One installer, one restart — and it runs before anyone signs in.
Running it in a container instead? See the Docker install guide. On a cPanel or Linux server, see the server install guide.
You will need three things:
You do not need Node.js. The installer carries its own copy and installs it only if the machine has none, or has one too old to run the database engine.
“Windows protected your PC” — unknown publisher.
Expected, and not a sign that anything is wrong. The installer is not yet code-signed: a certificate costs several hundred pounds a year and, while the product is free and in beta, that money is better spent elsewhere. It is on the list.
Click More info, then Run anyway. You will then get
the normal User Account Control prompt asking for administrator
rights, which the installer genuinely needs — it installs a runtime, writes to
ProgramData, and registers a startup task.
If you would rather verify before running it, that is what the checksum is for. Compare
the SHA-256 of your download against
the SHA256SUMS.txt published beside the installer on the
download page:
If it matches, the file is exactly the one we published and nothing has altered it in transit — which is the question a signature answers too.
Right-click gwsbackup-windows-0.9610-setup.exe and choose
Run as administrator. Accept the publisher warning as above.
It asks for one thing: the address the console will be reached on. The default,
http://127.0.0.1:3000, is right unless you already know otherwise — and
if port 3000 turns out to be taken on this machine, the installer picks a free one and
corrects this for you. There is
also an optional Cloudflare Tunnel page — leave it blank. That
feature is untested in this release and proper support is planned for a later version.
When it finishes, a message tells you where the .env file is — normally
C:\Program Files\GWSBackup\.env.
Back that file up now, somewhere that is not this PC.
It holds ENCRYPTION_KEY, which decrypts every stored client credential:
service accounts, Drive OAuth tokens, S3 and Azure secrets. It exists in exactly one
place. If you lose it, those credentials cannot be recovered by us or by anyone, and
every client connection has to be set up again from scratch.
Keeping it only on this machine is the same as not having it — the database it protects is on the same disk, so one failure takes both.
Setup then offers to restart Windows. Yes restarts after ten seconds; No closes setup without restarting, so you can do it in your own time.
The restart is not optional in the end — the console is started by Windows at boot, so it will not run until the machine has been restarted once. It is not superstition. GWS Backup is started by Windows at boot, so restarting is what proves that path works — and it gets the slow first start over with while you are away from the machine. That first start is slow because Windows has just had 120 MB of new files written to it and scans every one of them the first time it is read. Later starts are quick.
The console starts on its own during boot. It is not instant — allow a minute or so after you sign in before it answers, longer on an older machine.
Look for the GWS Backup icon next to the clock. You may need to click the small arrow to show hidden icons; Windows will let you drag it out to keep it visible. The icon tells you whether the console is running, and double-clicking it opens the console in your browser.
You can also open it from the Start Menu, or go straight to
http://127.0.0.1:3000.
If one address is refused, try the other. There are two ways to say “this machine”, and on any given PC one of them may not answer:
http://localhost:3000 or http://127.0.0.1:3000
Windows resolves the name localhost to the IPv6 address ::1
before it tries IPv4. Whether the console is reachable on one stack, the other, or
both depends on how Node bound its socket on that machine — and it is not
predictable; we have seen it fall each way. So try both before concluding anything
is wrong.
The tray icon and the Start Menu shortcuts test both and open whichever answers, so they are the reliable way in. Only a typed address or an old bookmark can pick the wrong one.
If 3000 was already taken, this install is on a different port. 3000 is the default for most development servers, so on a machine that has had web development on it a clash is common. The installer checks at setup time, skips the crowded 3001–3009 range, and picks a free port above it.
You do not have to track it. The tray icon, the Start Menu shortcuts and the firewall
rule all read the port from the installation’s own settings, so they follow it
automatically. If you want to know what it chose, open .env in the
installation folder and look at the PORT line.
Create your administrator account, save the recovery key it shows you — there is no email channel to reset a password through — and paste in your licence key.
The application is a background service with no window of its own, so the icon by the clock is how you see and control it. Right-click for the menu:
GWS Backup runs as a Windows scheduled task named GWS Backup, triggered at
startup, under the SYSTEM account. It starts during boot before anyone signs
in, and keeps running after you sign out. On a machine left in a cupboard that
is the entire point: a backup product that waits for someone to log in is one that
quietly stops the night Windows Update reboots the PC.
You can see it in Task Scheduler (taskschd.msc), in the top-level Task
Scheduler Library.
SYSTEM has no credentials on your network.
It reaches the internet perfectly well, so Google Drive, S3 and Azure destinations are unaffected. What it cannot do is authenticate to another machine on your own network — it presents the computer account, and mapped drive letters do not exist for it at all.
So a Local Folder destination pointing at a NAS or a shared folder will fail under SYSTEM, even though it worked when you ran the application by hand as yourself. Local Folder destinations on this PC’s own disks are unaffected.
To fix it: open Task Scheduler, find the GWS Backup task,
Properties → General → Change User or Group, enter an
account that can reach the share, leave Run whether user is logged on or not
selected, and supply that account’s password when asked. Use a UNC path
(\\server\share\folder) rather than a mapped drive letter either way
— drive letters belong to an interactive session and will not exist for a task,
whoever it runs as.
Not in the installation folder:
This is why an update does not touch your data, and why an uninstall leaves it behind. Your backups are not here at all — they go to whichever destination you configure in the console.
The installer adds a firewall rule for you, named GWS Backup console: inbound
on the console’s port, on the private network profile only. It uses
whichever port this install actually ended up on, and it is removed when you
uninstall.
You will never see Windows ask about this, and that is exactly why it is done for you: the application runs as SYSTEM in session 0, which cannot put a dialog on anybody’s desktop. The prompt cannot appear, so Windows would silently apply its default — block — while loopback carried on working and hid the problem until somebody tried to connect from elsewhere.
From another machine on the same network, use the PC’s name or address:
http://your-pc-name:3000 — or whichever port this install uses, if 3000
was taken when it was set up.
Do not port-forward 3000 from your router. It is an administration console for a backup product, served over plain HTTP with no encryption of its own. If you need to reach it from outside the network, put it behind something that terminates TLS and checks who is asking.
Run the newer installer over the top. It stops the running copy before replacing any file,
keeps your .env and its encryption key, and leaves everything in
C:\ProgramData\GWSBackup alone. Clients, schedules and history all survive.
It will ask to restart again, for the same reasons as the first time.
Removed: the application, the Start Menu entries, the tray icon and its start-up shortcut, the scheduled task, and the firewall rule.
Kept deliberately: everything in C:\ProgramData\GWSBackup,
and the .env file in the installation folder.
Those two are a pair. The .env holds the only key that can read those
databases, so keeping one without the other makes your stored credentials unrecoverable.
If you are genuinely finished with the product, delete both together. If you are
reinstalling, leave both alone — and if the .env has already gone while
the databases remain, the installer will refuse to continue rather than generate a new key
and destroy them.
Try the other address — http://localhost:3000 and
http://127.0.0.1:3000 are not interchangeable on every machine. See the note
in step 4. This is the most common cause by some distance, and the application is
almost certainly running fine.
Expected once, on a slower machine, for the reason given in step 3. Wait rather than reinstalling — restarting the service throws the warm-up away and begins again.
Check the task exists and what it is doing:
Ready means registered but not currently running; Running means it is up.
If the task is missing, run the installer again. If it is there but the console never
answers, the log says why — every start and every exit code is recorded in
C:\ProgramData\GWSBackup\logs\gws-backup.log, reachable from the tray icon
under View log.
Something else on the PC has taken the console’s port since it was installed — at install time a busy port is detected and a free one chosen instead, so this only happens when something else claims it afterwards. Find what has it:
The last column is the process id — look it up on the Details tab of Task Manager. The installer stops an older copy of GWS Backup automatically, but it will never touch a program that is not ours.
The service runs as SYSTEM, which has no credentials on your network. See How it runs above.
NEXTAUTH_URL in .env must be the address your browser actually
uses. If you reach the console on anything other than 127.0.0.1, set it to
that and restart the service from the tray icon.
Support is free, and stays free for as long as we can manage it. Email support@gwsbackup.com and a person reads it. Early adopters get particular attention.
We can help with the installer, the console, Google Workspace connections, backups,
restores and anything the product itself does. We cannot log into your machine, and we
cannot recover an ENCRYPTION_KEY that has been lost — not as a policy,
but because the key is the only thing that can decrypt those credentials and we have never
had a copy of it.