Install the R1Soft Server Backup agent on Windows Server

R1Soft's Windows agent is the same product as the Linux build but with a different driver path: block-level reads come through a kernel-mode filter driver (r1soft.sys) on top of NTFS, and application consistency is delegated to Microsoft Volume Shadow Copy Service. That matters because most Windows targets in a hosting fleet run Plesk on Windows, SQL Server, or IIS — none of which yield a clean recovery point without a VSS writer in the loop.

This guide installs the agent on Windows Server 2019 or 2022, registers the kernel driver without a reboot when possible, sets the agent password, opens the firewall, and proves the VSS writers are wired correctly before you cut the first disk safe. End-to-end on a typical Plesk box: about 20 minutes.

Prerequisites

• Windows Server 2019 or 2022, fully patched (Server 2016 still works but kernel driver signing is fussier — upgrade if you can)
• Local administrator rights, not just Backup Operators
• Outbound TCP/443 to download the installer
• Inbound TCP/1167 from your SBM
• A working SBM 6.16 or newer with a valid R1Soft license
• VSS service set to Automatic (Delayed Start) — services.msc → Volume Shadow Copy

Download and run the installer

Grab the current MSI from downloads.r1soft.com/server_backup_windows/. Use the 64-bit build — the 32-bit installer is still published but only relevant for ancient Windows 2008 boxes you should not be backing up in 2026.

$msi = "C:\Temp\ServerBackup-Agent-windows-amd64.msi"
Invoke-WebRequest -Uri "https://downloads.r1soft.com/server_backup_windows/ServerBackup-Agent-windows-amd64.msi" -OutFile $msi
msiexec /i $msi /qn /l*v C:\Temp\r1soft-install.log

The silent install completes in two to three minutes. It drops the agent under C:\Program Files\R1Soft\Server Backup Agent\, registers the R1Soft Server Backup Agent Windows service, and installs the r1soft.sys filter driver under C:\Windows\System32\drivers\. A reboot is only needed if the driver fails to attach on a busy volume — see the gotchas section.

Confirm the service is up:

Get-Service "R1Soft Server Backup Agent" | Select Status, StartType

You want Running and Automatic. If it shows Stopped, check C:\Temp\r1soft-install.log for Custom action failed lines — the most common cause is a third-party endpoint protection product blocking the driver install.

Set the agent password and SBM whitelist

The Windows agent ships with no password and an empty IP allow list. It refuses connections until both are set. Use the serverbackup-setup CLI shipped with the agent:

cd "C:\Program Files\R1Soft\Server Backup Agent\bin"
.\serverbackup-setup.exe --set-agent-password
.\serverbackup-setup.exe --add-server 10.20.30.40

The first command prompts twice for the password — pick a per-host secret, not a fleet-wide one, and store it in your password manager keyed to the hostname. The second adds the SBM's IP to the allow list; repeat for every SBM that should pull from this agent. Replication targets do not need to be added — they talk to the primary SBM, not the agent.

Verify both:

.\serverbackup-setup.exe --get-configuration | Select-String -Pattern "server|password"

The output lists the allowed servers and confirms a password is set. The hash is never echoed, by design.

Open the Windows firewall

The agent listens on TCP/1167. Open it only to your SBM's IP — exposing 1167 to the internet is one of the few R1Soft footguns that has shown up in real breach postmortems.

New-NetFirewallRule -DisplayName "R1Soft Agent (SBM only)" `
  -Direction Inbound -Protocol TCP -LocalPort 1167 `
  -RemoteAddress 10.20.30.40 -Action Allow -Profile Any

If the SBM lives in a separate VLAN, add the SBM subnet rather than a single IP. Don't widen to Any — there is no scenario in a hosting fleet where the agent port should accept arbitrary connections.

Register the host on the SBM

On the SBM web UI:

1. Servers → Add Server
2. Hostname or IP: the management IP of the Windows host
3. Port: 1167
4. Agent password: the secret you set above
5. Operating System: Windows
6. Click Save and test — the SBM opens a connection, exchanges the auth token, and reports the kernel driver version

If the test fails with Connection refused, the firewall is blocking. Authentication failed means the password mismatches. Driver not loaded means the kernel filter didn't attach — see the gotchas section.

Create the disk safe and policy

Disk safe creation is identical to Linux. Pick a target volume on the SBM with enough free space for the source's full image plus a few weeks of changes. R1Soft deduplicates at the block level, so plan for roughly 1.3 to 1.6× the source for a Plesk box with active mail and SQL.

The interesting Windows-specific part is the policy. Under Policies → New → Replication tab, R1Soft auto-detects VSS writers on the agent. On a Plesk-on-Windows server you should see at least:

• Microsoft Writer (System) — boot and system state
• NTDS Writer — only if this is a domain controller, otherwise absent
• SqlServerWriter — present when MSSQL is installed (Plesk on Windows pulls it in)
• IIS Metabase Writer and IIS Config Writer — IIS configuration consistency
• BITS Writer, Registry Writer, Shadow Copy Optimization Writer — system writers

Enable Application Consistent Backups in the policy and tick every writer except Shadow Copy Optimization Writer. That last one is a system writer, not an app — leaving it on adds shadow-copy churn for no gain.

Prove the backup is application-consistent

Run the first recovery point and check three things:

vssadmin list writers | Select-String -Pattern "Writer name|State"

Every enabled writer in the policy should show State: [1] Stable immediately after the backup finishes. A [8] Failed or [9] Last operation failed means the writer aborted — open the matching Windows Event Log under Applications and Services → Microsoft → Windows → BackupOperations.

On the SBM, open the recovery point and browse to a Plesk mail directory or a SQL data file. If you can mount the disk safe as a read-only volume on the SBM and the SQL database attaches cleanly to a test instance, the backup is genuinely application-consistent. A backup that "completes" but won't attach is a crash-consistent backup with a fancier name — that is exactly the failure mode you are paying R1Soft to avoid.

Common gotchas

• Driver fails to attach on the system volume. Endpoint protection (CrowdStrike, SentinelOne, Defender for Server) intercepts filter driver loads. Add C:\Windows\System32\drivers\r1soft.sys and the agent service binary to the EPP allow list, then reboot.
• serverbackup-setup.exe returns Access denied. UAC is silently downgrading the prompt. Right-click PowerShell → Run as Administrator even if your account is in the local admins group.
• Backups complete but Plesk mail is missing recent messages. The agent does not run a VSS quiesce on Plesk's MailEnable spool because there is no Plesk-specific writer. Schedule the backup during the lowest mail-receive window and accept the crash-consistent reality for the mail store, or take a separate Plesk-side backup with Plesk Backup Manager for mail only.
• First backup is very slow over a 1 Gbps link. The initial sweep reads the entire used portion of every protected volume. Throttle or schedule accordingly — see bandwidth and I/O throttling.
• Recovery point fails with VSS_E_INSUFFICIENT_STORAGE. The system volume needs free space for VSS shadow storage during the quiesce — the rule of thumb is 10% of the protected volume, minimum 5 GB. Set the shadow storage limit with vssadmin resize shadowstorage.

FAQ

Next steps

• Pair this agent with offsite copies: R1Soft Disk Safe replication.
• Size the SBM for a mixed Linux and Windows fleet: R1Soft SBM sizing.
• Buy or renew: R1Soft license.