Install the server

From installer to first technician code in about five minutes, plus optional PXE download time.

Install

Download the ImageForge server installer from the Downloads page and run it. The installer does the whole job: installs the Forge as a Windows service (auto-start, elevated), prompts for a server name and an optional license key, opens the LAN firewall ports, and configures SMB file sharing so direct capture works out of the box. When it finishes, the web console is at https://localhost:8967. It also adds a Start Menu group (with an Uninstall ImageForge shortcut), an optional desktop shortcut, and an optional system tray icon that shows whether the Forge service is running and gives one-click access to the console — all three link to the console, not a second copy of the server itself.

The installer includes one optional choice: Enable network boot (PXE). Selecting it downloads and verifies the version-matched x64/ARM64 bundle, opens the PXE firewall ports, and prepares the active deployment interface.

If you plan to apply Windows updates or remove bloatware from stored images, and those images are Windows 11 24H2 or newer, the Forge machine also needs servicing tools that new — install the matching Windows ADK Deployment Tools on it, or run the Forge on a host of that Windows release or newer. Plain capture and deploy don't need this; only in-place image servicing does.

Choose how technicians boot PCs

First run, in order

1. Set the admin password — the console demands one on first visit. Management stays locked until it exists.
2. Install the license key — paste it in the license view. Capture/deploy APIs stay locked until the Forge is activated.
3. Pick the image store — the storage view shows where images live and how much space is free. Windows images are 15–80 GB each: point the store at a disk with room (local disk or NAS/UNC path). See Storage & backup.
4. Create technician access codes — in the access view. Each code is shown once, uses one licensed seat, and labels everything that technician does in the audit trail.
5. Record the TLS fingerprint — shown in access → server identity. Technicians compare it on the boot client; site-specific media can pin it in advance.
6. Prepare the boot path — create the standard USB, or confirm the optional network boot page says boot files ready and listening.

Licensing

ImageForge licenses are offline: a signed key the Forge verifies locally, and activation succeeds or fails on that local check alone — by design, so air-gapped imaging networks work with no activation server required. When the Forge does have internet access it also sends a best-effort activation report to help catch obvious license sharing (see "Activation reporting" below); this is optional telemetry, never a requirement for activation to work. The licensee's name is embedded in the key and displayed on the console, on every technician's boot client, and in the audit trail.

Keys come in two forms:

Your install ID

The console's license view shows this machine's install ID (IFGN-XXXX-XXXX-XXXX-XXXX).

Send the install ID with your order and your key arrives bound to that machine. The ID derives from the machine's firmware identity, so it survives OS reinstalls — rebuilding Windows on the same server keeps your license working. It reveals nothing about your hardware (it's a one-way hash).

Replacing the server hardware changes the install ID: contact support with the old and new IDs for a re-issue.

Revocation checks

When the Forge has internet access, it checks a vendor-published revocation list once a day (a signed static file — the Forge sends nothing about you or your machines). A key is only ever revoked for cause: a refunded or charged-back purchase, or a leaked key. The check is fail-open: if the list can't be reached — air-gapped network, outage, firewall — your license keeps working exactly as before. Air-gapped Forges are unaffected by this mechanism entirely.

Activation reporting

When the Forge has internet access, it reports your license key's hash and this machine's install ID to https://imageforge-billing.onrender.com/api/activation — once when a key activates, and once a day after that. This lets the vendor notice the same key active on more than one distinct machine and follow up; it's how obvious license sharing gets caught. The raw key is never sent, and this never gates activation itself: activation always happens from the local check first, and reporting failure changes nothing. Like the revocation check, it's fail-open — an air-gapped Forge simply never reports. Set IMAGEFORGE_ACTIVATION_URL=off in the Forge's environment to disable it entirely, or point it at a different URL (e.g. a self-hosted mirror) by setting IMAGEFORGE_ACTIVATION_URL to that URL instead.

Updates

When the Forge has internet access it checks once a day whether a newer ImageForge release has been published by default. The dashboard's ImageForge server software panel lets an administrator keep daily checks, switch to manual-only checks, or click check now; it records both the latest attempt and latest successful check. The check is fail-open, so an unavailable release service never affects imaging. Nothing downloads or installs itself — follow the signed-download link and run the installer on the Forge machine; settings, license, backups, and your image library survive upgrades.

Network requirements

The installer configures the standard Windows firewall rules. Use this table for firewall reviews or locked-down networks where a network administrator wants to pre-approve access:

Direct capture additionally relies on the Windows Server service (LanmanServer) running — the installer sets it to start automatically. If direct capture is blocked by policy, ask the Windows administrator to allow File and Printer Sharing for the Forge server on the imaging network.

Browser certificate warning

The Forge serves HTTPS with a self-signed certificate, so your browser shows an "untrusted" warning once — expected for on-prem tools with no public CA. Boot clients don't rely on the browser trust model at all: they pin the certificate's SHA-256 fingerprint.