One installer, one restart — and it runs before anyone signs in.
Running it in a container instead? See the Docker install guide. On a cPanel or Linux server, see the server install guide.
You will need three things:
You do not need Node.js. The installer carries its own copy and installs it only if the machine has none, or has one too old to run the database engine.
“Windows protected your PC” — unknown publisher.
Expected — the installer is not yet code-signed (it’s on the list). Click More info, then Run anyway, then accept the normal administrator prompt.
If you would rather verify before running it, that is what the checksum is for. Compare
the SHA-256 of your download against
the SHA256SUMS.txt published beside the installer on the
download page:
If it matches, the file is exactly the one we published.
Right-click gwsbackup-windows-0.9701-setup.exe and choose
Run as administrator. Accept the publisher warning as above.
It asks for one thing: the address the console will be reached on. The default,
http://127.0.0.1:3000, is right unless you know otherwise; if port 3000 is
taken, the installer picks a free one for you. Leave the optional Cloudflare Tunnel
page blank.
When it finishes, a message tells you where the .env file is — normally
C:\Program Files\GWSBackup\.env.
Back that file up now, somewhere that is not this PC.
It holds ENCRYPTION_KEY, which decrypts every stored client credential.
If you lose it, they cannot be recovered — by us or by anyone. And don’t
keep the only copy on this PC: the database it protects is on the same disk.
Setup then offers to restart Windows. Yes restarts after ten seconds; No closes setup without restarting, so you can do it in your own time.
The restart is required — the console is started by Windows at boot, so it will not run until the machine has restarted once. The first start after installing is slow; later starts are quick.
The console starts on its own during boot. It is not instant — allow a minute or so after you sign in before it answers, longer on an older machine.
Look for the GWS Backup icon next to the clock. You may need to click the small arrow to show hidden icons; Windows will let you drag it out to keep it visible. The icon tells you whether the console is running, and double-clicking it opens the console in your browser.
You can also open it from the Start Menu, or go straight to
http://127.0.0.1:3000.
If one address is refused, try the other. There are two ways to say “this machine”, and on any given PC one of them may not answer:
http://localhost:3000 or http://127.0.0.1:3000
On any given PC one of them may not answer — try both. The tray icon and the Start Menu shortcuts always open whichever one works.
If 3000 was already taken, this install is on a different port. The
tray icon, the Start Menu shortcuts and the firewall rule all follow it
automatically. To see which port it chose, check the PORT line in
.env.
Create your administrator account, save the recovery key it shows you — there is no email channel to reset a password through — and paste in your licence key.
The application is a background service with no window of its own, so the icon by the clock is how you see and control it. Right-click for the menu:
GWS Backup runs as a Windows scheduled task named GWS Backup, under the
SYSTEM account. It starts during boot before anyone signs in, and keeps
running after you sign out.
You can see it in Task Scheduler (taskschd.msc), in the top-level Task
Scheduler Library.
SYSTEM has no credentials on your network.
Google Drive, S3 and Azure destinations are unaffected. But a Local Folder destination pointing at a NAS or a shared folder will fail under SYSTEM. This PC’s own disks are fine.
To fix it: open Task Scheduler, find the GWS Backup task,
Properties → General → Change User or Group, enter an
account that can reach the share, leave Run whether user is logged on or not
selected, and supply that account’s password when asked. Use a UNC path
(\\server\share\folder) rather than a mapped drive letter either way
— drive letters belong to an interactive session and will not exist for a task,
whoever it runs as.
Not in the installation folder:
An update never touches this folder, and an uninstall leaves it behind. Your backups are not here at all — they go to the destination you configure.
The installer adds a firewall rule for you, named GWS Backup console: inbound
on the console’s port, on the private network profile only. It uses
whichever port this install actually ended up on, and it is removed when you
uninstall.
From another machine on the same network, use the PC’s name or address:
http://your-pc-name:3000 — or whichever port this install uses, if 3000
was taken when it was set up.
Do not port-forward 3000 from your router. It is an administration console for a backup product, served over plain HTTP with no encryption of its own. If you need to reach it from outside the network, put it behind something that terminates TLS and checks who is asking.
Run the newer installer over the top. It stops the running copy before replacing any file,
keeps your .env and its encryption key, and leaves everything in
C:\ProgramData\GWSBackup alone. Clients, schedules and history all survive.
It will ask to restart again, for the same reasons as the first time.
Removed: the application, the Start Menu entries, the tray icon and its start-up shortcut, the scheduled task, and the firewall rule.
Kept deliberately: everything in C:\ProgramData\GWSBackup,
and the .env file in the installation folder.
Those two are a pair — the .env holds the only key that can read
those databases. Finished with the product? Delete both together. Reinstalling? Leave
both alone.
Try the other address — http://localhost:3000 and
http://127.0.0.1:3000 are not interchangeable on every machine. See the note
in step 4.
Expected once, on a slower machine. Wait rather than reinstalling.
Check the task exists and what it is doing:
Ready means registered but not currently running; Running means it is up.
If the task is missing, run the installer again. If it is there but the console never
answers, the log says why — every start and every exit code is recorded in
C:\ProgramData\GWSBackup\logs\gws-backup.log, reachable from the tray icon
under View log.
Something else on the PC has taken the console’s port since it was installed. Find what has it:
The last column is the process id — look it up on the Details tab of Task Manager.
The service runs as SYSTEM, which has no credentials on your network. See How it runs above.
NEXTAUTH_URL in .env must be the address your browser actually
uses. If you reach the console on anything other than 127.0.0.1, set it to
that and restart the service from the tray icon.
Support is free. Email support@gwsbackup.com and a person reads it.
We can help with anything the product itself does. We cannot log into your machine, and
we cannot recover a lost ENCRYPTION_KEY — we have never had a copy of
it.