ICARUS dedicated server on Windows: install, settings, firewall and prospect backups

What the RocketWerkz wiki specifies

The reference is the IcarusDedicatedServer repository on GitHub, published by RocketWerkz: a wiki covering setup, configuration, RCON commands and save migration, plus a sample ServerSettings.ini. Everything stated here about the server comes from that wiki, the sample file or the studio's Steam patch notes.

With no official sizing, this page states none. Run a session with your real group, watch the server process in Task Manager, and size from that.

Windows only: the licence and the Linux question

Every path in the wiki is a Windows path and the settings folder is literally named WindowsServer; the guide documents no Linux build. On our side Windows Server installs in one click, from 2008 R2 up to 2025 on the widest lines; which versions a machine offers depends on its line, and no ARM line runs it. The licence is paid, priced by core count, billed monthly on top of the machine and excluded from prepay discounts, so a modest core count keeps the licence line small.

Wine or Proton on Linux: a route players found, not one RocketWerkz documents. Valve documents @sSteamCmdForcePlatformType windows for fetching a Windows server on Linux, but nothing in the ICARUS wiki covers running it under a compatibility layer, and any game update can break it.

Account, folders, firewall and the boot task

The server needs no administrator rights, so it gets a standard local account named icarus. Run this once in an elevated PowerShell before the server exists. It creates the account (the password is typed at a hidden prompt and never lands in history), gives icarus modify rights on the install, data and backup folders but only read and execute on the folder holding the start script, turns the firewall on so that, apart from the rules Windows already ships switched on, the only inbound openings are Remote Desktop and the two game ports, and registers a task that will launch the script at boot as icarus.

$pw = Read-Host -AsSecureString "Password for the icarus account"
New-LocalUser -Name icarus -Password $pw -PasswordNeverExpires -Description "ICARUS dedicated server"
New-Item -ItemType Directory -Force -Path C:\steamcmd, C:\IcarusServer, C:\IcarusData, C:\IcarusBackup, C:\IcarusTools
foreach ($d in "C:\steamcmd", "C:\IcarusServer", "C:\IcarusData", "C:\IcarusBackup") {
  icacls $d /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "icarus:(OI)(CI)M"
}
icacls C:\IcarusTools /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "icarus:(OI)(CI)RX"

# keep Remote Desktop reachable, then enforce the firewall
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True -DefaultInboundAction Block
foreach ($proto in "UDP", "TCP") {
  New-NetFirewallRule -DisplayName "ICARUS $proto 17777+27015" -Direction Inbound -Action Allow -Protocol $proto -LocalPort 17777,27015
}

# boot-time task under the icarus account (registered now, started later)
$plain = [System.Net.NetworkCredential]::new("", $pw).Password
$act = New-ScheduledTaskAction -Execute "C:\IcarusTools\start.bat"
$set = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero)
Register-ScheduledTask -TaskName IcarusServer -Action $act -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings $set -User icarus -Password $plain
Remove-Variable plain

Valve's server-query page says Steam queries travel as UDP packets. The wiki names no protocol for 17777, so these rules allow both protocols on 17777 and 27015; that choice is ours. Neither rule names an address, so IPv6 is covered with IPv4. The zero execution limit matters: by default Task Scheduler ends a task after 72 hours. Restrict the Remote Desktop rule to your own addresses as described on our Windows RDP server page.

ServerSettings.ini and where the passwords go

Both secrets belong in the settings file, and the wiki documents no command-line flag for either, so neither ever shows in a process list. The file is normally written on the first lobby or prospect; the wiki's workaround is to place the sample yourself. With -UserDir=C:\IcarusData it goes in C:\IcarusData\Saved\Config\WindowsServer\ServerSettings.ini, readable only by administrators and icarus thanks to the folder rights above.

[/Script/Icarus.DedicatedServerSettings]
SessionName=
JoinPassword=a-join-password-for-your-group
MaxPlayers=8
AdminPassword=a-long-admin-password-used-nowhere-else
ShutdownIfNotJoinedFor=-1
ShutdownIfEmptyFor=-1
AllowNonAdminsToLaunchProspects=False
AllowNonAdminsToDeleteProspects=False
LoadProspect=
CreateProspect=
ResumeProspect=True
LastProspectName=

• AdminPassword: set it. The wiki warns that if it is empty, /AdminLogin alone grants admin to anyone.
• JoinPassword: empty means an open server.
• SessionName does nothing today; the browser name comes from -SteamServerName= (64 characters at most).
• AllowNonAdminsToLaunchProspects defaults to True, letting anyone in the lobby create or load a prospect. False reserves that for admins.
• ShutdownIfNotJoinedFor and ShutdownIfEmptyFor default to 300 seconds, after which the server drops back to the lobby; a negative value runs indefinitely.
• ResumeProspect=True reloads LastProspectName at startup. The wiki gives the startup order as LoadProspect, then ResumeProspect, then CreateProspect.

The start script: update, archive, launch

The wiki updates with SteamCMD and app_update 2089300 validate, then launches the executable with flags. This script does both, plus a backup, every time the task starts:

@echo off
rem C:\IcarusTools\start.bat - runs as icarus at every boot
rem 1. update; a failed update does not stop the lines below
C:\steamcmd\steamcmd.exe +force_install_dir C:\IcarusServer +login anonymous +app_update 2089300 validate +quit
rem 2. archive the prospects while the server is not running
powershell -NoProfile -Command "Compress-Archive -Path C:\IcarusData\Saved\PlayerData -DestinationPath ('C:\IcarusBackup\playerdata-' + (Get-Date -Format yyyyMMdd-HHmm) + '.zip')"
rem 3. start the server; passwords stay in ServerSettings.ini
C:\IcarusServer\IcarusServer.exe -UserDir=C:\IcarusData -SteamServerName="Styx Night Shift" -PORT=17777 -QueryPort=27015

Batch files run line by line regardless of errors, so a SteamCMD outage still ends in a running server, only one version behind. Valve's wiki says force_install_dir must precede login, which the order above respects. Logs land in C:\IcarusData\Saved\Logs. On the very first start PlayerData does not exist yet, so Compress-Archive prints a red error saying the path does not exist. That is expected: the script carries on to the next line and starts the server.

First start and the lobby

1. Download steamcmd.zip from Valve's SteamCMD wiki page and extract it into C:\steamcmd.
2. Save the script as C:\IcarusTools\start.bat and the settings file at the path above.
3. Run Start-ScheduledTask -TaskName IcarusServer. The first run downloads the whole server before launching it.
4. Check C:\IcarusData\Saved\Logs and confirm Config\WindowsServer sits beside it; if Saved appeared somewhere else, move the ini there.
5. In the game, open Join Session from the HAB menu and switch the browser toggle to dedicated servers.
6. With no prospect loaded you land in the server lobby. Type /AdminLogin followed by the admin password, then load or create a prospect.

To update between reboots, stop and restart the task: Stop-ScheduledTask -TaskName IcarusServer; Get-Process IcarusServer* -ErrorAction SilentlyContinue | Stop-Process -Force; Start-ScheduledTask -TaskName IcarusServer. Stopping the task alone ends cmd.exe, not the server it launched. This is a hard stop, so do it when nobody is playing.

Prospects: moving one in and keeping copies

A prospect from a player's own local game moves over as one file. The migration page puts it at %UserProfile%\AppData\Local\Icarus\Saved\PlayerData on the player's PC, in the folder named after their SteamID, under Prospects; copy the JSON into C:\IcarusData\Saved\PlayerData\DedicatedServer\Prospects with the server stopped, then name it in LoadProspect=. The wiki is blunt that renaming the file or editing its JSON corrupts the prospect for good, so back it up before the move.

The start script leaves one dated zip of PlayerData per start in C:\IcarusBackup. That folder shares a disk with the live saves, so copy the zips off the machine yourself on a schedule and delete old ones. The settings file is not in the archive, which keeps the passwords out of every copy you move around.

Where our machines fit, and where they do not

Our game server machines are physical servers leased whole: every core and all the memory run your prospect and nothing else. Each comes with an unmetered port, 1 Gbps on 10 of the 18 configurable lines and 500 Mbps on the other 8, and one IPv4 address. Rack servers and blades carry an out-of-band controller (iLO, iDRAC or a Supermicro BMC) whose browser console, usable once a console login exists for it in the dashboard, still reaches Windows after a bad firewall rule cuts off Remote Desktop. A racked machine is live about 30 minutes after the order is approved.

Put the machine near your group using our five data centers, all on our own network, AS19624. Another Windows-only survival server laid out the same way is our Enshrouded build.

Wrong fit: a group meeting a few evenings a month can keep playing from one player's own game, since the wiki shows a local prospect moving to a dedicated server later. And if the plan is Linux with no Windows licence, ICARUS does not support that officially.