---
id: windows
title: Windows
---

import RandomKey from "@site/src/components/RandomKey";

Anubis supports running on Windows as a native system service as of v1.27.0. In order to get started, download the MSI from [the releases page](https://github.com/TecharoHQ/anubis/releases) and run it. By default it installs to `C:\Program Files\Techaro\Anubis` and registers a service named `Anubis`.

:::note

Anubis is provided as both an amd64 (x64) and arm64 (Aarch64) executable. The amd64 MSI has been tested the most and is known to work. If you have trouble with the arm64 MSI, please [file a bug](https://github.com/TecharoHQ/anubis/issues).

:::

## First-time setup

By default installing Anubis does not start the `Anubis` service. This is intentional so that you may [customize Anubis' settings](../installation.mdx) and [configure your policy file](../policies.mdx). By default, the installer creates the following files in `%ProgramData%` (typically: `C:\ProgramData`):

|          File | Purpose                                                     |
| ------------: | :---------------------------------------------------------- |
|  `anubis.env` | Environment variable [Anubis settings](../installation.mdx) |
| `anubis.yaml` | Anubis [policy settings](../policies.mdx)                   |

Of note, you **MUST** set an ed25519 private key in `anubis.env` with `ED25519_PRIVATE_KEY_HEX`:

```sh
# Signing key, exactly 64 hexadecimal characters. If this is not set, Anubis
# generates a random key at every start, which invalidates every outstanding
# challenge whenever the service restarts. Set it before going to production.
# ED25519_PRIVATE_KEY_HEX=
```

To generate an ed25519 private key, you can use this PowerShell invocation:

```powershell
[Convert]::ToHexString([System.Security.Cryptography.RandomNumberGenerator]::GetBytes(32)).ToLower()
```

:::note

If you are using a legacy environment where only PowerShell 5.1 is available, use this invocation instead:

```powershell
$bytes = New-Object byte[] 32
[System.Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($bytes)
[System.BitConverter]::ToString($bytes).Replace('-','').ToLower()
```

:::

Alternatively here is a key generated by your browser:

<RandomKey />

Once you have configured Anubis to your liking, start it with PowerShell:

```powershell
Start-Service Anubis
```

And automatically start it on boot with `Set-Service`:

```powershell
Set-Service Anubis -StartupType Automatic
```

### Choosing an install location

Due to facts and circumstances surrounding how the Anubis installer MSI is created, there is no easy way to graphically pick an install folder for Anubis files. Instead you will need to manually set the `INSTALLDIR` variable with `msiexec`:

```powershell
msiexec /i anubis-1.26.2-windows-amd64.msi INSTALLDIR="D:\Anubis"
```

This is planned to be fixed at a future date or prioritized sooner if an enterprise customer contracts an immediate fix.

:::note

Changing the installation directory **DOES NOT** change where configuration files are written to and read from. The configuration files will always be in `%ProgramData%\Techaro\Anubis`.

:::

### Silent installs

To install Anubis silently, pass `/qn` to `msiexec`:

```powershell
msiexec /i anubis-1.26.2-windows-amd64.msi /qn INSTALLDIR="D:\Anubis"
```

## Administration notes

Anubis was designed for Unix-like systems and as such there are some warts that you should be aware of before deploying it in production.

### Service account

The `Anubis` service runs as the [virtual account](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-service-accounts#virtual-accounts) `NT SERVICE\Anubis`. Windows creates it automatically when the service is installed and removes it when it is uninstalled. There is no password to manage and nothing to create by hand.

The installer grants this virtual account rights on `%ProgramData%\Techaro\Anubis` so it can read its configuration, write its logs, and do other actions critical for Anubis to function. Please do not mess with these permissions. If you (or whoever you contract for compliance) feel that you need to, please file a bug to explain your usecase.

### Logging

Typically Windows services write logs to the Event Viewer. Anubis generates a lot more logs in typical operation than the Event Viewer was designed to handle, so by default it writes all its logs to these three files in `%ProgramData%\Techaro\Anubis`:

|                   File | Purpose                                                                                                 |
| ---------------------: | :------------------------------------------------------------------------------------------------------ |
|           `anubis.log` | All normal Anubis logs. This file will automatically be rotated out as it fills with data and ages out. |
| `anubis-bootstrap.log` | Any log messages generated during installation or upgrades.                                             |
|   `anubis-startup.log` | Any Anubis logs generated during early startup _before_ the main logging system is initialized.         |

### Upgrading

Installing a newer Anubis MSI over an older install removes the old service before creating the new one. If the service was running, the installer starts it again once the new files are in place. This causes a short interruption while the service is stopped, replaced, and restarted. Please plan upgrades for a maintenance window if that matters to you and your users.

The service's start type is not preserved when upgrades are performed. It is always reset to manual start. Make sure to re-configure Anubis to start on boot after an upgrade:

```powershell
Set-Service Anubis -StartupType Automatic
```

### IIS

To configure Anubis on IIS, consult [this guide for more information](https://rentry.co/anubis-on-iis).