> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Install a Neuron

> Prepare a Windows host and install the Neuron service

After this guide, the Neuron service is installed and its local first-run page opens in a browser.

## Prerequisites

* A supported 64-bit Windows host with administrator access.
* A DNS name for production use.
* Permission to bind the HTTP, HTTPS, XMPP, and any SMTP ports you plan to expose.
* A backup location outside the Neuron program-data directory.

The Neuron includes its own web server. Remove or reconfigure IIS and any other service already bound to ports `80` or `443`.

## Plan firewall rules

Open only the services you use.

|       Port | Protocol        | Purpose                                           |
| ---------: | --------------- | ------------------------------------------------- |
|   `80/TCP` | HTTP            | Certificate challenges and optional HTTP redirect |
|  `443/TCP` | HTTPS           | Web UI, HTTP APIs, OAuth, and MCP                 |
| `5222/TCP` | XMPP C2S        | Client-to-server XMPP                             |
| `5269/TCP` | XMPP S2S        | Federation between XMPP domains                   |
|   `25/TCP` | SMTP            | Direct server-to-server mail, when enabled        |
|  `587/TCP` | SMTP submission | Authenticated mail submission, when enabled       |
| `1080/TCP` | SOCKS5          | Optional proxy service                            |

RDP (`3389/TCP`) is an operating-system administration port, not a Neuron dependency. If used, restrict it to trusted source addresses or a private administration network.

## Run the installer

1. Download `NeuronSetup.exe` from your organization's approved distribution channel.
2. Run the installer as the interactive user. Do not use **Run as administrator** unless the release instructions explicitly require it; installing with the wrong identity can leave database keys unreadable by the service account and can prevent self-updates.
3. Accept the licence and select the target instance.
4. Wait for the service to enter the running state.
5. Open `http://localhost/` on the host.

<Note>
  On first start the runtime creates encryption keys for local database files. Key generation can make the service remain in **Starting** for a while. Check service state and CPU activity before terminating it.
</Note>

## Verify the installation

```powershell theme={null}
Get-Service | Where-Object { $_.DisplayName -match 'Neuron|IoT Gateway' }
```

Then request the local landing page:

```powershell theme={null}
Invoke-WebRequest http://localhost/ -UseBasicParsing
```

A successful HTTP response proves the web listener is available. It does not mean the first-run configuration is complete.

## Files and service state

The Windows installer normally separates immutable program files from mutable program data. The program-data folder contains configuration, databases, logs, package state, generated keys, and hosted content. Its exact location is selected by the installer and can differ between installations; verify it from the service configuration before scripting paths.

## Next step

Continue with [Complete first-run setup](/operations/first-run).