Windows
Windows notes
Running NGCP on Windows: services, paths, logs, isolated accounts, upgrades, backups, removal and Windows-only problems. The general picture is in Operations and Troubleshooting.
Services
| Service | Name | Notes |
|---|---|---|
| Controller | NGCP Controller (NGCPController) |
The panel |
| Built-in database | NGCPPostgreSQL |
Runs as NetworkService, listens on 127.0.0.1 only |
| Agent | NGCP Agent (NGCPAgent) |
LocalSystem, automatic start, restarts after 5 / 15 / 60 s |
Get-Service NGCPController, NGCPAgent, NGCPPostgreSQL
Restart-Service NGCPController
& 'C:\Program Files\NGCP Controller\ngcp-controller.exe' service status
Restart the controller after changing controller.env, and the agent after changing
agent.yaml. The agent is managed with ngcp-agent service status|stop|start|uninstall, the
controller’s service with the same commands on ngcp-controller.exe; see Command
line.
When the panel updates an agent, the agent swaps its binary and restarts through the service manager. The System event log records event 7031 (“terminated unexpectedly”) for this restart; that is expected. The agent’s game servers restart with it.
Files and folders
| What | Where |
|---|---|
| Controller program | C:\Program Files\NGCP Controller |
| Controller configuration, master key, self-signed certificate | C:\ProgramData\NGCP\Controller (SYSTEM and Administrators only) |
| Built-in database | C:\ProgramData\NGCP\Controller\postgres\data |
| Setup token (until the setup is done) | C:\ProgramData\NGCP\Controller\setup-token.txt |
Agent data (agent.yaml, certificate, private key, log, stored specs) |
C:\ProgramData\NGCP, SYSTEM and Administrators only |
| Game servers | C:\ngcp\services\svc-<id> |
| SteamCMD | C:\ngcp\steamcmd (owned by ngcp_steam) |
Logs
| Program | Where |
|---|---|
| Controller | C:\ProgramData\NGCP\Controller\controller.log (rotated at 20 MB to .1) |
| Agent | C:\ProgramData\NGCP\agent.log (local time; rotated at 10 MB) |
| Built-in PostgreSQL | C:\ProgramData\NGCP\Controller\postgres\ |
Get-Content C:\ProgramData\NGCP\agent.log -Tail 50 -Wait
More detail: set NGCP_LOG_LEVEL=debug in controller.env or log_level: debug in the agent’s
agent.yaml and restart.
Isolated accounts
The agent runs as LocalSystem because it creates accounts, limits and firewall rules. Game servers never run as the agent:
- Each service gets a local account
ngcp_s<id>with a random password (sealed with DPAPI), allowed only to log on as a batch job. - Its processes run inside a Job Object with memory, CPU-rate and process-count limits; stopping a service leaves no stray processes.
- The install directory is readable only by SYSTEM, Administrators and that account.
- SteamCMD runs under a separate per-node account,
ngcp_steam, so game servers cannot read the cached Steam login.
| Limit | How Windows applies it |
|---|---|
| CPU (% of one core; 100 = one core, 0 = unlimited) | Job Object hard CPU-rate cap |
| Memory (0 = unlimited) | Job Object limit: allocations beyond it fail |
More in Concepts and Security.
Runtimes for game servers
A clean Windows lacks files that many game servers need. On a node that runs game servers, NGCP Setup and the panel’s one-line command install these from Microsoft:
- Visual C++ Redistributable 2015-2022 (x64)
- Visual C++ Redistributable 2013 (x64)
- DirectX End-User Runtime (the older DirectX files)
Setup carries them inside its own file. The one-line command downloads them from Microsoft, checks Microsoft’s signature on each one and skips any that are already installed. If one cannot be installed the node still installs, with a warning. DirectX is the slowest of the three and can take several minutes.
The agent MSI and the bare binary install only the agent, so on those nodes install the three
runtimes yourself. A game that needs a missing runtime usually exits at once with code -1073741515
(0xC0000135).
Good to know
- Scheduled
scripttasks and game-definition scripts run with PowerShell. - Deny rules match case-insensitively. Links, junctions and 8.3 short names (
BATTLE~1) cannot reach a denied file under another name. - A running game often keeps its files locked. Locked files are skipped in a backup, which reports “N files could not be read (in use?) and are not in the backup”. Stop the server for a complete backup, or exclude them.
- ArmA 3 writes its console to its own window, so the panel console shows the
.rptlog tail.
Upgrading
Install the newer package over the old one. Configuration, keys, the database and game files stay. Back up the database and master key first.
msiexec /i ngcp-controller-X.Y.Z-x64.msi /qn
Migrations, agent updates and what to expect are in Operations. You can also install the newer agent package on the node directly; the enrollment is kept.
Backing up the built-in database
In PowerShell as Administrator:
$cfg = 'C:\ProgramData\NGCP\Controller\controller.env'
$url = (Select-String -Path $cfg -Pattern '^NGCP_DATABASE_URL=').Line.Substring(18)
& 'C:\Program Files\NGCP Controller\pgsql\bin\pg_dump.exe' --format=custom --file "D:\Backups\ngcp-$(Get-Date -Format yyyy-MM-dd).dump" --dbname $url
Copy-Item C:\ProgramData\NGCP\Controller\master.key D:\Backups\keys\
Run this as a Windows scheduled task and copy the dumps off the machine. What else to back up, and how to restore: Backing up the panel.
Uninstalling
NGCP Setup: Uninstall in Apps / Programs and Features removes both parts and keeps the
panel’s database and settings in C:\ProgramData\NGCP.
Controller: remove NGCP Controller in Settings -> Apps. The services and program folder
go; C:\ProgramData\NGCP\Controller (configuration, master key, built-in database data) stays.
Delete that folder too for a complete removal. A reinstall over kept data comes back in normal
mode with everything as it was.
Agent: follow the steps for a clean node. Uninstall it in
Settings -> Apps -> NGCP Agent, then delete C:\ProgramData\NGCP and C:\ngcp.
Troubleshooting
| Problem / message | Fix |
|---|---|
| SmartScreen warns about NGCP Setup or an MSI | Expected: the packages are not code-signed yet. |
| The setup page asks for a token | You opened it from another computer. The token is in C:\ProgramData\NGCP\Controller\setup-token.txt. |
| Built-in database fails | Check the setup’s message and C:\ProgramData\NGCP\Controller\postgres\. The setup can be repeated; it reuses what it already created. |
| Windows node takes about 20 s to come online the first time | Known; later connections are fast. |
| The one-line installer fails | Run it in an elevated PowerShell (PowerShell as Administrator). |
| ArmA 3: console shows only log lines | Normal: ArmA writes its console to its own window, so the panel tails the .rpt log. |
| Event 7031 in the System log after an agent update | Expected; see Services. |
More in Troubleshooting.