the auto_create_htaccess
+    // variable hasn't been explicitly set.
+    $not_apache = stripos($_SERVER['SERVER_SOFTWARE'], 'apache') === FALSE;
+    $htaccess_variable = variable_get('auto_create_htaccess');
+    if ($not_apache && !isset($htaccess_variable)) {
+      $requirements['file system']['description'] = $t('Your web server has been detected as different from Apache so creation of .htaccess files is not being enforced. As such your file system may not be secure. See the !link for more information.', array('!link' => l('API documentation', 'http://api.drupal.org/file_save_htaccess')));
+      $requirements['file system']['severity'] = REQUIREMENT_WARNING;
+    }
   }
 
   // See if updates are available in update.php.