Install the server

From installer to first technician code in about five minutes, plus optional PXE download time.

Install

Download the ImageForge server installer from the Downloads page and run it. The installer does the whole job: installs the Forge as a Windows service (auto-start, elevated), prompts for a server name and an optional license key, and opens local-subnet API/discovery firewall rules on trusted Domain/Private network profiles. Direct capture is an explicit opt-in that creates a local-subnet-only TCP 445 rule; the installer never enables Windows' broad File and Printer Sharing firewall group. When it finishes, the web console is at https://localhost:8967. It also adds a Start Menu group with shortcuts for the console, password recovery, and uninstalling ImageForge, plus an optional desktop shortcut and system tray icon that shows whether the Forge service is running and gives one-click access to the console. The console shortcuts open your browser; the recovery shortcut runs the local reset tool.

The installer includes one optional choice: Enable network boot (PXE). Selecting it downloads and verifies the version-matched x64/ARM64 bundle, opens the PXE firewall ports, and prepares the active deployment interface.

If you plan to apply Windows updates or remove bloatware from stored images, and those images are Windows 11 24H2 or newer, the Forge machine also needs servicing tools that new — install the matching Windows ADK Deployment Tools on it, or run the Forge on a host of that Windows release or newer. Plain capture and deploy don't need this; only in-place image servicing does.

Choose how technicians boot PCs

First run, in order

1. Set the admin password locally — open https://localhost:8967 on the Forge computer and create a password of at least 12 characters. Initial setup and post-reset ownership cannot be claimed from another LAN machine.
2. Start the trial or install a license key — in the license view, start the self-service 14-day Pro trial or paste a purchased key. Capture/deploy APIs stay locked until the Forge is active.
3. Pick the image store — the storage view shows where images live and how much space is free. Windows images are 15–80 GB each: point the store at a disk with room (local disk or NAS/UNC path). See Storage & backup.
4. Create technician access codes — in the access view. Each code is shown once, expires after the selected lifetime, uses one licensed seat while active, and labels everything that technician does in the audit trail. Leave sensitive profile access blocked unless that technician must deploy a profile holding a local-admin/domain-join password or first-boot script; issue the shortest practical code when enabled.
5. Review the server identity — its TLS fingerprint remains visible in access → server identity for audit and optional site-specific media. Routine USB, ISO, and PXE boots authenticate it automatically with the technician code; users do not copy or enter the fingerprint.
6. Prepare the boot path — create the standard USB, or confirm the optional network boot page says boot files ready and listening.

Forgotten admin password

A forgotten console password can be reset only by a Windows administrator at the Forge computer. This local recovery path avoids an email backdoor or an unauthenticated reset link on the imaging network.

1. Sign in to Windows on the Forge computer.
2. Open Start → ImageForge → Reset ImageForge Admin Password.
3. Approve the Windows administrator prompt and type RESET.
4. On the Forge computer, open https://localhost:8967 and create a new admin password.

The recovery tool safely stops and restarts the ImageForge service. It clears only the web console admin password; the image library, settings, license, history, backups, and technician access codes remain in place.

For a manual or custom-path installation, open an elevated PowerShell window in the ImageForge program folder and run:

.\imageforge-server.exe reset-admin -data .\data -restart-service -confirm

Licensing

Purchased ImageForge licenses are offline: a signed key the Forge verifies locally, and activation succeeds or fails on that local check alone — by design, so air-gapped imaging networks work with no activation server required. When the Forge does have internet access it also sends a best-effort activation report to help catch obvious license sharing (see "Activation reporting" below); this is optional telemetry, never a requirement for activation to work. The licensee's name is embedded in the key and displayed on the console, on every technician's boot client, and in the audit trail.

14-day self-service trial

An administrator can start one 14-day Pro trial from the console's license view. It includes every feature and one technician seat. The clock starts only when start free trial is clicked. That one request sends the entered name and email plus the Forge's hashed install ID to the ImageForge licensing service, which returns a signed key locked to this Forge. Internet is required to issue the key; the Forge then checks a vendor-signed trial status automatically. Capture and deploy can continue on a closed imaging network for up to 72 hours between successful validations.

One trial is available per Forge install. When it expires, protected capture and deploy operations lock, but images and settings remain in place. Purchase and paste a perpetual key to continue. Set IMAGEFORGE_TRIAL_URL=off to remove the self-service option on a managed or air-gapped installation; a manually issued evaluation key can still be pasted like any other key.

The Forge validates an installed trial at startup, every six hours while connected, and every 15 minutes after a failed attempt. If 72 hours pass without a successful check, capture and deploy lock until the administrator reconnects and clicks validate trial now in the license view. Only the trial key's one-way hash and the hashed install ID are sent. Set IMAGEFORGE_TRIAL_STATUS_URL=off only when self-service trials are not used; disabling validation does not grant an offline trial.

Keys come in two forms:

Your install ID

The console's license view shows this machine's install ID (IFGN-XXXX-XXXX-XXXX-XXXX).

Send the install ID with your order and your key arrives bound to that machine. The ID derives from the machine's firmware identity, so it survives OS reinstalls — rebuilding Windows on the same server keeps your license working. It reveals nothing about your hardware (it's a one-way hash).

Replacing the server hardware changes the install ID: contact support with the old and new IDs for a re-issue.

Self-service purchases require this install ID before Stripe checkout begins. Install the Forge first, copy the ID from Console → License, and keep it with your purchase record. Keys sold through self-service are node-locked; unbound keys are only issued for a separately arranged site agreement.

Revocation checks

When the Forge has internet access, it checks a vendor-published revocation list once a day (a signed static file — the Forge sends nothing about you or your machines). A key is only ever revoked for cause: a refunded or charged-back purchase, or a leaked key. The check is fail-open: if the list can't be reached — air-gapped network, outage, firewall — your license keeps working exactly as before. Air-gapped Forges are unaffected by this mechanism entirely.

Activation reporting

When the Forge has internet access, it reports your license key's hash and this machine's install ID to https://image-forge.net/api/activation — once when a key activates, and once a day after that. This lets the vendor notice the same key active on more than one distinct machine and follow up; it's how obvious license sharing gets caught. The raw key is never sent, and this never gates activation itself: activation always happens from the local check first, and reporting failure changes nothing. Like the revocation check, it's fail-open — an air-gapped Forge simply never reports. Set IMAGEFORGE_ACTIVATION_URL=off in the Forge's environment to disable it entirely, or point it at a different URL (e.g. a self-hosted mirror) by setting IMAGEFORGE_ACTIVATION_URL to that URL instead.

Updates

When the Forge has internet access it checks once a day whether a newer ImageForge release has been published by default. The dashboard's ImageForge server software panel lets an administrator keep daily checks, switch to manual-only checks, or click check now; it records both the latest attempt and latest successful check. The check is fail-open, so an unavailable release service never affects imaging. Nothing downloads or installs itself — follow the signed-download link and run the installer on the Forge machine; settings, license, backups, and your image library survive upgrades.

Network requirements

The installer configures the standard Windows firewall rules. Use this table for firewall reviews or locked-down networks where a network administrator wants to pre-approve access:

The installer scopes TCP 8967/UDP 8968 and optional TCP 445 to the local subnet on Domain/Private Windows Firewall profiles. If technicians reside on a routed deployment VLAN, add only that VLAN's CIDR to the named ImageForge TCP 8967 rule (and TCP 445 only when routed direct capture is intentionally required). Do not broaden the rules to Any or enable them on a Public profile merely to make a first test pass.

Direct capture additionally relies on the Windows Server service (LanmanServer) running — the installer sets it to start automatically. If direct capture is blocked by policy, ask the Windows administrator to allow File and Printer Sharing for the Forge server on the imaging network.

Browser certificate warning

The Forge serves HTTPS with a self-signed certificate, so your browser shows an "untrusted" warning once — expected for on-prem tools with no public CA. Boot clients don't rely on the browser trust model at all: they authenticate the certificate with the technician access code and then pin its SHA-256 fingerprint before sending credentials. An optional site-specific media pin remains available for fixed-Forge environments.