Enrolling a Windows Device

This guide walks through connecting a Windows device to GateBeacon using a native SSH reverse tunnel. Confirm your Windows version meets the minimum in Supported Operating Systems before you begin.

Step 1 — Start the Enrollment Wizard

Log in to the customer portal and go to Devices.
Click Add your device.
On Step 1 — Select device operating system, choose Windows.
Review and accept the Terms & Conditions and Acceptable Use Policy.
Click Next to generate a one-time enrollment token and advance to Step 2.

Step 2 — Run the Setup Command

Click Copy full command to copy the one-time PowerShell setup command.
On the Windows device, open PowerShell as Administrator.
Paste and run the command.

The installer will:

Install the Windows OpenSSH Client optional feature, if it isn't already enabled.
Generate a dedicated ed25519 SSH keypair directly on the device. The private key never leaves the device, and its file permissions are restricted to the Administrators group so the background scheduled task (which runs as SYSTEM) can use it.
Register the device with GateBeacon, sending the newly generated public key.
Receive back an assigned SSH username, a dedicated remote port, and the tunnel server's host-key fingerprint — the device pins this fingerprint rather than trusting it on first use.
Install and start a scheduled task that keeps the reverse SSH tunnel connected in the background.

Step 3 — Confirm Enrollment

The wizard will show the same success confirmation once the device checks in, and the device will appear in Devices with an Online status.

How the Tunnel Is Secured

Each device's SSH key is scoped so it can only open its one assigned remote port — it cannot open an interactive shell on GateBeacon's infrastructure, and it cannot reach any other device's tunnel. This scoping happens automatically; there's nothing to configure.

Next Steps

Publishing an IIS website: see Publishing IIS Websites.
Publishing any other local HTTP application: see Publishing an App over HTTPS.