Installing Windows on a Hetzner Dedicated Server
via Rescue System and QEMU

How This Works

The technique relies on a clever use of QEMU's ability to use a raw block device as its hard disk target. When running inside the Rescue System, your server's actual disk (/dev/sda) is unmounted and freely accessible. QEMU can boot a Windows ISO and write the installation directly to that physical disk - exactly as if you had inserted a USB stick and booted from it.

QEMU also exposes a VNC display, so you can connect from your local machine with any VNC client and interact with the Windows installer graphically. Once the installation finishes, you shut QEMU down and reboot the server. It comes up running Windows natively on bare metal - not inside a VM.

What You Need Before Starting

• Access to Hetzner Robot - the web panel at robot.hetzner.com
• An SSH client on your local machine (PuTTY on Windows, or any terminal on Linux/macOS)
• A VNC viewer on your local machine - RealVNC Viewer, TigerVNC, or any other client works
• A valid Windows Server licence - Hetzner's ISO mirror provides the installer; you supply the licence key during setup

Step-by-Step Installation Guide

Step 1 - Activate the Rescue System

Log into Hetzner Robot and select your server from the server list. Navigate to the Rescue tab. Select Linux 64-bit as the rescue OS, then click Activate rescue system.

Robot will display the temporary SSH root password for the rescue session. Copy it somewhere safe - you will need it in the next step and it is only shown once.

Step 2 - Trigger a Hardware Reset

Still in Robot, switch to the Reset tab (immediately to the right of the Rescue tab). Select Execute an automatic hardware reset and confirm. This is a hard reset - equivalent to pressing the physical power button - and will reboot the server into the rescue environment within about 60 seconds.

Step 3 - SSH into the Rescue System

Wait until SSH becomes available on port 22 (typically 60–90 seconds after the reset). Connect using the IP address of your server and the temporary password from Step 1:

ssh root@YOUR_SERVER_IP

You should see a Hetzner rescue system banner. You are now in a minimal Linux environment running entirely from RAM - the physical disk is idle and available for us to write to.

Step 4 - Download Portable QEMU

We need QEMU to act as a bootable installer environment. A portable, pre-compiled build is the fastest path - no package installation required:

wget -qO- https://github.com/AnimeKaizoku/InstallWindowsOnHetzner/raw/main/vkvm.tar.gz \
  | tar xvz -C /tmp

If your server has a disk larger than 2 TB, you also need the UEFI firmware blob so that Windows can address the full disk via GPT partitioning:

# Only required for disks > 2 TB
wget -qO- https://github.com/AnimeKaizoku/InstallWindowsOnHetzner/raw/main/uefi.tar.gz \
  | tar xvz -C /tmp

Step 5 - Download the Windows Server ISO

Hetzner maintains a mirror of Windows Server ISO images that is freely accessible from within their network - no authentication needed. Download directly to /tmp:

cd /tmp

# Windows Server 2022 (recommended)
wget http://mirror.hetzner.de/bootimages/windows/SW_DVD9_Win_Server_STD_CORE_2022_2108.15_64Bit_English_DC_STD_MLF_X23-31801.ISO

# Windows Server 2019 (alternative)
# wget http://mirror.hetzner.de/bootimages/windows/SW_DVD9_Win_Server_STD_CORE_2019_64Bit_English_DC_STD_MLF_X21-96581.ISO

The download happens over Hetzner's internal network and is very fast - typically under two minutes regardless of your server's external bandwidth.

Step 6 - Open Your VNC Viewer First

Before launching QEMU, open your VNC viewer on your local machine and prepare a connection to your server. The QEMU process starts a VNC server on display :1 (port 5901). Set up the connection now so you can connect immediately after QEMU starts:

• Host: your server's IP address
• Port: 5901 (or enter as IP:1 in clients that use display notation)
• No VNC password is set by default in this configuration

The reason to prepare this first: the Windows installer briefly displays a "Press any key to boot from CD/DVD…" prompt that times out after a few seconds. If you're not connected and watching when QEMU boots, the ISO won't load and you'll need to restart.

Step 7 - Launch QEMU

Run the appropriate command for your disk size. QEMU will start immediately and begin booting the ISO.

For disks up to 2 TB (standard BIOS mode):

/tmp/qemu-system-x86_64 \
  -net nic \
  -net user,hostfwd=tcp::3389-:3389 \
  -m 2048M \
  -localtime \
  -enable-kvm \
  -cpu host,+nx \
  -M pc \
  -smp 2 \
  -vga std \
  -usbdevice tablet \
  -k en-us \
  -cdrom /tmp/SW_DVD9_Win_Server_STD_CORE_2022_2108.15_64Bit_English_DC_STD_MLF_X23-31801.ISO \
  -hda /dev/sda \
  -boot once=d \
  -vnc :1

For disks larger than 2 TB (UEFI mode):

/tmp/qemu-system-x86_64 \
  -bios /tmp/uefi.bin \
  -net nic \
  -net user,hostfwd=tcp::3389-:3389 \
  -m 2048M \
  -localtime \
  -enable-kvm \
  -cpu host,+nx \
  -M pc \
  -smp 2 \
  -vga std \
  -usbdevice tablet \
  -k en-us \
  -cdrom /tmp/SW_DVD9_Win_Server_STD_CORE_2022_2108.15_64Bit_English_DC_STD_MLF_X23-31801.ISO \
  -hda /dev/sda \
  -boot once=d \
  -vnc :1

A few things worth understanding about these flags:

• -enable-kvm -cpu host - uses hardware virtualisation, making the installer run at near-native speed
• -hda /dev/sda - points QEMU at the bare-metal disk; Windows installs directly here, not into a virtual disk file
• -net user,hostfwd=tcp::3389-:3389 - forwards RDP from the QEMU guest to the rescue host, so you can test RDP access before the final reboot
• -boot once=d - boots from the CD-ROM (the ISO) just this once; subsequent boots go to the disk
• -vnc :1 - exposes the graphical display on VNC port 5901

Step 8 - Connect via VNC and Install Windows

Connect immediately with your VNC viewer. You should see the Windows installer boot screen. When you see the "Press any key to boot from CD or DVD…" prompt, click inside the VNC window and press any key quickly.

From here the installation proceeds like a standard Windows setup:

1. Choose language, time format, and keyboard layout - click Next
2. Click Install now
3. Enter your Windows Server licence key, or skip and activate later
4. Select the edition - Windows Server 2022 Standard or Datacenter depending on your licence
5. Accept the licence terms
6. Choose Custom: Install Windows only (advanced)
7. Select the unallocated disk space and click Next - Windows will create its partitions automatically
8. Wait for the installation to complete. This takes 15–30 minutes depending on your server's disk speed
9. Windows will reboot inside QEMU. Set the Administrator password when prompted

Step 9 - Enable RDP Before the Final Reboot

This is a critical step to do before shutting down QEMU. Once Windows is running inside QEMU, you need to enable Remote Desktop so you can connect after the bare-metal reboot.

Inside the VNC session, once Windows has booted to the desktop:

1. Right-click This PC → Properties
2. Click Advanced system settings on the left
3. Switch to the Remote tab
4. Select Allow remote connections to this computer
5. Uncheck Allow connections only from computers running Network Level Authentication (makes initial connection easier)
6. Click OK

Also open the Windows Firewall and confirm that Remote Desktop is allowed through the firewall - it usually is by default when you enable it via System Properties.

Step 10 - Reboot into Bare Metal Windows

Shut down the QEMU virtual machine gracefully from inside Windows (Start → Shut down). Once QEMU exits, you're back at the rescue system SSH prompt.

In Hetzner Robot, go back to the Reset tab and trigger another hardware reset - or simply reboot from the rescue SSH session:

reboot

The server will reboot directly into the Windows installation on /dev/sda. After about 60–90 seconds, connect via RDP to your server's IP on port 3389.

Post-Installation Checklist

After your first RDP session on the bare-metal Windows instance:

• Set a strong Administrator password if you haven't already
• Configure the Windows Firewall - allow only the ports you need (at minimum: 3389 for RDP, 443 for HTTPS if applicable)
• Run Windows Update - Server 2022 will have significant updates pending
• Activate Windows with your licence key via Settings → Activation
• Install VirtIO drivers if you plan to use additional virtual disks or network interfaces
• Configure rDNS in Hetzner Robot if you're running any services that require a reverse DNS record

Troubleshooting

VNC Connects but Shows a Black Screen

QEMU may still be loading. Wait 20–30 seconds and try clicking inside the VNC window. If it stays black, the ISO didn't boot - the "press any key" prompt timed out. Stop QEMU (Ctrl+C in the SSH session) and re-run the command, this time connecting to VNC before starting QEMU.

Windows Installer Can't Find the Disk

This usually means /dev/sda is the wrong disk identifier. Check which disks are available in the rescue system:

lsblk

If your disk shows as /dev/nvme0n1 (NVMe SSDs) rather than /dev/sda, update the -hda flag in the QEMU command accordingly.

QEMU is Extremely Slow

If -enable-kvm throws an error or KVM isn't available, the rescue system may not have KVM enabled. Check with:

ls -la /dev/kvm

If /dev/kvm doesn't exist, open a Hetzner support ticket - KVM acceleration needs to be enabled on the hypervisor level for your server.

RDP Not Available After Reboot

This almost always means RDP was not enabled inside QEMU before the final reboot. Boot back into the Rescue System, run QEMU again (it will boot from disk this time, not the ISO - remove -boot once=d or change it to -boot c), connect via VNC, enable RDP, and shut down again.