Chapter 25. Run Red Hat build of Keycloak as a Windows Service

Install a basic service (runs as Local System by default):

bin\kc.bat tools windows-service install --name keycloak

Manual startup and longer stop timeout:

bin\kc.bat tools windows-service install --startup=manual --stop-timeout=60

Delayed auto-start:

bin\kc.bat tools windows-service install --startup=delayed

Custom display name:

bin\kc.bat tools windows-service install --name=my-keycloak --display-name="My Keycloak Server"

Use --depends-on to ensure required Windows services start before Keycloak (for example, a local database). By default Apache Commons Daemon may add Tcpip and Afd network dependencies.

bin\kc.bat tools windows-service install --depends-on="postgresql-x64-15;Tcpip;Afd"

The default is to run the service as the Local System account - --service-user and --service-password can be omitted (recommended). To run as a specific user, the account must have the "Log on as a service" right.

bin\kc.bat tools windows-service install --service-user="DOMAIN\Username" --service-password="password"

You can supply the service password securely via an environment variable, which is recommended:

set KC_SERVICE_PASSWORD=s3cret
bin\kc.bat tools windows-service install --service-user="DOMAIN\Username"

Start the service:

net start keycloak

Stop the service:

net stop keycloak

Uninstall the service:

bin\kc.bat tools windows-service uninstall --name keycloak

Check status using the Windows Services console (services.msc).

Windows Services run in a separate session (usually as the LocalSystem account) and do not inherit the environment variables of the user who created the service. Define the required KC_* environment variables as system-wide environment variables, so they are available to the service.

If the Apache Commons Daemon wrapper becomes unresponsive:

taskkill /f /im prunsrv.exe

Use caution — this will affect all Procrun-managed services on the host.