--- title: "Windows capabilities" description: "Check which Alpacon features work on Windows and how the SYSTEM account affects command and file access. Review version requirements before installing Alpamon." --- > Full documentation index: https://docs.alpacax.com/llms.txt # Windows capabilities # Windows capabilities Alpacon supports Windows servers through the Alpamon agent. Terminal access (Websh), file transfer (WebFTP), port forwarding, system information, agent restart, and metrics all work; some Unix-specific features do not. Port forwarding needs Alpamon 2.5.1 or later. This page covers what's specific to Windows; the step-by-step procedures live in the linked guides. ## Supported versions and architecture | | Supported | | --- | --- | | Windows Server | 2019, 2022, 2025 | | Windows client | Windows 10 (1803 or later), Windows 11 | | Architecture | amd64 (x64) only | The support baseline is **Windows Server 2019+ and Windows 10 1803+**. **Websh** (the browser terminal) additionally needs ConPTY, the Windows pseudoconsole available only on **Server 2019+ and Windows 10 1809+**—so on Windows 10 1803–1808, everything works except Websh. **Windows Server 2016 and older are not supported**: the installer relies on the built-in `tar.exe` and modern PowerShell features that aren't present there. There is no ARM64 build for Windows. ## Installation Install from an elevated PowerShell (cmd.exe is not supported). The workspace-generated command, `install.ps1`, manual `.zip`, and Ansible paths are all in the [installation guide](/use/servers/register/install/#windows). ## What works on Windows | Feature | Windows | | --- | --- | | Terminal sessions (Websh) | ✅ | | Command execution (`exec`, `shell`) | ✅ (PowerShell) | | File transfer (WebFTP) | ✅ | | System information (users, groups, inventory) | ✅ | | Agent restart | ✅ | | Real-time metrics | ✅ | | Agent self-upgrade | ✅ (Alpamon 2.4.0 or later) | | User and group management | ❌ | | Permission changes (`chmod` / `chown`) | ❌ | | Port forwarding (tunnel) | ✅ (Alpamon 2.5.1 or later; IPv4 localhost `127.0.0.1` only) | | Code editor | ❌ | | ARM64 builds | ❌ | The **Code editor** checkbox can still be checked on a Windows server, but opening the editor ends with `Connection timeout. The editor failed to start.` Port forwarding reaches only services listening on IPv4 localhost (`127.0.0.1`), not ones bound only to `::1`. ## Permissions and identity on Windows This is the most important difference from Linux and macOS. On Windows, the agent runs every command as **SYSTEM (LocalSystem)**, regardless of which account you select when connecting. The account shown in a session is an **audit label**, not a privilege boundary—running `whoami` in Websh returns `nt authority\system`. Because there is no per-user boundary on the server, access is controlled by Alpacon rather than by Windows file permissions: - **Websh and command execution** run as SYSTEM. - **WebFTP** runs as SYSTEM and can read and write any path the agent can reach, including system directories such as `C:\Windows\System32`. There is no home-directory confinement. - **Port forwarding** connects to the local port from the agent, which runs as SYSTEM, and passes the traffic through unchanged. A service that requires sign-in, such as SQL Server or WinRM, authenticates the credentials your client sends, not SYSTEM. The real boundary is your **Alpacon roles and permissions** and the **list of users allowed to connect**. Grant Websh and WebFTP access deliberately, and use roles to limit who can reach sensitive servers and paths. ## Who can connect Alpacon does not create Windows accounts on demand. To connect with a system account, that account must already exist on the server—create the Windows account first, and it becomes selectable when connecting. ## Upgrades Like Linux and macOS, a Windows agent running Alpamon 2.4.0 or later updates itself, either automatically or on demand with `alpacon agent upgrade` (or **Upgrade agent** on the server's [Agent card](/use/servers/manage/#agent-card)); the agent downloads the latest release, verifies the checksum, and restarts itself. On Windows each command runs inside a job that ends with the agent (alpamon 2.8.3 and later). When the agent restarts, the command and any child processes still in that job are ended. A process that has left the job, such as one started as a scheduled task or a Windows service, keeps running. An automatic upgrade or a scheduled restart waits while the server has an open Websh or WebFTP session or a running command. It goes ahead when that work ends, or 48 hours after it was queued, whichever comes first. A manual upgrade or restart is refused while the server has that work, unless you force it (see [`alpacon agent upgrade`](/reference/cli/agent/upgrade/)). When an upgrade or restart goes ahead, any command still running in its job ends. Start anything that must outlive the agent as a scheduled task or a Windows service rather than from a command. An agent older than 2.4.0 can't update itself, so replace its binary once by hand; see [upgrading the agent](/use/servers/manage/#agent-card) for the steps. ## Removal and recovery Remove the agent with `alpamon unregister`, or recover a stuck host with `alpamon register --force`. Run these on the server (RDP or serial console), not over Websh, on alpamon v2.3.0 or later. Full steps: [uninstallation](/use/servers/remove/) and [re-registration and recovery](/use/servers/troubleshooting/#re-registration-and-recovery). ## Troubleshooting - **SmartScreen**: the binary is unsigned; if you downloaded the archive manually, run `Unblock-File` before registering. - **No automatic log rotation**: `%ProgramData%\alpamon\log\alpamon.log` grows unbounded—rotate it with a scheduled task. - **Service won't start (including StartPending)** and other agent issues: see [Agent issues → Windows](/use/servers/troubleshooting/#windows-agent-issues). ## Operations reference For deeper operational detail—service recovery behavior, PowerShell and TLS requirements, and the full install matrix—see the Alpamon Windows runbook: [alpamon/docs/windows.md](https://github.com/alpacax/alpamon/blob/main/docs/windows.md). Source: https://docs.alpacax.com/reference/platforms/windows/