Windows Server Installation¶

Section: Installation | Article 04
Audience: IT Administrators
Last Updated: 2026-04-07

Overview¶

This article walks you through installing RP-PAM on a Windows Server using the MSI installer package. After completing this guide, the RP-PAM service will be running and responding to health checks on your server.

Prerequisites¶

Before you begin, confirm the following:

Requirement	Details
Operating System	Windows Server 2019 or later (Desktop Experience or Server Core)
CPU	4 cores minimum (6 recommended)
RAM	12 GB minimum (16 GB recommended)
Disk	60 GB SSD minimum on the system drive
.NET Runtime	.NET 10 Runtime — the installer will prompt if missing
Account	Local administrator or domain account with local admin rights
Network	Outbound HTTPS (443) to `downloads.ravenphyre.net` for the download

See System Requirements and Network Requirements for full details.

Step 1 — Download the Installer¶

Download the latest MSI package from the Ravenphyre download portal.

Using a browser:

Navigate to https://downloads.ravenphyre.net/rppam/latest/windows and sign in with the credentials provided in your welcome email. Download the file named rppam-<version>-win-x64.msi.

Using PowerShell:

# Create a download directory
New-Item -ItemType Directory -Path "C:\Temp\rppam" -Force

# Download the installer (replace <version> with the actual version number)
Invoke-WebRequest `
    -Uri "https://downloads.ravenphyre.net/rppam/latest/rppam-1.0.0-win-x64.msi" `
    -OutFile "C:\Temp\rppam\rppam-1.0.0-win-x64.msi"

Tip: Your download portal URL and credentials are included in the welcome email sent when your Ravenphyre license was provisioned. If you cannot locate this email, contact support@ravenphyre.net.

Step 2 — Verify the Download (Optional but Recommended)¶

Each MSI is accompanied by a SHA-256 checksum file. Verify the download has not been tampered with.

PowerShell:

# Download the checksum file
Invoke-WebRequest `
    -Uri "https://downloads.ravenphyre.net/rppam/latest/rppam-1.0.0-win-x64.msi.sha256" `
    -OutFile "C:\Temp\rppam\rppam-1.0.0-win-x64.msi.sha256"

# Compare checksums
$expected = (Get-Content "C:\Temp\rppam\rppam-1.0.0-win-x64.msi.sha256").Split(" ")[0]
$actual   = (Get-FileHash "C:\Temp\rppam\rppam-1.0.0-win-x64.msi" -Algorithm SHA256).Hash

if ($expected -eq $actual) {
    Write-Host "Checksum OK" -ForegroundColor Green
} else {
    Write-Host "CHECKSUM MISMATCH — do not install this file" -ForegroundColor Red
}

Step 3 — Run the Installer¶

GUI Installation¶

Double-click rppam-1.0.0-win-x64.msi.
Accept the license agreement.
Choose the installation path (default: C:\Program Files\Ravenphyre\RP-PAM\).
Click Install. If prompted by UAC, click Yes.
When installation completes, click Finish.

Silent Installation (PowerShell)¶

For automated or headless installations, run the MSI silently from an elevated PowerShell prompt:

# Default installation path
msiexec /i "C:\Temp\rppam\rppam-1.0.0-win-x64.msi" /qn /l*v "C:\Temp\rppam\install.log"

# Custom installation path
msiexec /i "C:\Temp\rppam\rppam-1.0.0-win-x64.msi" /qn `
    INSTALLDIR="D:\Ravenphyre\RP-PAM" `
    /l*v "C:\Temp\rppam\install.log"

Note: The /qn flag runs the installer with no user interface. The /l*v flag writes a detailed log file for troubleshooting.

Step 4 — Default Installation Paths¶

After installation, the following directory structure is created:

Path	Contents
`C:\Program Files\Ravenphyre\RP-PAM\`	Application binaries, libraries, and runtime
`C:\Program Files\Ravenphyre\RP-PAM\modules\`	Installed module packages (`.rppkg` files)
`C:\ProgramData\Ravenphyre\RP-PAM\config\`	Configuration files (`rppam.config`, certificates)
`C:\ProgramData\Ravenphyre\RP-PAM\data\`	Local database files (if using embedded mode)
`C:\ProgramData\Ravenphyre\RP-PAM\logs\`	Application and audit log files
`C:\ProgramData\Ravenphyre\RP-PAM\keys\`	Encrypted key material (KEK, DEK wrappers)

Important: Do not move or rename these directories after installation. If you need a non-default location, specify it during installation using INSTALLDIR.

Step 5 — Verify the Service is Running¶

The installer registers RP-PAM as a Windows service named RavenphyreRpPam.

Using services.msc (GUI)¶

Press Win + R, type services.msc, and press Enter.
Scroll to Ravenphyre RP-PAM.
Verify the Status column shows Running.
Verify the Startup Type column shows Automatic.

Using PowerShell¶

Get-Service -Name "RavenphyreRpPam" | Format-Table Name, Status, StartType

Expected output:

Name               Status StartType
----               ------ ---------
RavenphyreRpPam   Running Automatic

Step 6 — Verify the Health Endpoint¶

RP-PAM exposes a health endpoint on the REST API port. By default, this is port 7101.

PowerShell:

Invoke-RestMethod -Uri "https://localhost:7101/health" -SkipCertificateCheck

Expected response:

{
    "status": "healthy",
    "version": "1.0.0",
    "uptime": "00:01:23"
}

Note: The -SkipCertificateCheck flag is used because RP-PAM ships with a self-signed certificate before you configure your own. In production, replace the self-signed certificate with a trusted one.

Bash (Git Bash or WSL):

curl -sk https://localhost:7101/health | python -m json.tool

Service Management¶

Use these commands to start, stop, and restart the RP-PAM service.

PowerShell¶

# Stop the service
Stop-Service -Name "RavenphyreRpPam"

# Start the service
Start-Service -Name "RavenphyreRpPam"

# Restart the service
Restart-Service -Name "RavenphyreRpPam"

# Check current status
Get-Service -Name "RavenphyreRpPam"

services.msc (GUI)¶

Open services.msc.
Right-click Ravenphyre RP-PAM.
Select Start, Stop, or Restart.

Setting Startup Type¶

# Set to start automatically on boot (default)
Set-Service -Name "RavenphyreRpPam" -StartupType Automatic

# Set to manual start
Set-Service -Name "RavenphyreRpPam" -StartupType Manual

# Disable the service
Set-Service -Name "RavenphyreRpPam" -StartupType Disabled

Viewing Logs¶

Application logs are written to C:\ProgramData\Ravenphyre\RP-PAM\logs\.

PowerShell — view recent log entries:

Get-Content "C:\ProgramData\Ravenphyre\RP-PAM\logs\rppam.log" -Tail 50

PowerShell — follow the log in real time:

Get-Content "C:\ProgramData\Ravenphyre\RP-PAM\logs\rppam.log" -Tail 20 -Wait

Uninstalling¶

GUI¶

Open Settings > Apps > Installed apps (or Control Panel > Programs and Features on older servers).
Find Ravenphyre RP-PAM.
Click Uninstall and follow the prompts.

PowerShell (Silent)¶

msiexec /x "C:\Temp\rppam\rppam-1.0.0-win-x64.msi" /qn /l*v "C:\Temp\rppam\uninstall.log"

Note: Uninstalling removes application binaries but preserves configuration and data in C:\ProgramData\Ravenphyre\RP-PAM\. To fully remove all data, delete that directory manually after uninstallation.

Troubleshooting¶

Symptom	Cause	Resolution
MSI fails with error 1603	Missing .NET 10 Runtime	Install .NET 10 Runtime from `https://dotnet.microsoft.com/download` and retry
Service not found after install	Install did not complete	Check `C:\Temp\rppam\install.log` for errors; re-run the MSI
Service starts then stops immediately	Configuration error	Check `C:\ProgramData\Ravenphyre\RP-PAM\logs\rppam.log` for the startup error
Health endpoint returns connection refused	Service not running or port conflict	Verify the service is running; check that port 7101 is not in use by another application
Health endpoint returns certificate error	Self-signed certificate	Use `-SkipCertificateCheck` (PowerShell) or `-k` (curl) until you configure a trusted certificate
Access denied during install	Not running as administrator	Right-click PowerShell and select Run as Administrator, or right-click the MSI and select Run as administrator

Next Steps¶

Setup Wizard — Run the first-time setup wizard to configure your database, encryption keys, and admin account
MSSQL Database Setup — Prepare a MSSQL database before running the setup wizard
PostgreSQL Database Setup — Prepare a PostgreSQL database before running the setup wizard
Online License Activation — Activate your license after setup
LVS Relay Setup — Deploy an on-premises license validation proxy (recommended for environments without direct internet access or for resilience against upstream outages)