Install on Windows

From the signed MSI to a server people sign in to: the licence, IIS and HTTPS, OpenBI Accounts, the first administrator and a clean doctor. Each step is a command, so IT or their agent can run it start to finish.

Before you start

• The machine: 64-bit Windows that stays on, and an administrator’s account on it. The installer brings .NET and the engine with it; IIS is set up by a command, below.
• Your licence, for your domain (norwayanalytics.no in the examples): buy it on the server’s setup page once it is installed (see Buy OpenBI Server), or have its key at hand.
• DNS: bi.<your domain> and accounts.<your domain> pointing to the server. Your two addresses explains both.
• The firewall: TCP 443 in for people; port 80 too if Let’s Encrypt issues your certificates. Out: HTTPS to api.keygen.sh; with a seat licence, to the seller’s billing service at billing.querex.no; to Let’s Encrypt, if it issues your certificates, for them and for their renewals, which run by themselves; and, while you set it up, to Microsoft’s and GitHub’s download sites.
• A mailbox to send invitations from, such as support@norwayanalytics.no (optional, but people then get their invitations by e-mail).

Check the installer’s signature

The status must be Valid, the signer Norway Analytics, and its thumbprint 48D6BE98B89BE0766F85A2BC9136C85409B569D7:

Get-AuthenticodeSignature .\OpenBI-Server-0.1.49-x64.msi | Format-List Status, SignerCertificate

Install

Double-click the MSI and follow it: the licence terms, the folder (C:\Program Files\OpenBI Server unless you choose another), then Install. On the last page, Open the setup page is ticked: it opens the server’s setup page, where you buy OpenBI Server or add your licence next.

Or install it silently, in a Command Prompt opened as administrator. You can give the domain and its licence key here, which saves the next step:

msiexec /i OpenBI-Server-0.1.49-x64.msi /qn DOMAIN=norwayanalytics.no LICENSE_KEY=<licence key> /l*v "%TEMP%\openbi-server-install.log"

The installer keeps the key out of its log. If the licence can’t be activated then (no internet, a mistyped key), the installation still finishes, and doctor says what to run. The installer starts both services.

What it installs

Neither service is reachable from the network: IIS, set up below, holds the public names and passes requests on.

Add your domain’s licence

Skip this if you gave DOMAIN and LICENSE_KEY to msiexec. Otherwise, on the server itself, open http://localhost:5780/ (the setup page):

• Buy OpenBI Server buys a seat licence, or starts a free trial, and the server adds the licence by itself once it is paid, or a trial’s card is registered: see Buy OpenBI Server.
• I have a license key: type your server’s web address (the domain, or an address you paste) and the licence key, then Add.

The page answers on the server only, and without a sign-in only until sign-in is set up: after that, add a domain with the command line.

Or from the command line. Without --key, it asks for the key, hidden:

cd "C:\Program Files\OpenBI Server"
OpenBI.Server.exe domain add norwayanalytics.no

The server answers only for its licensed domains and their subdomains. The licence explains what activation sends and what happens offline.

Put IIS in front

IIS holds your public names, the certificates and ports 80 and 443, and passes each request to the service its name is for. One command sets it up for an address. Without --apply it changes nothing and lists the steps, each done or to do:

OpenBI.Server.exe iis setup --host bi.norwayanalytics.no
OpenBI.Server.exe iis setup --host bi.norwayanalytics.no --apply
OpenBI.Server.exe firewall --apply

• What iis setup --apply does: adds the Web Server role if it’s missing; installs Microsoft’s URL Rewrite and Application Request Routing (ARR), downloaded from Microsoft (installing ARR restarts IIS); and makes the site “OpenBI Server” in C:\inetpub\openbi-server, with its own application pool, letting uploads as large as publishing takes through.
• ARR’s timeout is set to 30 minutes so long queries are answered. It is a setting of the whole IIS server; --keep-timeout leaves it as it is.
• firewall --apply opens TCP 80 and 443 inbound in Windows Firewall. The services’ own ports stay closed.
• It refuses a name no licence on the server covers: add the licence first.

HTTPS

A Let’s Encrypt certificate for the address, issued, installed in IIS and renewed by win-acme, which the command downloads the first time. --email is IT’s address, for Let’s Encrypt’s notices. Then send http:// to https://:

OpenBI.Server.exe https letsencrypt --host bi.norwayanalytics.no --email it@norwayanalytics.no --apply
OpenBI.Server.exe https redirect --apply

Let’s Encrypt checks the address from the internet on port 80. For a server reached from the office only, use a certificate of your own: see Office only, with internal DNS. For a made-up domain, such as openbi.home.arpa, the server makes its own with https local: see No domain yet: a made-up one.

OpenBI Accounts and sign-in

Give OpenBI Accounts its address and your company’s name, which people see on its pages, and restart it to take them; put it behind IIS with its own certificate; then sign people in there, and restart the server to take that:

OpenBI.Server.exe accounts setup --public-url https://accounts.norwayanalytics.no --name "Norway Analytics AS"
OpenBI.Server.exe accounts service restart
OpenBI.Server.exe iis setup --host accounts.norwayanalytics.no --apply
OpenBI.Server.exe https letsencrypt --host accounts.norwayanalytics.no --email it@norwayanalytics.no --apply
OpenBI.Server.exe signin use-accounts --server-url https://bi.norwayanalytics.no
OpenBI.Server.exe service restart

Using Microsoft Entra ID, Okta or another OpenID Connect provider instead? Skip these lines and see Your own sign-in provider.

E-mail for invitations

Optional, but without it invitations are links you hand over yourself, and the sign-in page has no “Forgot your password?”. Through Microsoft 365 it sends as one mailbox; any SMTP server works too. The command asks for the client secret, hidden:

OpenBI.Server.exe accounts mail set --graph --tenant <tenant id> --client-id <app id> --from support@norwayanalytics.no
OpenBI.Server.exe accounts mail test --to it@norwayanalytics.no

E-mail from your own mailbox covers the app registration, SMTP and the SPF, DKIM and DMARC check.

The first administrator

Server administrators create workspaces, look after people and see the admin portal. Invite the first one, then make them an administrator:

OpenBI.Server.exe accounts user invite --email kari@norwayanalytics.no --name "Kari Nordmann" --domain norwayanalytics.no
OpenBI.Server.exe admin add --email kari@norwayanalytics.no

With e-mail set up, Kari gets the invitation by e-mail; without it, the command prints the link to give her (it works once, for 7 days). She chooses a password, adds her phone’s authenticator app, and opens bi.norwayanalytics.no. From then on she adds the other administrators herself, in the portal: Settings (the gear), Users, a person’s … menu, Make server administrator.

Check everything

OpenBI.Server.exe doctor

doctor checks Windows, the services and the data folder, each licence and the connection to Keygen, the clock, OpenBI Accounts and the sign-in, the engine, the bill of materials, IIS, each address through IIS, its certificate and the firewall. It changes nothing; each problem comes with the command that fixes it. Run it after setting up, after an upgrade, and whenever something seems wrong.

The services and their logs

OpenBI.Server.exe status
OpenBI.Server.exe service restart
OpenBI.Server.exe accounts service restart
OpenBI.Server.exe logs --lines 100
OpenBI.Server.exe accounts logs

• status shows both services, the licences, IIS and HTTPS at a glance.
• The logs are in C:\ProgramData\OpenBI Server\logs\ (server-… and accounts-…). When a service doesn’t start, Windows’ Application log has its events under “OpenBI Server” or “OpenBI Accounts”.
• A change of sign-in takes effect when the server’s service restarts; the command says so.

Next steps

• Create a workspace and add people.
• Publish a model from OpenBI Studio.
• Plan backups and upgrades.
• For lakes and map backgrounds, set up DuckDB’s extensions: The extension gate.
• AI agents stay off until you turn them on: AI agents on the server.

Frequently asked questions

Can it run on Server Core, without a browser?

Yes. Every step above is a command, and the setup page has its command too: OpenBI.Server.exe domain add <domain>.

Our servers reach the internet through a proxy

Set Windows’ proxy for services, as doctor suggests when api.keygen.sh doesn’t answer: netsh winhttp set proxy <proxy:port>. Then run doctor again.

How do we uninstall it?

Apps & features, or msiexec /x OpenBI-Server-0.1.49-x64.msi /qn. Both services and the program go; the data folder stays, so a reinstall picks up where it was. Before you take a server down for good, free its licence with OpenBI.Server.exe domain remove <domain>. An older version can’t be installed over a newer one: see Upgrade and rollback.

Last updated 6 November 2026 · OpenBI Server 0.1.49