# Install FsRdpServer on Windows A complete guide from a freshly installed Windows server to your first working client connection. Every step is explained individually; no prior knowledge of certificates or DNS is required. > Plain-text version of > for AI assistants and printing. Its content matches the HTML version; > the web page is authoritative in case of doubt. > > Automatically generated from the page and language resources by > FsRdp/Build-InstallDocs.ps1. Edit those sources rather than this file. > **Try It without a License:** You do not need a license to install the server. Without a > license file, a server runs **as a trial installation for 30 days** with full > functionality; see section 6 for details. Once it is running in your environment, we > agree on the server name and license together. ## On This Page 1. What Should Be Running at the End 2. Prepare the Fresh Windows Server 3. Server Name: DNS with A and AAAA Records 4. Router, Port Access and Firewall 5. The TLS Certificate (PFX File) in Detail 6. Trial Period or License 7. Run Setup 8. Check That Everything Works 9. Browser Viewer on Port 8890 with Its Own Certificate 10. Your First Connection Test 11. Ongoing Operation: Backups, Updates and Renewal 12. Common Problems --- ## 1. What Should Be Running at the End FsRdpServer is a **relay server**. It does not capture screens or store session content; it connects the participants in a room. All clients connect to the server, never directly to one another. Only the server needs to be reachable, rather than any client. After installation, the service listens on these TCP ports: | Also allow port | Purpose | Required? | |---|---|---| | `8888` | Main connection: control, screen content, files and remote control | yes | | `8889` | Voice transmission (separate channel) | yes | | `8890` | Browser viewer for viewers without an installed client | optional, requires a license (available during the trial) | | `80` | *Temporarily only*, if obtaining certificates from Let's Encrypt | optional | The server binds its ports in **dual-stack mode**, accepting IPv4 and IPv6 connections on the same port. No configuration is required for this. --- ## 2. Prepare the Fresh Windows Server Windows Server 2019, 2022 and 2025, and Windows 10/11 x64 are suitable. A separate .NET installation is **not** required; the program includes everything it needs. ### Step 1: Fully Update Windows **Settings → Windows Update → Check for updates**until no more updates are offered, restarting as needed. A server that will be reachable from the internet should be up to date from the outset. ### Step 2: Check Time and Time Zone This matters more than it may seem: certificates and licenses have validity periods. If the server clock is several minutes wrong, connections may fail with seemingly inexplicable errors. Open PowerShell as administrator: ```powershell Get-Date w32tm /resync ``` ### Step 3: Assign a Fixed Local IP Address The router must forward ports to a *stable* address. Assign a fixed IPv4 address to the server, either statically in network settings or, more conveniently and with less room for error, as a fixed DHCP assignment in your router (“always assign the same IPv4 address to this device”). View Current Addresses: ```powershell Get-NetIPAddress -AddressFamily IPv4,IPv6 | Where-Object { $_.PrefixOrigin -ne 'WellKnown' } | Format-Table IPAddress, InterfaceAlias, PrefixOrigin, SuffixOrigin ``` ### Step 4: Check Whether Port 80 Is in Use Only relevant if obtaining your certificate from Let's Encrypt. If IIS or another web server is installed, it occupies port 80. Stop it briefly during certificate issuance or obtain the certificate another way. ```powershell Get-NetTCPConnection -State Listen -LocalPort 80 -ErrorAction SilentlyContinue ``` ### Step 5: Create a Working Folder and Gather Files Create, for example, `C:\FsRdp-Setup` and gradually collect: `Setup_FSRdpServer.exe`, and later `cert.pfx` and `license.fsrdp`. Store the PFX password in a password manager; you need it for every reinstallation and certificate renewal. --- ## 3. Server Name: DNS with A and AAAA Records ### 3.1 Why a Name Rather than an IP Address? Clients connect **using a DNS name**, for example `server.ihrefirma.de`, never an IP address. There are two essential reasons: - The TLS certificate is issued for a *name* . If a client connects using an IP address, the name does not match the certificate and the connection is rejected. - Your license is also tied to this exact name (`LicensedServerHost`). > **Remember:** Licensed host name = certificate name = name entered in the client. All > three must match character for character. Otherwise nothing works, and the error message > often mentions only one of them. ### 3.2 What Are A and AAAA Records? A DNS record translates a name into an address. There are two types because the internet uses two address types: | Record | Points To | Example | |---|---|---| | `A` | an IPv4 address (four numbers separated by dots) | `203.0.113.45` | | `AAAA` | an IPv6 address (hexadecimal groups separated by colons) | `2a02:810d:7087:8800::159` | Pronounce `AAAA` as “quad A”. Both records can exist for the same name, which is the usual case. The client uses whichever its connection supports and generally prefers IPv6. **Important:** An AAAA record points to the IPv6 address *of the server itself*, rather than the router. With IPv6, every device on a home or company network has its own globally valid address; there is no address translation as with IPv4. ### 3.3 Find Your Public Addresses Run this *on the server itself* : ```powershell # Öffentliche IPv4-Adresse Ihres Anschlusses (die des Routers) (Invoke-WebRequest -Uri "https://api.ipify.org" -UseBasicParsing).Content # Öffentliche IPv6-Adresse dieses Servers (Invoke-WebRequest -Uri "https://api6.ipify.org" -UseBasicParsing).Content ``` If the first command returns an address, you have public IPv4. If the second does, you have IPv6. If either fails, your connection does not support that protocol or it is not enabled. ### 3.4 DS-Lite: No Public IPv4 Address Many cable and fiber connections in Germany, commonly Vodafone cable and some other providers, use **DS-Lite**. Your connection shares a public IPv4 address with many other customers rather than having its own. The consequence is clear: - **IPv4 port forwarding in the router has no effect.** You can configure it, but it will never be reached; there is no external route to your connection. - **Only IPv6 works.** The name therefore receives only an AAAA record, without an A record. - **Clients on IPv4-only networks cannot connect.** In practice this affects some company networks and mobile connections. Viewers connecting from the internet need IPv6, or you need a different connection. **How to Recognize DS-Lite:** - Under “Internet → Online-Monitor”, the router shows no public IPv4 address, only IPv6, or an IPv4 address in the range `100.64.x.x` to `100.127.x.x`. - Running `https://api.ipify.org` (see 3.3) fails, while `api6.ipify.org` succeeds. - FRITZ!Box often explicitly shows “DS-Lite” under “Internet → Zugangsdaten → IPv6” (Internet → Account Information → IPv6). Many providers will switch you to a real IPv4 address on request at no charge; ask for “dual stack instead of DS-Lite”. If clients need to connect from any network, a call to the provider is the simplest solution. ### 3.5 Changing Addresses: Dynamic DNS Residential and small business connections usually have no fixed address. The public IPv4 address or IPv6 *prefix*, the first half of the address, changes. Eventually your DNS record is outdated and no one can reach the server. There Are Three Options: - **Order a fixed address from your provider.** The simplest arrangement, usually for a small monthly surcharge. Set the A and AAAA records once and you are done. - **Use a dynamic DNS service** (DynDNS, No-IP, deSEC, dynv6 and others). The router reports every address change to the service, where you receive a name such as `ihrname.dynv6.net` . Point your own name to it using `CNAME` . **Caution:** Not every service updates AAAA records, which is essential with DS-Lite. - **Run only on your local network** – no dynamic DNS or port access required (see 3.8). > **Also Keep in Mind for IPv6:** When the prefix changes, the server's address changes, > affecting both the AAAA record *and* the router access rule. Ensure the server keeps its > last address segment, the interface ID, so the router rule survives prefix changes. > FRITZ!Box does this automatically if you associate access with the device rather than a > manually entered address. ### 3.6 Create Records with Your DNS Provider Sign in to your domain provider (registrar or hosting provider) and create a record for the desired name: | Field | Value (Example) | Note | |---|---|---| | Type | `A` | only if you have public IPv4 | | Name / Host | `server` | results in `server.ihrefirma.de` | | Value | `203.0.113.45` | the connection's public IPv4 address | | TTL | `600` | 10 minutes; keep it short while testing | | Field | Value (Example) | Note | |---|---|---| | Type | `AAAA` | if you have IPv6; essential with DS-Lite | | Name / Host | `server` | the same name as above | | Value | `2a02:810d:7087:8800::159` | IPv6 address **of the server**, rather than the router | | TTL | `600` | | Changes can take up to one TTL period to reach all systems. Increase the TTL (e.g. to 3600) only once everything works. ### 3.7 Check Name Resolution Run this *from another computer* rather than the server: ```powershell Resolve-DnsName server.ihrefirma.de -Type A Resolve-DnsName server.ihrefirma.de -Type AAAA ``` Expect the exact address you entered. “DNS name does not exist” means the record has not propagated yet or is misspelled. A *different* address probably comes from an outdated cached entry; clear it using `Clear-DnsClientCache`. ### 3.8 Run Only on Your Local Network If all participants are on the same company network, no public DNS or port access is needed. The name must still exist because the certificate and license rely on it. Two options: - **Internal DNS** (e.g. your Active Directory DNS service): create `server.ihrefirma.de` with the local IP address. This is the preferred approach. - **A hosts file on every client** – suitable only for small tests. Add an entry in `C:\Windows\System32\drivers\etc\hosts` : ```text 192.168.1.50 server.ihrefirma.de ``` A hosts entry only changes name resolution. It does not replace certificate name verification or license binding; the certificate must still be issued for `server.ihrefirma.de` . --- ## 4. Router, Port Access and Firewall There are two barriers between an internet client and your server: the router and Windows Firewall. Setup handles Windows Firewall automatically; you configure the router yourself. ### 4.1 IPv4: Port Forwarding With IPv4, your network has one public address shared by all devices. The router must know which device should receive incoming connections. Create a rule for each port: | Protocol | External Port | Target Device | Device Port | |---|---|---|---| | TCP | 8888 | your server | 8888 | | TCP | 8889 | your server | 8889 | | TCP | 8890 | your server | 8890 | On a FRITZ!Box: **Internet → Freigaben → Portfreigaben → Gerät für Freigaben hinzufügen (Internet → Permit Access → Port Sharing → Add Device for Sharing)**, then select the server and create each rule. ### 4.2 IPv6: Allow Access Rather than Forwarding IPv6 has no address translation; every device is already addressable from outside. The router does not redirect anything, but *opens* its firewall for that device and port. The interface usually still calls this “port sharing”, with a choice such as “internet access via IPv6”. > Create the access rule **for the device** rather than a manually entered IPv6 address. > Only then does the rule follow the server when the prefix changes. With DS-Lite, only > IPv6 access rules work; IPv4 forwarding is unnecessary. ### 4.3 Port 80: Only for Let's Encrypt Let's Encrypt must verify that you control the name. The simplest verification uses port 80. Allow port 80 to your server permanently, since automatic renewal runs every 60 days. Routers often display a security warning here, referring to a continuously running web server. If a program listens on port 80 only for the few seconds needed to issue a certificate, the risk is low. ### 4.4 Windows Firewall Setup creates the incoming rules `FSRdpServer Main`, `FSRdpServer Audio` and, if you enable the browser viewer, `FSRdpServer WebGateway` . Rules apply only to the server program, rather than the port generally. Additional security software may need manual port rules. --- ## 5. The TLS Certificate (PFX File) in Detail ### 5.1 What Is a PFX File? `cert.pfx` is a password-protected PKCS#12 container holding three things: - the **server certificate** – the public identity for your server name; - the **private key** – the secret proving that identity belongs to you; - usually also the **intermediate certificates** from the issuing authority. FsRdpServer uses it to encrypt all connections, just as a web server uses its HTTPS certificate. The service does not start without a valid certificate. > **The PFX File Is a Secret.** Anyone with the file and its password can impersonate your > server. Do not send it by unencrypted email, store it on network drives with broad > permissions or upload it to a public repository. ### 5.2 Which Name Must the Certificate Include? The certificate must include the licensed server name as a *Subject Alternative Name* (SAN). Two variants are allowed: - **A wildcard certificate** for `*.ihrefirma.de` – also covers `server.ihrefirma.de` and can be reused for additional servers later. - **A certificate for this one name only**, namely `server.ihrefirma.de`. Less expensive, but not reusable for other names. The PFX file may contain **exactly one** certificate with a private key. If it contains several, the server refuses to start with a clear message. ### 5.3 Option A: Purchase a Certificate and Export It as PFX The usual approach if you already have a domain with a hosting provider. Order a certificate, have it issued and export it as PFX on Windows. #### Step 1: Order a Certificate from Your Provider Order a certificate from your domain provider (e.g. HostEurope, IONOS, GoDaddy) for `server.ihrefirma.de` or `*.ihrefirma.de` . The provider guides you through ownership verification, usually by email or DNS record. #### Step 2: Install the Certificate The provider supplies either a ready-made PFX file, in which case you are done here, or certificate files to import into the Windows certificate store. Double-click the file, select store location **Local Machine**and store it under **Personal**. #### Step 3: Export as PFX `certlm.msc` to open certificates for the local computer. Under **Personal → Certificates** , find the certificate, right-click → **All Tasks → Export**. Then: - **Yes, export the private key** – the file is unusable without it. - Format: **PKCS#12 (.PFX)**. - **Include all certificates in the certification path if possible** to include intermediate certificates in the file. - Set a password (choose encryption `AES256-SHA256` if offered). - Save as `cert.pfx` . ### 5.4 Option B: Free with Let's Encrypt Works only if your server name is in public DNS and the certificate authority can reach your server. On Windows, **win-acme** is the commonly used tool (free, from `win-acme.com`). #### Step 1: Download and Start win-acme Extract the ZIP file and run `wacs.exe` as administrator. A menu appears in the console window. #### Step 2: Create a Certificate with All Options Choose a certificate with full options, select manual input as the source and enter `server.ihrefirma.de` . Choose HTTP validation, where win-acme briefly listens on port 80 itself. #### Step 3: Save as a PFX File When asked for the storage location, choose a **PFX file** , rather than only the Windows certificate store. Specify a destination folder such as `C:\FsRdp-Setup\certs` and a password. win-acme then creates a scheduled task for automatic renewal. > Exact menu labels depend on the win-acme version. Three points matter: the name must > exactly match your licensed server name, the result must be a **PFX file with a private > key** , and port 80 must be reachable from outside. If you obtained the certificate another way as `fullchain.pem` and `privkey.pem` , bundle it with OpenSSL: ```text openssl pkcs12 -export -out cert.pfx ^ -inkey privkey.pem -in fullchain.pem ``` OpenSSL then asks for the password interactively so it is not stored in command prompt history. ### 5.5 Option C: Your Company's Own CA Suitable only for internal installations. You issue the certificate yourself, but *every* client must explicitly trust your company CA or all connections fail. This option is unsuitable for the browser viewer because every browser would show a warning page. ### 5.6 Check the PFX File before Installation Always do this first; otherwise an incorrect certificate only becomes apparent when setup aborts: ```powershell $pfx = Get-PfxCertificate -FilePath C:\FsRdp-Setup\cert.pfx $pfx | Format-List Subject, NotBefore, NotAfter, HasPrivateKey, Thumbprint $pfx.Extensions | Where-Object { $_.Oid.FriendlyName -eq 'Subject Alternative Name' } | ForEach-Object { $_.Format($true) } ``` Check Three Points: - `HasPrivateKey` must report `True` . - `NotAfter` must be in the future. - The SAN list must include your licensed name; for a wildcard certificate, the corresponding entry is `*.ihrefirma.de`. ### 5.7 Add the Expiry Date to Your Calendar Certificates expire: purchased ones usually after a year, Let's Encrypt after 90 days. When the certificate expires, every client suddenly stops connecting. Set a reminder two weeks before `NotAfter` or configure automatic renewal. win-acme handles renewal itself; the service must be restarted afterwards (see section 11). --- ## 6. Trial Period or License ### No License Needed for the First 30 Days If no license file exists beside the configuration, the server still starts and runs **as a trial installation for 30 days**. Nothing needs to be enabled: install, configure the certificate and start the service. The trial limits duration and capacity, **not** features: | | Trial Period | With a License | |---|---|---| | Concurrent Rooms | 1, fixed number `123456789` | as specified in the license | | Session Duration | up to 24 hours | as specified in the license | | Waiting Time Afterwards | none | as specified in the license | | Participants per Room | 5 | as specified in the license | | Room Features | all | all | | Total Duration | 30 days from installation | license term | | Watermark | yes | no | “All features” means screen sharing, remote control, camera, voice, chat, file transfer, session recording, live captions and the browser viewer. Their technical requirements still apply: captions need your own API key, and the browser viewer needs its port and certificate (section 9). During the trial, all participants see a **Watermark** over the shared screen. This is intentional: an unlicensed server should be recognizable as such. What the trial does not include is **supporter key** and the features tied to those keys: reserved room names and the room password with which a customer opens their permanent room in a browser. This is not a feature block; an unlicensed server simply does not issue keys. > **The room number `123456789` is publicly known.** If your test server is reachable from > the internet, set a **room PIN**. The field is next to the room number in both desktop > clients. The person opening the room sets it; everyone else needs it to join. After 30 days, the service keeps running and listening but responds to every connection with a request for a license; it does not refuse **not** to start. You can install a license file later without reinstalling (section 11). ### Request a License For continued operation, the license file `license.fsrdp` is required. It is tied to two things: your **server name** and a permanent **installation ID**, generated on the server. Send Me These Details for Issuing the License: - the exact DNS name clients will use; - the desired number of concurrent rooms; - the number of participants per room; - the desired term; - whether you want browser viewing, session recording or live captions; these features must be enabled in the license. > **On a first Windows installation, this is straightforward:** I send you the license > together with the matching installation ID, which setup adopts and saves automatically. > You do not need to generate anything beforehand. Only when reusing an *existing* > installation, such as one from the trial period, must you retain its existing ID. Read > it using the command below and send it to me. An installed server displays its ID as follows: ```powershell & "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" --installation-id ``` --- ## 7. Run Setup You Now Need: `Setup_FSRdpServer.exe` and `cert.pfx` with its password. The license file `license.fsrdp` is needed only if you already have one; otherwise install the 30-day trial. ### Step 1: Start as Administrator `Setup_FSRdpServer.exe` Right-click **Run as administrator** . Without administrator permissions, setup cannot create the service or firewall rules. ### Step 2: Set Ports The suggested ports `8888` and `8889` are suitable in almost all cases. The same page includes the checkbox for the **browser viewer** and its port (`8890`). Select it only if your license includes the feature. The **demo mode** option on the same page is for users without a license key and is disabled in normal operation. ### Step 3: Enter the Certificate and Password Select `cert.pfx` and enter its password on the next page. ### Step 4: Select the License File or Leave the Page Empty If you have a license, select the supplied `license.fsrdp` . Otherwise leave the page empty: setup asks once whether it should create the 30-day trial installation (section 6), then continues normally. ### Step 5: Wait for Validation Before copying any files, setup checks: - license signature and validity; - the installation ID; - the licensed host name; - the PFX password and private key; - certificate validity period, intended use and names; - the certificate chain; - whether the licensed host name resolves via DNS. **Without a license** , the three checks requiring a license are skipped. The password, private key, certificate validity, intended use and chain are still checked. The trial has no licensed host name against which to compare the certificate name yet. > **If a DNS Warning Appears:** Setup allows you to continue if the name does not resolve > yet. Do so only if you know that you will configure DNS or hosts entries before the > first client connection. Otherwise cancel and correct the DNS record first. **What Setup Configures:** | Bereich | Ort bzw. Wirkung | |---|---| | Program Files | `C:\Program Files\FsRdpServer` | | Data and Secrets | `C:\ProgramData\FsRdpServer` with `appsettings.json`, `cert.pfx`, `license.fsrdp`, `server-instance-id.txt` and `Logs\` | | Service | `FsRdpServer`, delayed automatic startup, runs as `LocalSystem`, restarts automatically after failures | | Firewall | incoming rules for the configured ports | | Access Permissions | the data folder is restricted to `SYSTEM` and local administrators | > **About the PFX Password:** It is stored as plain text in > `C:\ProgramData\FsRdpServer\appsettings.json`. Folder permissions protect it rather than > encryption. Therefore, **never** give ordinary users access to this folder or include it > in a backup readable by more people than the folder itself. --- ## 8. Check That Everything Works Open PowerShell as administrator and work through these checks in order. **Is the Service Running?** ```powershell Get-Service -Name FsRdpServer ``` The status must be `Running` . **Are Both Ports Listening?** ```powershell Get-NetTCPConnection -State Listen -LocalPort 8888,8889 ``` **Are the Firewall Rules Present?** ```powershell Get-NetFirewallRule -DisplayName "FSRdpServer Main","FSRdpServer Audio" ``` **What Does the License Report?** ```powershell & "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" --license-status ``` During the trial, you see this instead of customer details: ```text License state: trial Trial state file: C:\ProgramData\FsRdpServer\trial-state.json Trial period: 2026-09-11 through 2026-10-11 (30 day(s) left) Trial room: 123456789 ``` The 30-day period is tied to the **first start of this installation**, recorded in `trial-state.json`. It is measured against the latest time ever observed; turning the system clock back does not extend it. **Complete Self-Check:** ```powershell & "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" ` --validate-installation ` --validation-data-dir "$env:ProgramData\FsRdpServer" ``` Return code `0` means everything is in order. Return code `3` means warnings, for example unresolved DNS or a certificate chain that cannot be fully verified locally. Read the warning in full and continue only if you understand the cause. Fix every genuine error before putting the server into operation. **View the Latest Log Files:** ```powershell Get-ChildItem "$env:ProgramData\FsRdpServer\Logs" | Sort-Object LastWriteTime -Descending | Select-Object -First 10 ``` --- ## 9. Browser Viewer on Port 8890 with Its Own Certificate The browser viewer lets viewers participate without an installed client; they simply open `https://server.ihrefirma.de:8890/`. It is disabled by default and requires two settings: permission **in the license** and activation **in the configuration**. ### 9.1 Why a Second Certificate Makes Sense Any certificate trusted by native clients is sufficient for them, including one from your own company CA. A **Browser** is stricter and shows visitors a warning if the certificate is not issued by a publicly recognized authority. Give the browser viewer its own publicly trusted certificate without changing the native channels' certificate. > If both settings are empty, the browser viewer automatically uses the same `cert.pfx` as > ports 8888/8889. This is fine as long as it comes from a public certificate authority. ### 9.2 Setup #### Step 1: Obtain a Publicly Trusted Certificate For example, use win-acme (see 5.4) to obtain a `C:\FsRdp-Setup\certs\webgateway.pfx`. It must be issued for the name visitors use to access the page. #### Step 2: Add Configuration `C:\ProgramData\FsRdpServer\appsettings.json` as administrator in an editor and enter both values: ```json "WebGatewayEnabled": true, "WebGatewayPort": 8890, "WebGatewayCertificatePath": "C:\\FsRdp-Setup\\certs\\webgateway.pfx", "WebGatewayCertificatePassword": "IhrPasswort", ``` Note the **double backslashes** : JSON requires every backslash to be doubled. A path with a single backslash makes the file invalid and prevents the service from starting. #### Step 3: Restart and Check the Service ```powershell Restart-Service -Name FsRdpServer Get-NetTCPConnection -State Listen -LocalPort 8890 ``` Then open `https://server.ihrefirma.de:8890/` in a browser. If there is no certificate warning, everything is correct. Remember to allow port 8890 in the router (section 4). If the browser viewer is disabled, setup does not create a firewall rule for this port. Enable it later by running setup again. ### 9.3 Remember Renewal > The server reads its certificates **only at startup**. When a certificate is renewed, > for example automatically by win-acme every 60 days, the running service does not adopt > the new file automatically. Restart it afterwards. Restarting disconnects all active > sessions, so schedule it for a quiet time. The simplest solution is to add a call to > `Restart-Service -Name FsRdpServer` to the win-acme renewal task. --- ## 10. Your First Connection Test ### Step 1: Install the Client on Another Computer Do not test on the server itself, since this misses router and firewall problems. The [Client Installation Guide](https://www.fssoft.de/FsRdp/en/InstallingClient.aspx) describes installation. ### Step 2: Enter the Server Name in the Client Use the exact licensed name, rather than an IP address, and ports `8888` and `8889`. ### Step 3: Connect Two Devices to the Same Room Only with two participants can you verify that screen and audio are transmitted correctly. > **Do not run `telnet` or `Test-NetConnection` in a loop.** The server treats repeated > connection attempts without a valid protocol as an attack and temporarily blocks the > test computer's IP address. One connection test is fine; continuous loops lock you out. --- ## 11. Ongoing Operation ### Backups Back up `C:\ProgramData\FsRdpServer` to a location with equally restrictive access permissions, since they contain the PFX file and password. > **`server-instance-id.txt` must never be lost.** Your license is tied to this ID. If > lost, the license is unusable for this installation and must be reissued. The data > folder is therefore intentionally retained during uninstallation. ### Update the Server Run a newer `Setup_FSRdpServer.exe` as administrator. Configuration, certificate, license, installation ID, room reservations and logs are retained, including browser viewer certificate settings. ### Install or Replace the License The same procedure applies to the first license after a trial and a renewed license: add the file, validate and restart the service. The license itself reloads automatically without restarting, but browser viewer, captions and demo mode settings are read at startup and require a restart. ```powershell Stop-Service -Name FsRdpServer Copy-Item ".\license.fsrdp" "$env:ProgramData\FsRdpServer\license.fsrdp" -Force & "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" ` --validate-installation ` --validation-data-dir "$env:ProgramData\FsRdpServer" Start-Service -Name FsRdpServer ``` Do not start the service if validation fails. If a license is regenerated with a different supporter count, all supporter keys may change; distribute new keys promptly. ### Replace the Certificate ```powershell Stop-Service -Name FsRdpServer Copy-Item ".\cert.pfx" "$env:ProgramData\FsRdpServer\cert.pfx" -Force # Falls sich das Passwort geändert hat: appsettings.json anpassen Start-Service -Name FsRdpServer ``` Then repeat the self-check from section 8. --- ## 12. Common Problems ### The Certificate Name Does Not Match The client name, certificate name and licensed host name differ. Check all three and always connect using the licensed name. ### `RevocationStatusUnknown` The issuing authority publishes no reachable revocation list, common with a company CA. For public installations, use a certificate with normal revocation checking. Disabling certificate verification globally is not a solution. ### Incorrect PFX Password or Missing Key Use `Get-PfxCertificate` (section 5.6) to check that `HasPrivateKey` to `True` is shown and the password is correct. The file must contain exactly one certificate with a private key. ### The License Belongs to Another Installation Select `server-instance-id.txt` was replaced or deleted. Restore the original file from backup or request a new license for the current ID. Never edit the signed license file manually. ### Every Client Reports “Trial Period Expired” The 30 days have ended. The service keeps running but accepts no connections until a license is installed (section 11). `--license-status` shows `trial-expired` and the end date in this case. ### The Server Remains in Trial Mode Despite an Installed License The license file was not found or accepted. The startup banner shows both the expected path and the reason. Typical causes are an incorrect `LicensePath` in `appsettings.json`, a license for another installation ID or a manually edited and therefore invalid file. ### The Service Runs, but No Clients Connect Work Through the Connection Path from Outside In: 1. Does the client's name resolution return the correct address? (`Resolve-DnsName`) 2. Is router port access enabled, including IPv6 with DS-Lite? 3. Is the server listening on both ports? (`Get-NetTCPConnection`) 4. Do the firewall rules exist? 5. What do the logs in `C:\ProgramData\FsRdpServer\Logs`? ### It Worked before, but Not Today Two common causes: the certificate expired or your connection's public address changed and the DNS record is outdated. First check the certificate's `NotAfter` , then whether the DNS record still matches the current address. --- ## Further Reading - [More on PFX Certificates: Obtaining, Installing and Renewing](https://www.fssoft.de/FsRdp/en/HowToPFX.aspx) - [The Same Guide for Linux Servers](https://www.fssoft.de/FsRdp/en/InstallingServerLinux.aspx) - [Install the Client](https://www.fssoft.de/FsRdp/en/InstallingClient.aspx) - [License Terms](https://www.fssoft.de/FsRdp/en/Lizenz.aspx) **Stuck at a Particular Step?** Get in touch; we are happy to agree on the server name, certificate and license together. Robert Fischbacher [Contact Me Directly](https://www.fssoft.de/en/Impressum.aspx)