---
title: "Server roles"
description: "The server roles Outpost detects on an endpoint from its installed services and Windows roles, and the evidence behind each one."
url: "https://support.outpostplatform.com/endpoints/server-roles/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "Reference list of the 21 server roles shown in Roles & tags, including Proxmox VE host, KVM/libvirt host, Hyper-V Host, directory, network, web, database, file, print, backup, and container roles. Lists the installed services and Windows roles used as evidence and the limits of detection."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "endpoint:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/endpoints/server-roles.md"
license: "CC BY 4.0"
---

# Server roles

This page lists the server roles Outpost detects on endpoints and the evidence
each one is detected from. Detected roles appear in the **Roles & tags** column
of the endpoint list, on the endpoint's **Overview** tab, and in the **Roles &
tags** filter. Your own tags appear in the same places; see
[Define a tag](/endpoints/organize-endpoints/#define-a-tag).

## How roles are detected

Outpost reads roles from the endpoint's inventory each time the endpoint
reports it. Nothing extra runs on the endpoint.

- **Services are the main evidence.** A role is detected when one of its
  service names is installed and not disabled. Service names are compared
  without regard to case.
- **A disabled service does not count.** A role whose service has been
  disabled is treated as switched off.
- **Some roles come from Windows Server roles.** Print Server and RD Session
  Host are also detected from the enabled Windows Server role, by its English
  name.
- **An inventory with no services changes nothing.** If an endpoint reports no
  services at all, Outpost keeps the roles it already had instead of clearing
  them.

Roles are detected by Outpost, so a new detection rule reaches every endpoint
at its next inventory without an agent update.

## The roles

| Role | Detected from |
| --- | --- |
| **Domain Controller** | The `NTDS` or `samba-ad-dc` service, or the endpoint reporting it is a domain controller. |
| **PDC Emulator** | The endpoint reporting it is the primary domain controller. It also gets **Domain Controller**. |
| **DNS Server** | The `DNS`, `named`, `bind9`, `unbound`, or `dnsmasq` service. |
| **DHCP Server** | The `DHCPServer`, `isc-dhcp-server`, or `kea-dhcp4` service. |
| **Exchange Server** | The `MSExchangeIS`, `MSExchangeTransport`, or `MSExchangeFrontEndTransport` service. |
| **IIS Web Server** | The `W3SVC` service. |
| **Web Server** | The `nginx`, `apache2`, `httpd`, or `caddy` service. |
| **SQL Server** | The `MSSQLSERVER` service, or a named instance `MSSQL$<name>`. The Windows Internal Database (`MSSQL$MICROSOFT##...`) does not count. |
| **Database Server** | The `mysql`, `mysqld`, `mariadb`, or `mongod` service, or a service whose name starts with `postgresql`. |
| **Hyper-V Host** | The `vmms` service. |
| **Proxmox VE host** | The `pveproxy`, `pvedaemon`, or `pve-cluster` service. |
| **KVM/libvirt host** | The `libvirtd` service. Suppressed when **Proxmox VE host** is detected. |
| **File Server** | The `DFSR`, `Dfs`, `smbd`, or `nfs-server` service. On a domain controller, `DFSR` and `Dfs` do not count, because every domain controller runs them. |
| **Print Server** | The `cups` service, or the **Print Server** Windows Server role. |
| **RD Session Host** | The **Remote Desktop Session Host** Windows Server role. |
| **Certificate Authority** | The `CertSvc` service. |
| **WSUS** | The `WsusService` service. |
| **AD FS** | The `adfssrv` service. |
| **NPS / RADIUS** | The `IAS` or `freeradius` service. |
| **Backup Server** | The `VeeamBackupSvc`, `VeeamEnterpriseManagerSvc`, or `Veeam.Archiver.Service` service. A computer running only a backup agent is not a backup server. |
| **Container Host** | The `docker` or `containerd` service. |

## Limits

- Windows Server role names are matched in English. A Print Server or RD
  Session Host on a server with another display language is not detected from
  its role, though a Print Server running `cups` still is.
- Backup servers are detected for the Veeam products listed only.
- A role that is not listed here is shown by its internal name if Outpost
  detects it before the console has a label for it.

## Related

- [Organize endpoints with sites, device groups, and tags](/endpoints/organize-endpoints/)
- [Find and filter endpoints](/endpoints/endpoint-list/)