Install StackRegent on Windows Server

Two ways to install StackRegent on Windows Server#

Both paths run the same install.ps1 in the end. Check the requirements first, and read the page for your Windows release for what differs on it: 2025, 2022, 2019 or 2016.

Install with the one-line installer#

Open PowerShell with Run as administrator and run, with your own key:

[Net.ServicePointManager]::SecurityProtocol='Tls12'; & ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://panel.stackregent.com/get/stackregent.ps1'))) -LicenseKey SR-XXXXX-XXXXX-XXXXX-XXXXX

The first statement makes Windows PowerShell 5.1 use TLS 1.2 for the download; older defaults can fail to connect. The script then:

1. reads the server's Windows machine ID and activates the license for this server,
2. asks the license server for the newest stable release offered to your license,
3. downloads it and checks the size, the SHA-256 hash and the signature against the StackRegent release key (key ID 4kybuaOI7rGnp0qC), whose public half is written into the script,
4. unpacks it, refusing any path that would leave the target folder,
5. runs install.ps1 from the release.

If any check fails, it stops with an error and nothing is installed.

One-line installer parameters#

The one-line installer does not pass port or folder options. To install on another port or into another folder, either change the port afterwards with stackregent panel-port, or run with -DownloadOnly and start install.ps1 from the folder it prints, with the options you need. The developer site documents the install script for automation.

Install from the zip package#

1. Copy the StackRegent zip to the server and extract all of it. install.ps1 expects bin\stackregent.exe next to it.
2. Open PowerShell with Run as administrator in the extracted folder.
3. Run:

powershell -ExecutionPolicy Bypass -File .\install.ps1 -AdminEmail you@example.com -LicenseKey SR-XXXXX-XXXXX-XXXXX-XXXXX

Without -LicenseKey, the installer asks for the key before its log starts, so a typed key never lands in the log. Press Enter to skip and enter it in the panel later.

install.ps1 parameters#

Component IDs for -Components#

recommended stands for urlrewrite, dns, ftp, webdeploy, php, mailenable, roundcube, mariadb-hosting, phpmyadmin. You can also list IDs yourself, for example -Components "urlrewrite,php,mariadb-hosting,mssql,aspnetcore". Other IDs are vcredist, aspnetcore, nodejs, iisnode, git, composer, wpcli, mssql, spamassassin and modsecurity. Use none to install only the panel and add components later under Tools & Settings › Server Components. Components that need others (PHP needs the Visual C++ runtime, iisnode needs URL Rewrite, phpMyAdmin and Roundcube need PHP) say so in the panel.

What the installer sets up#

On a fresh server, install.ps1 works through these stages and prints each one as it goes:

1. IIS. Adds the IIS web server role with the features StackRegent uses (ASP.NET 4.x, CGI for FastCGI, URL authorization, IP and domain restrictions, WebSockets, request tracing and others). On Server Core it skips IIS Manager.
2. Windows baseline. Turns off SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 on the server side, sets strong cryptography for .NET Framework, requires SMB signing and turns off SMB 1, stops and disables the Print Spooler, requires Network Level Authentication for Remote Desktop, sets an account lockout policy when none exists, disables the remote management firewall rules for WinRM and WMI, and raises a fixed page file that is smaller than the RAM. Some of this takes effect after a restart.
3. Panel database. Installs the Visual C++ runtime if missing, downloads MariaDB and creates the private panel database StackRegent SQL Server on 127.0.0.1:8306.
4. Files. Copies the program to C:\Program Files\StackRegent and locks etc to SYSTEM and Administrators.
5. Configuration and services. Writes the configuration, creates the admin login and registers the services StackRegent (web panel), StackRegentTask (task runner) and StackRegentGuard (brute-force guard). It also makes sure Microsoft Defender is present and excludes database files from real-time scanning.
6. Firewall. Opens TCP 9443 and 9080 for the panel, 80 and 443 for websites and 9444 for Website Preview in Windows Defender Firewall.
7. Service Monitor. Adds the StackRegent Service Monitor tray app at administrator logon and Start menu shortcuts (skipped on Server Core).
8. Check and components. Waits for the panel to answer, then installs the chosen components one by one.

The log is in C:\Program Files\StackRegent\var\log, in a file named install- followed by the date and time.

Ports to open in your provider's firewall#

Windows Firewall rules are created for you, but a cloud security group or a hardware firewall in front of the server must be opened separately. At minimum:

Add mail, DNS, FTP and the others as you install those components. The full table is on the requirements page.

First login#

At the end, the installer prints:

StackRegent is installed.
  Panel:     https://203.0.113.10:9443/
  Login:     admin
  Password:  ...

Save the password at once; it is not stored anywhere in plain text. Open the address, accept the self-signed certificate warning, and log in. Then follow getting started. If you lose the password, run & "C:\Program Files\StackRegent\bin\stackregent.exe" admin-password to print a new one.

Re-running install.ps1 and uninstalling#

Running install.ps1 from a newer package on an installed server upgrades in place: it stops the panel services, copies the new binaries, updates the panel database and starts them again. Websites keep running. Usually you update from the panel instead; see updating StackRegent.

To remove the panel, run powershell -ExecutionPolicy Bypass -File "C:\Program Files\StackRegent\uninstall.ps1". It keeps the panel data unless you add -RemoveData, and it leaves IIS, MailEnable, MariaDB and other components in place. The installation chapter of the administrator guide has the details.