Setup guide

Sign in to Tower, open your unit, follow Boxes in the unit nav, and use Enroll a box. Tower shows you three things: a download button for tower-remote.exe with the version it is serving, a one-time enrollment token that is valid for 15 minutes and shown exactly once, and the command to paste on the box.

The download lives inside the panel, so get the file while signed in, then copy it to the box (or sign in on the box and download it there). Windows will warn about it the first time. That is expected and covered further down.

Then, on the box, in the folder you saved the file into:

Copy the exact line from the panel rather than typing this one, since it already carries your URL and token. The leading .\ matters: PowerShell will not run a program from the current folder without it. Add --name if you want the box to show up under something other than its hostname.

Then open a new PowerShell window with Run as administrator, cd back to the folder tower-remote.exe is in (an elevated window starts in C:\Windows\System32, not where you were), and run:

That registers a Windows service called Tower Remote, which starts at boot, survives you logging off, restarts itself if it crashes, and updates itself from then on. You will not need to download the file again. Administrator is not optional here: Windows only lets an elevated process register a service, and the command says so and stops if you skip it.

Within a few seconds the remote should appear online in the panel. If it does not, the box needs to be able to reach Tower over HTTPS outbound.

On the box, in a normal (not elevated) prompt, in the folder tower-remote.exe is in:

It asks for your Steam account name, sets SteamCMD up if this is a fresh box, and then hands the window over to SteamCMD itself, which asks for the password and, if you have Steam Guard, a code. Its own words for what is happening: Type directly into this window - Tower does not see, store, or log what you type.

That is the whole reason this step is a command on your box instead of a form in the browser. Tower never holds a Steam password in any form, not encrypted, not temporarily. SteamCMD keeps its own login cache in its own folder on the box, and Tower saves only the account name. Nothing about this step reaches our servers.

After the login, it checks that the same session works unattended, because the installs are actually run by the Windows service rather than by you. If that check fails it tells you and does not save the account, since installs would fail the same way.

To see where you stand at any time, without being prompted for anything, from the same folder:

It names the configured account and says whether the cached session is still good. Steam invalidates sessions from time to time, and a password change ends them immediately. The fix is always the same command you started with, and the failure messages say so rather than leaving you to guess.

From the unit page, create a server. Tower asks for four things: a name, which remote it runs on, an install folder (it suggests one under C:\TowerServers\ based on the name), and a game port, which it allocates clear of every other instance it knows about on that box. Then press Create and install.

Install is not a separate button. The job starts immediately, and the server page shows its progress and log while SteamCMD fetches roughly 5 GB. First time on a fresh box, it installs SteamCMD first.

Give every server its own install folder, which is what the suggestion does. Server-side mods keep their extension files and their configuration inside the install folder, so two servers sharing one folder cannot run different ones, and neither can be updated while the other is running. Mods themselves are downloaded once per box and shared, so a second server costs far less disk than it sounds.

One honest limit on the port suggestion: Tower knows about ports used by its own servers, plus anything the last box diagnostics run reported. A port held by another panel or another application is only caught when the server actually tries to start, and then you get a refusal naming the process rather than a fight over the port.

The settings page is generated from the full Arma 3 parameter set, grouped and searchable, with an Advanced toggle for the long tail and a Save and apply button that writes the config files on the box. You never hand-edit server.cfg again. New servers start from a safe baseline already: BattlEye on, signature verification at the current version, file patching off, UPnP off, and the server set to come up already running its mission instead of ending it the moment it is empty.

Four things are worth setting before anyone tries to join.

• Server name. What players see in the browser. Tower seeds it from the name you gave the server, so it is never left as the machine name.
• Passwords. The join password (leave it blank for an open server) and the admin password, which is what grants in-game admin.
• RCON password. Set one. BattlEye will not enable RCON without a password, and without RCON there is no web console, no kick or ban from the browser, and no restart warnings in chat. The RCON port has to sit outside the game port block (the game port through game port plus four); the convention is game port minus one.
• Restart schedule. Optional, but this is where a lot of the value is. You add times in your own local time and Tower stores them in UTC so every admin sees the same instant. A due restart warns in chat and then restarts even with players connected, on purpose: a busy server is exactly the one that needs restarting, and predictable beats polite. A window missed because the box was offline is skipped rather than fired late.

You do not retype your mod list. Open the Mods page, choose Import from Arma 3 Launcher, and give it the preset file your unit already passes around: in the launcher's Mods tab, use Export to file or Export to clipboard, then upload or paste it here. Tower parses it, shows what it found, and you save it as a named preset.

Anything in the export that is not on the Steam Workshop is listed as skipped, because Tower has nothing to download. Those are your private and hand-built mods. Drop each mod folder into the remote's local mods folder (C:\ProgramData\Tower\local-mods) by whatever means you use today, press Rescan local mods, and they join the library like any other mod.

Each mod in the preset says who loads it. Most load on the server and the players both. Anti-cheat tools and extensions are Server only. Mods only your players need, sound and visual packs being the usual ones, are Players only: your servers do not run them and do not keep a copy of them, but they still collect each one's signature key, which is what lets a player who has the mod loaded join at all.

Assign the preset to a server from the Game servers card on the same page. The row tells you where it stands: no preset, never synced, stale, or in sync. Headless clients inherit their parent server's list, so there is nothing to keep in step by hand.

Updates are detected continuously and applied only when you say so. Tower shows which mods have a newer version and you press update, per preset or for everything. If a server affected by the update is running, it says which one and offers to restart it with the update, because Arma reads mods when the process starts and files that change underneath a running server produce signature mismatches for joining players. Nothing ever updates itself while you sleep.

Creator DLC, meaning S.O.G. Prairie Fire, is a per-server switch rather than a mod you download: on the Mods page, with the server stopped, switch that server's install to the Creator DLC branch. Adding it to a preset only tells the preset to reference it, so both steps are needed. SteamCMD cannot update files a running server holds open, which is why the button is disabled until you stop it.

Signature keys are handled for you: Tower collects each mod's key and copies it where the engine actually looks. Mods that publish no key at all are named in the job log rather than skipped quietly, which matters more than it sounds. See the next section for what to do about them.

Missions are uploaded to Tower, not to the box. On the Missions page, upload a .pbo named the way Arma expects, MissionName.WorldName.pbo. Uploading the same name and world again creates a new version and never overwrites the old one, which is what makes rolling back a real option rather than a hope. Your unit has a storage quota and the page shows how much of it you are using.

Then open that server's Missions page, assign the mission (and the version you want), and sync it to the box. The Rotation editor is where you say what the server comes up running: an empty rotation means the server starts and sits there waiting, and Tower tells you so instead of leaving you to work it out. Every older version has a roll back button next to it, which re-points the assignment and re-syncs.

Be aware of what the check on upload does and does not do. It checks the file is named in the right shape. It does not confirm the world exists in your mod set, so a mission built against a different mod pack, or one whose terrain comes from a Creator DLC, is only caught when the server tries to load it and refuses. If a mission will not load, that mismatch is the first thing to suspect.

Someone switching mission in game is normal use, not drift. Tower does not fight it or put the old one back.

Press Start on the server page. The status tile fills in with players, mission and map once the server answers, and the RPT log tail underneath is Arma's own log, live. A heavily modded server can take several minutes to get there on first start.

Before you ask anyone to try connecting, use Check firewall. It reports one of Allowed, Not allowed or Unknown for this server's UDP port block, and shows the exact rule to add. If you want Tower to add it, the Allow this port button does it behind a confirmation. That is the only thing Tower ever writes to your Windows Firewall, and it never happens as a side effect of starting a server.

Then have someone load the same preset in their launcher and connect. If the server is running, the port is open, and they still cannot get in, read the signature keys note below first: a missing key produces exactly that symptom.