What you need before installing VaultPilot
VaultPilot 3.0.3 needs a 64-bit Windows Server 2019 or later host with at least 2 CPU cores, 8 GB of RAM and 250 GB of disk, and users open it from a browser with Web Crypto.
Minimum system
- Operating system
- Windows Server 2019 or later (64-bit)
- Processor
- 2 cores, 64-bit (x64)
- Memory (RAM)
- 8 GB
- Disk
- 250 GB
- Database
- Local SQLite, installed by the MSI
- Network
- Inbound TCP 1734 (HTTPS) by default
- Permissions
- Local Administrator for install and update
- Browser
- A modern browser with Web Crypto; Chrome or Edge for the extension
Software to install
The server MSI brings its own Node runtime and SQLite files; the documentation lists no other software to install first. The other components are optional and go where the table says.
| Software | Version | Where it runs | Get it |
|---|---|---|---|
| VaultPilot Enterprise Vault Console | 3.0.3 | Windows Server or an approved Windows host | Download the MSI |
| VaultPilot Browser Vault Extension | 1.3.3 | Google Chrome, Microsoft Edge | Open in Chrome Web Store |
| VaultPilot DC Agent Service | 1.2.27 | A controlled Windows host near the domain controller | Download the script |
| Offline Share Decrypter | 1.2.1 | Any browser, offline | Download the ZIP |
| VaultPilot Backup Tool | 3.0.0 | The VaultPilot server | In the console: Server settings |
| VaultPilot Log Collector | 3.0.2 | The VaultPilot server | In the console: Server settings |
| Uninstall (Windows Installer) | 3.0.3 | The VaultPilot server | Uninstall guide |
| DC Agent uninstall | 1.2.27 | The DC Agent machine | Active Directory agent guide |
Server
What the Windows host needs before and after the MSI runs.
| Requirement | Detail | Guide |
|---|---|---|
| Inbound TCP on port 1734 | 1734 is the default HTTPS port; change it only if your network policy requires it. The MSI creates the firewall rule; allow only the intended network path. | Admin quickstart |
| Data directory C:\ProgramData\VaultPilot | Encrypted vault data and operational metadata live there in the local database, and logs in its logs folder. Include this folder in your backup and storage planning. | Windows Server installation |
| Backup location outside the install directory | Keep encrypted backups in an operator-controlled location and preserve the data directory before production upgrades. | Admin quickstart |
Network and certificates
The name users open, the certificate that must match it, and the path updates download from.
| Requirement | Detail | Guide |
|---|---|---|
| A DNS name or IP address for users | The public host must resolve to the VaultPilot server, and the certificate must match it under SAN/CN rules. | Public host, HTTPS and certificates |
| Managed self-signed certificate or your PFX/P12 | Automatic mode keeps a VaultPilot-managed self-signed certificate. Enterprise mode validates a PFX/P12 package with its matching private key before it goes live. | Public host, HTTPS and certificates |
| Clients trust the issuing CA | Use internal PKI on private networks or a public certificate for internet-facing names, and confirm trust from a separate device. | Public host, HTTPS and certificates |
| Outbound HTTPS to github.com for updates | Update Center downloads the Ed25519-signed manifest and the MSI from the allowed release host. Allow that outbound HTTPS path from the server in your firewall. | Update Center |
User devices
What people need on their own computers.
| Requirement | Detail | Guide |
|---|---|---|
| Chrome or Edge for the extension | The extension comes from the Chrome Web Store and pairs with your server through a short-lived code approved in VaultPilot. Managed fleets deploy its extension ID through browser policy. | Browser extension |
| Any browser for external recipients | The Offline Share Decrypter is an HTML file that opens share packages fully in the browser, with no network connection. | Sharing and offline decrypter |
Active Directory (optional)
Only when you connect Active Directory through the DC Agent.
| Requirement | Detail | Guide |
|---|---|---|
| A Windows host near the domain controller | The agent runs there as the VaultPilotDCAgent service and must reach the VaultPilot URL through firewall and DNS. | Active Directory and DC Agent Service |
| Administrator PowerShell | Install, repair and remove the agent with vaultpilot-dc-agent.ps1 from an Administrator PowerShell session. | Active Directory and DC Agent Service |
| A read account with the narrowest scope | The bind password is entered only in the local prompt and never sent to VaultPilot. The agent reads OU, group and user metadata, never AD passwords or hashes. | Active Directory and DC Agent Service |
Before and after install
Checks that belong to every install and update.
| Requirement | Detail | Guide |
|---|---|---|
| A full Backup Tool backup before every update | Run VaultPilotBackupTool.exe as Administrator and store the ZIP off the server with restricted access; Quick Recovery is not a full backup. | Backups and restore |
| Post-install check | sc.exe query VaultPilotServer shows the service running, https://127.0.0.1:1734 opens on the server, and the remote URL opens from an approved workstation. | Windows Server installation |