Installing LeoCore Backup
One installer. It copies the application, registers the backup service and starts it. There is no separate step to turn backups on, and no runtime to install first.
LeoCoreBackup-4.7.2-setup.exe, x64. The .NET runtime is bundled, so there is no
prerequisite to install first, which matters on a locked-down database host. A compact ZIP is
also available for machines that already have .NET 8; everything below about the service,
the file layout and the command line applies to both.
What happens when you run it
- Windows asks for administrator approval. The installer needs it to register a service and to
create a data folder outside
Program Files. - Choose the destination folder, or accept
C:\Program Files\LeoCore Backup. - Click Install. The application is copied, the
LeoCoreAgentservice is registered and started, and the console opens. - Sign out of Windows and back in. See below — this one is easy to skip and it is the difference between the console working and appearing broken.
That is the whole thing. The component and shortcut pages are skipped, because the answer is almost always "all of it, in the usual place" — see choosing components if it is not.
What it puts on the machine
| Application | C:\Program Files\LeoCore Backup — the console, the agent and the updater | |
| Your data | C:\ProgramData\LeoCore — jobs, schedules, credentials, run history, the artifact catalogue, plus Logs\ and Temp\ | |
| Service | LeoCoreAgent, displayed as LeoCore Backup Agent | |
| Local group | LeoCore Operators — members may use the console without elevating. The installing account is added automatically. | |
| Shortcuts | Start menu group; a desktop icon only if you ask for it | |
| Sign-in | The console starts minimised to the notification area. Backups do not depend on this — the service runs regardless. | |
Program files and data are deliberately separate. An update replaces the first and never touches the second, which is why upgrading cannot lose a job definition or a saved credential.
The backup service
This is the part that matters, and it is why LeoCore is installed rather than merely unzipped. The console is only a window onto it; closing the console stops nothing.
| Account | NT AUTHORITY\SYSTEM by default. Use a domain account or gMSA if backups must reach a network share. | |
| Start type | Automatic (Delayed Start) — so it does not compete with the database engine during boot | |
| If it crashes | Windows restarts it after 60 seconds, again after 60 seconds, then every 5 minutes. The failure count resets daily. | |
| Depends on | TCP/IP | |
| Talks to the console over | A named pipe restricted to LeoCore Operators, plus Administrators and Backup Operators for an elevated console. No TCP port is opened and nothing listens on the network. | |
LeoCore.Agent.exe install --account "DOMAIN\svc-leocore" --password "…", or set it in
services.msc. A gMSA works and needs no password.
Server Core and headless machines
Server Core has no desktop, so install the service on its own and manage it from a console on another machine:
.\LeoCoreBackup-4.7.2-setup.exe /VERYSILENT /TYPE=service /LOG=install.log
Or, if the files are already in place, drive the agent directly. Every verb works identically on every Windows edition:
LeoCore.Agent.exe install [--account "DOMAIN\user"] [--password "…"]
LeoCore.Agent.exe start
LeoCore.Agent.exe status
LeoCore.Agent.exe stop
LeoCore.Agent.exe uninstall
LeoCore.Agent.exe --console # run in the foreground to watch it work
start and stop wait for the service to actually reach the requested
state rather than returning the moment Windows accepts the request, so their exit codes mean
what they say and are safe to branch on in a script.
Unattended installation
For RMM tools, Intune, or a deployment script:
.\LeoCoreBackup-4.7.2-setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG=install.log
/VERYSILENT | No wizard, no progress window | |
/SUPPRESSMSGBOXES | Suppress prompts. Pair it with /LOG — it is the only trace left of a warning. | |
/NORESTART | Never reboot on its own | |
/LOG=<file> | Write a full installation log | |
/DIR="<path>" | Install somewhere other than Program Files | |
/TYPE= | full (default), service, or console | |
Check the exit code. If the service cannot be registered, the installer fails
and returns non-zero rather than reporting success and leaving a machine with no service on it.
A silent install that returns 0 has a running LeoCoreAgent.
.msi,
which this installer is not. Intune deploys it without trouble as a Win32 app using the switches
above. If you need MSI specifically, tell us — it changes what we build, and we would rather hear
it from you than guess.
Choosing components
The default install is everything. To see the component and shortcut pages in the wizard, run
the installer with /CUSTOM:
.\LeoCoreBackup-4.7.2-setup.exe /CUSTOM
- Agent service and management console — the normal choice.
- Agent service only — Server Core, or a server you administer remotely.
- Management console only — an administrator's workstation that connects to an agent installed elsewhere.
Upgrading
Run the new installer over the old one. It stops the service, replaces the program files,
re-registers the service against the new path and starts it again. Jobs, schedules, credentials
and history in %ProgramData%\LeoCore are untouched, and any database schema change
is applied inside a transaction after a snapshot is written.
From 4.4.3 onward you do not have to come back here for the installer. Settings →
Updates → Check for updates now offers to download and install the new version. On a
normal per-machine install the console cannot write to Program Files as an
ordinary user, so it fetches the installer and runs it, and Windows asks you to approve it;
where the program folder is writable it swaps the files directly with no prompt. Either way the
download is rejected unless its SHA-256 matches the signed release description, and declining
the Windows prompt cancels without changing anything.
Every route rolls back to the previous version if the swap fails, so a failed update leaves a working installation rather than a half-replaced one.
Uninstalling
Use Apps & features, or the Start menu shortcut. The service is stopped, waited for, and removed.
%ProgramData%\LeoCore holds the archive encryption password. Delete it and
every encrypted archive you already hold becomes unrestorable — there is no recovery
path, by design. Say yes only when you are certain you will never need those archives.
If something goes wrong
"…is marked for deletion from a previous uninstall"
Windows keeps a deleted service registered until every handle to it is closed. Close the LeoCore console and any open Services window, restart the machine, then install again. The installer reports this specifically rather than failing with a bare error code.
"Your account is not allowed to manage LeoCore Backup on this computer"
The service is running; your account simply cannot open its pipe. Almost always this means you have not signed out since installing — the group exists and you are in it, but your logon token predates it. Sign out and back in.
If it persists, add the account explicitly from an elevated prompt in the installation folder, then have that person sign out and back in:
LeoCore.Agent.exe grant "DOMAIN\user"
Quote the account name. Windows account names often contain a space —
DELL SERVER, John Smith — and without quotes the command reads only
the first word and grants access to an account that does not exist. Version 4.4.1 accepts an
unquoted name as well, but quoting is correct on every version.
This is how you give a colleague access to the console without making them a local administrator. Run as administrator works at any time and needs no group change.
The service was registered but did not start
The install itself is fine — this warns rather than aborting. Start it from the console, or run
LeoCore.Agent.exe start from an elevated prompt. Because the service is set to
delayed automatic start, it will also come up by itself at the next reboot. If it still refuses,
%ProgramData%\LeoCore\Logs and the Windows event log will say why.
"Windows protected your PC"
SmartScreen shows this for any installer that is not yet signed with a purchased code-signing certificate. Verify the SHA-256 published on the changelog before choosing More info → Run anyway. A signed build is on the way; until then we would rather you check the hash than trust a button.
The installer refuses to run on this version of Windows
See the requirements below. The most common cause is Windows 8.1, which shares its version number with Windows Server 2012 R2 but is not supported by the .NET 8 runtime LeoCore is built on.
Requirements
| Windows client | Windows 10 version 1607 or later, Windows 11. Not Windows 8.1 or earlier. | |
| Windows Server | 2012 R2, 2016, 2019, 2022, 2025 — including Server Core. 2012 R2 is supported by the .NET 8 runtime only under Extended Security Updates. | |
| Architecture | x64. It runs on ARM64 Windows 11 under emulation; there is no native ARM64 build yet. | |
| Privileges | Administrator to install. None afterwards — the console runs as you, and reaches the service through a named pipe ACL'd to Administrators and Backup Operators. | |
| Disk | 250 MB, plus staging space for the largest single backup | |
Something here wrong, or missing? support@seksolution.com — we answer within one business day and we would rather fix the page than answer the same question twice.