Windows Server, step by step¶

The example: Northwind, 60 people, domain corp.example. Files live on \\files01\Company. Dana runs IT and is a domain admin. Gate goes on a new Windows Server VM, GATE01, and people will open it at https://ai.corp.example.

What you end with: people on domain PCs open Gate and are already signed in as themselves. Their AI opens \\files01\Company with their own NTFS permissions, under your guardrails, all in one audit trail. Nobody manages a service password.

Time: about an hour of work. Step 1 may need a 10-hour wait, so check it the day before.

What you need¶


Server	Windows Server 2019, 2022 or 2025, joined to the domain. A small VM is enough: Gate does not run the AI model. Port 443 free.
You	Signed in to the server as a domain admin while setup runs (once).
DNS	A name for Gate (we use `ai.corp.example`) pointing at the server.
Certificate	An enterprise CA (AD Certificate Services) in the forest, or a `.pfx` for the name. Without either, Gate uses a self-signed certificate and browsers warn.
License	Your license file from app.acutisgo.com/gate → License.
Chat	Gate on Windows does not include a chat app. Use Open WebUI on any Docker host (step 9), or Claude Desktop, Cursor or VS Code.

Step 1. The day before: the gMSA root key¶

Gate runs as a group Managed Service Account (gMSA), so Active Directory rotates its password and nobody ever knows it. A forest needs one KDS root key before any gMSA can exist, and a new key takes up to 10 hours to become usable.

On a domain controller, in PowerShell:

Get-KdsRootKey

It lists a key: you are done with this step.
It lists nothing: create one, then wait 10 hours before step 4:
```
Add-KdsRootKey -EffectiveImmediately
```

Lab with a single domain controller and no patience?

In a test lab only, you can backdate the key so it works at once: Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10)). Do not do this in production: other DCs may not have the key yet.

Step 2. The DNS name¶

In DNS Manager on a domain controller: Forward Lookup Zones → corp.example → right-click → New Host (A or AAAA). Name ai, IP address of GATE01, Add Host.

Or in PowerShell

Add-DnsServerResourceRecordA -ZoneName corp.example -Name ai -IPv4Address 10.0.0.40

Check from any PC: nslookup ai.corp.example answers with the server's address.

Step 3. Download¶

On GATE01, download the signed installer: AcutisGate-Windows.msi. Put your license file somewhere handy, like C:\Downloads\acutis-gate.license.

Step 4. Install¶

Run AcutisGate-Windows.msi. It copies the setup files to C:\Program Files\Acutis Gate\Setup and adds a Start menu folder.
Because our DNS name (ai.corp.example) is not the server's own name (gate01.corp.example), run setup from an administrator PowerShell so we can pass the name and the license:
```
cd "C:\Program Files\Acutis Gate\Setup"
.\Install-AcutisGate.ps1 -DnsName ai.corp.example -LicenseFile C:\Downloads\acutis-gate.license
```
If people will use the server's own name, you can instead just open Start → Acutis Gate → Set up Acutis Gate.

Setup prints eight steps:

Step	What it does
1 Checking this server	Elevated, domain-joined, the DNS name points here, port 443 free
2 Python 3.12	Installs it if missing
3 Gate files	Copies Gate to `C:\Program Files\Acutis Gate`
4 Settings	Fresh secrets in `C:\ProgramData\AcutisGate`
5 Service account in Active Directory	Creates the gMSA `acutisgate$` (AES only), adds `HTTP/ai.corp.example` to it, and lets this server open your file servers as each person
6 TLS certificate	Asks your enterprise CA for a Web Server certificate for the name
7 Windows service	The Acutis Gate and Acutis Gate File Broker services, set to start automatically; firewall rule for 443
8 Browser sign-in (Group Policy)	Creates and links the Acutis Gate sign-in GPO so Edge and Chrome send people's Windows sign-in to Gate

It ends with Acutis Gate is installed and the address to open.

If setup stops¶

Message	Fix
`Run this in an elevated PowerShell`	Right-click PowerShell → Run as administrator.
`This server is not joined to an Active Directory domain`	Join it, reboot, run again.
`ai.corp.example is not in DNS yet` / `points at ... not at this server`	Fix the A record from step 2. Setup continues, but people cannot reach Gate by name until it is right.
`Port 443 is already used by ...`	Stop that program (often IIS: `Stop-Service W3SVC; Set-Service W3SVC -StartupType Disabled`), or add `-Port 8443`.
`This forest has no usable gMSA root key yet`	Step 1. Wait the 10 hours, then run setup again.
`This server cannot use the gMSA ... yet`	AD replication. Wait a minute, run again.
`HTTP/ai.corp.example already belongs to ...`	An old account holds the name. Remove it as the message shows (`setspn -D ...`), run again.
`You may not create accounts in AD`	You are not a domain admin. Setup prints the exact lines for a domain admin to run on a DC. Have them run those, then run setup again.
`Using a SELF-SIGNED certificate for now`	No enterprise CA was found. Browsers will warn and Windows sign-in will not be seamless. Get a certificate for `ai.corp.example` as a `.pfx` and run setup again with `-CertPfx C:\certs\ai.pfx`.

Running setup again is always safe: it keeps your data, secrets and certificate.

Step 5. The first admin¶

On any PC, open https://ai.corp.example/signup.
Fill in your name, email, a password and the company name. Press Create Account. You go straight to sign-in (an on-prem Gate has no email step).
Sign in. Scan the QR code with your authenticator app, type the code, Confirm & continue.

The first account is the only one made this way. Sign-up closes after it; everyone else comes from Active Directory or Identity → People.

Step 6. License¶

If you passed -LicenseFile, it is already loaded. Otherwise: License → Load a license, choose the file (or paste its text), Load. Gate checks the signature on this server; nothing is sent anywhere.

Step 7. Connect Active Directory¶

Open Identity → Active Directory. The domain and the service account (acutisgate$) are already filled in.
Who gets Gate: an AD group, for example AI-Users. Only its members (nested groups included) can use Gate, and they are your seats. Leave blank for every enabled user.
Gate admins: an AD group, for example AI-Admins, whose members get the Admin pages.
Keep Windows sign-in ticked. Leave Allow NTLM off unless you need it (NTLM).
Press Connect, then Sync now. The card shows how many people and groups came over.

People and groups now follow AD automatically (every 15 minutes, and at each sign-in).

Setup created the Acutis Gate sign-in Group Policy. PCs pick it up at their next policy refresh (up to about 90 minutes). To test now, on a domain PC as a normal user:

gpupdate /force
klist get HTTP/ai.corp.example

klist should show a ticket. Then close and reopen the browser, open https://ai.corp.example/gate, and you are in with no login page. Health check → Test this browser confirms it was Kerberos.

Full detail and fixes: Windows sign-in (Kerberos).

Step 9. The chat¶

Open WebUI is the usual company chat. Run it on any Docker host (a small Linux VM is fine), pointed at your model server.

In Gate: Connect an AI → Open WebUI → + Create the company connection. Copy the two lines and the key it shows (shown once).

On the Docker host:

docker run -d --name open-webui --restart always -p 3000:8080 \
  -v open-webui:/app/backend/data \
  -e OLLAMA_BASE_URL=http://your-model-server:11434 \
  -e ENABLE_FORWARD_USER_INFO_HEADERS=true \
  -e FORWARD_USER_INFO_HEADER_JWT_SECRET=<the secret Gate showed> \
  ghcr.io/open-webui/open-webui:main

Open http://<docker host>:3000, create the first account (it becomes Open WebUI's admin).
In Open WebUI (0.11 or later): Settings → Admin → Integrations → External Tool Servers → +. Click the Type until it says MCP Streamable HTTP, then fill in Name (Acutis Gate), ID (acutis-gate: required for MCP even though it says optional, or Save silently does nothing), URL and Auth: Bearer with the key. Press Verify Connection (the circular arrows): it should say Connection successful. Save, then Save on the page. (Older Open WebUI: Admin Panel → Settings → External Tools → +.)
- URL: https://ai.corp.example/api/v1/gate/mcp
- Auth: Bearer, with the key from step 1.
Each person needs an Open WebUI account with the same email as in Gate (their AD mail or UPN).
In each chat, people turn Gate on: the tools icon next to + under the message box → Tools → switch Acutis Gate on.

Open WebUI says the certificate is not trusted

Gate's certificate comes from your company CA, which a Linux container does not trust by default. Export your root CA as Base-64 .cer (from certlm.msc on any domain PC → Trusted Root Certification Authorities), copy it to the Docker host as corp-root.crt, then:

cat /etc/ssl/certs/ca-certificates.crt corp-root.crt > /opt/owui-ca.crt

and add to the docker run above: -v /opt/owui-ca.crt:/opt/owui-ca.crt:ro -e SSL_CERT_FILE=/opt/owui-ca.crt -e REQUESTS_CA_BUNDLE=/opt/owui-ca.crt.

Prefer Claude Desktop, Cursor or VS Code? Each person makes a personal token under Connect an AI (Connect an AI).

Step 10. File shares and guardrails¶

Setup already allowed Gate to open the file servers it found in your Group Policy drive maps, home folders and logon scripts. Details, and what to do when you add a file server later: File shares as each person.
Then: Guardrails, a worked example and Prove it works.

Step 11. Health check¶

Admin → Health check → Run all checks. Fix whatever says Start here; each row links to its fix. Run it again after any change.

Day two¶

Task	How
Back up	`C:\ProgramData\AcutisGate` (data, secrets, certificate, license, logs).
Logs	`C:\ProgramData\AcutisGate\logs\service.log`.
Upgrade	Run the new MSI, then Set up Acutis Gate again. The database is backed up first.
New file server	Run Set up Acutis Gate again: it adds the new server to the delegation list.
Restart	Services → Acutis Gate → Restart, or `Restart-Service AcutisGate`.
Remove	Start → Acutis Gate → Remove Acutis Gate services (keeps data), then uninstall in Settings → Apps.