WindowsPublished on May 28, 202614 min read

How to host a TeamSpeak server on a Windows VPS

This guide shows how to install a TeamSpeak server on a Windows VPS and set it up: download TeamSpeak 3 Server, run ts3server.exe, open the ports, start it at boot, take admin rights, organise permissions, secure it, back it up and add a domain name. The commands target Windows Server 2025, the system delivered on OuiHeberg Windows VPS. First connect over Remote Desktop with an administrator account, as explained in Connect to a Windows VPS via RDP.

Choose resources and ports

TeamSpeak is lightweight. A VPS with 2 GB of memory is enough for most gaming communities. Bandwidth matters more than memory.

Concurrent users	Memory	vCPU	Bandwidth
Up to 10	1 GB	1	100 Mbps
Up to 50	2 GB	2	200 Mbps
Up to 100	4 GB	2	500 Mbps
Up to 200	8 GB	4	1 Gbps

TeamSpeak can share the VPS with another service, such as a FiveM server. Ports do not overlap, but then plan at least 8 GB of memory and 4 vCPU. Here are the TeamSpeak 3 Server ports, according to its documentation.

Port	Protocol	Use
9987	UDP	Voice, main port
30033	TCP	File transfer
10011	TCP	Classic ServerQuery (administration)
10022	TCP	ServerQuery encrypted over SSH
41144	TCP	TSDNS, only if you run `tsdnsserver.exe`

Choose between TeamSpeak 3 and TeamSpeak 6

TeamSpeak 3 Server is still the stable version. The TeamSpeak 6 server is in beta, published on GitHub.

Criterion	TeamSpeak 3 Server	TeamSpeak 6 Server
Status	Stable, version 3.13.8 of 27 May 2026	Beta, features still incomplete
License	Free up to 32 slots and 1 virtual server	32-slot beta license, renewed every two months
More slots	License to request from TeamSpeak	Not possible yet
Migration	None	No path from TeamSpeak 3
Bots and tools	Rich ecosystem	Still limited

For a server meant to last, choose TeamSpeak 3. The rest of this guide covers it.

Install TeamSpeak 3 Server

The official download page offers the 64-bit version for Windows. These commands download it and compute its SHA256 hash, to compare with the one on the page.

# Download the official archive (version 3.13.8)
$zip = "$env:USERPROFILE\Downloads\teamspeak3-server_win64-3.13.8.zip"
Invoke-WebRequest -Uri "https://files.teamspeak-services.com/releases/server/3.13.8/teamspeak3-server_win64-3.13.8.zip" -OutFile $zip

# Compare the hash with the one on the download page
Get-FileHash $zip -Algorithm SHA256

Then extract the archive. The files must sit directly in C:\TeamSpeak3-Server\.

# Create the install folder
New-Item -ItemType Directory -Path "C:\TeamSpeak3-Server" -Force

# Extract the archive, then copy its content straight into C:\TeamSpeak3-Server
Expand-Archive -Path "$env:USERPROFILE\Downloads\teamspeak3-server_win64-3.13.8.zip" -DestinationPath "$env:TEMP\ts3" -Force
Copy-Item -Path "$env:TEMP\ts3\teamspeak3-server_win64\*" -Destination "C:\TeamSpeak3-Server" -Recurse -Force

TeamSpeak will not start until you accept its license, found in license.txt. After reading it, create the acceptance file. The license_accepted=1 parameter does the same at launch.

# Accept the license (file read from the working folder)
New-Item -ItemType File -Path "C:\TeamSpeak3-Server\.ts3server_license_accepted" -Force

Start the server a first time. The createinifile=1 parameter creates the ts3server.ini file used by the automatic start.

# Go to the folder
Set-Location "C:\TeamSpeak3-Server"
# First start: also creates the ts3server.ini file
.\ts3server.exe license_accepted=1 createinifile=1

On the first start only, the server shows the password of the serveradmin ServerQuery account and a privilege key (token). Store them right away in a password manager. They are also written to the log in the logs folder.

------------------------------------------------------------------
ServerAdmin privilege key created, please use it to gain
serveradmin rights for your virtualserver. please
also check the doc/privilegekey_guide.txt for details.
 token=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
------------------------------------------------------------------

The privilege key grants server admin rights in the client. It works only once. Without a license file, TeamSpeak 3 Server runs with 32 slots and a single virtual server. Beyond that, you need a TeamSpeak license, copied into the server folder.

Open the ports in the Windows Firewall

The client area has no network firewall for VPS, so only the Windows Firewall matters. Open PowerShell as administrator and paste this block.

# Rule 1: voice (UDP 9987)
New-NetFirewallRule `
  -DisplayName "TeamSpeak3 - Voice (UDP 9987)" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 9987 `
  -Action Allow `
  -Profile Any

# Rule 2: ServerQuery (TCP 10011)
New-NetFirewallRule `
  -DisplayName "TeamSpeak3 - ServerQuery (TCP 10011)" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 10011 `
  -Action Allow `
  -Profile Any

# Rule 3: file transfer (TCP 30033)
New-NetFirewallRule `
  -DisplayName "TeamSpeak3 - FileTransfer (TCP 30033)" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 30033 `
  -Action Allow `
  -Profile Any

# Rule 4: TSDNS (TCP 41144), only if you run tsdnsserver.exe
New-NetFirewallRule `
  -DisplayName "TeamSpeak3 - TSDNS (TCP 41144)" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 41144 `
  -Action Allow `
  -Profile Any

Write-Host "Firewall rules created" -ForegroundColor Green

Check that the rules exist and are enabled.

Get-NetFirewallRule | Where-Object { $_.DisplayName -like "TeamSpeak3*" } | Select-Object DisplayName, Enabled, Direction

ServerQuery controls the whole server. Restrict its port to your IP address.

# Restrict ServerQuery to your IP address
Set-NetFirewallRule -DisplayName "TeamSpeak3 - ServerQuery (TCP 10011)" -RemoteAddress "203.0.113.42"

The guide How to open a port in Windows Firewall on a VPS explains rule management in detail.

Start TeamSpeak with Windows

Without a scheduled task, the server does not come back after a VPS restart. First create the startup script.

# Create the startup script
$scriptContent = @'
# TeamSpeak 3 startup script
$tsPath = "C:\TeamSpeak3-Server"
$tsExe  = "$tsPath\ts3server.exe"

# Do nothing if the server is already running
$running = Get-Process -Name "ts3server" -ErrorAction SilentlyContinue
if (-not $running) {
    Start-Process -FilePath $tsExe `
                  -WorkingDirectory $tsPath `
                  -ArgumentList "inifile=ts3server.ini" `
                  -WindowStyle Hidden
    Write-EventLog -LogName Application -Source "TeamSpeak3" -EventId 1000 `
                   -EntryType Information -Message "TeamSpeak 3 Server started" `
                   -ErrorAction SilentlyContinue
}
'@

New-Item -ItemType Directory -Path "C:\Scripts" -Force | Out-Null
$scriptContent | Out-File -FilePath "C:\Scripts\Start-TeamSpeak3.ps1" -Encoding UTF8
Write-Host "Script created: C:\Scripts\Start-TeamSpeak3.ps1" -ForegroundColor Green

Then create the task that runs this script at boot under the SYSTEM account, even with no open session.

# Task settings
$taskName    = "TeamSpeak3-AutoStart"
$scriptPath  = "C:\Scripts\Start-TeamSpeak3.ps1"
$description = "Automatic start of the TeamSpeak 3 server"

# Action: run PowerShell with the script
$action = New-ScheduledTaskAction `
    -Execute "powershell.exe" `
    -Argument "-NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$scriptPath`""

# Trigger: at system startup, with a delay
$trigger = New-ScheduledTaskTrigger -AtStartup
$trigger.Delay = "PT30S"

# Settings: no open session needed, SYSTEM account
$settings = New-ScheduledTaskSettingsSet `
    -ExecutionTimeLimit (New-TimeSpan -Hours 0) `
    -RestartCount 3 `
    -RestartInterval (New-TimeSpan -Minutes 1)
$principal = New-ScheduledTaskPrincipal `
    -UserId "SYSTEM" `
    -LogonType ServiceAccount `
    -RunLevel Highest

# Register the task
Register-ScheduledTask `
    -TaskName $taskName `
    -Action $action `
    -Trigger $trigger `
    -Settings $settings `
    -Principal $principal `
    -Description $description `
    -Force

Write-Host "Scheduled task '$taskName' created" -ForegroundColor Green

Check the task, then test it.

# Check that the task exists
Get-ScheduledTask -TaskName "TeamSpeak3-AutoStart" | Select-Object TaskName, State

# Run the task by hand, then check the process
Start-ScheduledTask -TaskName "TeamSpeak3-AutoStart"
Start-Sleep -Seconds 5
Get-Process -Name "ts3server" -ErrorAction SilentlyContinue

Finally, restart the VPS and check that ts3server.exe shows up in Task Manager.

Connect and take admin rights

Install the client from the download page. The labels below are those of the English TeamSpeak 3 client.

Open Connections › Connect (Ctrl+S).
In the address, type YOUR_VPS_IP:9987, pick a nickname, then click Connect.
On first connection, the client asks for a key. Paste the privilege key saved during the install. If the window does not show up, open Permissions › Use Privilege Key.

You now have Server Admin rights. Right-click the server name, then Edit Virtual Server, to set the essentials.

The server name, clear for your community.
The message of the day, shown on connection.
The number of slots, 32 at most without a license.
A password, if the community is private.

Organise permissions

The TeamSpeak 3 permission system is powerful but often misunderstood. First turn on advanced mode, otherwise part of the permissions stays hidden. In the client, open Tools › Options › Application and tick Advanced permission system.

TeamSpeak has two kinds of groups. Server groups apply to the whole server.

Group	Usual role
Server Admin	Full control of the server
Moderator	Kick, ban, move
Member	Access to the usual channels
Guest	Limited access

Channel groups only apply inside one channel.

Group	Usual role
Channel Admin	Manages sub-channels and channel permissions
Channel Operator	Can kick channel members
Normal	Talks and listens

Create a custom group

Open Permissions › Server Groups.
Right-click, then add a group and name it, for example "VIP" or "Streamer".
Tick the permissions you want, such as b_channel_create_permanent to create permanent channels.

Restrict access to a channel

Right-click the channel, then Edit Channel. In the channel permissions, set i_channel_needed_join_power. A group whose i_channel_join_power is lower than this value cannot enter.

Secure the server

Change the ServerQuery password

Prefer the encrypted SSH ServerQuery to plain port 10011. The OpenSSH client is included in Windows Server 2025. From the VPS, log in with the password saved during the install.

ssh -p 10022 serveradmin@127.0.0.1

Then generate a new password. The server picks it and shows it in its reply.

# After the SSH login: generate a new password for serveradmin
clientsetserverquerylogin client_login_name=serveradmin

Close unused ports

Not using file transfer? Disable its rule. Do the same for TSDNS if you do not run tsdnsserver.exe.

# Disable the file transfer rule
Set-NetFirewallRule -DisplayName "TeamSpeak3 - FileTransfer (TCP 30033)" -Enabled False

Encrypt voice

The Opus Voice codec gives the best balance between quality and bitrate. Pick it in the settings of each channel. To encrypt voice on the whole server, run this command in ServerQuery.

use sid=1
# 2 = voice encryption enabled on the whole server
serveredit virtualserver_codec_encryption_mode=2

Slow down flood bots

A high identity security level forces each new client to spend longer computing its identity. Bots that create identities in bulk are slowed down.

use sid=1
serveredit virtualserver_needed_identity_security_level=25

Ban clients or addresses

# Ban a connected client for one hour
banclient clid=ID_CLIENT banreason=Spam time=3600
# Ban an IP address directly, with no time limit
banadd ip=1.2.3.4 banreason=Flood time=0

time=0 makes the ban permanent. time is counted in seconds.

Checklist

The ServerQuery password has been regenerated.
The ServerQuery port is open to your IP address only.
Voice is encrypted on sensitive channels.
The identity security level has been raised.
A password protects the server if the community is private.
You read the logs in C:\TeamSpeak3-Server\logs\ regularly.

Back up and restore

File	Content	Priority
`ts3server.sqlitedb`	Full database: users, channels, permissions	Essential
`licensekey.dat`	Your TeamSpeak license, if you have one	Essential
`query_ip_allowlist.txt`	Addresses allowed on ServerQuery	Important
`query_ip_denylist.txt`	Addresses denied on ServerQuery	Important
`ts3server.ini`	Server configuration	Important

This script copies these files and keeps the last 7 backups. Save it as C:\Scripts\Backup-TeamSpeak3.ps1.

# Script: C:\Scripts\Backup-TeamSpeak3.ps1
# Daily backup, 7 backups kept
$sourceDir  = "C:\TeamSpeak3-Server"
$backupRoot = "C:\Backups\TeamSpeak3"
$date       = Get-Date -Format "yyyy-MM-dd_HH-mm"
$backupDir  = "$backupRoot\$date"
$maxBackups = 7

# Create the backup folder
New-Item -ItemType Directory -Path $backupDir -Force | Out-Null

# Files to back up
$filesToBackup = @(
    "ts3server.sqlitedb",
    "licensekey.dat",
    "query_ip_allowlist.txt",
    "query_ip_denylist.txt",
    "ts3server.ini"
)

foreach ($file in $filesToBackup) {
    $src = Join-Path $sourceDir $file
    if (Test-Path $src) {
        Copy-Item -Path $src -Destination $backupDir -Force
        Write-Host "Backed up: $file" -ForegroundColor Green
    } else {
        Write-Host "File not found: $file" -ForegroundColor Yellow
    }
}

# Rotation: keep only the last 7 backups
$allBackups = Get-ChildItem -Path $backupRoot -Directory | Sort-Object CreationTime
if ($allBackups.Count -gt $maxBackups) {
    $toDelete = $allBackups | Select-Object -First ($allBackups.Count - $maxBackups)
    foreach ($dir in $toDelete) {
        Remove-Item -Path $dir.FullName -Recurse -Force
        Write-Host "Old backup deleted: $($dir.Name)" -ForegroundColor Gray
    }
}

Write-Host "Backup finished: $backupDir" -ForegroundColor Cyan

Schedule it every day at 3 am.

$backupAction = New-ScheduledTaskAction `
    -Execute "powershell.exe" `
    -Argument "-NonInteractive -ExecutionPolicy Bypass -File `"C:\Scripts\Backup-TeamSpeak3.ps1`""
$backupTrigger = New-ScheduledTaskTrigger -Daily -At "03:00"

Register-ScheduledTask `
    -TaskName "TeamSpeak3-DailyBackup" `
    -Action $backupAction `
    -Trigger $backupTrigger `
    -Principal (New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount) `
    -Description "Daily TeamSpeak 3 backup" `
    -Force

Write-Host "Daily backup scheduled at 3 am" -ForegroundColor Green

To restore, stop the server, copy the files back, then start it again.

# 1. Stop the TeamSpeak server
Stop-Process -Name "ts3server" -Force -ErrorAction SilentlyContinue
Start-Sleep -Seconds 3

# 2. Pick the backup to restore (adjust the date)
$backupToRestore = "C:\Backups\TeamSpeak3\2026-05-27_03-00"
$targetDir       = "C:\TeamSpeak3-Server"

# 3. Restore the files
$filesToRestore = @("ts3server.sqlitedb", "licensekey.dat", "query_ip_allowlist.txt", "ts3server.ini")
foreach ($file in $filesToRestore) {
    $src = Join-Path $backupToRestore $file
    if (Test-Path $src) {
        Copy-Item -Path $src -Destination $targetDir -Force
        Write-Host "Restored: $file" -ForegroundColor Green
    }
}

# 4. Start the server again
Start-Process -FilePath "$targetDir\ts3server.exe" -WorkingDirectory $targetDir
Write-Host "TeamSpeak 3 server restarted" -ForegroundColor Cyan

These backups stay on the VPS. The client area also offers an automatic backup option for the whole VPS, described in How to set up automatic VPS backups.

Migrate an existing server to this VPS

On the old server, back up ts3server.sqlitedb, licensekey.dat, ts3server.ini and query_ip_allowlist.txt.
Install TeamSpeak on the new VPS with this guide, then stop it.
Copy the files into C:\TeamSpeak3-Server\ and start the server. Channels, groups and users are back.
Update the DNS A record so it points to the new IP.

Update TeamSpeak Server

According to the upgrade guide shipped with the server, you only need to stop the server and copy all files of the new version over the old ones. This script does it, after a backup. Read the changelog on the download page before each update.

# 1. Stop the server
Stop-Process -Name "ts3server" -Force -ErrorAction SilentlyContinue
Start-Sleep -Seconds 5

# 2. Back up before the update
& "C:\Scripts\Backup-TeamSpeak3.ps1"

# 3. Download the new version (update this number)
$newVersion = "3.13.8"
$downloadUrl = "https://files.teamspeak-services.com/releases/server/$newVersion/teamspeak3-server_win64-$newVersion.zip"
$zipPath = "$env:TEMP\ts3server_update.zip"
Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath

# 4. Extract to a temporary folder
$tempDir = "$env:TEMP\ts3server_new"
Expand-Archive -Path $zipPath -DestinationPath $tempDir -Force

# 5. Copy all files of the new version (the archive has no database, license or ts3server.ini)
Copy-Item -Path "$tempDir\teamspeak3-server_win64\*" -Destination "C:\TeamSpeak3-Server\" -Recurse -Force

# 6. Clean up and restart
Remove-Item $zipPath, $tempDir -Recurse -Force
Start-Process -FilePath "C:\TeamSpeak3-Server\ts3server.exe" -WorkingDirectory "C:\TeamSpeak3-Server"
Write-Host "Server restarted with version $newVersion" -ForegroundColor Green

Version 3.13.8 fixes three flaws that could crash the server (CVE-2026-4390 to 4392). Update any older server.

Use a domain name

Instead of an IP address, give your users a name such as ts.mydomain.com. If you move servers, you only change the DNS. First create an A record in your domain's DNS zone.

Type  : A
Name  : ts
Value : YOUR_VPS_IP
TTL   : 3600

With the default port 9987, this record is enough. An SRV record also lets users connect without typing another port.

Type     : SRV
Name     : _ts3._udp.ts.mydomain.com
Priority : 0
Weight   : 5
Port     : 9987
Target   : ts.mydomain.com
TTL      : 3600

In most DNS managers, the SRV form asks for these fields.

Field	Value
Service	`_ts3`
Protocol	`_udp`
Name	`ts.mydomain.com`
Priority	`0`
Weight	`5`
Port	`9987`
Target	`ts.mydomain.com`

Propagation takes from a few minutes to 24 hours. Then check the resolution.

Resolve-DnsName -Name "_ts3._udp.ts.mydomain.com" -Type SRV

Fix common errors

"failed to bind network interface"

Another process holds port 9987. Find it.

# Find the process holding port 9987
netstat -ano | findstr :9987
# Get its name from the PID
Get-Process -Id NUMERO_PID

Stop that process, or change the TeamSpeak port in ts3server.ini.

default_voice_port=9988

Then adjust the firewall rule, and your SRV record if you have one.

Remove-NetFirewallRule -DisplayName "TeamSpeak3 - Voice (UDP 9987)"
New-NetFirewallRule -DisplayName "TeamSpeak3 - Voice (UDP 9988)" -Direction Inbound -Protocol UDP -LocalPort 9988 -Action Allow

The server does not start after a reboot

# Task state (LastTaskResult = 0 means success)
Get-ScheduledTask -TaskName "TeamSpeak3-AutoStart" | Select-Object State, LastRunTime, LastTaskResult
# Run it by hand to test
Start-ScheduledTask -TaskName "TeamSpeak3-AutoStart"

If the task fails, check the execution policy with Get-ExecutionPolicy, and that -ExecutionPolicy Bypass is in the task action.

Cannot connect from outside

Only the Windows Firewall filters connections to the VPS. Check that the rules created earlier are enabled with the rule check command.

Your address was banned by mistake

login serveradmin YOUR_PASSWORD
use sid=1
banlist
bandel banid=BAN_ID

If ServerQuery itself refuses you, add your IP to query_ip_allowlist.txt and restart the server.

The privilege key is lost

Create a new one for the Server Admin group, whose ID is 6 by default.

login serveradmin YOUR_PASSWORD
use sid=1
tokenadd tokentype=0 tokenid1=6 tokenid2=0

The database is damaged

# 1. Stop the server
Stop-Process -Name "ts3server" -Force
# 2. Rename the damaged database
Rename-Item "C:\TeamSpeak3-Server\ts3server.sqlitedb" "ts3server.sqlitedb.corrupt"
# 3. Restore the latest backup
$latestBackup = Get-ChildItem "C:\Backups\TeamSpeak3" -Directory | Sort-Object CreationTime -Descending | Select-Object -First 1
Copy-Item "$($latestBackup.FullName)\ts3server.sqlitedb" "C:\TeamSpeak3-Server\"
# 4. Restart
Start-Process -FilePath "C:\TeamSpeak3-Server\ts3server.exe" -WorkingDirectory "C:\TeamSpeak3-Server"

Without a backup, the server creates an empty database on the next start. Channels, groups and users are lost, but the server runs again.

Need help?

Open a ticket from Tickets › Open a Ticket, or from the Contact support tile at the bottom of the VPS page. In the Related Service field, pick the VPS so the team saves time. You can also ask your question on the OuiHeberg Discord.

Open a ticket Discord

Was this article helpful?

317 views

Share this article

VPS Windows

Need a Windows VPS?

Windows Server 2025 with the license included, Remote Desktop access and management from the client area.

View plans →