Who this guide is for Prepare the server, operating system and login Install on Debian / Ubuntu Install on Rocky / AlmaLinux and other RPM systems Start and check the Linux service Prepare media folders and Linux permissions Install on Windows Server and run at boot Ports, host firewalls and cloud security rules Open Emby and complete initial setup Manage the Linux service and read logs Updates and backups Stop, restart and uninstall Troubleshoot by symptom Routine maintenance and acceptance checks Next steps: clients and reverse proxies References and documentation differences 1. Who this guide is for # You have bought a VPS or cloud server, installed a fresh operating system, and want to turn your own films, shows or music into a library accessible from a browser and Emby clients. This guide starts with logging in and uses native Emby Server packages on Debian, Ubuntu, Rocky Linux, AlmaLinux and Windows Server. Linux users should follow the installation section for their distribution, then continue with folders, permissions, firewalls and initial setup. Windows users can go directly to sections 7–9. The service, backup and troubleshooting sections cover ongoing operation. Emby Server does not supply films or automatically copy files from your computer to the VPS. Upload media you are entitled to use, or mount storage you have permission to access. A domain and reverse proxy can wait until the server itself works. 2. Prepare the server, operating system and login # 2.1 Choose the operating system and resources # Windows Server 2019, 2022 and 2025 are common cloud images. Emby's Windows download page gives broad requirements, without a complete support matrix for those Server editions . Check the current download guidance and any actual errors. A Server 2025 installer failure is documented on the official forum; see the Windows installation and troubleshooting sections. References to Windows Vista or Windows 7 in older documentation are not a reason to deploy an operating system that no longer receives security updates. Resource requirements depend mainly on playback. Direct Play primarily uses storage and network bandwidth; live video transcoding needs more CPU or an available video acceleration device. Most ordinary VPS plans do not expose a usable GPU, and an ARM CPU does not automatically provide hardware transcoding. For a small Linux installation focused on direct playback, 2 vCPU and 2–4 GB of RAM are a reasonable planning starting point. Windows needs additional memory for the operating system. These are planning suggestions, not universal Emby minimums or a promise of 4K transcoding. Allow space for the application, database, artwork, logs and temporary transcodes in addition to media. Check outbound bandwidth, monthly transfer allowances and cloud disk costs. 2.2 Keep a working management connection # Find the public IP, initial username, SSH key or password in the cloud console. Locate its serial, VNC or rescue console before changing anything. Linux normally uses SSH; Windows uses RDP. Restrict management ports to your own source IP. SSH defaults to TCP 22 and RDP to TCP 3389, but use the provider's actual ports. Run the following SSH command in a terminal on your own computer , replacing the sample username and IP: Debian images may use debian , Rocky images rocky , and other providers may use root , almalinux , opc or ec2-user . Check rather than guess. To specify a key and a different port: Verify the server's identity against information from the cloud console on first connection. 203.0.113.10 is a documentation address, not a usable server. All following Linux commands run on the VPS after logging in . Code blocks omit the shell prompt so they can be copied. Keep sudo for a regular account; omit it if already root. If a minimal image lacks sudo, use the provider's root or console access for preparation rather than weakening SSH policy. /etc/os-release identifies the distribution, df -h shows free disk space, and free -h shows memory. The service commands below require PID 1 to be systemd . On a restricted container-based VPS without systemd, first check the provider's service management capabilities. If the clock is wrong, restore time synchronization using the provider's or distribution's documentation; HTTPS downloads and signature validation can fail with an incorrect clock. 2.3 Match architecture names correctly # amd64 also applies to 64-bit Intel processors. arm64 and aarch64 name the same 64-bit ARM family in different packaging systems; neither can use an x86 package. On Debian / Ubuntu, also check the userspace architecture: On an RPM system: The official APT repository currently lists amd64 arm64 armhf . The current stable GitHub release provides DEBs for those architectures and RPMs for x86_64/aarch64 . An ARMv7 RPM entry in an older download-page template does not establish that the latest stable release supplies it. Verify 32-bit systems, unusual ABIs and CPU instruction requirements separately; do not force an incompatible package to install. 3. Install on Debian / Ubuntu # 3.1 Update the system and install tools # On a fresh server, refresh the package index and install system updates. Review the proposed changes before confirming. If an update asks about configuration files, inspect the differences rather than overwriting the cloud image's SSH configuration blindly. These tools cover HTTPS downloads, certificate validation, ACLs, mounts, ports and process or memory checks. The package manager resolves Emby's dependencies. There is no need to copy an old tutorial's Mono, obsolete .NET, apt-transport-https or a long list of unrelated components. If system updates require a reboot, confirm console access, run sudo reboot , and wait for SSH to recover before continuing. 3.2 Add the official stable APT repository # Follow the official Emby APT instructions to add a separate keyring and Deb822 source file: The source should use https://pkg.emby.media/apt/ , the stable suite and a Signed-By entry pointing to the saved keyring. apt-cache policy should show a candidate from this repository. Resolve any download or index error before continuing. Do not add the beta source, use apt-key , set trusted=yes or disable signature validation as a workaround. The second command should print the installed package name, version and correct architecture. APT selects the matching architecture. The instructions do not pin a version number that will quickly become outdated. 3.3 Fallback: download an official DEB manually # Use this section only if you are not using the repository: choose one installation method . Open the official Linux download page , select Debian / Ubuntu, your architecture and the stable channel, then copy the .deb link. Alternatively, find the matching asset in the official GitHub release . Replace the variable below with that file's full HTTPS URL. Do not leave the placeholder, choose a beta package or use a third-party modified build. Check that the metadata says emby-server and matches the architecture recorded earlier. APT can resolve a local package's dependencies from configured repositories, making it more suitable for beginners than dpkg -i alone. Downloading a file does not set up an update repository; subsequent updates require another stable package download and installation. References: Debian APT handbook , Ubuntu software management . 4. Install on Rocky / AlmaLinux and other RPM systems # 4.1 Update the system and add the official repository # Rocky, AlmaLinux, RHEL, CentOS Stream, Oracle Linux and Fedora use RPM / DNF. Downloading the .repo file directly avoids differences between DNF 4 and DNF 5 config-manager arguments. Do not enable EPEL, CRB or unrelated third-party repositories indiscriminately to install Emby. The stable repository ID is currently emby ; its URL contains /rpm/stable/ and $basearch . Preserve gpgcheck=1 and repo_gpgcheck=1 . DNF may ask to import Emby's public key during initial validation. Verify the official source https://pkg.emby.media/keys/emby-public.asc and the documentation before accepting; do not import keys from unknown mirrors. The installed package should match x86_64 or aarch64 . The systemd service is still emby-server , not emby , embyserver or an old SysV service command. References: official Emby DNF instructions , Rocky software management . An official forum discussion covers RPM use on AlmaLinux / Rocky , but does not prove every new release combination works. Use the package manager's dependency checks and current Emby guidance. 4.2 Fallback: download an official RPM manually # Without the repository, choose the stable .rpm for your architecture from the official Linux download page or GitHub release, then fill in its complete HTTPS URL: DNF resolves dependencies. A direct download does not by itself verify the publisher's RPM signature; local-package validation also depends on the system's localpkg_gpgcheck policy. Prefer the official repository when you need auditable signature validation. Do not append --nogpgcheck , --nodeps or --force after a signature error. Manually installed packages need another download for updates; a later dnf upgrade alone is not guaranteed to update Emby. 5. Start and check the Linux service # The package supplies the service definition and account; you do not need to write a systemd unit. Confirm that the cloud firewall does not allow unrestricted access to 8096, then run: Expect enabled , active and active (running) . ss should show a TCP listener on 8096; HTTP should return a page or redirect status such as 200 / 302. The exact response varies by version; 000 means curl did not receive an HTTP response. enable configures startup at boot and --now also starts the service immediately. A listening port proves only that a process accepts connections; a browser must still display the wizard or login page. If startup fails, inspect: Official Linux packages normally run as emby and use /var/lib/emby for data. The actual unit, systemctl cat/show and the dashboard's server information establish the current paths, account and arguments. An old tutorial's configuration path is not a substitute for checking them. See the official Linux notes and data directory documentation . 6. Prepare media folders and Linux permissions # 6.1 Fresh server: use a local folder you manage # Use /data/media if the system disk has enough space, or /mnt/media for a data disk or mounted NAS. Media, Emby application data and temporary transcodes are separate. Do not copy films into /var/lib/emby as configuration. The following creates new local media folders: The owner is your current account, or root if you have switched to root. Mode 2750 lets the owner write, the media group read and traverse, and other accounts do neither. The setgid bit makes new entries inherit the directory's group. Keep -a in usermod -aG : it appends membership instead of replacing existing groups. Restart the service to pick up the new membership. Upload media through SFTP, WinSCP or the provider's supported tools. A regular upload account needs write access to the target. Start with a few files: If the upload tool preserves overly restrictive permissions, the media group may still be unable to read files. Add group read access only to this local tree that you have confirmed you manage : Directories need x for traversal; files need r for reading. Films do not need executable permission. If files did not inherit the media group, inspect ls -l and correct the actual media tree's group using the next section. 6.2 Existing folders: preserve ownership and grant access # Root being able to read a folder does not establish that Emby can. Check every parent: Emby needs traversal through / , /mnt , /mnt/media and Movies . Changing only the last folder will not help media inside /root or a mode-700 home directory. A dedicated media path is usually more suitable. Option A: the media group. Use this only on a local media tree you own without special ACLs. It preserves file owners: Option B: ACLs. To preserve the existing owner and group, grant access specifically to emby. You do not need both options. Save the current ACLs before changing them: Capital X grants traversal on directories without making every ordinary film executable. Default ACLs apply to newly created entries; moved files and uploads or copies that preserve source permissions may not inherit them. Check again after uploading. The ACL mask and #effective entries constrain effective permissions; later chmod operations can also change the mask. Do not apply these recursive commands blindly to special NAS ACLs, read-only filesystems or mounts without POSIX ACL support. References: Emby permissions , setfacl manual . Use chown only when deliberately changing the upload owner of a new folder , for example sudo chown your_upload_user:media /data/media/Movies . Do not recursively transfer ownership of a shared disk to emby. 6.3 Data disks, SMB / NFS and boot-time mounts # An attached cloud disk may not yet be mounted. Inspect devices and existing filesystems: If a partition already has a filesystem, verify that it is not the system disk, then mount its actual UUID at a new path. Replace the placeholder: For a new blank disk without a filesystem, follow the cloud provider's disk initialization instructions. Formatting erases the target device. A sample device name is not your disk. This guide does not offer a generic command that could format the system disk accidentally. For mounting at boot, back up /etc/fstab , then use an editor to add an entry matching the real UUID and filesystem. An existing ext4 data partition could use: If nano is missing, install it with your distribution's package manager or use an editor you know. This is fstab content, not a shell command : For XFS, use xfs and its appropriate check settings rather than copying the ext4 entry. Validate the file, reload configuration and check the mount: Fix validation errors before rebooting. nofail allows the OS to boot without the disk, but Emby should not scan its empty mount directory. Once an actual fstab mount is defined, run sudo systemctl edit emby-server and add: This creates dependencies and startup ordering for the relevant mount units. The path must actually have a mount definition: an empty directory alone does not tell systemd which disk you intended to mount. See systemd mount dependencies . Mount SMB / NFS reliably in the operating system before giving Emby the local mount path. SMB issues commonly involve UID / GID mapping and share-side ACLs; NFS issues include mismatched numeric IDs and export permissions. root_squash is not a reason to disable NFS security settings. Test with sudo -u emby ls . Protect credential files and do not put SMB passwords on the command line. Configure _netdev , network readiness and failure behavior using storage and distribution documentation. Use scheduled scans when real-time monitoring is unavailable. 7. Install on Windows Server and run at boot # 7.1 Log in, update and download # Connect using the provider's RDP details. Install Windows updates and check the clock and disk space inside the server. The following PowerShell commands run on Windows Server. Open PowerShell as administrator for firewall and service operations. Open Emby Server for Windows in the server's browser. Choose the stable Server , not the Emby Windows / Theater client. The official page offers an installer and portable x64 / x86 ZIPs. This guide assumes x64 Windows Server; a Linux ARM64 package cannot be used here. 7.2 Installer or portable installation # Installer: Download from the official page and run it as the Windows account you intend to keep using for Emby. Follow the installer. It may fetch further files online, so allow access to official HTTPS download sources. Installation normally starts Emby and opens the setup wizard. If it does not, visit http://localhost:8096 . A common application path is %APPDATA%\Emby-Server\system\EmbyServer.exe , rather than an all-users installation under C:\Program Files . %APPDATA% belongs to the installation / runtime account , not whichever account happens to be logged in later. Portable: Download the official x64 ZIP and extract it to a fixed folder such as C:\Emby . Preserve its System subfolder. The executable should be C:\Emby\System\EmbyServer.exe . Do not scatter the contents of System into the root folder or run from Downloads or a temporary location. The first command should return True ; the second applies only to an extracted portable installation. Start normally to check that the application works. Choose one installation and keep a single running instance. 7.3 Data and media folders # A common installer data path is: With the portable System layout preserved, data is normally in programdata in the parent folder: C:\Emby\programdata in this example. It contains configuration, users, databases, plugins, metadata and logs. Do not clear it as a cache during an upgrade. Confirm the actual location through … → Get Server Info beside the server name in the dashboard, or Data path in startup logs; do not assume it is C:\ProgramData . References: official data folder guidance , portable directory discussion . Create separate media folders such as D:\Media\Movies and D:\Media\TV if a D: data disk exists; otherwise C:\Media is an option. In Explorer's Properties → Security, grant the Emby account Read & execute, List folder contents and Read on media, and Modify on its data folder. Add media write access only when needed to save adjacent subtitles or NFO files. Do not grant Everyone Full control. 7.4 Run without logging in: create a Windows Service # Starting at user login is different from running after a reboot with nobody logged in. A Windows Service is appropriate for a VPS; do not assume a normal installation has already registered one . Emby's official service instructions use the third-party service wrapper NSSM. Verify Emby through a normal startup, then close it through the tray or dashboard. Confirm that Task Manager shows no remaining EmbyServer process. Disable the ordinary instance's startup at login in Emby settings, preventing tray and service instances from competing for ports or data. Obtain the matching Windows architecture from the official NSSM site . Keep nssm.exe in a fixed location such as C:\Tools\nssm\nssm.exe ; the service depends on that file, so do not move or delete it later. Run this in administrator PowerShell to open service configuration. This guide uses the service name EmbyServer throughout: Set the default action under Exit actions to Exit / do not automatically restart the application , as Emby specifies. Otherwise Shutdown in the dashboard can immediately relaunch the process. Use Windows Restart-Service for a normal service restart. The account needs Log on as a service plus the folder permissions above. Avoid defaulting to highly privileged LocalSystem for convenience; it also does not automatically have your SMB credentials. Enter account passwords in NSSM's Log on UI, not scripts or command history. Start with the original account to preserve paths, then consider a dedicated restricted service account. When changing accounts, verify the data path and NTFS / share permissions. Click Install service, then run: Expect Running , startup mode Auto , a listener on 8096 and TcpTestSucceeded: True . Open the dashboard again and confirm it contains the same configuration rather than a fresh wizard. Service mode does not update automatically; use the manual procedure later in this guide. 8. Ports, host firewalls and cloud security rules # 8.1 Which ports to allow # HTTP on 8096 is unencrypted. A source-IP restriction does not replace TLS; use the SSH tunnel below or the server's own browser for initialization and administrator login. Set up HTTPS or a private VPN before long-term public access. https://IP:8096 and http://IP:8920 are not interchangeable correct addresses. See Emby network settings . 8.2 Debian / Ubuntu with UFW already enabled # A missing ufw command does not prove the server has no firewall; the image may use nftables or other rules. Status: inactive means UFW is disabled. Do not enable it merely to follow this guide. If UFW is active and restricted public access is needed, replace 198.51.100.25 with your computer's current public IPv4 : The sample address is not usable. Before enabling UFW, preserve SSH using its actual port and source, keep the current connection open and verify a new terminal can connect. Do not run ufw enable after allowing only 8096. Match UFW source restrictions to the cloud firewall. Reference: Ubuntu firewall documentation . 8.3 Rocky / AlmaLinux with firewalld # Find the zone assigned to the public interface; it may not be public . The following is a source-restricted example using public. Replace both the zone and IP: --permanent saves the rule across reboots; reload applies it to runtime configuration. Reload also discards unsaved temporary rules, so first ensure SSH access is saved permanently. If firewalld is inactive, inspect existing rules before starting another firewall. Check for an existing unrestricted allow rule on 8096: adding a narrower rule does not tighten a broader one. References: firewall-cmd , rich rule syntax . 8.4 Windows Defender Firewall # In administrator PowerShell, inspect network categories and firewall state: Open wf.msc , then Inbound Rules → New Rule → Port. Select TCP 8096, Allow the connection and the applicable profiles. Restrict the remote source IP in the rule's Scope settings. An application rule must point to the actual EmbyServer.exe ; check it again if the program path or version folder changes. Alternatively, create this restricted rule. -Profile Any accommodates cloud images using Public, Private or Domain while still restricting the source IP: Replace the address before running it. Also inspect broad rules the installer may have created; this new restriction does not override them. Do not disable Windows Firewall. Reference: Microsoft New-NetFirewallRule . 8.5 The cloud provider adds another layer # AWS Security Groups / Network ACLs, Azure NSGs, Google Cloud VPC Firewall, Oracle Cloud NSGs / Security Lists, Alibaba Cloud / Tencent Cloud security groups, Vultr Firewall and DigitalOcean Cloud Firewall can block traffic before it reaches the host. Check that rules are attached to the actual interface or instance , allow inbound TCP on 8096, and use your public source IP. A single IPv4 host uses /32 ; IPv6 uses the matching /128 or a deliberate network range. With only an SSH tunnel or RDP-local browser, no public 8096 rule is needed. A NAT VPS also needs the provider's external port mapping checked. A VPS with its own public IP does not require copying a home router's UPnP procedure. 9. Open Emby and complete initial setup #

9.1 Recommended connection methods # Linux: open another terminal on your computer and establish an SSH tunnel. Adjust the user, IP and SSH port to your actual details from section 2: Leave this terminal running and open the following in your computer's browser: 18096 avoids a conflict with a local 8096 listener. SSH carries the request securely to the VPS's 8096. Continue when the wizard appears. Closing the tunnel terminal makes this address unavailable; the tunnel only forwards traffic and does not install Emby on your computer. Windows: use the browser inside the server's RDP session and open http://localhost:8096 . Localhost in your own computer's browser refers to that computer, not the VPS. For restricted public diagnostics, use http://SERVER_PUBLIC_IPV4:8096 . IPv6 uses http://[SERVER_IPV6]:8096 and requires IPv6 routing, a listener and matching firewall rules. Public HTTP can help diagnose connectivity, but enter administrator credentials only through an encrypted tunnel or configured HTTPS. 9.2 Complete the wizard # Button names and translations vary slightly between versions. Use the official initialization guidance for the current flow. Display language: Choose your interface language. This is separate from metadata language. Administrator: Choose an independent username and strong password, and save it in a password manager. Do not leave the password blank or reuse the VPS root / Windows administrator password. Emby Connect association is optional. Media libraries: Choose a content type and display name for films, shows or music, then add the real server folder, such as /data/media/Movies or D:\Media\Movies . Do not enter your computer's local path or an application data folder. If media is not uploaded yet, skip this and add it later in Library settings. Metadata language and region: Select the language for artwork and descriptions and the appropriate region for ratings. Use Simplified Chinese / China or English as appropriate, including separate library preferences. Use consistent names and test recognition with a few files. Remote access: You can leave public remote access disabled while initializing locally or through the tunnel. For remote clients, enable both server-wide and that user's remote access. A VPS generally does not need automatic port mapping / UPnP; use explicit cloud rules. Terms and completion: Read and accept Emby's terms, finish the wizard, then sign in with the local administrator you created. 9.3 Check the dashboard after setup # Open the gear or Manage Server and inspect Dashboard for the version, libraries and active tasks. Record the real data path from server information. Keep default local ports in Network. Do not require HTTPS for all remote connections before configuring TLS. Do not bind to a NAT public IP that is not assigned to a local interface, or classify the whole Internet as LAN. In Library, check folders, content type, metadata language and scan options. The first scan reads files and retrieves metadata; a large library will not finish immediately. Add a few items, wait, then play one and inspect whether it uses Direct Play, Direct Stream or Transcoding. Fix names or matching before repeatedly rescanning the entire library. You can defer preview thumbnails, intro detection and other extra tasks until basic playback works. Network mounts may not support real-time monitoring; use Scheduled Tasks for scans. References: library setup , playback methods . 10. Manage the Linux service and read logs # These commands apply to the native APT / RPM installation. The Windows service name chosen in this guide is EmbyServer ; do not mix the names. disable alone does not stop a running process, and stop alone does not disable the next boot. Ordinary dashboard settings do not usually require daemon-reload ; that command reloads systemd unit and drop-in configuration. These show the current boot, the last hour and a live log stream respectively. Press Ctrl+C to stop following logs without stopping Emby. Check journal for startup errors. For scans and playback, also inspect embyserver , ffmpeg and hardware detection logs under dashboard Logs . Linux application logs default to /var/lib/emby/logs ; confirm the data path before using: References: systemctl , journalctl , Emby logs . Inspect logs for usernames, media paths, public IPs and tokens before sharing them. Dashboard export applies anonymization, but an address local to a public VPS may still appear. 11. Updates and backups # 11.1 Back up before changing versions # Record the current version, architecture, data folder, mounts and service account. Updates can change database structure: reinstalling an older executable does not establish that its database can safely be downgraded . Keep a stopped-service data copy and the current installer or package, and review release notes before upgrading. For the default Linux data directory, create a restricted offline backup as follows. Replace paths if you customized the data location: Check that backup succeeded and disk space is sufficient before updating. Archives may contain password-related data, plugin configuration and private media information; copy them encrypted to controlled storage outside the server. This archive does not include media, fstab, custom units or SMB credentials; back up necessary system configuration separately and securely. A backup on the same VPS disk is not disaster recovery. 11.2 Update through APT / DNF # For Debian / Ubuntu using the official repository: For an RPM system using the official repository: Check service state, local HTTP, dashboard version and playback of an item. If an update fails, keep the error and backup and investigate logs; do not repeatedly start, randomly replace databases or mix in beta builds. For manual DEB / RPM installations, repeat the earlier download procedure with the new official stable package and install it without first uninstalling the old one. The package manager may restart the service during an update. 11.3 Update Windows # In normal application mode, follow the current Emby update prompt or download the new official installer. NSSM service mode does not update automatically: stop the service, confirm the process has exited, back up the actual programdata and service settings, then install into the original location using the original account. For portable installation, extract the new ZIP into a temporary folder and check its layout. After stopping the service, replace the original System program files while preserving programdata and the fixed paths. Do not turn a restored backup into a second concurrent instance. Restart, then verify the data path, version and libraries. If a new setup wizard appears, stop and check whether the wrong data directory was selected. 12. Stop, restart and uninstall # 12.1 Restart Emby or the operating system # On Linux, sudo systemctl restart emby-server restarts only Emby. sudo reboot restarts the VPS, disconnects SSH and interrupts all services. Reboot the whole server when system or kernel maintenance requires it. For a Windows Service, use administrator PowerShell: Choose the action you need; there is no reason to run stop, start and restart consecutively. In normal application mode, use the tray or dashboard Shutdown, then launch the original shortcut. Do not routinely force-kill the process. For a Windows reboot, use Restart from the Start menu and first ensure RDP can recover. 12.2 Uninstall Linux without intentionally deleting data # Stop and disable the service, complete a data backup, then use the removal command for your distribution: Debian / Ubuntu: Rocky / AlmaLinux and other RPM systems: Review the removal list rather than blindly using purge or autoremove. Uninstalling software does not establish that databases, accounts or media were deleted , and package maintenance scripts may vary. Back up first and check the actual data location. Media folders and data disks should not be removed with the application. If the official repository is no longer needed, remove only the individual source file created by this guide , then refresh metadata: Or, on RPM systems: Do not remove unrelated sources or entire source directories. Skip this if manual installation never created those files. This guide provides no recursive deletion command for programdata , /var/lib/emby or media disks; before a full cleanup, verify backups and each directory's purpose. 12.3 Uninstall Windows # In NSSM mode, stop the service and remove the service registered by this guide: Confirm that the dialog names EmbyServer . For an installer installation, use Settings → Apps or Programs and Features from the original installation account. Portable installations do not require a system uninstaller: after the process and service have stopped, remove shortcuts and clean up program files as appropriate. If programdata shares the parent folder, deleting all of C:\Emby also deletes configuration; back it up first. Remove only rules created for this installation, for example: Remove corresponding cloud rules when no longer needed, preserving SSH / RDP management. Do not delete NSSM if other services use it. 13. Troubleshoot by symptom # 13.1 Downloads and installation # Download failure, 404 or HTML instead of a package. Likely causes include an old version URL, the wrong file, DNS, network or proxy problems. Copy a current official link and use curl -fL . For TLS errors, first check time and CA certificates. Do not use curl -k , unknown file-sharing packages or unverified one-click scripts. HTTP 429 indicates rate limiting; do not retry endlessly. APT cannot find emby-server / NO_PUBKEY. Inspect /etc/apt/sources.list.d/emby.sources and check the keyring exists with mode 0644. Read the full sudo apt update error, then check apt-cache policy emby-server . No candidate means the index, source, architecture or channel is not ready; repeating install will not fix it. Correct the official keyring setup rather than adding trusted=yes . DEB installation fails or dependencies are missing. Check Package / Architecture with dpkg-deb -f ; use sudo apt install /actual/path/emby-server.deb for dependency resolution. If a previous dpkg-only attempt left unconfigured packages, run sudo dpkg --audit , then inspect the plan from sudo apt --fix-broken install . Accept only after checking it will not unexpectedly remove other software. RPM reports nothing provides or a signature error. Check rpm -qp , dnf info emby-server , dnf repolist , the OS release and key source. Fix index errors first. If dependencies are unavailable, confirm platform support rather than mixing another distribution's RPMs. Do not hide errors with --nodeps , --force or --nogpgcheck . Exec format error, architecture mismatch or Illegal instruction. Compare uname -m with package-manager architecture. Native AMD64 packages cannot run on ARM64. A 64-bit kernel does not establish 64-bit userspace. Illegal instruction may also indicate insufficient CPU features on the VPS; check logs and current runtime / distribution CPU requirements, preserving data before changing packages. Package manager is locked. A fresh image may still be running cloud-init or automatic updates. Check the actual process and let it finish. Do not delete locks, kill update processes or start competing installations. 13.2 Service failure, no listener or repeated exits # Unit not found. Check native installation with dpkg-query -W emby-server or rpm -q emby-server , then inspect systemctl list-unit-files 'emby*' . Portable or container installations do not automatically supply this systemd unit. Do not use these commands when PID 1 is not systemd. Failed state or immediate exit. Collect status and current-boot logs: Find the first meaningful error: Permission denied calls for checking data and parent permissions; No space left calls for disk and inode checks; binding errors require port checks. Back up before changing a problematic configuration or plugin. test -w checks the directory, not whether every existing file is writable. Do not recursively change the system's permissions to repair one folder. Repeated kills / OOM. Inspect: Determine whether memory, provider limits or concurrent tasks are responsible. Reduce scanning or transcoding concurrency, defer unnecessary heavy tasks, and increase resources based on actual demand. Swap does not guarantee real-time transcoding performance. Endless restart loops are not a root-cause fix. No listener on 8096. Check startup completion, changed ports and a loopback-only bind. Use sudo ss -lntp 'sport = :8096' together with journal and application logs. A brief startup delay can be normal; a persistent missing listener is not a cloud-firewall problem. Address already in use. Identify the process and PID in ss, then stop a duplicate Emby instance or adjust the known conflicting service. Do not kill -9 a process you have not identified. After fixing the cause, if systemd's start limit prevents another attempt, run sudo systemctl reset-failed emby-server , start it and watch logs. 13.3 Local access works, public access fails # Check from the inside out: process → listening address / protocol → host firewall → cloud firewall / NAT → client address . If local curl fails, fix the service before changing cloud rules repeatedly. From your own Windows computer: The allowed source must be your computer's current public IP; changing networks may change it. Inspect actual UFW / firewalld rules, the Windows profile and cloud-rule attachment. Connection refused often means no listener or an explicit reject; timeouts often indicate dropped traffic or routing. Neither proves a single cause by itself. Put IPv6 literals in brackets and verify the client has IPv6. Whether [::]:8096 also accepts IPv4 depends on system configuration; check both. A NAT public address not appearing in ip addr can be normal. For a NAT VPS, use the provider's external port and correctly set Emby's Public Port. That setting advertises the address to clients; it does not create a cloud mapping or open a firewall . 13.4 Empty media folders, Permission denied or missing media after reboot # A folder is added but no files appear. Check the real server path, content type and supported file format. Use sudo -u emby ls -lah /actual/folder . Inspect parent traversal, effective group membership, ACL mask and symlink destinations rather than relying on an administrator's ls output. A mounted disk disappears after reboot. Check UUID and mount with findmnt /mnt/media and lsblk -f . A directory existing does not mean a disk is mounted. Restore the mount before scanning so an empty folder is not mistaken for deleted media. Fix fstab, network readiness and RequiresMountsFor. Do not keep uploading into a failed mount directory and fill the system disk. SMB / NFS cannot be read. Check share-side access, client UID / GID, mount options and read-only state. A Windows service should not rely on the interactive user's mapped Z: drive; use a UNC path such as \\NAS\Media that the service account can access. Check both share and NTFS permissions. Everyone Full control or running the Linux service as root is not a solution. Permissions look correct but SELinux denies access. On Rocky / AlmaLinux and similar systems, inspect: The audit package provides ausearch; obtain it through distribution guidance if missing. Use the actual AVC process domain, file label and mount type to determine the correction. Verify the domain Emby actually runs in rather than applying Nginx httpd_* labels by guesswork. Do not disable SELinux or blindly generate an allow-all policy. 13.5 Web interface, initialization and administrator login # Blank page or endless loading. Check local HTTP and application logs. Try a private window, refresh cached content, use a current browser and temporarily disable relevant site-content blocking extensions. Check HTTP / HTTPS confusion and incorrect proxy or CDN handling. Establish native access before adding a proxy layer. Login fails. Distinguish a local Emby user, Emby Connect and the operating system account. Check username case, keyboard input, the password manager's target site and remote-access permission. After reinstalling or changing service accounts, also verify the data path. The only administrator password is forgotten. Follow Emby's reset procedure . Use a local address or SSH tunnel to reach the login page, choose Forgot Password and enter the local username. Read the server file identified by the interface through SSH / RDP, then follow its link and PIN. Emby Connect is not a substitute. Do not delete the user database or share the reset file publicly. A fresh wizard appears after every restart. Inspect Data path, the runtime account, portable System layout, data write access and possible duplicate instances. Locate and back up the original directory instead of repeatedly creating another administrator to conceal missing configuration. 13.6 Scans, memory and transcoding # High CPU / IO while scanning. Initial media probing, artwork, chapter thumbnails and intro detection add load. Inspect Dashboard tasks and Logs. Start with a small library, defer unnecessary extra tasks and separate scans from playback. High utilization alone does not establish a broken installation. High memory and poor responsiveness. Inspect available memory in free -h , tasks, concurrent transcodes and OOM logs. Linux filesystem cache is not equivalent to an application memory leak. On Windows, use Task Manager and Event Viewer. For continuing growth without tasks, collect version, timing, plugin and log information for Emby support rather than clearing the database. CPU maxes out during playback. Check the reported Transcoding reason: unsupported codec or audio, a bitrate limit, subtitle burning or insufficient bandwidth. Prefer compatible clients and media for Direct Play. Burning image-based subtitles can still consume substantial CPU with GPU acceleration. Inspect the matching ffmpeg log rather than assuming a vCPU count guarantees a number of streams. Hardware transcoding is unavailable. It requires usable hardware, drivers, device permissions, supported codecs and the applicable Emby Premiere feature. Checking a box does not create a GPU on an ordinary VPS. On Linux, inspect ls -l /dev/dri , the device's actual group and id emby ; add the appropriate group and restart only when a device exists and access is needed. For NVIDIA, check drivers and provider GPU allocation. On Windows, inspect hardware detection logs, drivers and possible RDP-session effects. See official hardware acceleration guidance . A transcode fails partway through or runs out of space. Check that the temporary path exists, is writable and has enough free space. Cloud disk throughput limits can also cause stuttering. See transcoding settings . Do not delete temporary files currently in use. 13.7 Windows-specific failures # The installer fails immediately. Verify it is Server, that x64 matches, and that Windows updates, time and official HTTPS downloads work. Read installer logs and Defender Protection History. For the reported Server 2025 online-installer issue, use the official portable ZIP as suggested; do not download an unknown patched installer. Service cannot start, error 1069 / 1053. 1069 commonly involves the service-account password or Log on as a service. 1053 requires further event and application logs; it does not identify one cause. In services.msc , check Log On, startup type and status. In Event Viewer, inspect System / Application at the same timestamp. Verify NSSM remains at its fixed path, Application Path and Startup directory are correct, Arguments is -service , and the tray instance is closed. If the service runs but the interface does not, inspect the real data path and listener before reinstalling or clearing configuration. Files work in RDP but not in service mode. The runtime identities may differ. Check the service account's NTFS / SMB access and UNC path. Interactive mapped drives being unavailable to a service is a common cause. Grant access separately to data and media folders. Defender blocks the application or writes. Inspect Protection History and Controlled Folder Access for a specific block, and verify the official source. For an actual false positive, follow Microsoft / Emby guidance for the specific application or path. Do not disable Defender for the whole server or exclude all of C:. 14. Routine maintenance and acceptance checks # After setup, you should be able to answer: Is the service running and enabled at boot? Does the Windows Service run without an interactive login? Does the local or tunneled browser show the interface, with an administrator password set? Is at least one real media folder scanned, with an item that plays? Can the Emby identity read media and write its data and transcode directories, with free space remaining? Do both cloud and host firewalls match the intended access scope, without an unrestricted initialization endpoint left behind? Do data disks or network mounts recover after reboot? Are the data location and version recorded? Is there an off-server backup and a known stopped-service restore procedure for the matching version? Routinely check systemctl status / Get-Service , free space, scan tasks and logs. On Linux use df -h , df -i and free -h ; on Windows use Get-Volume and Task Manager. Keep stable update channels and plan maintenance windows. Back up before major changes and check system security updates separately from Emby updates. Schedule reboot checks when nobody is playing media. Confirm SSH / RDP recovery, mounted storage, active / Running service and playback. For database corruption, preserve a complete stopped-service copy and consult official recovery guidance; deleting a database and rescanning is not routine maintenance. AlmaLinux users can view system advisories with dnf updateinfo --list ; see AlmaLinux Errata . These are OS maintenance notices, not an Emby version check. 15. Next steps: clients and reverse proxies # After native access, permissions and playback work, configure a domain and HTTPS. This Wiki has separate guides: Reverse Proxy for Emby (Linux) Reverse Proxy for Emby (Windows Server) Choosing a Client Emby Home Service Setup Frequently Asked Questions Follow the reverse-proxy guide to restrict origin access appropriately. Emby Connect helps clients discover or sign into a server; it does not replace security groups, port mapping or TLS. Nginx, Cloudflare and certificate deployment remain in their dedicated guides. 16. References and documentation differences # Sources were checked on 2 October 2026 , with the official stable repositories as the primary installation path. At that time, the latest stable GitHub release and APT / RPM metadata all listed 4.10.1.0. This is a snapshot: install the stable candidate the package manager currently shows, rather than pinning that version. Some differences remain explicit. Static HTML on official download pages still contains old placeholder links, and some documentation mirrors show earlier versions; cross-check current repositories / Releases. The Windows download and old system-requirements pages differ in their minimum-version wording. This guide neither recommends obsolete systems nor claims hands-on validation of every Windows Server edition. Section 4 explains the RPM helper / manual-repository signature difference. Main references: Installation sources: Emby Linux downloads , APT repository , DNF repository , official Releases . Windows: official Server downloads , Windows Service , NSSM usage , Microsoft service accounts . Setup and troubleshooting: Emby wizard , libraries , network , data folders , logs , administrator reset . System commands: Debian APT , Ubuntu software management , Rocky software management , official systemd manual sources , firewalld documentation . Practical checks: Vultr's Emby deployment guide helped check the journey from a fresh server to initialization; its Docker / Traefik setup is not used here. AlmaLinux discussion and Windows Server 2025 installer discussion informed platform troubleshooting. Commands are cross-checked against official installation guidance, current repository text / package indexes and system manuals, with completed static syntax and Wiki rendering checks. No Emby Server was installed or started locally while writing this guide, and no hands-on Linux-distribution or Windows Server installation experiment was performed. Unusual cloud images, signature failures, CPU instructions and hardware transcoding still require logs from your actual server.