Deployment guide

JBoss EAP on Windows

Overview

Red Hat JBoss Enterprise Application Platform (JBoss EAP) is an enterprise-grade Java application server built on the WildFly open-source project. It is a platform for deploying Java EE applications in production.

The JBoss EAP on Windows AMI from SecureAnyCloud gives you a preconfigured JBoss EAP installation on Windows Server. You can reach a working application server within minutes of launching the instance.

What you get:

JBoss EAP 7.4.0 registered as a Windows Service that starts automatically on boot
Java preinstalled and ready to use
The JBoss EAP Administration Console in your browser on port 9990
The JBoss Welcome Page on port 8080
24/7 SecureAnyCloud support

This guide covers connecting over Remote Desktop, managing the JBoss EAP service, creating a management user, deploying applications and applying security best practices. To browse the full catalogue of preconfigured AMIs on the AWS Marketplace, visit secureanycloud.com.

Prerequisites

Have the following in place before you launch the AMI.

AWS account: An active account with permission to launch EC2 instances and manage security groups.
EC2 key pair: A key pair in the region where you plan to launch. You need it to decrypt the Windows Administrator password.
Remote Desktop client: A Remote Desktop Protocol (RDP) client on your local machine, such as Microsoft Remote Desktop (macOS/Windows), Remmina (Linux) or any compatible client.
Security group: A group that allows inbound TCP on the ports below.

Open these ports in the security group:

RDP, TCP 3389: Remote Desktop access
TCP 9990: JBoss EAP Administration Console
TCP 8080: JBoss Welcome Page

Restrict RDP to your own IP address or a trusted CIDR range. Limit the JBoss management port (9990) to trusted administrators only.

Minimum system requirements: 1 vCPU, 1 GB RAM and 30 GB of disk space. For production workloads, use a t3.medium or larger instance type with at least 4 GB of RAM for consistent performance.

Step by Step Setup

Step 1 - Launch the instance

Open the AWS Marketplace listing for JBoss EAP on Windows by SecureAnyCloud.

Click Continue to Subscribe, then Continue to Configuration.

Select your preferred AWS Region and instance type.

On the launch page, choose your VPC and subnet, and assign the security group you prepared above.
Select your EC2 key pair and launch the instance.

Step 2 - Wait for the status checks

Wait until the instance shows 2/2 status checks passed before you connect. Windows instances can take several minutes to finish their initial boot.

Step 3 - Retrieve the Windows Administrator password

Sign in to the AWS Console and open EC2 > Instances.
Select the radio button next to your new instance.
Click Actions > Security > Get Windows password.
Click Browse and upload the .pem key pair file you selected at launch.
Click Decrypt password.
Copy the Administrator password that appears and store it securely.

Step 4 - Connect with Remote Desktop

Open your Remote Desktop client.
Create a new connection to the public IP address of your EC2 instance. If the instance is on a private subnet and you have a VPN connection, use the private IP address instead.
Click Add or Connect.
When prompted for credentials, enter the username Administrator and the decrypted password from Step 3, then click Continue.
If a certificate warning appears, click Continue to proceed.

The Windows Server desktop opens.

Step 5 - Verify the Java installation

Open a Command Prompt (CMD) and check the Java version:

java --version

Java is preinstalled and available on the system PATH.

Step 6 - Verify the JBoss EAP service

The JBoss EAP service starts automatically on boot. To confirm it is running:

Open the Start Menu and search for Services.
Click Services to open the Services management console.
Find the JBossEAP7 service in the list.
Check that Status shows Running and Startup Type shows Automatic.

The service properties show:

Service name: JBossEAP7
Display name: JBossEAP7
Description: JBoss Enterprise Application Platform 7
Path to executable: C:\Users\Administrator\jboss-eap-7.2\bin\prunsrv.exe //RS//JBossEAP7
Startup type: Automatic

Step 7 - Verify the JBoss Welcome Page

Open a web browser on the instance, or on your local machine if port 8080 is open in the security group, and go to:

http://<PUBLIC_IP>:8080

The JBoss EAP Welcome Page confirms that the application server is running.

Step 8 - Create a management user

You must create a management user before you can open the Administration Console. Open a Command Prompt as Administrator and run:

cd C:\Users\Administrator\EAP-7.4.0\bin add-user.bat

The script prompts you for the following:

What type of user do you wish to add? Enter a for Management User.
Username: Enter a username, for example admin. If the user already exists, choose option a to update that user's password and roles.
Password: Enter a strong password. It must contain at least 8 characters, including 1 alphabetic character, 1 digit and 1 non-alphanumeric symbol. It must not match the username or a restricted value (root, admin, administrator).
Re-enter Password: Confirm the password.
What groups do you want this user to belong to? Press Enter to leave this blank.
Is this new user going to be used for one AS process to connect to another? Enter no.

Step 9 - Open the Administration Console

Open the JBoss EAP Administration Console in your browser:

http://<PUBLIC_IP>:9990

A sign-in prompt appears. Enter the following:

Username: The management username you created, for example admin
Password: The password you set in the add-user script

Click Sign In. The Red Hat JBoss Enterprise Application Platform management console opens, with these areas:

Deployments: Manage deployed applications
Configuration: Edit subsystem settings
Runtime: Monitor server status, JVM usage and logs
Patching: Apply JBoss EAP patches
Access Control: Manage user roles and permissions

Server Components

The AMI includes these preconfigured components:

JBoss EAP 7.4.0: Red Hat JBoss Enterprise Application Platform
Java (latest compatible version): The Java Runtime Environment that JBoss EAP requires
Windows Server 2012 R2 or later: The operating system

JBoss EAP is installed in the Administrator user's home directory at C:\Users\Administrator\EAP-7.4.0. It is registered as a Windows Service that starts automatically.

Filesystem Layout

The AMI uses a single C: drive that holds Windows Server, JBoss EAP and Java.

Key directories:

C:\Users\Administrator\EAP-7.4.0: JBoss EAP installation directory
C:\Users\Administrator\EAP-7.4.0\bin: JBoss EAP binaries, scripts and service management tools
C:\Users\Administrator\EAP-7.4.0\standalone: Standalone server configuration, deployments and data
C:\Users\Administrator\EAP-7.4.0\standalone\configuration: Server configuration files, including standalone.xml
C:\Users\Administrator\EAP-7.4.0\standalone\deployments: Application deployment directory (hot-deploy folder)
C:\Users\Administrator\EAP-7.4.0\standalone\log: Server log files
C:\Users\Administrator\EAP-7.4.0\domain: Domain mode configuration for multi-server setups

Managing Services

Manage the JBoss EAP service from the Windows Services console or the command line.

Using the Windows Services console

Open the Start Menu and search for Services.
Find JBossEAP7 in the service list.
Right-click it to Start, Stop or Restart the service, or to change the Startup Type.

Using the command line

Open a Command Prompt as Administrator:

:: Check the JBoss EAP service status sc query JBossEAP7 :: Stop the JBoss EAP service net stop JBossEAP7 :: Start the JBoss EAP service net start JBossEAP7 :: Restart the JBoss EAP service net stop JBossEAP7 && net start JBossEAP7

Using PowerShell

# Check service status Get-Service JBossEAP7
# Stop the service Stop-Service JBossEAP7
# Start the service Start-Service JBossEAP7
# Restart the service Restart-Service JBossEAP7

Changing the startup type

To stop JBoss EAP from starting automatically on boot, run:

sc config JBossEAP7 start=demand

To turn automatic startup back on, run:

sc config JBossEAP7 start=auto

Scripts and Log Files

These scripts and files are the ones you use most often:

add-user.bat in C:\Users\Administrator\EAP-7.4.0\bin: Creates or modifies management and application users
standalone.bat in C:\Users\Administrator\EAP-7.4.0\bin: Starts JBoss EAP in standalone mode (manual start)
jboss-cli.bat in C:\Users\Administrator\EAP-7.4.0\bin: The JBoss EAP command-line interface for administration
server.log in C:\Users\Administrator\EAP-7.4.0\standalone\log: The main JBoss EAP server log
standalone.xml in C:\Users\Administrator\EAP-7.4.0\standalone\configuration: The primary server configuration file
mgmt-users.properties in C:\Users\Administrator\EAP-7.4.0\standalone\configuration: The management user credentials store

Deploying Applications

Hot deployment

The simplest way to deploy a Java application is to copy your WAR, EAR or JAR file into the deployments directory:

copy C:\path\to\your\application.war C:\Users\Administrator\EAP-7.4.0\standalone\deployments\

JBoss EAP detects and deploys the application automatically. A .deployed marker file appears when deployment is complete.

Using the Administration Console

Sign in to the Administration Console at http://<PUBLIC_IP>:9990.
Click Deployments on the home page.
Click Add and browse to your application file.
Follow the wizard to upload and enable the deployment.

Using the CLI

Open a Command Prompt and launch the JBoss CLI:

cd C:\Users\Administrator\EAP-7.4.0\bin jboss-cli.bat --connect deploy C:\path\to\your\application.war

Troubleshooting

Cannot connect over RDP

Confirm the instance has reached 2/2 status checks in the EC2 console.
Check that your security group allows inbound TCP on port 3389 from your IP address.
Check that you are using the correct decrypted Administrator password.
If you have a VPN connection to the VPC, try the private IP address.

The JBoss EAP service is not running

Open Services and check the status of the JBossEAP7 service.
If the service has stopped, read the server log at C:\Users\Administrator\EAP-7.4.0\standalone\log\server.log for error messages.
Make sure the C: drive has enough free disk space.
Check that Java is installed correctly and runs from the command line.

Cannot reach the Administration Console on port 9990

Check that the JBossEAP7 service is running.
Check that you created a management user with the add-user.bat script. The console requires authentication and is not accessible without a management user.
Check that port 9990 is open in your security group.

Cannot reach the Welcome Page on port 8080

Check that the JBossEAP7 service is running.
Check that port 8080 is open in your security group.
Review the server log for startup errors.

Deployment fails

Check the server log for deployment error messages.
Check that the application is compatible with the installed JBoss EAP version.
Make sure there is enough free disk space for the deployment.

Password requirements not met during add-user

The password must be at least 8 characters long.
It must contain at least 1 alphabetic character, 1 digit and 1 non-alphanumeric symbol.
It must not match the username or be a restricted value such as root, admin or administrator.

Security Recommendations

Change the Windows Administrator password

After your first sign-in, change the Administrator password in Windows:

Press Ctrl+Alt+Del, or use your RDP client's equivalent.
Select Change a password.
Enter the current password and set a new strong password.

Once you change the password, you can no longer retrieve it from the AWS Console.

Restrict RDP access

Limit RDP (port 3389) to specific trusted IP addresses in your security group. Never expose RDP to 0.0.0.0/0. Consider a bastion host or AWS Systems Manager for remote access.

Restrict management console access

Port 9990 gives full administrative control over the JBoss EAP server. Open it only to trusted administrator IP addresses.

Use strong management passwords

When you create management users with add-user.bat, choose passwords that meet your enterprise password policy.

Enable Windows Firewall

In addition to AWS security groups, configure Windows Firewall to allow inbound traffic only on the required ports.

Apply Windows updates

Keep Windows Server up to date with the latest security patches:

Open Server Manager.
Go to Windows Update.
Check for updates and install them.

Apply JBoss EAP patches

Monitor Red Hat's security advisories for JBoss EAP. Apply patches in the Patching section of the Administration Console.

Enable HTTPS

For production deployments, configure JBoss EAP to use HTTPS with a TLS certificate on both the application port (8080) and the management port (9990).

Back up configuration and deployments

Back up the JBoss EAP configuration and your deployed applications regularly. Use AWS EBS snapshots for volume-level backups, or copy the standalone\configuration and standalone\deployments directories manually.

Support

If you hit an issue this guide does not cover, the SecureAnyCloud support team is available 24/7.

Email: sales@secureanycloud.com Phone: (+44) 02045382725 Website: secureanycloud.com Address: 3rd Floor, 86 90 Paul Street, London, EC2A 4NE

When you contact support, include your EC2 instance ID, the AWS region, a description of the issue, and any relevant log output or screenshots.

Deploy on AWS

Launch JBoss EAP on Windows with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com