Enshrouded Admin Commands, Roles and Server Settings

Enshrouded has no admin console, no chat commands and no RCON. Everything an admin controls lives in enshrouded_server.json and in the in-game player list. This guide covers the full permission system, the complete config schema, and how to actually kick and ban people.

On a GameServerKings server, set the group passwords on the Startup tab — not in the file

This is the one thing on this page that will cost you an evening if you get it wrong. Your panel rewrites ten keys inside enshrouded_server.json every single time the server boots, from the values on the Startup tab. All four group passwords are among them. Type a new Admin password into the file and it works until the next restart, then silently reverts — with no error and nothing in the console to explain it.

Set passwords on the Startup tab, then restart. Section 3 lists exactly which keys are panel-owned.

There is no command list — that is not an omission

If you arrived here looking for /kick, /give or /tp, they do not exist in Enshrouded. Keen Games ships no console for either the client or the dedicated server, the server window accepts no input, and there are no meaningful launch parameters. Administration is entirely config file plus in-game UI. Everything below is the real surface.

1. Where Administration Actually Happens

2. The Files That Matter

The dedicated server is a separate Steam application, app ID 2278520, listed under Tools in your Steam library. Launch enshrouded_server.exe once and it writes its config next to itself.

Keen's installation guide still states that only Windows is officially supported and that Linux support is planned for later. Linux dedicated servers do exist, but they run the Windows binary under Wine or Proton.

3. Roles Replace a Conventional Admin List

There is no admins.txt and no SteamID allowlist. Enshrouded uses user groups: each group has its own password, and the password a player types when joining decides what they may do. Give someone the Admin password and they are an admin.

Each entry in userGroups takes these fields:

The four roles the shipped default config creates, with the values it actually writes:

Two of those are worth reading twice. Friend can extend bases — placing, upgrading and removing Flame Altars — which is a broader grant than the name suggests. And Guest cannot edit the world at all: canEditWorld is false, so guests cannot terraform outside bases. Guest and Visitor ship with identical permission flags; the only thing separating them is reservedSlots.

Keen's own roles documentation is older than the config and does not describe this accurately — it predates the canEditWorld flag entirely and its worked example omits it. The table above is read from the default config the server is actually shipped with, which is the file your server starts from.

Every role — Visitor included — can still fight, loot, gather, mine and complete quests. The flags only gate bases, containers, world editing and moderation.

{
  "name": "Admin",
  "password": "pick-something-long",
  "canKickBan": true,
  "canAccessInventories": true,
  "canEditWorld": true,
  "canEditBase": true,
  "canExtendBase": true,
  "reservedSlots": 2
}

You are not limited to the presets: add as many groups as you like with any combination of flags. A "Builder" role with canEditBase but not canAccessInventories is perfectly valid.

reservedSlots holds that many session slots for one role. Players joining under a different role see the server as full once they would consume the reserved slots, so an admin can still get in on a 16/16 server.

The legacy password key. Before Update 2 (Melodies of the Mire, June 2024) a single top-level "password" line protected the whole server. That key no longer sets the server password. Keen's roles documentation says a detected legacy password is migrated into one group named default with Friend-equivalent permissions, so old setups keep working. The current default config omits the key — use userGroups.

On a hosted server the passwords are not randomized — they default to ChangeMe1–ChangeMe4

A standalone Enshrouded server randomizes each role password on first boot. Yours does not. The panel writes the four passwords from the Startup tab into the file on every boot, and they ship with the placeholder defaults ChangeMe1 (Admin), ChangeMe2 (Friend), ChangeMe3 (Guest) and ChangeMe4 (Visitor). Anyone who knows your address and has read a guide like this one can walk straight in as Admin.

Change all four on the Startup tab before you hand the address to anybody. A purely numeric password is rejected by the panel, so include at least one non-digit.

Which keys the panel owns

Your panel re-applies these ten keys to enshrouded_server.json on every boot. Edit them in the file and your edit survives exactly until the next restart:

Everything else in the file — every permission flag, reservedSlots, tags, the chat toggles, the whole gameSettings block and bannedAccounts — is yours, and editing it in the file is the correct way to change it.

Two consequences worth planning around. The names of groups 2, 3 and 4 are pinned, so keep four groups in that order; deleting the Visitor group or reordering the array leaves the panel writing passwords into the wrong entries. And the first group's name is not pinned, so you may rename Admin freely — its password still comes from the Admin field on the Startup tab.

A group left with "password": "" lets anyone join at that permission level without typing anything — only ever do that on your lowest-privilege role, and note that the panel will overwrite an empty password with whatever the Startup tab holds.

4. Kicking and Banning in Practice

Both actions happen in game, performed by a player whose role has canKickBan: true. Open the player list, select the offender, choose the action.

The same in-game widget lists existing bans and unbans names. The list is persisted in the bannedAccounts array at the top level of enshrouded_server.json — not bans, which is not a key the server reads. To clear it wholesale, stop the server, set "bannedAccounts": [], and start again — editing the file while the process is running achieves nothing, because the server holds its own copy and can overwrite yours on shutdown. bannedAccounts is not one of the panel-managed keys, so your edit sticks.

You cannot kick another admin

Since patch 0.7.2.1 the game blocks kicking any player who themselves holds the kick permission, and the UI reflects this. To remove a rogue admin, change that role's password and restart — they cannot rejoin at that level.

5. Core Server Settings

These sit at the top level of enshrouded_server.json.

Ports. Current builds expose a single queryPort, 15637/udp by default, plus Steam's own ports. The launch-era config also carried "gamePort": 15636; it is absent from the config the server generates today, so drop it if you are copying a 2024 guide.

6. Difficulty Presets

gameSettings are ignored unless the preset is Custom

Editing enemyHealthFactor while gameSettingsPreset is "Hard" does nothing at all. Set "gameSettingsPreset": "Custom" first, then tune. This is the single most common Enshrouded config mistake.

7. The Full gameSettings Block

37 values, all inside "gameSettings": { ... }. Out-of-range numbers are silently clamped to the nearest limit; invalid text values are not, and the server refuses to boot and prints the offending value in the console window.

Player

Survival and Environment

World, Gathering and Progression

Keen's own documentation is inconsistent on one value: the description for perkUpgradeRecyclingFactor says 0.100000, while the default config on the same page shows 0.500000. The config block is what the server actually generates, so treat 0.5 as the real default and set it explicitly if it matters.

Enemies and Bosses

Time and Death

For the three nanosecond values, multiply minutes by 60000000000: 20 minutes of daylight is 1200000000000, and the 2-minute floor is 120000000000. Enter them as plain integers, no quotes and no separators.

8. A Complete Config

Keep all four groups, in this order — the panel pins the names of groups 2, 3 and 4 and writes each group's password by position.

{
  "name": "My Enshrouded Server",
  "saveDirectory": "./savegame",
  "logDirectory": "./logs",
  "ip": "0.0.0.0",
  "queryPort": 15637,
  "slotCount": 16,
  "tags": ["LookingForPlayers", "BaseBuilding"],
  "voiceChatMode": "Proximity",
  "enableVoiceChat": true,
  "enableTextChat": true,
  "gameSettingsPreset": "Default",
  "userGroups": [
    {
      "name": "Admin",
      "password": "ChangeMe1",
      "canKickBan": true,
      "canAccessInventories": true,
      "canEditWorld": true,
      "canEditBase": true,
      "canExtendBase": true,
      "reservedSlots": 0
    },
    {
      "name": "Friend",
      "password": "ChangeMe2",
      "canKickBan": false,
      "canAccessInventories": true,
      "canEditWorld": true,
      "canEditBase": true,
      "canExtendBase": true,
      "reservedSlots": 1
    },
    {
      "name": "Guest",
      "password": "ChangeMe3",
      "canKickBan": false,
      "canAccessInventories": false,
      "canEditWorld": false,
      "canEditBase": false,
      "canExtendBase": false,
      "reservedSlots": 3
    },
    {
      "name": "Visitor",
      "password": "ChangeMe4",
      "canKickBan": false,
      "canAccessInventories": false,
      "canEditWorld": false,
      "canEditBase": false,
      "canExtendBase": false,
      "reservedSlots": 0
    }
  ],
  "bannedAccounts": []
}

The four ChangeMe passwords are shown as the panel ships them. Replace them on the Startup tab, not here.

For custom difficulty, set "gameSettingsPreset": "Custom" and keep the whole 37-key gameSettings block that the server generated, editing values in place rather than deleting keys.

9. Applying Changes

Nothing in this file is hot-reloadable. Stop the server, edit enshrouded_server.json, start the server, then confirm it came up cleanly in the log. Remember that the boot you are about to trigger is also when the panel re-applies its ten keys — so if you were changing a password, change it on the Startup tab instead and the restart will apply it for you.

[Session] 'HostOnline' (up)!
[Session] finished transition from 'Lobby' to 'Host_Online' (current='Host_Online')!
[server] Load deserialization took 2.77 s

Difficulty cannot change on a live world session

Gameplay settings are read when the world session starts. Changing them mid-session does nothing — the server must be restarted. This has been true since the settings were introduced in the Back to the Shroud update.

JSON is unforgiving, and a broken file blocks the boot

A missing comma, a trailing comma, or a smart quote pasted from a web page will stop the server starting. Keen also warn that configs carried over from older versions sometimes upgrade incorrectly. If the server refuses to start after an update, back up your file, delete it, let the server regenerate a fresh one, and copy your values across by hand.

Use the panel rather than an editor over FTP

On your rented Enshrouded server, stop the server, edit enshrouded_server.json in the file manager, start it, and watch the Console tab for the Host_Online transition. You see the validation error immediately instead of wondering why the server never appeared in the browser.

10. FAQ

How do I make someone an admin on an Enshrouded server?

There is no admin list — the password is the permission. On a GameServerKings server, open the Startup tab, set [USER GROUP] ''Admin'' Group Password, and restart. Give that password to the person; they enter it when joining and the server puts them in the Admin group, which is the group with "canKickBan": true.

Do not set it by editing password inside enshrouded_server.json. The panel overwrites all four group passwords from the Startup tab on every boot, so a password typed into the file works until the next restart and then silently reverts. Anyone holding the Admin password is an admin, so treat it as a credential.

What are the Enshrouded admin commands?

There are none. Enshrouded ships no developer console, no chat commands and no RCON on either the client or the dedicated server. Kicking and banning happen in the in-game player list; everything else is enshrouded_server.json. Any "Enshrouded command list" containing /give or /teleport is describing a different game.

How do I ban a player, and where is the ban stored?

Join with a role that has canKickBan, select the player in the in-game list, and ban them. They go onto a persistent blacklist and are rejected on future join attempts. The list lives in the bannedAccounts array of enshrouded_server.json, and the same in-game widget reviews it and unbans people. The key is bannedAccounts, not bans — and unlike the group passwords, it is not panel-managed, so editing it by hand works.

Why is my gameSettings block having no effect?

Almost certainly because gameSettingsPreset is not "Custom". The individual values are only read in Custom mode; with any of the four named presets the server uses that preset's values and ignores yours. Set the preset to Custom, restart, and check the log for a boot error.

Which ports does an Enshrouded server need?

One: queryPort, UDP 15637 by default, plus Steam's standard ports. Older guides mention a second gamePort on 15636 — that key existed at launch and is no longer part of the generated config.

How many players can an Enshrouded server hold?

slotCount accepts 1 to 16, and 16 is the hard ceiling — set it on the Startup tab, since the panel owns that key. Each slot costs performance, so lower it if CPU or RAM is the bottleneck. The shipped config reserves no slots for Admin (it gives 1 to Friend and 3 to Guest), so raise reservedSlots on your Admin role in the file if you want a guarantee that a full server never locks you out.

11. What to Read Next

• Getting started with your Enshrouded server — first boot, connecting, and the server browser
• Enshrouded Server Settings and Config File — a walkthrough of enshrouded_server.json end to end

Made with 💜 by GameServerKings