Installation

About 22 min read

This page describes step by step how to install 2WinScada on a new computer with the installation wizard (Setup). To upgrade an existing system, see Upgrading.

Before you begin

Check that the server meets the system requirements and prepare the following information:

Topic	Information to prepare
Components	The optional components the project will use: Notification, RecordDevice, MQTT Publisher, MCP Server, License Manager. The API and the web interface are always installed.
Access address	A single DNS name or IP address that users will type in the browser; additional addresses, if any. The HTTP and HTTPS ports.
Certificate	Whether a self-signed certificate or the customer's PFX certificate will be used. If PFX is used, the file and its password.
SQL Server	Whether a local SQL Server 2025 Express will be installed or an existing server will be used. For a new SQL Express, the instance name and the data folder; for an existing server, the server and instance name and the installation account; for a remote server, also the application login. The database name.
Archive database (QuestDB)	Whether a local QuestDB will be installed or an existing server will be used. The data folder, the ports, and separate passwords for the HTTP and PG users.
Initial administrator	A password of at least 12 characters for the administrator (SystemAdmin) account to be created in the new database.
MQTT / MCP	Setup does not ask for the MQTT broker details or an MCP access key; both are entered in the web interface after installation. If MQTT Publisher will be used, prepare the address, port and TLS usage of the existing broker and the user credentials, if any, for that step. Setup does not install a broker.
Directories	The installation directory, the QuestDB data folder, the SQL data folder if a new SQL Express will be installed, and the SQL backup directory. These directories must not be nested inside each other.

Store the passwords securely

Save the initial administrator password and the database passwords in a password manager before installation. The administrator account is not included in configuration backups.

If the publisher signature cannot be verified

Setup verifies the integrity and the publisher signature of the package; if the verification fails, it does not start the installation. In that case, obtain the package again only from the official source and contact the 2WinScada support team. Do not try to bypass the signature check.

Starting Setup

1. Copy the 2WinScada.Setup.<version>.x64.exe file to a local disk of the server.
2. Right-click the file, select Run as administrator and accept the UAC prompt.
3. The first screen shows Preparing setup files and does not install anything yet: Setup unpacks the package content into a protected temporary folder. This can take a few minutes. Then the installation wizard opens; the installation location is chosen in the wizard.

At this point Setup removes temporary folders left by earlier attempts. Only one 2WinScada Setup can run at a time. Setup checks the Windows edition before the first screens; on an unsupported edition, it shows the reason and stops.

If a previous installation attempt was interrupted, Setup detects it and asks for recovery with the warning "An interrupted deployment was found". Select Yes; when recovery completes, the operation you selected continues. A new installation is not started without recovery.

Wizard steps

The wizard marks required fields in their labels and checks them when you select Next. If a value is missing or invalid, it returns to the field. When you go back to previous pages with Back, the values you entered are kept. The ... button next to path fields lets you select a folder or file.

Language

Select the installer language: Türkçe, English or Deutsch.

Installation Mode

When the computer has no installation, the page shows "No existing installation was detected. Install is selected." and Install is selected.

• Company name (required): The customer's name. The wizard suggests the database name from this name.

Installation Paths

• Base installation directory (required): The root directory where the services and the website are installed. The default is C:\Program Files\Turkuvaz Inovasyon. If a local QuestDB will be installed, use only ASCII characters in the path.
• Panel PC (8 GB, full stack) preset: Select this if all software will be installed on a panel PC with 8 GB RAM. Details: Panel PC and Kiosk.
• SQL Server max server memory (MB, 0 = unchanged): The maximum memory SQL Server can use. 0 leaves the setting unchanged; other values must be between 256 and 1048576. The limit is applied only to the SQL Server Express instance installed by Setup.
• Also apply it to an existing SQL Server instance on this computer that Setup did not install: Select this to apply the memory limit to an existing SQL Server instance on this computer as well. It is not applied to a remote SQL Server.

Components

The API and the web interface are required and are always installed. Optional components are selected one by one; Select all selects or clears all optional components. In a new installation, the optional components are not selected.

Option	When to select it
NotificationService	If email, SMS or WhatsApp notifications will be used
RecordDeviceService	If record devices will be used
MQTT Publisher	If data will be published to an MQTT broker. The broker is entered in the web interface after installation.
MCP Server	If AI clients (MCP) will be used
License Manager	If the license file will be imported on this computer

When MCP Server is selected, the Add "2WinScada MCP istemci kurulumu" to my Start menu (MCP Server) option is also available. The shortcut is added only to the Start menu of the Windows account that runs Setup.

The wizard does not ask for the MQTT broker details or an MCP access key:

• MQTT Publisher starts with publishing off in a new installation. Publishing starts once the broker details are entered and saved in the web interface on the Settings > MQTT Publisher Settings page after installation. See MQTT Publisher.
• MCP Server runs each request with the permissions of the user it is bound to. For client access, an API key is created in the web interface after installation. See MCP access.

In a repair, an additional option appears below the installed MQTT Publisher; see Repair.

IIS and SSL

• Domain or IP (required): The primary address users will type in the browser. Enter a single DNS name or IP address; do not add *, https:// or a port. If an IP address is used, it must be assigned to one of the server's network adapters.
• Public HTTP port and Public HTTPS port: The ports of the web interface (usually 80 and 443).
• API internal port: The internal port of the main API service (default 7100). Clients use the API through IIS; do not open this port to the outside in the firewall.
• Notification internal port and RecordDevice internal port (optional): The local ports of these services (defaults 7102 and 7103).
• Generate self-signed certificate: Setup generates a certificate for this server. Browsers do not trust this certificate and show a warning; the certificate must be trusted on the clients. See Trusting the self-signed certificate.
• Use existing PFX certificate: The customer's certificate is used. Enter the PFX file path and the PFX password. The certificate must cover the primary address and all additional DNS names.

The ports must be between 1 and 65535 and must not conflict with each other.

Additional web addresses

• Additional addresses, separated with semicolons (optional): DNS names or IP addresses, other than the primary address, that the site responds to; for example office.example.com;192.168.1.20. Do not enter *.
• Create separate self-signed HTTPS certificate for additional local IPs (PFX): If the PFX certificate covers only the DNS name, this generates a separate self-signed certificate for the additional local IP addresses. It is selected by default in a new installation. This certificate must also be trusted on the clients.

Advanced settings

• Advanced backend and integration settings: If selected, the wizard also opens the Backend Env Values pages, which show the database connections and service addresses. Not needed for a normal installation.
• Internet profile: harden this server for direct internet access, Publish /mcp on the internet site, Allow plain HTTP (no redirect) and SystemAdmin sign-in only from these networks: Used if the server will be accessed from outside the plant network. See Internet and Network Access.

Engineering workstation

The option on this page of the wizard is only for the integrator's own engineering computer and is off by default. Leave it off at customer sites. The details are described in the help installed with the product.

SQL Server

The page title is SQL Server (required). The SQL Server instances on this computer are listed at the bottom of the page. In a new installation, the wizard preselects the server accordingly: localhost\SQLEXPRESS if SQLEXPRESS exists, otherwise localhost for the default instance, otherwise the only named instance. If the computer has no instance at all, Install local SQL Server Express is selected. To use a remote SQL Server, clear this option and enter the server name.

• Install local SQL Server Express: If selected, Setup installs SQL Server 2025 Express on this computer. The SQL Server field is then filled in from the instance name and cannot be changed; Use SQL authentication is off. The SQL Express installed by Setup uses Windows authentication only; the 2WinScada services connect to SQL Server with their own Windows identities.
• Instance name: The name of the instance to install; the default is SQLEXPRESS. The name must start with a letter and contain at most 16 letters, digits or underscores. MSSQLSERVER installs the default instance; the server name is then localhost. If an instance with this name already exists, Setup asks for confirmation: it does not install SQL Server Express, uses the existing instance as it is, and uninstall does not remove it.
• SQL data folder of the new SQL Express (database files go below it): The default is C:\Program Files\Microsoft SQL Server. To keep the database files off the operating system disk, choose for example D:\SQLData. The folder must be a full path on a local drive; the root of a drive cannot be used.
• SQL Server: If an existing server is used, the server and instance name; for example SERVER\SQLEXPRESS or server,1433.
• Database name (required): The wizard suggests a name in the form 2WinScada_<Company>. In a new installation, enter a name that does not exist yet; Setup creates the database. For the naming rules, see Path and name rules.
• Use SQL authentication: Select this if the installation account that Setup uses to create the database is a SQL login, and enter the SQL user and SQL password. If not selected, the Windows account that runs Setup is used.

If the computer already has another instance, the new SQL Express is installed next to it as a second instance. Because the two SQL Servers share the same memory, use the SQL Server memory limit on the Installation Paths page.

INFO

A database created outside Setup that contains data is not taken over directly in a new installation; Setup stops at the validation step. For an existing system, see the Upgrading page.

QuestDB

• Install QuestDB: If selected, Setup installs QuestDB on this computer and creates the Windows service named QuestDB:2WinScada.ArchiveDb. If not selected, an existing QuestDB server is used; the server address is entered on the Database and recovery page.
• QuestDB database name and QuestDB service name (fixed): The service name cannot be changed.
• QuestDB base data directory (required): The folder where archive data is kept. It must consist of ASCII characters and must not contain spaces.
• HTTP user / HTTP password and PG user / PG password: The accounts used to connect to QuestDB. Use different passwords.
• Enable read-only user: Optionally defines an additional QuestDB user that can only read.

QuestDB performance and ports

This page opens if a local QuestDB will be installed.

• Installed system memory and Recommended QuestDB profile: The wizard detects the computer's RAM and recommends a suitable profile.
• QuestDB memory profile: One of the 4, 8, 16 or 32 GB system memory profiles is selected. Details: QuestDB memory profile.
• HTTP port, ILP port and PGWire port: The defaults are 9000, 9009 and 8812 respectively. The values must be between 1 and 65535 and different from each other. The local QuestDB is installed so that it can only be reached from this computer (127.0.0.1).
• Upgrade the local QuestDB engine (requires a data backup): Appears only in an upgrade or repair. Do not select it in a normal upgrade; see Upgrading with Setup.

Database and recovery

• Initial admin password / repeat (install: 12+ characters): The password of the administrator account to be created in the new database. Type the password in both fields; the page does not close until the two fields match exactly, including upper and lower case. See Administrator account.
• SQL backup directory (required for upgrade and repair; path on SQL host): In an upgrade or repair, Setup first backs up the existing database to this folder. The path must be on the SQL server and must be writable by the SQL Server service account. If the server is an instance on this computer, the field is filled in with the instance's default backup folder. If you use a remote SQL Server, type the path instead of using the ... button.
• SQL application login / password / repeat (new account: 12+ characters): The SQL login the 2WinScada services use to connect to SQL Server. Required for a remote SQL Server. If the login does not exist on the server, Setup creates it; the password of a new login must be at least 12 characters long. The password of an existing login is not changed. If either the user name or the password is entered, the other is also required; the password is typed twice. If Install local SQL Server Express was selected, these fields are not used and are disabled.
• QuestDB host: The address of the computer where QuestDB runs.

If an existing SQL application login was entered, Setup tries to connect with this login and the entered password before the installation starts. If the password does not match, or the login is disabled or locked, the installation stops before it begins. If you use a login name left over from an earlier installation, enter that login's current password or have the SQL Server administrator reset the login. The installation also stops if SQL Server accepts Windows authentication only; in that case SQL Server and Windows Authentication mode must be turned on in SQL Server and SQL Server must be restarted.

Backend Env Values

Opens only if Advanced backend and integration settings was selected. Page (1/2) shows the database and QuestDB connections, page (2/2) shows the log folder and the service addresses. Fields left empty use the values generated by Setup. Reset this page to defaults resets only the values of that page.

Summary

Before installation, the mode, access address, ports, SQL Server and QuestDB choices (for a new SQL Express, the instance name and the data folder), the QuestDB profile and the location of the setup log are listed. If MQTT Publisher or MCP Server was selected, the setting to make in the web interface after installation is also noted. Check the values and start the installation.

When you continue from this page, Setup checks the settings on this computer without changing anything (SQL Server, disks, Windows policy); this can take up to a minute. If a setting cannot be used, the message The settings cannot be used on this machine. Nothing was changed. Use Back to correct them, then continue. is shown with the first error. Use Back to return to the page concerned and correct the value.

How the installation runs

When the installation starts, Setup does the following in order:

1. Validates the settings and the computer (ports, paths, permissions, connections).
2. Installs IIS, the IIS modules and the .NET 10 runtime if they are missing.
3. Installs SQL Server 2025 Express and QuestDB if selected.
4. Creates the database and adds the initial administrator account; creates the alarm and operation history tables in QuestDB.
5. Copies the application files and creates the Windows services, the IIS site, the certificate and the Windows Firewall rules.
6. Prepares the integrity protection of the administrator account (see Protecting the administrator account).
7. Starts the services and checks that they are running.

If the main API service does not become ready, the installation is rolled back. If an optional service (Notification, RecordDevice, MQTT Publisher, MCP Server) is started but does not become ready in time, the installation is not rolled back; it completes, and these services are listed as warnings at the end of the setup log. In that case, check the services after installation.

Setup limits the size and retention period of the service logs it creates and of the QuestDB logs.

If a restart is requested

The SQL Server installation or a pending Windows restart (for example one left by a SQL Server removal or an update) can stop the installation. In that case, nothing has been installed; Setup asks whether to restart Windows now and stops with the result Restart Windows, then run Setup again. Restart the computer and run Setup again with the same choices.

If the installation fails

If an error occurs during installation, Setup automatically rolls back its changes and shows the message "No new installation was completed". Even though the rollback has completed, nothing has been installed. Fix the first error in the details and run Setup again.

If the rollback cannot complete either, Setup shows the original error and writes it to the %ProgramData%\2WinScada\Logs\setup.log file. In this case:

• Do not delete the Setup operation logs or the lock and backup files under %ProgramData%\2WinScada.
• Do not start the services by hand.
• Fix the error and open Setup again; Setup offers recovery again.

Share the log and installation files only with the 2WinScada support team, over a secure channel.

Activation

The installation can be completed without a license. The Activation page shows where the license file is expected (License file); Open License Folder opens this folder. The license file is obtained through a license request file and imported with License Manager.

If License Manager was selected, a 2WinScada License Manager shortcut is added to the desktop and to the Turkuvaz Inovasyon folder in the Start menu. The shortcut opens with administrator rights and asks for UAC confirmation. Details: License.

Setup Completed

On the last page:

• Open deployment report: Shows the result report of the operation. The report is also saved to the %ProgramData%\2WinScada\InstallerRuntime\deployment-result.json file.
• Open Web Interface: Opens the web interface in the browser.

If MCP Server was installed, the page also reminds you to create an API key for the MCP client (see MCP access).

First sign-in and accounts

Administrator account

Setup creates the initial administrator account in the new database and assigns the password entered in the wizard; the account's username is given in the help installed with the product. This account is in the SystemAdmin group:

• SystemAdmin accounts are for the integrator's system administration; they are managed separately from the customer's Administrators accounts and are not listed on the user management screen.
• Configuration backups do not include SystemAdmin accounts. Keep the password in a password manager.
• If the password is forgotten, it cannot be recovered with Forgot password. See If the password is forgotten or sign-in is rejected.

Use this account only for integrator administration. Create personal accounts in the Administrators group for the customer's administrators, and personal accounts for the operators. See User and Group Management.

Password rules: new passwords must be at least 10 characters long, SystemAdmin passwords at least 12 characters. Many failed sign-ins in a short time temporarily lock the user name or the client address concerned.

Sample operator and monitoring accounts

In a new installation, the main API service creates two sample accounts when it starts for the first time:

Account	Group	Permissions
Operator account	Operators	Operate, Monitor, Alarm, Report, recipe apply
Monitoring account	Monitors	Monitor

These accounts are created without a password and cannot sign in until a password is given.

To use the accounts:

1. Sign in with the administrator account and open the Users tab.
2. Give a temporary password with Password Reset on the row of the account.
3. Pass the temporary password to the user. At the first sign-in, the user is taken to the Change your password screen and cannot do anything else until they set their own password.

Details: User and Group Management.

• Accounts whose password has never been set cannot get a password with Forgot password; only an administrator gives the first password.
• The accounts are created only once, in a new installation. If they are deleted, they are not created again. They are not added to upgraded installations.
• If possible, give each person their own account instead of shared accounts.

Sample project

On a new database, the main API service creates a simulated sample project when it first starts: in the Örnek Proje (Sample Project) folder, the pages Genel Bakış (Overview, the landing page with an isometric plant view), Tesis Yerleşimi (Plant Layout, the plant seen from above), Tesis Özeti (Plant Summary), Pompa İstasyonu (Pump Station) and Enerji Analizörü (Energy Analyzer); the active devices Demo (pump station), Trafo1_EA and Trafo2_EA (energy analyzers) on the Internal channel; 48 simulated tags; and two consumption log definitions for the KWH energy counters of the two analyzers (Cyclic, 60 seconds, Cumulative, 12 months retention). Enerji Analizörü is a template page that shows how the same page is used for several devices with a tag prefix (see Explore the sample project). The simulated pump is running from the first start; the pages show live values when they are first opened. The sample project does not come with historical data; the consumption logs write records from the time of installation. It is not added to existing customer databases.

• The three active devices of the sample project use 3 devices and 48 tags of the license capacity; the limit of the Starter package is 10 devices and 500 tags (see License). Log definitions do not count toward the capacity.
• To stop the simulation, set the Demo, Trafo1_EA and Trafo2_EA devices to inactive; the pages remain, and the consumption logs stop writing records.
• If you want to remove the sample, first make another page the landing page. Then delete the three devices: first Trafo1_EA and Trafo2_EA, then Demo (Trafo1_EA reads tags of the Demo device). The tags of the devices and the two consumption log definitions are deleted with the devices; the archived log data is not deleted. Then delete the five pages (Genel Bakış, Tesis Yerleşimi, Tesis Özeti, Pompa İstasyonu, Enerji Analizörü) and the now empty Örnek Proje folder; a folder can only be deleted when it is empty. Do not delete the Internal channel (see Internal (Memory Channel)). Instead of deleting the Demo task center and the Demo process group, renaming them for the project is recommended, because devices added later can also use them.

Protecting the administrator account

SystemAdmin accounts are protected by an additional integrity protection. When there is a problem with this protection, a SystemAdmin integrity warning card is shown to the users of the SystemAdmin and Administrators groups on the System Information page (see System Information page). In that case, contact your system integrator. How the protection works and the installer steps are described in the help installed with the product.

Uninstalling and reinstalling

Uninstalling always keeps the license information. Upgrade and repair keep the existing database. The steps for the administrator account when reinstalling and when the database is moved are described in the help installed with the product.

If the password is forgotten or sign-in is rejected

The SystemAdmin password cannot be recovered with Forgot password. Another SystemAdmin account can reset the password from the web interface. If the password is forgotten, or sign-in is rejected even with the correct password, your system integrator re-enables the account on the server with the local recovery tool. The administrator account recovery steps are described in the help installed with the product.

MCP access

MCP Server is closed to anonymous access; each client connects with an API key that belongs to its own user. To connect an MCP client:

1. Sign in to the web interface with an administrator account.
2. On the API Keys screen, select the user who will access and create a new key with MCP access as the Purpose.
3. The key is shown only at the moment it is created; copy it to a safe place.
4. In the MCP client, define the key as the ApiKey HTTP header.

Requests run with the role and process group permissions of the user the key is bound to. You do not need to run Setup again for MCP.

Checks after installation

• The deployment report shows that the installation completed (InstallationCompleted is true).
• In the Windows Services list, the installed 2WinScada services and the local QuestDB service are Running. If the setup log listed an optional service that was not ready as a warning, check that service's status and log.
• The web interface opens at the primary address and the additional addresses; there is no certificate warning on HTTPS, or the self-signed certificate has been trusted on the clients.
• You can sign in with the administrator account; the System Information page shows the services as running and there is no warning card.
• The license has been imported and verified.
• If MQTT Publisher was installed, the broker has been entered and saved on the Settings > MQTT Publisher Settings page; if MCP Server was installed, API keys have been created for the clients.
• The %ProgramData%\2WinScada\Logs\setup.log file contains no errors.

Silent installation

Setup can also run without showing the wizard, using a settings file. Because the settings file contains passwords, it must be kept in a folder that only administrators can access. The command line and the exit codes of the silent installation are described in the help installed with the product.