Proxmox Backup Client for Windows: PBS Backup Guide

Proxmox Backup Server handles VM and container backups well. But if you run bare-metal Windows servers alongside your Proxmox cluster, you have a problem: there is no official Proxmox Backup Client for Windows. Proxmox provides proxmox-backup-client for Debian-based systems only.

A community project changes that. tizbac/proxmoxbackupclient_go is a Golang reimplementation of the PBS client protocol. It runs natively on Windows, supports VSS snapshots for crash-consistent backups, and pushes data directly to your PBS datastore. Same deduplication. Same encryption. No intermediate storage needed.

This is alpha software. It works, but it has not seen the years of production hardening that the official Linux client has. Treat it accordingly.

Why Back Up Windows to PBS?

Most mixed environments end up with two completely separate backup stacks: PBS for Proxmox VMs, and something else for Windows. That means two retention policies, two monitoring dashboards, two restore procedures to document, and two systems to maintain.

Backing up Windows servers to Proxmox Backup Server eliminates that split. Your Windows file servers, Active Directory controllers, and SQL Server hosts land in the same datastores as your VM backups. PBS deduplication works across all of it. A Windows file server sharing common OS files with other Windows backups will see the same chunk-level dedup savings you get with VMs.

You also get PBS features for free: centralized retention policies, backup verification, and offsite sync to a remote PBS instance. One system to maintain. One restore procedure.

The alternatives each have trade-offs. Veeam Agent for Windows works but requires licensing. Windows Server Backup writes to local disks or network shares with no deduplication. Backing up via WSL or Cygwin-based Borg adds complexity and fragility. Direct PBS integration is the cleanest path if the client is reliable enough for your use case.

The Golang Client

The project lives at tizbac/proxmoxbackupclient_go on GitHub. Written in Go, it compiles to a single static binary on Windows, Linux, and macOS. No runtime dependencies, no installer.

It implements the PBS backup protocol directly: chunking, deduplication, upload, and catalog generation. The server sees these backups the same way it sees backups from the official client. You can browse, verify, and restore them from the PBS web UI.

The key feature for Windows is VSS (Volume Shadow Copy Service) integration. Without VSS, backing up a running Windows system risks capturing files mid-write. Databases, registry hives, and open documents would be inconsistent. VSS coordinates with applications to create a point-in-time snapshot before the backup reads any data.

The client is CLI-only. There is no GUI, no Windows service, no tray icon. You run it from PowerShell or cmd, and schedule it with Task Scheduler. Development is active but the feature set is still limited compared to the official client.

Prerequisites

Installation

Verify the binary:

C:\Tools\pbs-client\proxmox-backup-client-go.exe --version

Set the environment variables:

[System.Environment]::SetEnvironmentVariable(
  "PBS_REPOSITORY",
  "backup-user@pbs!token@192.168.1.50:8007:your-datastore",
  "Machine"
)

[System.Environment]::SetEnvironmentVariable(
  "PBS_PASSWORD",
  "your-api-token-secret",
  "Machine"
)

[System.Environment]::SetEnvironmentVariable(
  "PBS_FINGERPRINT",
  "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
  "Machine"
)

The PBS_REPOSITORY format is user@realm!tokenname@host:port:datastore. Replace the values with your actual PBS credentials. Restart your PowerShell session after setting these.

First Backup

Test backup of a single directory:

proxmox-backup-client-go.exe backup `
  test-data.pxar:C:\Users\Administrator\Documents

Full volume backup with VSS:

proxmox-backup-client-go.exe backup `
  system.pxar:C:\ `
  --vss

Restore a single file to verify:

proxmox-backup-client-go.exe restore `
  system.pxar `
  C:\Restore\test\ `
  --archive-path "Users/Administrator/Documents/test-file.txt"

Scheduling with Task Scheduler

Running backups manually defeats the purpose. Use Windows Task Scheduler to automate daily runs.

Create a PowerShell wrapper script that logs output:

$logFile = "C:\Tools\pbs-client\logs\backup-$(Get-Date -Format 'yyyy-MM-dd').log"
New-Item -ItemType Directory -Force -Path "C:\Tools\pbs-client\logs" | Out-Null

& "C:\Tools\pbs-client\proxmox-backup-client-go.exe" backup `
  system.pxar:C:\ `
  --vss `
  *>&1 | Tee-Object -FilePath $logFile

if ($LASTEXITCODE -ne 0) {
  Write-EventLog -LogName Application -Source "PBS Backup" `
    -EventId 1001 -EntryType Error `
    -Message "PBS backup failed. See $logFile"
}

Register the scheduled task:

$action = New-ScheduledTaskAction `
  -Execute "powershell.exe" `
  -Argument "-NoProfile -ExecutionPolicy Bypass -File C:\Tools\pbs-client\backup.ps1"

$trigger = New-ScheduledTaskTrigger -Daily -At 2:00AM

$settings = New-ScheduledTaskSettingsSet `
  -StartWhenAvailable `
  -DontStopOnIdleEnd `
  -AllowStartIfOnBatteries

Register-ScheduledTask `
  -TaskName "PBS Backup" `
  -Action $action `
  -Trigger $trigger `
  -Settings $settings `
  -User "SYSTEM" `
  -RunLevel Highest

Run at 02:00 when user activity is low and disk I/O from VSS snapshots won't impact production workloads. The -StartWhenAvailable flag ensures the task runs after a missed schedule (e.g., server reboot during the backup window).

Encryption

The Golang client supports the same client-side encryption as the official Linux client: AES-256-GCM. Data is encrypted before it leaves your Windows server. The PBS server stores only ciphertext and cannot read your backup contents.

Generate an encryption key and pass it to the client:

# Generate a key (or use an existing one from your Linux PBS client)
proxmox-backup-client-go.exe key create C:\Tools\pbs-client\encryption-key.json

# Set the key path as environment variable
[System.Environment]::SetEnvironmentVariable(
  "PBS_ENCRYPTION_PASSWORD",
  "your-key-passphrase",
  "Machine"
)

# Run backup with encryption
proxmox-backup-client-go.exe backup `
  system.pxar:C:\ `
  --vss `
  --keyfile C:\Tools\pbs-client\encryption-key.json

If you already use client-side encryption on your Linux backups, you can use the same key. Copy the key file from your Linux host and use it on Windows. The encryption format is identical.

Limitations and Alternatives

If the alpha status is a dealbreaker, there are alternatives:

Veeam Agent for Windows (free/paid) handles full image-level backup with bare-metal restore. The free tier limits you to one backup job. It does not integrate with PBS.

Borg via WSL lets you run Borg Backup inside Windows Subsystem for Linux, then use PBS to pull from a Borg datastore. Works, but WSL adds a layer of complexity and does not support VSS.

SFTP target — configure Windows backup software to write to an SFTP server that PBS can ingest. Indirect, but uses proven tools at every step.

Run Windows as a VM — if possible, the simplest answer. Convert bare-metal Windows to a Proxmox VM and back it up like any other VM. PBS handles the rest. Not always feasible for hardware-dependent workloads or licensing constraints.

Frequently Asked Questions

Wrap-Up

The Golang PBS client fills a real gap in mixed Proxmox/Windows environments. It gives you one backup system for everything: VMs, containers, and bare-metal Windows. VSS support and client-side encryption make it usable for real workloads.

That said, alpha means alpha. Test it. Monitor it. Keep a secondary backup for anything critical until the project matures. Check the GitHub repository regularly for updates and breaking changes.