Windows Images

Last updated: July 31, 2026Latest Frontend Version: 2.17.4

Supported Editions

Edition	Status
Windows Server 2019 / 2022 / 2025	Recommended
Windows 10/11 Pro	Supported
Windows 10/11 Home	Not supported

note

You must supply your own Windows license.

Choose a Creation Method

Method	Best for
In-Platform	Building images directly inside tiCrypt with no external tools
Ansible	Reproducible, automated builds for multiple image variants

Both methods produce a qcow2 image with the VM Installer and controller.toml included.

tip

You can also create Windows images outside of tiCrypt using any hypervisor that produces qcow2 images (VirtualBox, virt-manager, QEMU). Install Windows and the VirtIO drivers, then follow the same tiCrypt component steps before importing the image via Add Image to tiCrypt.

In-Platform Build

Build a Windows image entirely within tiCrypt using the Management interface and Service VMs. No external hypervisor is needed.

note

This method creates a blank bootable image. After installing Windows, continue with the standard configuration steps to complete the image.

Step Overview

📋Steps at a Glance

1. Download ISOs

2. Upload ISOs to storage pool

3. Register ISO images

4. Create raw disk image

5. Create VM image record

6. Create and boot a Service VM

7. Install Windows via VNC

8. Base system configuration

9. Install Windows features and roles

10. Configure NFS client

11. Enable FIPS mode

12. Windows activation

13. Enable BitLocker

14. Install the VM Installer

15. Configure the controller

16. Enable SFTPOptional

17. Install applicationsOptional

18. Enable RDP audio redirectionOptional

19. Finalize

1. Download Required ISOs

Download to your local machine:

Windows Server ISO from the Microsoft Evaluation Center
VirtIO drivers ISO from the Linux KVM project

2. Upload ISOs to the Storage Pool

Copy both ISO files into the ISO storage pool directory on the tiCrypt backend:

cp WindowsServer2025.iso /path/to/ticrypt-vm-isos/
cp virtio-win.iso /path/to/ticrypt-vm-isos/

Navigate to Management > Virtual Machines > ISO Volumes and confirm both files appear in the table.

caution

If the ISOs do not appear, refresh the Libvirt storage pool. Both must be visible before proceeding.

3. Register ISO Images

Navigate to ISO Images and click Create from volume for each ISO:

Select the Realm (e.g., Libvirt).
Choose the ISO volume from the dropdown.
Enter a Name (e.g., WindowsServer2025, virtio-win).
Select the Boot mode (UEFI or Legacy).
Click Create ISO.

Repeat for both ISOs.

4. Create a Raw Disk Image

Navigate to Libvirt Volumes and click Create raw image:

Enter a Name (e.g., windows-2025-base).
Set the Size (40 GB minimum for Windows Server).
Click Create.

5. Create a VM Image Record

Navigate to VM Images and click Create new VM image:

Enter a Name (e.g., Windows Server 2025).
Set the Operating System to Windows.
Select the raw volume from the previous step.
Set Boot options to match the ISO boot mode (UEFI or Legacy).
Click Create.

6. Create and Boot a Service VM

Navigate to Service VMs and click Create new service VM:

Select the VM image from the previous step.
Set hardware resources (4+ cores, 8+ GB memory recommended).
Click Create.

Once created, select the service VM, open the context menu, and click Boot from ISO:

In ISO image, select the Windows Server ISO.
In Additional ISO images, add the VirtIO drivers ISO.

caution

The VirtIO drivers ISO must be attached as a secondary ISO. Without it, the Windows installer cannot detect the virtual disk and installation will fail.

Click Boot.

7. Install Windows via VNC

Right-click the service VM and select Open VNC terminal to open a console session to the VM.

The VM boots from the Windows ISO. Follow the installation steps below:

Language and region

Select your language, time/currency format, and keyboard layout.
Click Next, then click Install now.

Product key and edition

Enter your product key or click I don't have a product key to activate later.
Select the edition (e.g., Windows Server 2025 Standard (Desktop Experience)).
Accept the license terms and click Next.

Installation type

Select Custom: Install Windows only (advanced).

Load VirtIO storage driver

The disk list is empty because Windows does not include VirtIO drivers natively. Click Load driver.
Click Browse and navigate to the VirtIO ISO drive (typically drive D: or E:).
Open the vioscsi folder, then select the subfolder matching your Windows version (e.g., 2k25\amd64 for Server 2025).
Select the Red Hat VirtIO SCSI driver and click Next.
The virtual disk now appears in the disk list. Select it and click Next.

tip

If multiple driver entries appear, select the one that matches your exact Windows version and architecture (amd64).

Installation

Windows copies files and installs. The VM reboots automatically during this process. Do not close the VNC terminal.
After the final reboot, set the Administrator password when prompted.

caution

Create only an Administrator account. Do not create additional user accounts during installation. tiCrypt manages user provisioning at boot through the VM Controller.

Install remaining VirtIO drivers

Log in as Administrator.
Open File Explorer and navigate to the VirtIO drivers ISO (still attached as a secondary drive).
Run virtio-win-guest-tools.exe from the root of the ISO. This bundled installer installs all remaining drivers (network, balloon, serial, display) in one step. Alternatively, install each driver individually through Device Manager by browsing to the corresponding folder on the ISO (netkvm, balloon, vioserial).
Verify in Device Manager that no devices show warnings or missing drivers.

8. Base System Configuration

Apply the following settings before installing tiCrypt components. Open an elevated PowerShell session and run:

# ── Timezone and regional settings ──
Set-TimeZone -Id "Eastern Standard Time"
Set-WinSystemLocale -SystemLocale en-US

# ── Disable hibernation and sleep ──
powercfg /h off
powercfg /change standby-timeout-ac 0
powercfg /change monitor-timeout-ac 0

# ── Disable Windows Firewall ──
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

# ── TLS hardening ──
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' -Name "Enabled" -Value 0 -Type DWord
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' -Name "Enabled" -Value 0 -Type DWord
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name "Enabled" -Value 1 -Type DWord

# ── NTP ──
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters' -Name "NtpServer" -Value "time.nist.gov,0x9"
Start-Service W32Time

# ── RDP encryption (High) and NLA ──
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "MinEncryptionLevel" -Value 3 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -Value 1 -Type DWord

# ── Windows Update: disable auto-restart ──
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "NoAutoRebootWithLoggedOnUsers" -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name "AUOptions" -Value 3 -Type DWord

# ── Lock screen and screen saver ──
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization' -Name "NoLockScreen" -Value 1 -Type DWord
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop' -Name "ScreenSaveActive" -Value 0 -Type DWord

# ── IE Enhanced Security ──
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}' -Name "IsInstalled" -Value 0
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}' -Name "IsInstalled" -Value 0

# ── Server Manager auto-start ──
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\ServerManager' -Name "DoNotOpenServerManagerAtLogon" -Value 1

# ── Edge browser policies ──
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name "HideFirstRunExperience" -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name "PasswordManagerEnabled" -Value 0 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name "SearchSuggestEnabled" -Value 0 -Type DWord

# ── Disable telemetry and diagnostic data prompt ──
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -Name "AllowTelemetry" -Value 0 -Type DWord
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds' -Name "AllowBuildPreview" -Value 0 -Type DWord
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE' -Name "DisablePrivacyExperience" -Value 1 -Type DWord

What each section does

Section	Purpose
Timezone/regional	Sets Eastern Standard Time and en-US locale
Hibernation/sleep	Prevents the VM from entering standby
Firewall	Disables Windows Firewall so the VM Controller can bind port 22. tiCrypt's network infrastructure handles all traffic filtering.
TLS hardening	Disables TLS 1.0/1.1, enables 1.2
NTP	Points to `time.nist.gov` for clock synchronization
RDP encryption	Sets encryption to High with NLA required
Windows Update	Prevents automatic restarts with logged-on users
Lock screen/screensaver	Disables both to prevent idle lockouts in headless VMs
IE ESC	Disables Internet Explorer Enhanced Security Configuration
Server Manager	Prevents auto-open at logon
Edge policies	Suppresses first-run experience, disables password manager and search suggestions
Telemetry	Disables diagnostic data collection and the Server 2025 first-logon privacy prompt

9. Install Windows Features and Roles

The following features and roles are required for tiCrypt. Install them all in a single elevated PowerShell command:

Install-WindowsFeature Telnet-Client, RDS-RD-Server

Feature / Role	PowerShell Name	Purpose
Telnet Client	`Telnet-Client`	Network connectivity debugging
Remote Desktop Session Host	`RDS-RD-Server`	RDP session support for tiCrypt users

The server restarts after installation. Reopen the VNC terminal and log in as Administrator.

note

If your organization requires additional features (e.g., Hyper-V, SNMP, Windows Server Backup), add them to the command above.

Configure RDP policies:

tiCrypt requires unlimited concurrent RDP sessions. Clipboard and drive redirection must be disabled to prevent data exfiltration.

# Enable RDP connections
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

# Remove session limits
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "MaxInstanceCount" -Value 999999
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "MaxInstanceCount" -Value 999999

# Disable clipboard and drive redirection
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "fDisableClip" -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "fDisableCdm" -Value 1

caution

Clipboard and drive redirection must remain disabled. Enabling either allows data exfiltration from the secure enclave.

10. Configure NFS Client

tiCrypt VMs mount NFS shares from tiCrypt storage for file access. The Client for NFS feature must be installed, its service enabled, and identity mapping configured.

Prefer to automate this section?

Run these three scripts in order, elevated. Stages 1 and 2 reboot automatically where a reboot is actually required; after each reboot, log back in as Administrator and run the next one.

1-Install-NfsFeature.ps1 - installs the NFS-Client feature and driver, then reboots so nfsrdr.sys loads.
2-Configure-NfsClient.ps1 - enables the service, sets identity mapping, then reboots to activate. Pass -AnonymousUid/-AnonymousGid to match a different storage export.
3-Verify-Nfs.ps1 - read-only checks (no reboot): confirms the feature, driver, and service are up.

powershell -ExecutionPolicy Bypass -File .\1-Install-NfsFeature.ps1
# reboots automatically; log back in as Administrator, then:
powershell -ExecutionPolicy Bypass -File .\2-Configure-NfsClient.ps1
# reboots automatically; log back in as Administrator, then:
powershell -ExecutionPolicy Bypass -File .\3-Verify-Nfs.ps1

Pass -NoReboot to stage 1 or 2 to skip its automatic reboot (for the image-seal workflow, or to inspect state first). A single-pass Configure-NfsClient.ps1 (with an optional -Reboot) is also available if you prefer to do everything in one run.

Manual NFS configuration steps

Install the NFS Client feature:

Install-WindowsFeature NFS-Client

Restart the server after installation. The NFS kernel-mode redirector driver (nfsrdr.sys) does not fully register until the next boot. Reopen the VNC terminal and log in as Administrator before continuing.

Enable the NFS Client service:

The NfsClnt service installs with Manual startup and is not started by default. Set it to start automatically:

Set-Service -Name NfsClnt -StartupType Automatic
Start-Service NfsClnt

Configure NFS client settings and anonymous identity mapping:

tiCrypt VMs operate on an isolated VLAN with no Active Directory. NFS mounts use anonymous authentication (AUTH_SYS), so the anonymous UID and GID must be set to match the tiCrypt storage export. Otherwise, the client maps to UID/GID -2 (nobody), causing permission failures. Two client settings must also be present: UseReservedPorts and Protocols.

$nfs = "HKLM:\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default"
New-Item -Path $nfs -Force | Out-Null
Set-ItemProperty -Path $nfs -Name "UseReservedPorts" -Value 1        -Type DWord
Set-ItemProperty -Path $nfs -Name "Protocols"        -Value 13630719 -Type DWord
Set-ItemProperty -Path $nfs -Name "AnonymousUid"     -Value 0        -Type DWord
Set-ItemProperty -Path $nfs -Name "AnonymousGid"     -Value 0        -Type DWord

UseReservedPorts is required

Linux NFS exports use the secure option by default, which only accepts connections from a privileged source port (below 1024). UseReservedPorts=1 makes the Windows client use one. Without it, the mount is rejected with "Network Error - 53" even though showmount -e and ping to the server succeed. This is a confusing failure that looks like a network problem but is really a source-port mismatch. This value is normally seeded when the NFS-Client feature initializes, but if the registry key is created before that happens it can be missing, so set it explicitly.

note

The AnonymousUid and AnonymousGid values shown above (0 = root) are typical for tiCrypt deployments. If your storage export uses a different UID/GID, set the values accordingly. These are machine-wide settings that apply to all NFS mounts.

Restart the server:

Restart to activate the kernel-mode redirector (nfsrdr.sys), start the NfsClnt service, and apply the identity mapping. Reopen the VNC terminal and log in as Administrator, then verify.

Restart-Computer

Server-side NFS export configuration

The NFS export on the storage server must include options that match the Windows client's anonymous authentication. In /etc/exports on the storage host:

/mnt/enclave/nfsapplib  <subnet>(rw,sync,insecure,all_squash,anonuid=0,anongid=0)

Option	Why
`rw`	Read-write access for VM file operations
`sync`	Writes are committed to disk before acknowledging, preventing data loss on server crash
`insecure`	Accept connections from unprivileged ports (above 1024). Required if `UseReservedPorts` is not set on the client, but recommended regardless for compatibility
`all_squash`	Map all client UIDs/GIDs to the anonymous account. tiCrypt VMs have no shared identity provider, so per-user mapping is not possible
`anonuid=0`	Anonymous operations map to UID 0 (root). Must match the `AnonymousUid` set on the Windows client
`anongid=0`	Anonymous operations map to GID 0 (root). Must match the `AnonymousGid` set on the Windows client

After editing, apply with exportfs -ra on the storage host.

Troubleshooting a mount error

If NFS mounts fail after completing this section, reinstall the NFS Client feature:

Uninstall-WindowsFeature NFS-Client
Restart-Computer
# after reboot:
Install-WindowsFeature NFS-Client
Restart-Computer

Then re-run the configuration scripts above. If the mount still fails after reinstalling, check the storage host for the rejection reason: journalctl -u rpc-mountd -f.

Verify the NFS client is operational:

Get-WindowsFeature NFS-Client
Get-Service NfsClnt

The feature should show installed and the service running. Once the VM is on the network, test connectivity with showmount -e <storage-ip>, then mount:

mount.exe -o anon <storage-ip>:/<export> Z:

11. Enable FIPS Mode

Enable Federal Information Processing Standards (FIPS) 140-2 compliant algorithms. Required for deployments that must meet NIST 800-171, CMMC, or other federal compliance frameworks.

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy' -Name "Enabled" -Value 1 -Type DWord

note

FIPS mode restricts Windows to FIPS-validated cryptographic algorithms. Some third-party applications may not function correctly with FIPS enabled. Test your installed applications after enabling.

12. Windows Activation

Activate Windows before finalizing the image. tiCrypt VMs have no outbound internet access, so activation must use a KMS server on your organization's network or be completed during image preparation.

KMS activation (recommended for volume licensing):

Set the Generic Volume License Key (GVLK) for your edition, point to your KMS server, and activate:

slmgr /ipk <product-key>
slmgr /skms kms-server.example.com
slmgr /ato

Edition	GVLK
Windows Server 2025 Standard	`TVRH6-WHNXV-R9WG3-9XRFY-MY832`
Windows Server 2025 Datacenter	`D764K-2NDRG-47T6Q-P8T8W-YP6DF`
Windows Server 2022 Standard	`VDYBN-27WPP-V4HQT-9VMD4-VMK7H`
Windows Server 2022 Datacenter	`WX4NM-KYWYW-QJJR4-XV3QB-6VM33`
Windows Server 2019 Standard	`N69G4-B89J2-4G8F4-WWYCC-J464C`
Windows Server 2019 Datacenter	`WMDGN-G9PQG-XVVXX-R3X43-63DFG`

MAK activation (standalone key):

If your organization uses Multiple Activation Keys instead of KMS:

slmgr /ipk <your-MAK-key>
slmgr /ato

Verify activation status:

slmgr /dli

danger

tiCrypt VMs have no outbound network access. The KMS server's domain and port (default: 1688) must be added to the Licensing Servers allowlist under Management > Virtual Machines > Licensing Servers before VMs are deployed. Without this entry, Windows cannot complete periodic reactivation and will eventually become unlicensed.

Licensing server entries are universal: all VMs in the realm can reach any entry in the list.

note

For full details on KMS setup and product keys, see the Microsoft KMS documentation.

13. Enable BitLocker

tiCrypt uses BitLocker to encrypt VM drives. It is not enabled by default on Windows Server.

Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools

The server restarts. After the restart:

Reopen the VNC terminal and log in as Administrator.
Wait for post-restart configuration tasks to complete.
A Remote Desktop Licensing dialog may appear. Dismiss or configure it per your organization's licensing.
Open Server Manager > All Servers and wait until the Manageability column shows Online before proceeding.

danger

BitLocker is required. Without it, tiCrypt cannot mount encrypted drives and the VM will not function.

14. Install the VM Installer

Download and run the VM Installer MSI: Windows

The MSI installs to C:\Program Files\Tera Insights\tiCrypt VM Controller\.

15. Configure the Controller

Edit C:\Program Files\Tera Insights\tiCrypt VM Controller\controller.toml. See Controller Configuration for the full reference.

For Windows images with RDP access, uncomment addGroups in the [tunnel] section:

[tunnel]
addGroups = ["Remote Desktop Users"]

16. Enable SFTP (Optional)

Enable this if your users need to upload files from their local machine into a running VM.

SFTP provides a one-way file transfer into the VM. Uploads are permitted; downloads and file reads are blocked.

note

OpenSSH is preinstalled on Windows Server 2019, 2022, and 2025.

Disable automatic start so the OpenSSH service does not hold port 22 at boot:
```
Set-Service -Name sshd -StartupType Disabled
Stop-Service -Name sshd
```

Edit controller.toml:

[tunnel]
sftpEnabled = true
sftpPort = 2022

caution

If the OpenSSH service starts automatically and binds port 22, the VM Controller cannot register.

17. Install Applications (Optional)

Pre-install applications that your researchers need so they are available immediately when the VM boots. Common examples: R, RStudio, Python, Jupyter, MATLAB, SAS, ArcGIS, Chrome, VS Code, or domain-specific analysis tools.

Chocolatey simplifies bulk installation. For example:

choco install googlechrome notepadplusplus 7zip python rstudio -y

caution

tiCrypt VMs have no outbound network access by default. If any installed software requires communication with a licensing server for activation or periodic license checks (e.g., Windows, SAS, ArcGIS, Adobe, MATLAB), the server's domain and port must be added under Management > Virtual Machines > Licensing Servers before the VM can reach it. Without this entry, the software will fail to activate.

Licensing server entries are universal: all VMs in the realm can reach any entry in the list.

18. Enable RDP Audio Redirection (Optional)

Enable this if your users need audio playback during RDP sessions. By default, Windows Server 2025 disables the audio services required for sound redirection.

Start the audio services:

The Windows Audio and Windows Audio Endpoint Builder services are present but disabled by default on Windows Server. Both must be set to start automatically:

Set-Service -Name AudioEndpointBuilder -StartupType Automatic
Start-Service -Name AudioEndpointBuilder
Set-Service -Name Audiosrv -StartupType Automatic
Start-Service -Name Audiosrv

Allow audio redirection via policy:

These registry keys allow RDP clients to redirect audio playback and microphone input through the RDP session. They mirror the Group Policy settings under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.

New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "fDisableCam" -PropertyType DWord -Value 0 -Force
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "fDisableAudioCapture" -PropertyType DWord -Value 0 -Force

Registry Value	Effect when set to 0
`fDisableCam`	Allows audio and video playback redirection
`fDisableAudioCapture`	Allows audio recording (microphone) redirection

note

Audio rides the existing RDP virtual channel (TCP 3389). No additional firewall rules or ports are required.

tip

On the RDP client side, open Show Options > Local Resources > Remote audio > Settings and set Remote audio playback to "Play on this computer." For .rdp files, set audiomode:i:0 (play locally) and optionally audiocapturemode:i:1 (enable microphone).

19. Finalize

Open Server Manager > All Servers and verify the Manageability column shows Online.
Select Shut Down from the Start menu or run Stop-Computer in PowerShell to stop the service VM.

The image is ready for use. If you encounter registration issues after deploying the image, see the Troubleshooting guide.

Supported Editions​

Choose a Creation Method​

In-Platform Build​

Step Overview​

1. Download Required ISOs​

2. Upload ISOs to the Storage Pool​

3. Register ISO Images​

4. Create a Raw Disk Image​

5. Create a VM Image Record​

6. Create and Boot a Service VM​

7. Install Windows via VNC​

8. Base System Configuration​

9. Install Windows Features and Roles​

10. Configure NFS Client​

11. Enable FIPS Mode​

12. Windows Activation​

13. Enable BitLocker​

14. Install the VM Installer​

15. Configure the Controller​

16. Enable SFTP (Optional)​

17. Install Applications (Optional)​

18. Enable RDP Audio Redirection (Optional)​

19. Finalize​

Supported Editions

Choose a Creation Method

In-Platform Build

Step Overview

1. Download Required ISOs

2. Upload ISOs to the Storage Pool

3. Register ISO Images

4. Create a Raw Disk Image

5. Create a VM Image Record

6. Create and Boot a Service VM

7. Install Windows via VNC

8. Base System Configuration

9. Install Windows Features and Roles

10. Configure NFS Client

11. Enable FIPS Mode

12. Windows Activation

13. Enable BitLocker

14. Install the VM Installer

15. Configure the Controller

16. Enable SFTP (Optional)

17. Install Applications (Optional)

18. Enable RDP Audio Redirection (Optional)

19. Finalize