Skip to content

Installing PowerShell Orchestrator Server

This article covers the installation of the PowerShell Orchestrator Server component. The server hosts the web-based administrative interface, manages scripts, jobs, and schedules, and coordinates agent activity. Complete this installation before deploying any PowerShell Orchestrator Agents.

Step 1 — Run the installer:

Locate the installation package:

LTA_PSOrchestrator.msi

Double-click the MSI file and follow the installation wizard prompts. When prompted, choose an installation directory:

Default installation path:

C:Program FilesLTA_PSOrchestrator

What the installer does:

During installation the MSI automatically:

  • Installs the server application binaries into the installation directory
  • Creates and registers a Windows service named PowerShellOrchestrator configured to start automatically

Generates a self-signed HTTPS certificate stored at:
certsPSOrchestrator.pfx

  • Sets the machine-level environment variable LTAORCHESTRATOR_CERT_PASSWORD with the certificate password
  • Creates supporting folders including data and logs
  • Starts the service automatically after installation completes

Default ports:

The server binds to the following ports by default:

Protocol Port URL
HTTP 52865 http://0.0.0.0:52865
HTTPS 52866 https://0.0.0.0:52866

[Your administrator should confirm these ports are not already in use on the server and that inbound firewall rules are in place for both ports.]

Step 2 — Verify the service is running:

After installation completes, confirm the PowerShellOrchestrator Windows service is running:

Via Services console:

  1. Open services.msc
  2. Locate PowerShellOrchestrator
  3. Confirm the status shows Running

Via PowerShell:

Get-Service PowerShellOrchestrator

If the service is not running, check the following:

Confirm the certificate password environment variable is set correctly:
LTAORCHESTRATOR_CERT_PASSWORD

  • Check database file permissions in the data directory

Review application logs:
C:Program FilesLTA_PSOrchestratorlogs

  • Check the Windows Event Log for service startup errors

Step 3 — Verify the web interface is accessible:

  1. Open a browser on the server
  2. Navigate to:
https://localhost:52866
  1. Accept the self-signed certificate warning on first access — this is expected
  2. Confirm the PowerShell Orchestrator login page appears

If the web interface is not accessible:

  • Confirm the service is running
  • Check firewall rules for ports 52865 and 52866

Confirm the certificate is valid:
Get-ChildItem Cert:LocalMachineMy

Try the HTTP endpoint as an alternative:
http://localhost:52865

Step 4 — First time login:

Log in using the default administrator credentials:

Field Value
Username admin
Password TempP@ssw0rd!2025

After successful login you will be automatically redirected to change your password before accessing the dashboard.

Password requirements:

Requirement Detail
Minimum length 10 characters
Uppercase letters At least one (A-Z)
Lowercase letters At least one (a-z)
Digits At least one (0-9)
Special characters At least one special character

After changing the password you will be redirected to the Jobs dashboard. The system is now ready for configuration.

Change the default password immediately. Refer to the Admin article for user management instructions.

Server configuration:

The server is configured through appsettings.json in the installation directory. Key configuration values:

{

  “Server”: {

    “Standalone”: true,

    “UseHttps”: true,

    “Http”: {

      “Url”: “http://0.0.0.0:52865”

    },

    “Https”: {

      “Url”: “https://0.0.0.0:52866”,

      “Certificate”: “certs/PSOrchestrator.pfx”

    }

  },

  “Serilog”: {

    “MinimumLevel”: {

      “Default”: “Information”

    }

  }

}

After modifying appsettings.json restart the service to apply changes:

Restart-Service PowerShellOrchestrator

Data and log locations:

Location Purpose
dataorchestrator.db SQLite database — contains all server configuration and job data
logs Application log files
certsPSOrchestrator.pfx Server TLS certificate

Back up the SQLite database (dataorchestrator.db) regularly. This file contains all PowerShell Orchestrator Server configuration including scripts, jobs, schedules, targets, and agent registrations.

Replacing the self-signed certificate for production:

For production deployments replace the auto-generated certificate with a CA-issued certificate:

  1. Obtain a CA-issued certificate in .pfx format
  2. Replace PSOrchestrator.pfx in the certs folder
  3. Update the LTAORCHESTRATOR_CERT_PASSWORD environment variable with the new certificate password:

[System.Environment]::SetEnvironmentVariable(

  “LTAORCHESTRATOR_CERT_PASSWORD”,

  “<new-password>”,

  “Machine”

)

  1. Restart the service to apply the new certificate:

Restart-Service PowerShellOrchestrator