Windows Server

Secrets Management for Windows Server

This guide will show you how to provision an application running on a Windows Server with the secrets it needs.

To make life easy, you can use demo app from the Getting Started guide to have something to deploy to a test server.

If your servers run in the cloud, check out the cloud-specific guides instead that cover how to authenticate to SecretHub using cloud-native services, so you don’t have to deal with service credentials:

Before you begin

Before you start using SecretHub on Windows Server, make sure you have:

  1. Followed the Getting Started Guide.
  2. Set up remote desktop access to a test server.
  3. Open a port on the server, so you can see the result.

Step 1: Create a service account for the demo app

Let’s deploy the app to a Windows test server in your datacenter.

The first step here is to create a service account for the demo app by running service init. This command generates a new credential for the app to fetch and decrypt the secrets, which you can store in a file like so:

secrethub service init your-username/demo \
  --description demo-app \
  --permission read > credential

Now upload the credential file to the Windows Server and place it in C:\Users\<Username>\.secrethub\. The SecretHub CLI will look for the credential at this location.

Any usage of this credential gets recorded on the audit log, and you can revoke the account at any time.

Step 2: Install the CLI on the Server

With the service credential in place, the next step is to install the SecretHub CLI on the Windows Server.

You can RDP into the server and download the latest amd64 .msi file or use one of the various other installation methods, like PowerShell or Scoop.

Windows installation wizard

Step 3: Run the app

To provision the demo app with secrets, set secret references as environment variables and they’ll automatically get replaced with the secret values:


To load secrets into your app, wrap it in secrethub run:

secrethub run -- secrethub demo serve --host --port 1234

Make sure to set the --port flag to an open port on the machine.

Visit the webpage and see it in action!

There you have it, an app running on a Windows Server, provisioned with the secrets it needs. Check out the audit log, and you’ll see reads done by this service account being logged. If you want to rotate the secret, just write a new version to SecretHub and restart the apps that consume it. No config updates needed.