Install Odoo 20 on Windows Server: A Source Setup That Survives the First Run

• Python 3.12, 64 bit. Odoo 20 accepts 3.12 to 3.14, but 3.12 installs every dependency from prebuilt wheels on Windows. Install it for all users.
• PostgreSQL 16 or later. Older versions are unsupported. Record the superuser password safely.
• Git for Windows. Used to clone the source and pull fixes later.
• Microsoft C++ Build Tools. Covers the rare package that must compile.
• wkhtmltopdf 0.12.6 with patched Qt. Needed for PDF reports with headers and footers.

git --version
py -3.12 --version
psql --version
wkhtmltopdf --version

Odoo refuses to connect as the postgres superuser, so create a dedicated role that can log in and create databases but nothing more.

psql -U postgres -c "CREATE ROLE odoo WITH LOGIN CREATEDB PASSWORD 'the-odoo-role-password';"

Keep paths short to avoid Windows path limits. This guide uses C:\odoo as the root.

git config --system core.longpaths true
mkdir C:\odoo; cd C:\odoo
git clone https://github.com/odoo/odoo.git --depth 1 --branch 20.0 --single-branch src
mkdir custom-addons, data, logs
py -3.12 -m venv venv
.\venv\Scripts\Activate.ps1
python -m pip install --upgrade pip setuptools wheel

Enterprise subscribers clone the enterprise repository into C:\odoo\enterprise at the same branch and list it first in the addons path. If you are still deciding, compare Odoo Community and Enterprise editions before you clone.

cd C:\odoo\src
pip install -r requirements.txt
python odoo-bin --version

The last command should print the version without import errors.

Save this as C:\odoo\odoo.conf.

[options]
admin_passwd = use-a-long-random-master-password
db_host = localhost
db_port = 5432
db_user = odoo
db_password = the-odoo-role-password
dbfilter = ^odoo_prod$
list_db = False
proxy_mode = True
http_interface = 127.0.0.1
http_port = 8069
addons_path = C:\odoo\src\addons,C:\odoo\custom-addons
data_dir = C:\odoo\data
logfile = C:\odoo\logs\odoo.log

With the database manager hidden, create the database from the command line, then start Odoo.

python odoo-bin -c C:\odoo\odoo.conf -d odoo_prod -i base --stop-after-init
python odoo-bin -c C:\odoo\odoo.conf

Open http://127.0.0.1:8069 on the server itself, sign in as admin with the password admin, and change that password immediately.

• Create a service account. Make a local user such as svc_odoo without administrator rights.
• Grant folder access. Give it modify rights on the data and logs folders.
• Register the service. Point NSSM at the virtual environment Python with odoo-bin and the config file.

icacls C:\odoo\data /grant "svc_odoo:(OI)(CI)M"
icacls C:\odoo\logs /grant "svc_odoo:(OI)(CI)M"
nssm install Odoo C:\odoo\venv\Scripts\python.exe "C:\odoo\src\odoo-bin -c C:\odoo\odoo.conf"
nssm set Odoo AppDirectory C:\odoo\src
nssm set Odoo ObjectName .\svc_odoo "service-account-password"
nssm set Odoo Start SERVICE_AUTO_START
nssm set Odoo AppExit Default Restart
nssm start Odoo

Create a site bound to your DNS name, add HTTP_X_FORWARDED_PROTO to the allowed server variables in URL Rewrite, and place this web.config in the site folder.

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="OdooProxy" stopProcessing="true">
          <match url="(.*)" />
          <serverVariables>
            <set name="HTTP_X_FORWARDED_PROTO" value="https" />
          </serverVariables>
          <action type="Rewrite" url="http://127.0.0.1:8069/{R:1}" />
        </rule>
      </rules>
    </rewrite>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="134217728" />
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

This allows uploads up to 128 MB. Also raise the ARR proxy timeout to about 300 seconds for large reports.

• Use a certificate from your corporate authority, or a free Let's Encrypt certificate issued and renewed by the win-acme client.
• Bind it to port 443 on the site and redirect plain HTTP to HTTPS.

Windows Defender Firewall

• Allow inbound TCP 443, and 80 only for the HTTPS redirect.
• Do not open 8069 or 5432. Odoo and PostgreSQL listen on the local address only.

New-NetFirewallRule -DisplayName "Odoo HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

Nightly backup task

Run this PowerShell script nightly from Task Scheduler, with the odoo role password stored in pgpass.conf for that account.

$d = Get-Date -Format yyyyMMdd
& "C:\Program Files\PostgreSQL\16\bin\pg_dump.exe" -U odoo -Fc odoo_prod -f "D:\backups\odoo_prod_$d.dump"
robocopy C:\odoo\data\filestore\odoo_prod "D:\backups\filestore_$d" /MIR /R:2 /W:5

Copy backups off the server daily and rehearse a restore monthly. Our Odoo database backup and restore guide covers retention in more detail.