Enshrouded dedicated server: Windows install, query port and user groups

What Keen specifies for the hardware

Keen publishes two reference builds, and says the load depends mainly on how many players are active. Both call for SSD storage with at least 30 GB free and an upload of 2 Mbit/s per player, with download roughly matching upload.

The FAQ adds the process view: about 4.4 GB of physical RAM at idle, up to 100 MB more per player, and no more than 6 GB in total. The server files are about 13 GB uncompressed. A world save runs from 1 MB on a fresh map to around 100 MB on a world with large bases, and the server writes one every 5 minutes. Read together, the two articles put a 16 GB machine around a process that should stay under 6 GB, which leaves the rest for Windows.

Keen's CPU figures pair cores with clock speed: a 6-core, 3.2 GHz chip for four to six players and an 8-core, 3.7 GHz chip for sixteen. Check a machine against both numbers on the Intel processor list, base and turbo clocks as well as cores.

Windows only, and what that means here

Keen's installation article says it plainly: for now only Windows is supported, and Linux support is planned for later. The Steam entry for app 2278520 lists Windows as its only platform. So the supported way to run this server is a Windows install on the machine.

On our lines Windows Server is an install option up to 2025 on the x86 lines that offer it; it is not available on ARM. It is a paid licence billed monthly on top of the machine and counted per core, and it takes no prepay discount. That is a real cost on a high-core box, so size the machine to Keen's figures rather than buying cores beyond them.

Linux hosting through Wine or Proton exists only as community projects. Valve's SteamCMD can fetch the Windows build on a Linux host with @sSteamCmdForcePlatformType windows, but Keen neither documents nor supports running the result under a compatibility layer. If you go that way, you own every breakage after a game update.

Install with SteamCMD

Keen's own route goes through Steam: owning the game unlocks the server under Tools in the library. On a server, Valve's SteamCMD does the same job without a desktop Steam client. Valve's wiki says to set the install directory before logging in; it also notes that an anonymous login fetches most servers, though some require a Steam account.

1. Download steamcmd.zip from Valve and extract it to a folder such as C:\steamcmd.
2. Run the command below from that folder. If the anonymous login is refused for this app, replace anonymous with a Steam account that owns Enshrouded.
3. Start the server executable from the install folder once (Keen's config article calls it enshrouded_server.exe). Do not use a Launch button; Keen recommends running the .exe directly.
4. Stop it. The first run has written enshrouded_server.json next to the executable; that is the file you edit.

steamcmd +force_install_dir C:\enshrouded +login anonymous +app_update 2278520 validate +quit

The server is ready when the console window and the log show the session reaching Host_Online. To update, stop the server and run the line again; validate can be dropped for routine updates. Valve's wiki describes it as a check for missing or corrupted files, and it overwrites any changed game files.

enshrouded_server.json, field by field

• name: what every player sees listed in the in-game browser.
• saveDirectory: world saves, default ./savegame. Character progress is not here; Keen stores it on the clients.
• logDirectory: default ./logs, with older logs moved to ./logs/backup automatically.
• ip: bind address, default 0.0.0.0. Change it only for an internal network layout.
• queryPort: default 15637; Keen says to change it to suit your firewall.
• slotCount: a number from 1 to 16. Each slot adds load; Keen suggests lowering it if CPU or RAM is the bottleneck.
• gameSettingsPreset: Default, Relaxed, Hard, Survival or Custom. Only Custom reads the individual values in the gameSettings section.

Out-of-range numbers in gameSettings are clamped to the minimum or maximum. Invalid text stops the server from booting and names the bad value in the console. If an update leaves the file in a bad state, Keen's fix is to delete it and let the next start write a fresh one: keep a copy first, because it holds your passwords.

Passwords and user groups

Since Update 2, access is controlled by userGroups, not the old top-level password line, which no longer sets the dedicated server's password. If the server finds a value there, it builds a single group called default from it with Friend-level rights. A fresh file starts with Admin, Friend and Guest groups (plus Visitor in current versions) and randomised passwords. The password a player types decides which group, and so which rights, they get.

"userGroups": [
  {
    "name": "Admin",
    "password": "long-random-secret-1",
    "canKickBan": true,
    "canAccessInventories": true,
    "canEditBase": true,
    "canExtendBase": true,
    "reservedSlots": 1
  },
  {
    "name": "Guest",
    "password": "long-random-secret-2",
    "canKickBan": false,
    "canAccessInventories": false,
    "canEditBase": false,
    "canExtendBase": false,
    "reservedSlots": 0
  }
]

Treat every group password as a secret. The Admin one can kick and ban. Do not paste the file into a ticket, a screenshot or a public repository, and restrict who can read the server folder on the machine. reservedSlots keeps places free for a group, so an Admin can still join a server full of Guests.

Ports and the firewall

Keen's FAQ names one port of its own, queryPort 15637, and points to Valve's Required Ports for Steam article for the rest. The server uses IPv4, which suits our machines: each comes with one IPv4 address. Keen does not state a protocol for the query port, so the rule below, our suggestion rather than Keen's, allows the program instead of guessing at one.

New-NetFirewallRule -DisplayName "Enshrouded server" -Direction Inbound -Program "C:\enshrouded\enshrouded_server.exe" -Action Allow

Players find the server in the in-game browser after enabling the dedicated-server filter. If it does not appear, Keen's documented workaround is a Steam favourite entered as IP plus query port, as in 203.0.113.10:15637. Keep Remote Desktop off the open internet where you can, and use a long password on the Windows account.

Running it on our machines

Each of the machines for game servers is a physical server leased whole: no other tenant on the cores the world simulation runs on, and an unmetered port, 1 Gbps on 10 of the 18 configurable lines and 500 Mbps on the others. Keen's 2 Mbit/s per player means a full 16-slot server wants about 32 Mbit/s of upload by our arithmetic, a small fraction of either port; traffic is not counted at all.

• Rack servers and blades carry an out-of-band controller (iLO, iDRAC or a Supermicro BMC): a browser console that still works when Windows Update or a firewall rule locks you out of RDP.
• Approval of the order starts the clock: about 30 minutes for a racked machine; a build to your spec needs 4-24 hours.
• Five cities on our own network AS19624: pick the one nearest your players on the locations page.

Back up savegame and enshrouded_server.json together. Keen documents no live backup procedure, so the safe copy, in our view, is taken with the server stopped.

When this is the wrong machine

If you want Linux and no Windows licence, Enshrouded is the wrong game for that today; a natively supported Linux server such as a Valheim world fits that plan better. And if four friends play a few evenings a week, Keen's peer-to-peer hosting from inside the game may be all you need.