Install StackRegent on Windows Server 2016
StackRegent installs and runs on Windows Server 2016, but Microsoft ends its extended support in January 2027. Use it for servers you already have, and plan the move to a newer release.
- Get a license key from the store (or the free trial): it is on your service page.
- Prepare the server: Windows updates installed, a host name, a static IP address, signed in as an administrator.
- Run the installer in an elevated PowerShell, with your key in place of the Xs:
[Net.ServicePointManager]::SecurityProtocol='Tls12'; & ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://panel.stackregent.com/get/stackregent.ps1'))) -LicenseKey SR-XXXXX-XXXXX-XXXXX-XXXXXThe installer activates the license, downloads the newest release, checks its size, SHA-256 and signature, installs IIS and the panel, then opens it at https://SERVER:9443/. Every installer parameter.
Read this first: Windows Server 2016 support ends in January 2027#
Microsoft's extended support for Windows Server 2016 ends on January 12, 2027. After that date the release gets no more security updates unless you buy Extended Security Updates from Microsoft. A hosting server faces the internet all day; running it without security updates is not something we recommend.
So:
- New server? Install on Windows Server 2025 or Windows Server 2022 instead.
- Existing 2016 server? Installing StackRegent on it is a reasonable way to manage the sites you have now and move them later. The Migration & Transfer Manager copies subscriptions to a new StackRegent server one by one, and can copy the latest changes again right before you switch DNS. See the migration guide.
The StackRegent lifecycle policy says how long StackRegent itself supports each Windows release.
What is different on Windows Server 2016#
Windows Server 2016 (build 14393) is the oldest release the installer accepts. Everything in StackRegent works on it, with these differences:
| Area | On Windows Server 2016 |
|---|---|
| Website TLS | TLS 1.2 at most; no TLS 1.3, no HTTP/3. HTTP/2 works. |
| Git over SSH | Windows has no built-in OpenSSH client, so the Git tool uses the SSH client that comes with Git for Windows. |
| .NET Framework | 4.6.2 as shipped. StackRegent 0.17.16 and later install 4.8 for you. |
| Windows PowerShell 5.1 | May not use TLS 1.2 by default for web requests; the one-line installer sets it first. |
| Visual C++ runtime | Usually missing; the installer adds it. |
curl.exe | Not included; use Invoke-WebRequest for checks. |
| Disk I/O limits per subscription | Supported: Server 2016 is the first release with the job object I/O rate control StackRegent uses. |
Prepare a Windows Server 2016 server#
Bring it fully up to date#
Install the latest servicing stack update and the latest cumulative update, then restart. Windows Update on 2016 is slow; a long-unpatched server may need several hours and more than one restart. Do this before installing StackRegent, so the IIS role is added on a patched system.
Install .NET Framework 4.8#
Windows Server 2016 ships with .NET Framework 4.6.2. Many ASP.NET applications today target 4.7.2 or 4.8 and fail with a configuration error on 4.6.2. From StackRegent 0.17.16, the installer checks for this on Windows Server 2016 and, when 4.8 is missing, downloads .NET Framework 4.8 from Microsoft, checks that the download is signed by Microsoft, and installs it before the IIS role. Restart Windows when the installer says so; ASP.NET 4.8 sites need the restart. You can also install it yourself beforehand through Windows Update or Microsoft's offline installer. Check the installed release with:
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full').ReleaseA value of 528040 or higher means 4.8 is installed.
Know why the TLS line matters#
Windows PowerShell 5.1 on Server 2016 can still default to TLS 1.0 for web requests, and the download from the license server then fails to connect. That is why the one-line installer starts with [Net.ServicePointManager]::SecurityProtocol='Tls12'. Do not leave it out. After installation, the StackRegent baseline sets strong cryptography for .NET Framework, so .NET applications on the server use TLS 1.2 by default as well.
Network and DNS#
Give the server a fixed IP address, create an A record for its host name and open TCP 9443, 80 and 443 in any firewall in front of it.
Install StackRegent on Windows Server 2016#
Step 1: Open Windows PowerShell as administrator#
Right-click Windows PowerShell and choose Run as administrator. On Server Core, type powershell at the command prompt.
Step 2: Run the one-line installer#
[Net.ServicePointManager]::SecurityProtocol='Tls12'; & ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://panel.stackregent.com/get/stackregent.ps1'))) -LicenseKey SR-XXXXX-XXXXX-XXXXX-XXXXXThe signature check works with the .NET Framework that ships with 2016; the script falls back to the older Windows cryptography interface when the newer one is not there.
Step 3: Wait through the IIS and runtime stages#
The installer adds the IIS role, installs the Visual C++ runtime, sets up the panel database and then the components. If Windows reports that IIS needs a restart, finish the installation first and restart after the first login.
Step 4: Save the login and restart#
Note the panel address, admin and the password. Then restart the server once: the protocol changes of the security baseline and a resized page file take effect only after a restart.
Server Core on Windows Server 2016#
Server Core 2016 runs StackRegent the same way as the newer releases, without IIS Manager and the tray app. Without curl.exe, check from the console that the panel port is listening:
Test-NetConnection -ComputerName localhost -Port 9443TcpTestSucceeded : True means the panel is up. Open the panel itself from a browser on another computer; the self-signed certificate warning is expected until you issue a trusted certificate.
Check the installation#
Get-Service StackRegent, StackRegentTask, StackRegentGuard, StackRegentSQLshows all four running.& "C:\Program Files\StackRegent\bin\stackregent.exe" license-checkreports the license as licensed.- In the panel, Tools & Settings › About StackRegent marks Windows Server 2016; TLS 1.3, HTTP/3 and the built-in OpenSSH client show as not available, which is expected on this release.
- Tools & Settings › ASP.NET Settings lists the detected .NET Framework versions; it should show 4.8 after the restart.
- Tools & Settings › Diagnose & Repair › Check Everything finds nothing to repair.
Then follow getting started, and put the move to a newer release on your calendar.
Frequently asked questions
Does StackRegent support Windows Server 2016?
Yes, the installer accepts Windows Server 2016 (build 14393) and every feature works except TLS 1.3 and HTTP/3 for websites. Because Microsoft's extended support ends on January 12, 2027, we recommend 2022 or 2025 for new servers.
When does Windows Server 2016 support end?
Microsoft's extended support for Windows Server 2016 ends on January 12, 2027. After that there are no security updates unless you buy Extended Security Updates from Microsoft.
How do I move StackRegent from Windows Server 2016 to a newer release?
Install StackRegent on a new 2022 or 2025 server and use the Migration & Transfer Manager to copy subscriptions over HTTPS. Re-run the migration just before switching DNS to copy the latest files, databases and mail. The migration guide has the overview.
Why does the one-line installer fail to download on Windows Server 2016?
Usually because PowerShell used TLS 1.0. Make sure the command starts with [Net.ServicePointManager]::SecurityProtocol='Tls12'; and that the server's clock is correct, then run it again.
Do ASP.NET 4.8 applications run on Windows Server 2016?
Yes. Server 2016 ships with 4.6.2, which is too old for applications that target 4.7.2 or 4.8, so the StackRegent installer (0.17.16 and later) installs .NET Framework 4.8 from Microsoft. Restart Windows afterwards to finish it.