Install private AI natively on Windows — no Docker, no WSL

Plenty of enterprise AI has to live on Windows: a Windows Server fleet with no Linux hosts in the rack, locked-down desktops where Docker Desktop and WSL are not approved software, air-gapped plants running Windows IoT. For those environments there is a native Windows x64 build of the SearchAI Inference Server — the same engine, models, kernels, and OpenAI-compatible API as the Linux and macOS builds, compiled for Windows and started at boot by a Scheduled Task instead of systemd.

The install is still one line. But Windows adds a few steps you won't see on Linux — an elevated PowerShell, a SmartScreen warning on an unsigned binary, a firewall rule if you serve the LAN — so this guide walks the whole path honestly, including what the Windows edition deliberately does not do yet.

OS	Windows Server 2019/2022/2025, or Windows 10 (1803+) / Windows 11, 64-bit
CPU	x86-64 with AVX2 (Intel Haswell 2013+ / AMD Excavator 2015+; any current server CPU qualifies). AVX-512, VNNI, and AMX are detected and used automatically at runtime when present.
RAM	8 GB minimum (2B model) · 16 GB recommended (4B model + vision)
Disk	~4 GB for the binary + default 4B model group (2B group ~1.5 GB; audio groups add ~2 GB)
Tools	None to install — the installer uses the curl.exe and PowerShell that ship with Windows. ffmpeg on PATH enables video input (optional).

Open PowerShell as Administrator (this is the first extra step — the installer registers a boot task and writes to C:\SearchAI, so it must be elevated) and run:

irm https://inference-server.searchblox.com/install-windows | iex

The installer downloads the binary (with SHA-256 verification), fetches the selected model group, generates an API key, writes C:\SearchAI\config\server.properties, registers a Scheduled Task that starts the server at boot as SYSTEM (the Windows stand-in for systemd/launchd), starts it immediately, and preloads the default model. Everything lives under C:\SearchAI\ (bin, models, config, logs).

Options are environment variables set before running — same names as the Linux and macOS installers:

Variable	Default	Meaning
$env:MODELS	"4b"	Space-separated model groups: 4b 2b asr tts voice
$env:SERVER_PORT	8081	HTTP port
$env:SERVER_HOST	127.0.0.1	Bind address — set 0.0.0.0 to serve the LAN (see step 3)
$env:API_KEY	generated	Bearer key for the API
$env:SEARCHAI_ROOT	C:\SearchAI	Install root — keep it short (long-path support is a known platform gap)

The Windows binary is currently unsigned — there is no signed MSI yet. Two practical consequences, and what to do about each:

• SmartScreen may warn if the exe is launched interactively (double-click). The installer avoids most of this by calling Unblock-File and running the server via the Scheduled Task, but if you ever see "Windows protected your PC", it's this — choose "More info → Run anyway" for C:\SearchAI\bin\searchai-server.exe.
• Endpoint protection / application control (Defender ASR rules, AppLocker, third-party EDR) may quarantine or block an unsigned exe that starts at boot as SYSTEM. For production, allow-list C:\SearchAI\bin\searchai-server.exe in your endpoint policy before rollout — its SHA-256 is published next to the download at /build/windows-x64/searchai-server.exe.sha256, and the installer verifies it on every install.

A signed binary/MSI is on the roadmap for general availability; this channel ships ahead of that for teams that need Windows today.

Confirm the server is up and grab the generated API key:

curl.exe http://127.0.0.1:8081/health
Select-String api-key C:\SearchAI\config\server.properties

By default the server binds 127.0.0.1 — local callers only, nothing to configure. To serve other machines, set server.host=0.0.0.0 in C:\SearchAI\config\server.properties, restart the task, and add the inbound rule (the third Windows-specific step — Linux hosts usually have no local firewall in the way):

New-NetFirewallRule -DisplayName "SearchAI" -Direction Inbound `
  -Protocol TCP -LocalPort 8081 -Action Allow
Stop-ScheduledTask -TaskName 'SearchAI Inference Server'; Stop-Process -Name searchai-server
Start-ScheduledTask -TaskName 'SearchAI Inference Server'

There is no in-process TLS on Windows — the server refuses to start if TLS keys are configured. For https, terminate TLS in a fronting proxy: IIS ARR, nginx, or caddy.

The API is OpenAI-compatible at http://127.0.0.1:8081/v1, and a browser console is served at http://127.0.0.1:8081/console. With the curl.exe built into Windows:

curl.exe -s http://127.0.0.1:8081/v1/chat/completions ^
  -H "Authorization: Bearer YOUR_API_KEY" ^
  -H "Content-Type: application/json" ^
  -d "{\"model\":\"q35-4b\",\"messages\":[{\"role\":\"user\",\"content\":\"Summarize why RAG reduces hallucinations.\"}]}"

Or any OpenAI SDK — point base_url at the server:

from openai import OpenAI
client = OpenAI(base_url="http://127.0.0.1:8081/v1", api_key="YOUR_API_KEY")
r = client.chat.completions.create(model="q35-4b",
        messages=[{"role": "user", "content": "Hello!"}])
print(r.choices[0].message.content)

Building request bodies in PowerShell? Prefer curl.exe --data-binary "@file.json" with files written by [IO.File]::WriteAllText — some PowerShell web cmdlets have their own timeout quirks, and Set-Content writes UTF-8 byte-order marks (the server tolerates them, but other tools may not).

Supported, identical to Linux: chat and text completions with streaming, tool/function calling and JSON mode, the 2B and 4B models with multi-model serving, prefix caching (measured 58 s → 0.5 s on a repeated 5k-token prompt), concurrent requests with admission control, and the full optimized CPU kernel stack (AVX2/AVX-512/VNNI/AMX, auto-detected at runtime). Vision, ASR, and TTS are included and installable but not yet validated on Windows to the level of the Linux builds; video input additionally needs ffmpeg on PATH.

Not in this edition:

Feature	What to do instead
Clustering (multi-node routing)	Windows nodes run single-node. For multi-node scale, use Linux nodes — they serve Windows clients over the same API.
In-process TLS (https)	Front with IIS ARR, nginx, or caddy.
GPU acceleration, image generation/editing	CPU inference only on Windows; GPU serving is Linux-only.
Signed binary / MSI	Unsigned exe + PowerShell installer for now — see step 2.
Per-connection read timeouts; TCP_NODELAY	Streaming can pace slightly burstier than Linux; stalled clients are bounded by the connection cap (512). No action needed for typical deployments.
Paths longer than ~260 characters	Keep the install root short — the default C:\SearchAI is fine.

On an 8-vCPU / 16 GB cloud node (AWS c8i.2xlarge, Intel Xeon Sapphire Rapids), 2B model, out-of-the-box settings:

Metric	Result
Decode speed (per-user, 2B)	18.9 tokens/sec
Prompt processing (5.4k-token prompt)	93 tokens/sec
Warm request latency (short prompt)	~0.3 s
Cached follow-up (same long prompt)	~0.5 s
4 concurrent users (aggregate)	20.4 tokens/sec, 4/4 succeeded

Throughput scales with cores — the published Linux numbers come from 32-vCPU nodes. Windows and Linux deliver equivalent per-core performance on the same CPU family; see Measured Performance for the full matrix.

Task	Command
Stop	Stop-ScheduledTask -TaskName 'SearchAI Inference Server'; Stop-Process -Name searchai-server
Start	Start-ScheduledTask -TaskName 'SearchAI Inference Server'
Logs	Get-Content C:\SearchAI\logs\searchai.log -Tail 50 -Wait
Config	C:\SearchAI\config\server.properties — restart after edits. Use forward slashes in paths (C:/SearchAI/models); backslashes are escape characters in properties files.
Health	curl.exe http://127.0.0.1:8081/health
Uninstall	Unregister-ScheduledTask -TaskName 'SearchAI Inference Server' -Confirm:$false; Stop-Process -Name searchai-server -Force; Remove-Item C:\SearchAI -Recurse -Force

If your environment is Windows, you don't need Docker, WSL, or a Linux exception to run private AI: one elevated PowerShell line installs an OpenAI-compatible server that starts at boot, serves the same models as the Linux builds, and keeps every prompt on your hardware. Budget three extra minutes for the Windows realities — elevation, SmartScreen, a firewall rule — and know the edition's edges going in: single-node, CPU-only, TLS in a fronting proxy.

irm https://inference-server.searchblox.com/install-windows | iex

Questions, or a need this edition doesn't cover (clustering, GPU, signed packaging)? Contact support@searchblox.com. Linux and macOS installs: see Pick your install.