Installation & Setup

Install ServerEngine

1. 1

   Get it from the Microsoft Store

   ServerEngine ships as a sandboxed MSIX package. Install it from the Microsoft Store. It runs on Windows 10 and 11.
2. 2

   Run as Administrator

   For full functionality — installing the automation service, configuring WinRM, and registering scheduled tasks — start ServerEngine as Administrator. Basic remote management works without elevation.
3. 3

   Follow the welcome tutorial

   On first launch, the built-in tutorial walks you through WinRM setup, connecting a remote desktop, syncing hosts, running scripts, the AI Coder, runbooks, scheduling, and software deployment. You can reopen it anytime from Settings.

Enabling the automation service

Scheduled and API-triggered jobs run through a background Windows service so they execute even when no one is signed in. When you enable automation, ServerEngine installs and starts this service for you (this is why elevation is required). Once running, it shows up as an automatic service and hosts the local REST API.

Manual install & control

The app manages the service for you, but you can also drive it directly — useful for unattended deployment, a custom service account, or troubleshooting. The service binary is ServerEngineService.exe and registers as the service ServerEngine (display name ServerEngine Automation Engine), running as LocalSystem with automatic start. Run these from an elevated prompt:

cd "C:\ProgramData\ServerEngine"

# Install and start (LocalSystem by default)
.\ServerEngineService.exe --install
.\ServerEngineService.exe --start

# Install under a specific service account instead
.\ServerEngineService.exe --install --account DOMAIN\svc-serverengine --password "••••••••"

# Stop / start / check state
.\ServerEngineService.exe --stop
.\ServerEngineService.exe --status

# Remove the service
.\ServerEngineService.exe --uninstall

# Run in the foreground for debugging (Ctrl+C to quit)
.\ServerEngineService.exe --console

Configure WinRM on your targets

ServerEngine connects to remote machines over WinRM. On first run it checks whether WinRM is running locally and offers one-click setup.

One-click local setup

If WinRM isn't configured, ServerEngine prompts you with Install WinRM Service. This enables WinRM, sets TrustedHosts to allow connections, and opens the firewall — the equivalent of running:

winrm quickconfig -quiet
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
Enable-PSRemoting -Force

WinRM over SSL (recommended)

For encrypted transport, ServerEngine can provision WinRM over HTTPS on your hosts in one click. Open the Admin Console tab and use the Install WinRM SSL action in its toolbar: select one or more machines, provide admin credentials, and ServerEngine configures an HTTPS listener with a self-signed certificate and opens port 5986. See Admin Console for more.

The WinRM SSL configuration scripts

The one-click action runs a bundled PowerShell script on the target. Both scripts ship with ServerEngine and live at C:\ProgramData\ServerEngine\Scripts\_Scripts_ServerEngine\ — run them by hand (as Administrator) or adapt them for your own GPO/rollout. Each one enables PS Remoting, starts WinRM, binds an HTTPS listener to a certificate, and opens port 5986.

The self-signed script needs no edits — run it and it provisions everything:

# Run as Administrator on the target
Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private
Enable-PSRemoting -Force

# Ensure WinRM runs and start on boot
Start-Service WinRM
Set-Service WinRM -StartupType Automatic
winrm quickconfig -transport:https -force

# Create a self-signed cert for this host (reused until ~30 days before expiry)
$hostname = [System.Net.Dns]::GetHostByName($env:COMPUTERNAME).HostName
$cert = New-SelfSignedCertificate -DnsName $hostname `
        -CertStoreLocation "Cert:\LocalMachine\My" -KeySpec KeyExchange

# Bind the HTTPS listener and open the firewall
winrm delete winrm/config/Listener?Address=*+Transport=HTTPS
New-Item -Path "WSMan:\localhost\Listener" -Transport HTTPS -Address * `
         -CertificateThumbprint $cert.Thumbprint -Force
New-NetFirewallRule -Name "WINRM-HTTPS-In-TCP" `
        -DisplayName "Windows Remote Management (HTTPS-In)" `
        -Enabled True -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

The domain variant is the same flow, but instead of generating a certificate it loads an existing one from the certificate store — set the wildcard/subject to match yours:

# Point this at your issued domain/wildcard certificate
$hostname = "*.yourcompany.com"   # REPLACE with your certificate subject

$cert = Get-ChildItem "Cert:\LocalMachine\My" | Where-Object {
    $_.Subject -like "CN=$hostname*" -and $_.HasPrivateKey
} | Sort-Object NotBefore -Descending | Select-Object -First 1

if (-not $cert) { Write-Error "No matching certificate found for $hostname" }

# ...then the same listener + firewall steps as the self-signed script

Requirements checklist

• Windows 10/11 for the ServerEngine console.
• WinRM enabled on each target (one-click, or your own GPO/script).
• Administrator rights to install the service and register schedules.
• Network reachability to your targets on 5985/5986 (WinRM), plus 3389/22/5901 for remote sessions.

Next: run your first remote script →