What you need before installing VaultPilot
VaultPilot 3.0.3 needs a 64-bit Windows Server 2019 or later host with at least 2 CPU cores, 8 GB of RAM, and 250 GB of disk. Users open it from a browser with Web Crypto.
Minimum specifications
- Operating system
- Windows Server 2019 or later (64-bit)
- Processor
- 2 cores, 64-bit (x64)
- Memory (RAM)
- 8 GB
- Disk
- 250 GB
- Runtime
- .NET Framework 4.x; Node.js 22 ships in the MSI
- Database
- Local SQLite, installed by the MSI
- Network
- Inbound TCP 1734 (HTTPS) by default
- Permissions
- Local Administrator for install and update
- Browser
- A modern browser with Web Crypto; Chrome or Edge for the extension
Software to install
The server MSI brings its own Node runtime and SQLite files; the documentation lists no other software to install first. The other components are optional and go where the table says.
| Software | Version | Where it runs | Get it |
|---|---|---|---|
| VaultPilot Enterprise Vault Console | 3.0.3 | Windows Server 2019 or later, 64-bit | Download the MSI |
| VaultPilot Browser Vault Extension | 1.3.3 | Google Chrome, Microsoft Edge | Open in Chrome Web Store |
| VaultPilot DC Agent Service | 1.2.27 | The domain controller or a Windows host next to it | Download the script |
| Offline Share Decrypter | 1.2.1 | A current browser, offline | Download the ZIP |
| VaultPilot Backup Tool | 3.0.0 | The VaultPilot server | In the console: Server settings |
| VaultPilot Log Collector | 3.0.2 | The VaultPilot server | In the console: Server settings |
| Uninstall (Windows Installer) | 3.0.3 | The VaultPilot server | Uninstall guide |
| DC Agent uninstall | 1.2.27 | The DC Agent machine | Active Directory agent guide |
Ports and connections
Every connection VaultPilot 3.0.3 accepts or opens. Only the first row is needed for every install; the others apply when you use that feature. Licensing works offline.
| From | To | Port and protocol | Purpose | Needed |
|---|---|---|---|---|
| User browsers | VaultPilot server | TCP 1734, HTTPS | Console, sign-in, and vault use | Always |
| Browser extension (Chrome, Edge) | VaultPilot server | TCP 1734, HTTPS | Pairing and encrypted snapshots | With the extension |
| API clients | VaultPilot server | TCP 1734, HTTPS | Read-only API, 120 requests per minute | With API clients |
| DC Agent machine | VaultPilot server | TCP 1734, HTTPS | Directory sync, status, and action results | With Active Directory |
| DC Agent machine | Domain controller | TCP 9389 (AD Web Services) with the ActiveDirectory module; otherwise TCP 389 LDAP with Kerberos signing and sealing | Directory read and account actions | With Active Directory |
| VaultPilot server | github.com, api.github.com, objects.githubusercontent.com, release-assets.githubusercontent.com | TCP 443, HTTPS, direct (no proxy support) | Signed update manifest and MSI download | For in-app updates |
| VaultPilot server | Your SMTP relay | The port you set, TLS or STARTTLS | Notification and share-package email | With email |
| VaultPilot server | Private IPv4 targets | The ports in the scan plan, up to 32 (TCP connect and TLS; no ICMP) | Discovery port, login-surface, and TLS checks | During a Discovery run |
| VaultPilot server | Approved UNC paths | TCP 445, SMB, as the server's computer account | Read-only Discovery file scan | During a Discovery run |
| VaultPilot server | Windows or IIS targets | TCP 5985 or 5986, WinRM (5986 for local accounts and IP targets) | Credentialed configuration-file checks | With a credentialed Discovery run |
| VaultPilot server | Linux, Nginx, or Apache targets | TCP 22, SSH/SFTP with host-key pinning | Credentialed configuration-file checks | With a credentialed Discovery run |
| User browsers | Chrome Web Store | HTTPS | Extension install and updates | With the extension |
| User browsers | Have I Been Pwned, VirusTotal | HTTPS | Leak check and file-hash lookup, only when a user starts them | Optional |
Server
The Windows host VaultPilot is installed on, and what the MSI sets up there.
| Requirement | Detail | Guide |
|---|---|---|
| Local Administrator for install and update | Run the MSI from an elevated session on 64-bit Windows Server 2019 or later with .NET Framework 4.x. It installs the program under C:\Program Files\VaultPilot\versions\<version>, its own Node.js 22 runtime, the VaultPilotServer service, and the firewall rule; nothing else has to be installed first. | Windows Server installation |
| Inbound TCP 1734, HTTPS only | 1734 is the default port and must not already be in use. The MSI adds the inbound rule "VaultPilot Server 1734" for all profiles and any address; narrow its scope to the networks that need access. The server listens on IPv4 with TLS 1.2 or later; an internal HTTP listener stays on 127.0.0.1:1735 and must not be opened. | Admin quickstart |
| Data directory C:\ProgramData\VaultPilot | Holds the local database with encrypted vault data and operational metadata; logs go to its logs folder. Uninstalling removes the service, the firewall rule, and the program files but keeps this folder. | Windows Server installation |
| The service runs as LocalSystem | The installer creates VaultPilotServer as LocalSystem and repair restores that account, so a gMSA or domain service account is not supported. On a network share the service appears as the server's computer account (DOMAIN\SERVER$). | Windows Server installation |
| No internet needed for licensing | The license is verified offline with a public key on the server. Renewal codes come from support@vaultpilot.io. | First run, Owner, and license |
| A correct server clock | Certificate validity and two-step verification codes depend on time; a TOTP code is accepted within one 30-second step, about ±30 seconds. VaultPilot does not check time sync itself, so keep the server on your domain or NTP time source. | Certificate warning |
HTTPS address and certificate
The name users open and the certificate that must match it.
| Requirement | Detail | Guide |
|---|---|---|
| One DNS name or IP address that resolves to the server | VaultPilot builds its HTTPS address from the public host and port you set. Another alias users type is not covered by the certificate. | Public host, HTTPS and certificates |
| Managed self-signed certificate or your PFX/P12 | Automatic mode keeps a managed self-signed certificate. Enterprise mode takes one .pfx or .p12 file of up to 2 MB with its private key: a server certificate, not a CA certificate, whose SAN or subject covers the host and, if it lists key usages, includes Server Authentication. Save a validated package within 10 minutes. | Public host, HTTPS and certificates |
| Client devices trust the issuing CA | Use internal PKI on private networks or a public certificate for internet-facing names, and confirm trust from a separate device. | Public host, HTTPS and certificates |
| Cookies allowed, one host, one port | Browsers must accept cookies for the VaultPilot host. Always use the same host name, https, and port; a reverse proxy in front of VaultPilot must keep all three and the cookies unchanged. | 401 right after sign-in |
User devices
What people need on their own computers.
| Requirement | Detail | Guide |
|---|---|---|
| A modern browser over HTTPS | The console runs in a current browser; creating the first profile and unlocking a vault work only over HTTPS. | Windows Server installation |
| Chrome or Edge for the extension | Install the extension from the Chrome Web Store, or deploy its ID to managed fleets through Chrome or Edge policy. A device pairs with an eight-character code that expires in 10 minutes, and the server address must match exactly, including https and the port. | Browser extension |
| A current browser for external recipients | The Offline Share Decrypter is an HTML file that opens share packages fully offline. The recipient's browser must not block local files; package expiry is checked against the recipient's clock. | External share will not open |
DC Agent and Active Directory (optional)
Only when you connect Active Directory. The DC Agent is the only agent VaultPilot uses.
| Requirement | Detail | Guide |
|---|---|---|
| The domain controller or a Windows machine next to it | The agent runs as the VaultPilotDCAgent service under LocalSystem, needs Windows PowerShell 5.1 and .NET Framework 4.x, and keeps its files and DPAPI-protected bind credential in C:\ProgramData\VaultPilot\ad-agent. It opens outbound HTTPS to the VaultPilot URL and polls every 10 minutes; no inbound port is needed. | Active Directory and DC Agent Service |
| Elevated PowerShell for install and repair | Install, repair, and remove the agent with vaultpilot-dc-agent.ps1 from an Administrator PowerShell session. The command pins the current VaultPilot certificate; with an enterprise CA, also manage trust through the Windows certificate store or policy. | Integrations screen |
| A bind account with delegated, narrow rights | Sync needs only read access to the OUs, groups, and users you manage. Account actions (unlock, require a password change, assign a random password, disable) write to Active Directory, so delegate those rights only where you use them. The bind password is typed only at the agent's local prompt. | Active Directory and DC Agent Service |
| Agent 1.2.20 or later for account actions | 3.0.3 ships DC Agent 1.2.27. One agent serves one VaultPilot server, syncs every 10 minutes by default, and needs the Integration license feature. | Integrations screen |
Discovery scan
Discovery runs from the VaultPilot server itself; there is no separate scanner to install.
| Requirement | Detail | Guide |
|---|---|---|
| Private IPv4 targets only | Scope a run with RFC 1918 addresses, CIDR blocks, or explicit ranges of up to 512 hosts; a range stays inside one /24. Public addresses, host names, IPv6, loopback, and link-local are rejected. | Discovery screen |
| Firewall paths from the server to the targets | A plan uses up to 32 ports; the default list is 22, 53, 80, 88, 135, 139, 389, 443, 445, 464, 636, 3268, 3269, 3389, 5985, 5986, 8080, 8443, 9389, 9443. A run opens TCP connections, performs TLS handshakes, and sends limited HTTP or HTTPS requests to known login pages; it never guesses passwords. Credentialed configuration checks also need WinRM (5985/5986) or SSH (22) to the target. | Discovery screen |
| Read access for the VaultPilot service account | File checks read up to 32 approved local or UNC paths as LocalSystem, which reaches a network share as the server's computer account (DOMAIN\SERVER$). Grant that computer account read access only on the shares you intend to scan. System paths, drive roots, and VaultPilot data folders are rejected. | Discovery screen |
| Owner approval and the Discovery license feature | Only the Owner starts or changes a run, after confirming authorization for the targets and paths. Limits: files up to 25 MB, 80 extensions, timeouts of 250 to 15,000 ms, and 1 to 16 parallel checks. | Discovery screen |
Email (optional)
Only when VaultPilot sends notifications or share packages by email.
| Requirement | Detail | Guide |
|---|---|---|
| An SMTP relay the server can reach | Set the host name, port, sender, and TLS or STARTTLS. With authentication on, TLS or STARTTLS and a user name with a password or token are required. | Server settings screen |
| At least one recipient and one event | Email turns on only with a recipient list and an event rule. A share package sent by email can be up to 12 MB and 250 items, and its passphrase is never attached. | Notifications screen |
Antivirus and EDR policy
Exclusions and allowances to add to your antivirus or EDR policy so it does not block or slow VaultPilot.
| Requirement | Detail | Guide |
|---|---|---|
| Folder exclusions on the server | C:\Program Files\VaultPilot\ (each release runs from its own versions\<version> folder) and C:\ProgramData\VaultPilot\, which holds the SQLite database vaultpilot-server.db with its -wal and -shm files, logs, config, certs, and backups. For a narrower policy, exclude the database files and logs and keep updates\staged and updates\jobs scanned. | Windows Server installation |
| Process exclusions on the server | vaultpilot-service.exe, runtime\node.exe, VaultPilotBackupTool.exe, VaultPilotLogCollector.exe, and installer\VaultPilotMaintenanceBootstrap.exe under C:\Program Files\VaultPilot\versions\<version>. Use a wildcard for the version folder. | Backups and restore |
| DC Agent machine | Exclude C:\ProgramData\VaultPilot\ad-agent\ and its VaultPilotDCAgentService.exe. The agent is installed with vaultpilot-dc-agent.ps1 from an elevated PowerShell using -ExecutionPolicy Bypass. | Active Directory and DC Agent Service |
| Allow, do not exclude, the system tools | node.exe starts powershell.exe, icacls.exe, takeown.exe, and schtasks.exe; an update runs a SYSTEM scheduled task VaultPilotUpdate-<job> that starts powershell.exe and msiexec.exe /qn and can show a UAC prompt. Allow these behaviors for the VaultPilot paths instead of excluding the Windows tools themselves. | Updates screen |
Before and after install
Checks that belong to every install and update.
| Requirement | Detail | Guide |
|---|---|---|
| A full Backup Tool backup before every update | Run VaultPilotBackupTool.exe as Administrator and store the ZIP off the server with restricted access; the ZIP is not password protected. Quick Recovery is not a full backup. | Backups and restore |
| An administrator session for the update | Keep an authorized Windows administrator available to approve a UAC prompt. An MSI placed on the server by hand still needs a valid signature. | Updates screen |
| Post-install check | sc.exe query VaultPilotServer shows the service running, https://127.0.0.1:1734 opens on the server, and the remote address opens from an approved workstation. | Windows Server installation |
See VaultPilot in your own environment
Tell us what the evaluation should cover, or open the live demo with sample data first.