Windows servers

Windows Server runs as a first-class image. The differences from Linux are real but few, and all of them come from one fact: Windows has no cloud-init.

What runs underneath

Layer	Technology
Guest configuration	cloudbase-init, the Windows equivalent of cloud-init
Configuration channel	configdrive2 — the same virtual CD-ROM Proxmox already attaches
Networking inside the guest	cloudbase-init’s network plugin, plus a small zone9 script for extra interfaces and routes
Image preparation	sysprep /generalize /oobe /shutdown with an unattend file
Console	VNC (Windows has no useful serial console)
Guest agent	QEMU guest agent, installed separately from a signed installer

What differs from Linux

	Linux	Windows
Default user	Image-specific (ubuntu, debian, …)	Administrator
Credential	SSH key, or a one-time password	A one-time password; SSH keys do not apply
Console	Serial (text, fast, copy-paste friendly)	VNC (graphical)
Minimum memory	None	4 GB — the s and m plans are hidden
First boot	Seconds	Minutes. Sysprep specialisation runs before the machine is usable.

The password is shown once at creation and is not stored. Copy it before closing the dialog.

Getting in

1. Open the server and choose Konsol (Console). Windows opens in VNC.
2. Log in as Administrator with the password from creation.
3. If you gave the server a public address, connect over RDP instead — after attaching a firewall that allows 3389 from your address, and only from your address.

Caution

Never expose RDP to the whole internet. A Windows machine with 3389 open to 0.0.0.0/0 is found by scanners within minutes. Restrict the source, or reach the machine through a Zero Trust gateway instead of a public address.

Networking

The first interface is configured by cloudbase-init from the configuration drive. Additional interfaces and the routes that make a gateway work are written by a small zone9 script that runs on each boot — the same role the Linux network script plays.

If a Windows server has no address after first boot, the usual cause is that the configuration drive was not read, which the panel surfaces as the server having no observed address. The console will show the machine at the login screen; that is the place to check ipconfig.

Licensing

zone9 does not provide Windows licences and does not activate anything. The image is a Windows Server evaluation or your own licensed media, prepared by whoever installed the platform. Bring your own licence and activate as you normally would.

Limits

• No SSH key injection; Windows uses passwords.
• No serial console.
• The first boot is slow and cannot be hurried; sysprep specialisation is doing real work.