Skip to content

Add baton-runner Windows service setup guide #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mindymo wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Add baton-runner Windows service setup guide #113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
dd20730
Add baton-runner Windows service setup guide
mindymo Mar 2, 2026
6a70640
Update page title to focus on use case over tool name
mindymo Mar 2, 2026
23c6d53
Add screenshot placeholders for baton-runner Windows guide
mindymo Mar 2, 2026
681e11d
Add baton-runner configuration reference page
mindymo Mar 3, 2026
8f28e45
Update baton-runner reference with real-world example and log-level fix
mindymo Mar 3, 2026
b97253d
Update baton/baton-runner-windows.mdx
mindymo Mar 3, 2026
f0f8786
minor tweaks
mindymo Mar 3, 2026
48d822e
add screenshots
mindymo Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
214 changes: 214 additions & 0 deletions baton/baton-runner-windows.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,214 @@
---
title: Run multiple connectors as a Windows service
og:title: Run multiple connectors as a Windows service - ConductorOne docs
og:description: Install and configure baton-runner as a Windows service to run multiple Baton connectors from a single process on Windows Server.
description: Install and configure baton-runner as a Windows service to run multiple Baton connectors from a single process on Windows Server.
sidebarTitle: Run multiple connectors on Windows
---

{/* Editor Refresh: 2026-03-02 */}

This guide walks through installing baton-runner as a Windows service and configuring it to sync two SQL Server connectors. For a full reference on configuration options and secret backends, see [Baton-runner configuration reference](/baton/baton-runner).

## Before you begin

You'll need:

- A Windows Server with an account that has administrator rights to install Windows services and run administrative PowerShell sessions
- Usernames and passwords for each SQL Server instance you want to sync
- The [baton-sql-server](https://github.com/ConductorOne/baton-sql-server) executable downloaded
- The baton-runner installer downloaded
- A ConductorOne connector created for each SQL Server instance — see [Deploy self-hosted connectors](/baton/deploy)
- A client ID and secret for each connector

## Install baton-runner

<Steps>
<Step>
Run the baton-runner installer. Right-click the installer and select **Run as administrator** if prompted.

<Note>
The installer completes silently — it does not display progress or require any configuration input.
</Note>
</Step>
<Step>
Confirm the service installed correctly. Open **Services** (search for "Services" in the Windows search bar) and look for **baton-runner** in the list.

The startup type defaults to **Manual** — leave it as Manual for now.

<Frame>
<img src="/images/product/assets/baton-runner-windows-1.png" alt="Services window showing baton-runner with Manual startup type" />
</Frame>
</Step>
<Step>
Open the baton-runner service properties and select the **Log On** tab. Set the service account to the user account you'll use to store credentials in Windows Credential Manager. This must be the same account you'll use in the wincred steps below.

<Frame>
<img src="/images/product/assets/baton-runner-windows-2.png" alt="Service properties Log On tab with user account selected" />
</Frame>
</Step>
</Steps>

## Set up connector files

<Steps>
<Step>
Create a directory for the baton-sql-server executable. The directory path must not contain spaces.
</Step>
<Step>
Using File Explorer, navigate to `C:\ProgramData\ConductorOne\baton-runner`.
</Step>
<Step>
Create a YAML file for each SQL Server instance you want to sync, plus a `config.yaml` file for baton-runner. Name each connector file in a way that identifies the server it connects to.

For this example, we'll use `sql1.yaml` and `sql2.yaml` for two SQL Server instances.

<Frame>
<img src="/images/product/assets/baton-runner-windows-3.png" alt="baton-runner directory containing sql1.yaml, sql2.yaml, and config.yaml" />
</Frame>
</Step>
<Step>
Open each connector YAML file in Notepad and add the following, replacing the values with the connection string and ConductorOne credentials for that instance:

```yaml
BATON_DSN: server=192.168.1.40;user id=sa;password=YOUR_PASSWORD;port=1434
BATON_CLIENT_ID: YOUR_CLIENT_ID
BATON_CLIENT_SECRET: YOUR_CLIENT_SECRET
```
</Step>
</Steps>

## Store credentials in Windows Credential Manager

Baton-runner uses Windows Credential Manager (wincred) to store connector secrets securely on the server.

Check warning on line 83 in baton/baton-runner-windows.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/baton-runner-windows.mdx#L83 

Did you really mean 'wincred'?

<Steps>
<Step>
Open PowerShell as administrator. Right-click the Windows logo and select **Windows PowerShell (Admin)**.
</Step>
<Step>
Change to the baton-runner directory:

```powershell
cd C:\ProgramData\ConductorOne\baton-runner\
```
</Step>
<Step>
Store the credentials for each connector using the `wincred set` command:

```powershell
& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" wincred set sql1 sql1.yaml
& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" wincred set sql2 sql2.yaml
```

Each command should return `successfully set secret.`
</Step>
<Step>
Verify the credentials are stored. Run:

```powershell
cmdkey /list
```

You should see an entry for each connector:

```
Currently stored credentials:

Target: LegacyGeneric:target=sql2
Type: Generic
Local machine persistence

Target: LegacyGeneric:target=sql1
Type: Generic
Local machine persistence
```

You can also verify a specific credential using baton-runner:

```powershell
& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" wincred get sql1
```
</Step>
</Steps>

## Configure baton-runner

<Steps>
<Step>
Open `config.yaml` in `C:\ProgramData\ConductorOne\baton-runner` and add the following configuration, updating the paths and names to match your setup:

```yaml
connectors:
- name: sql1
path: C:\baton-sql\baton-sql-server.exe
config:
envFrom:
secrets:
BATON_DSN: sql1:BATON_DSN
BATON_CLIENT_ID: sql1:BATON_CLIENT_ID
BATON_CLIENT_SECRET: sql1:BATON_CLIENT_SECRET
- name: sql2
path: C:\baton-sql\baton-sql-server.exe
config:
envFrom:
secrets:
BATON_DSN: sql2:BATON_DSN
BATON_CLIENT_ID: sql2:BATON_CLIENT_ID
BATON_CLIENT_SECRET: sql2:BATON_CLIENT_SECRET
secrets:
wincred:
secrets:
sql1: sql1
sql2: sql2
```
</Step>
<Step>
Test the configuration by running baton-runner from PowerShell. Press **Ctrl+C** to stop it once you've confirmed it starts without errors:

```powershell
& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" -c .\config.yaml
```
Comment on lines +167 to +171
Copy link
Contributor

@coderabbitai coderabbitai bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Use an absolute config path in the test command.

Line 170 depends on the current working directory. If the shell isn’t in C:\ProgramData\ConductorOne\baton-runner, the check can fail or read the wrong file.

Suggested doc fix 
-& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" -c .\config.yaml
+& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" -c "C:\ProgramData\ConductorOne\baton-runner\config.yaml"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
Test the configuration by running baton-runner from PowerShell. Press **Ctrl+C** to stop it once you've confirmed it starts without errors:
```powershell
& "C:\Program Files (x86)\ConductorOne\baton-runner\baton-runner.exe" -c .\config.yaml
```
Test the configuration by running baton-runner from PowerShell. Press **Ctrl+C** to stop it once you've confirmed it starts without errors:
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@baton/baton-runner-windows.mdx` around lines 167 - 171, The PowerShell test
uses a relative path (.\config.yaml) which can fail if the shell's CWD isn't the
baton-runner config folder; update the example command that invokes
baton-runner.exe so it uses the absolute config path (e.g., replace
.\config.yaml with the full path to
C:\ProgramData\ConductorOne\baton-runner\config.yaml) so the invocation of
baton-runner.exe reliably loads the intended config file.

</Step>
</Steps>

## Start and validate the service

<Steps>
<Step>
Reboot the server. This confirms that the wincred credentials persist across reboots and completes post-installation steps for the service.
</Step>
<Step>
After rebooting, confirm your credentials are still present:

```powershell
cmdkey /list
```
</Step>
<Step>
Open **Services**, find baton-runner, and click **Start**. Confirm the status changes to **Running**.

<Frame>
<img src="/images/product/assets/baton-runner-windows-4.png" alt="Services window showing baton-runner with Running status" />
</Frame>
</Step>
<Step>
Check the log for errors:

```
C:\ProgramData\ConductorOne\baton-runner\baton-runner.log
```
</Step>
<Step>
In ConductorOne, confirm the connectors are syncing. Navigate to each connector and verify data is appearing.
</Step>
<Step>
Once syncing is confirmed, change the baton-runner service startup type to **Automatic**.
</Step>
<Step>
Restart the server one final time to confirm the service starts automatically and all connectors sync successfully.
</Step>
<Step>
After confirming baton-runner starts successfully and both connectors sync, delete or securely clear the connector YAML files (`sql1.yaml`, `sql2.yaml`) immediately. These files contain plaintext credentials and are no longer needed once secrets are stored in wincred.
</Step>
</Steps>
Loading