# Enrolling a Windows Device

# Enrolling a Windows Device

This guide walks through connecting a Windows device to GateBeacon using a native SSH reverse tunnel. Confirm your Windows version meets the minimum in [Supported Operating Systems](/books/gatebeacon-documentation/page/supported-operating-systems) before you begin.

## Step 1 — Start the Enrollment Wizard

1. Log in to the customer portal and go to **Devices**.
2. Click **Add your device**.
3. On **Step 1 — Select device operating system**, choose **Windows**.
4. Review and accept the Terms & Conditions and Acceptable Use Policy.
5. Click **Next** to generate a one-time enrollment token and advance to Step 2.

## Step 2 — Run the Setup Command

1. Click **Copy full command** to copy the one-time PowerShell setup command.
2. On the Windows device, open **PowerShell as Administrator**.
3. Paste and run the command.

The installer will:

1. Install the **Windows OpenSSH Client** optional feature, if it isn't already enabled.
2. Generate a dedicated ed25519 SSH keypair directly on the device. The private key never leaves the device, and its file permissions are restricted to the Administrators group so the background scheduled task (which runs as SYSTEM) can use it.
3. Register the device with GateBeacon, sending the newly generated public key.
4. Receive back an assigned SSH username, a dedicated remote port, and the tunnel server's host-key fingerprint — the device pins this fingerprint rather than trusting it on first use.
5. Install and start a scheduled task that keeps the reverse SSH tunnel connected in the background.

## Step 3 — Confirm Enrollment

The wizard will show the same success confirmation once the device checks in, and the device will appear in **Devices** with an **Online** status.

## How the Tunnel Is Secured

Each device's SSH key is scoped so it can **only** open its one assigned remote port — it cannot open an interactive shell on GateBeacon's infrastructure, and it cannot reach any other device's tunnel. This scoping happens automatically; there's nothing to configure.

## Next Steps

- Publishing an IIS website: see [Publishing IIS Websites](/books/gatebeacon-documentation/page/publishing-iis-websites).
- Publishing any other local HTTP application: see [Publishing an App over HTTPS](/books/gatebeacon-documentation/page/publishing-an-app-over-https).