One installer, one restart — and it runs before anyone signs in.
Running it in a container instead? See the Docker install guide. On a cPanel or Linux server, see the server install guide.
You will need three things:
You do not need Node.js. The installer carries its own copy and installs it only if the machine has none, or has one too old to run the database engine.
“Windows protected your PC” — unknown publisher.
Expected — the installer is not yet code-signed (it’s on the list). Click More info, then Run anyway, then accept the normal administrator prompt.
If you would rather verify before running it, that is what the checksum is for. Compare
the SHA-256 of your download against
the SHA256SUMS.txt published beside the installer on the
download page:
If it matches, the file is exactly the one we published.
Right-click gwsbackup-windows-1.00-setup.exe and choose
Run as administrator. Accept the publisher warning as above.
It asks for one thing: the address the console will be reached on. The default,
http://127.0.0.1:3000, is right unless you know otherwise; if port 3000 is
taken, the installer picks a free one for you. Leave the optional Cloudflare Tunnel
page blank.
When it finishes, a message tells you where the .env file is — normally
C:\Program Files\GWSBackup\.env.
Back that file up now, somewhere that is not this PC.
It holds ENCRYPTION_KEY, which decrypts your encrypted backups and every
stored client credential. If you lose it, they cannot be recovered — by us or by anyone. And don’t
keep the only copy on this PC: the database it protects is on the same disk.
Setup then offers to restart Windows. Yes restarts after ten seconds; No closes setup without restarting, so you can do it in your own time.
The console is already starting when setup closes, but the first start after installing is slow. Restarting gets that over with while you are away, and the icon by the clock appears when you next sign in. Later starts are quick.
The console starts on its own during boot. It is not instant — allow a minute or so after you sign in before it answers, longer on an older machine.
Look for the GWS Backup icon next to the clock. You may need to click the small arrow to show hidden icons; Windows will let you drag it out to keep it visible. The icon tells you whether the console is running, and double-clicking it opens the console in your browser.
You can also open it from the Start Menu, or go straight to
http://127.0.0.1:3000.
Use http://127.0.0.1:3000. On some PCs
http://localhost:3000 is refused, because Windows sends
“localhost” to the IPv6 address first. The tray icon and the Start Menu
shortcuts always open the address that answers.
If 3000 was already taken, this install is on a different port. The
tray icon, the Start Menu shortcuts and the firewall rule all follow it
automatically. To see which port it chose, check the PORT line in
.env.
Setup goes in order: your Admin account; the keys (save the recovery key it shows you, and keep the copy of the encryption key it offers); your licence key; the licence agreement. Then, if you like, where backups go and your first client. Overview keeps a checklist of anything you skip.
The console never sends email, so the recovery key is the only way back into this Admin account if the password is lost. It also unlocks the account after too many wrong passwords. Anyone else is unlocked, or given a new password, by an Admin under Settings → Users & security.
The application is a background service with no window of its own, so the icon by the clock is how you see and control it. Right-click for the menu:
GWS Backup runs as a Windows scheduled task named GWS Backup, under the
SYSTEM account. It starts during boot before anyone signs in, and keeps
running after you sign out.
You can see it in Task Scheduler (taskschd.msc), in the top-level Task
Scheduler Library.
SYSTEM has no credentials on your network.
Google Drive, S3 and Azure destinations are unaffected. But a Local Folder destination pointing at a NAS or a shared folder will fail under SYSTEM. This PC’s own disks are fine.
To fix it: open Task Scheduler, find the GWS Backup task,
Properties → General → Change User or Group, enter an
account that can reach the share, leave Run whether user is logged on or not
selected, and supply that account’s password when asked. Use a UNC path
(\\server\share\folder) rather than a mapped drive letter either way
— drive letters belong to an interactive session and will not exist for a task,
whoever it runs as.
Choose an account that is an administrator on this PC, because an update installed from the console runs setup as that account. And do this again after every update: installing one, from the console or by hand, sets the task back to SYSTEM.
Not in the installation folder:
An update keeps everything in this folder, and adds a copy of the databases before it changes anything. An uninstall leaves it behind. Your backups are not here at all — they go to the destination you configure.
Sign in on this PC, at http://127.0.0.1:3000. From another machine the
console opens, but signing in does not work over plain http://: browsers
keep the sign-in cookie only on https:// or on the PC’s own address,
so the sign-in page says so and will not sign you in.
To use it from another machine, put something in front of it that serves it over
https:// and checks who is asking, and set NEXTAUTH_URL in
.env to that address. Or use remote desktop to this PC.
The installer adds a firewall rule named GWS Backup console: inbound on the
console’s port, on the private network profile only. It is removed
when you uninstall.
Do not port-forward 3000 from your router. It is an administration console for a backup product, served over plain HTTP with no encryption of its own. If you need to reach it from outside the network, put it behind something that terminates TLS and checks who is asking.
Once you are on 1.00, the console tells you when a newer version is out, under
Settings → System → Updates. An Admin clicks
Install update: the console checks that nothing is running, copies the
databases into C:\ProgramData\GWSBackup\db_backups, runs the new setup in
the background and starts again on its own. Windows does not restart.
Or run the newer installer over the top yourself. It stops the running copy before
replacing any file, keeps your .env and its encryption key, and keeps
everything in C:\ProgramData\GWSBackup. Clients, schedules and history all
survive. It asks to restart again, for the same reasons as the first time.
Removed: the application, the Start Menu entries, the tray icon and its start-up shortcut, the scheduled task, and the firewall rule.
Kept deliberately: everything in C:\ProgramData\GWSBackup,
and the .env file in the installation folder.
Those two are a pair — the .env holds the only key that can read
those databases. Finished with the product? Delete both together. Reinstalling? Leave
both alone.
Try the other address — http://localhost:3000 and
http://127.0.0.1:3000 are not interchangeable on every machine. See the note
in step 4.
Expected once, on a slower machine. Wait rather than reinstalling.
Check the task exists and what it is doing:
Ready means registered but not currently running; Running means it is up.
If the task is missing, run the installer again. If it is there but the console never
answers, the log says why — every start and every exit code is recorded in
C:\ProgramData\GWSBackup\logs\gws-backup.log, reachable from the tray icon
under View log.
Something else on the PC has taken the console’s port since it was installed. Find what has it:
The last column is the process id — look it up on the Details tab of Task Manager.
The service runs as SYSTEM, which has no credentials on your network. See How it runs above.
The OAuth app you made in Google Cloud must list the redirect address shown on
Settings → Destination. It is built from the address in your
browser, so if you open the console on another address, add that one too. Keep
NEXTAUTH_URL in .env the same as the address you use, and
restart the service from the tray icon after changing it.
Each account gets five free tries. After that it waits a minute before each try up to the 10th, five minutes up to the 15th and fifteen minutes up to the 20th. The 20th wrong password or two-step code in a row locks the account.
The Admin made at setup gets back in with the recovery key: Forgotten your password? on the sign-in page. It sets a new password, unlocks the account, makes it an Admin again and turns off two-step sign-in. Anyone else is unlocked, or given a new password, by an Admin under Settings → Users & security. The console never sends email, so there is no reset link.
Support is free. Email support@gwsbackup.com and a person reads it.
We can help with anything the product itself does. We cannot log into your machine, and
we cannot recover a lost ENCRYPTION_KEY — we have never had a copy of
it.