> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# High Availability & Load Balancing

> Deploy multiple TAMS instances behind round-robin DNS for resilience, zero-downtime maintenance, and horizontal scale.

A single TAMS instance is a potential single point of failure for all unlock operations within the environment. The recommended deployment pattern is to run **two or more** TAMS instances across separate Windows Server hosts and expose them behind an internal DNS record.

Because TAMS is stateless (no session or in-memory state is shared between instances), round-robin DNS is sufficient. **No dedicated load balancer appliance is required.**

<img src="https://mintcdn.com/truu-2/oYCvFfzmw5MpZcBq/images/image-(9)-2.png?fit=max&auto=format&n=oYCvFfzmw5MpZcBq&q=85&s=2782c03cc7754e9cd2cba512373f5276" alt="Image (9) 2" title="Image (9) 2" style={{ width:"75%" }} width="2314" height="1380" data-path="images/image-(9)-2.png" />

## Recommended Setup

<Steps>
  <Step title="Deploy multiple TAMS hosts">
    Install TAMS on two or more Windows Server hosts (for example, `tams-server-1.corp.example.com`, `tams-server-2.corp.example.com`).
  </Step>

  <Step title="Create an internal DNS record">
    Create an internal DNS A record (for example, `tams.corp.example.com`) with multiple address entries, one per host. This gives round-robin DNS load distribution at no additional infrastructure cost.
  </Step>

  <Step title="Point the Windows Authenticator at the DNS name">
    Configure the TruU Windows Authenticator (**v26.1.0 or later**) to target the DNS FQDN (`tams.corp.example.com:<WebServerPort>`) instead of a single host IP. Any instance can then serve the request, and hosts can be replaced or taken offline without reconfiguring agents.
  </Step>

  <Step title="Standardize configuration and certificates">
    Each instance must be configured with the same registry settings and must hold a valid `TRUU-HTTPS` TLS certificate. The certificate must cover the shared FQDN as a Subject Alternative Name, or you can use a wildcard certificate.
  </Step>
</Steps>

## Benefits

* **Resilience** — agent unlock requests succeed even when one TAMS host is unavailable (patching, reboot, hardware failure).
* **Maintenance without downtime** — instances can be updated or restarted one at a time.
* **Horizontal scalability** — add capacity by registering a new host and appending its IP to the DNS record.
* **Geo-located services** — with DNS entries and localized DNS servers, TAMS can be positioned to provide low network latency and connectivity to localized AD instances.