The VaultPilot admin quickstart takes you from the official release download to a healthy first vault. Each step lists the proof to expect.
Day-0 path
| Step | Action | Proof |
|---|---|---|
| 1 | Download VaultPilot-3.0.3-x64.msi from the official v3.0.3 release. | File name, file size and SHA-256 match release assets. |
| 2 | Verify the Ed25519-signed update manifest before trusting the package. | The manifest lists version 3.0.3 with the MSI’s SHA-256 and file size; the 3.0.3 MSI is unsigned, so no signer is expected. |
| 3 | Install the MSI from an elevated Windows session. | The VaultPilot Server service exists and is running. |
| 4 | Open https://<SERVER_HOST>:1734. | The server responds; until a trusted certificate is configured, the browser may show a certificate warning. |
| 5 | Create the first owner profile and unlock the default vault through HTTPS. Opening VaultPilot on the server itself is fine only for a local check. | Owner appears in Users and the first vault is available. |
| 6 | Apply the license. | License page shows active state, capacity and expiry. |
| 7 | Configure public host and HTTPS. | Browser reaches the intended host without a mismatch warning. |
| 8 | Enable 2FA for the owner. | Lock and unlock require master password plus authenticator code. |
| 9 | Export an encrypted backup. | Backup file imports into a clean validation profile or staging host. |
| 10 | Review security posture and audit chain. | Overview actions are understood and audit chain health is visible. |
Minimum environment
| Requirement | Baseline |
|---|---|
| Host | Windows Server or approved Windows service host. |
| Port | Default public HTTPS port 1734, reachable by intended operators. |
| Browser | Chromium-family browser for extension pairing; modern browser for console use. |
| Permissions | Administrator rights for MSI install and update. |
| Data | Stored in the local VaultPilot data directory on the server. |
| Backup | Operator-controlled encrypted backup location outside the install directory. |
First validation commands
Run these from an elevated PowerShell session on the server:
sc.exe query VaultPilotServer
netstat -ano | findstr ":1734"
Collect only redacted command output for support. Do not upload databases, backups, certificate private keys or raw logs containing secret values.
Stop conditions
Stop and move to the knowledge base if:
- The MSI does not create the service.
- The service runs but the browser cannot reach
https://<SERVER_HOST>:1734. - The first owner cannot unlock after profile creation.
- The license page is read-only unexpectedly.
- The browser shows an HTTPS name mismatch after certificate upload.
- Update Center reports a manifest, checksum or signer mismatch.