VaultPilotVaultPilot
SearchTRRequest a demo
VaultPilotVaultPilot
Request a demoSearch the siteTürkçe

Windows Server installation

Use this runbook for a normal VaultPilot Server installation or an in-place Windows upgrade, before you open the server to other users.

Requirements

RequirementNotes
Windows Server or approved Windows hostUse a controlled host with stable storage and backup policy.
Administrator rightsRequired for the MSI, service registration and firewall rule.
Inbound TCP accessDefault port is 1734; change only if your network policy requires it.
Backup decisionExport or preserve the existing data directory before production upgrades.
Release assetsUse the MSI and update manifest from the official release, not files copied from chat or support threads.

Install

  1. Download VaultPilot-3.0.3-x64.msi from the official v3.0.3 release.
  2. Before running it, verify the allowed release address, exact filename, Ed25519-signed update manifest, SHA-256, and file size. The v3.0.3 package is an unsigned MSI; do not expect signer details for this release. Use release asset verification for the full procedure.
  3. Run the MSI as Administrator.
  4. The installer sets up the server, its Windows service, the firewall rule, and the data and log directories.
  5. Open VaultPilot from the server first:
https://127.0.0.1:1734

Then validate remote access:

https://<SERVER_HOST>:1734

Creating the first profile and unlocking the vault work only over HTTPS. The server uses HTTPS on port 1734 by default, with a managed self-signed certificate until you configure a trusted PFX/P12. Always open VaultPilot with https://.

Installed surfaces

SurfaceValue
Windows serviceVaultPilotServer; upgraded servers may still show the older PassManServer name
Display nameVaultPilot Server
Data directoryC:\ProgramData\VaultPilot; upgraded servers may still use C:\ProgramData\PassMan
Log directoryC:\ProgramData\VaultPilot\logs
Default port1734
Browser entryhttps://<SERVER_HOST>:1734 with managed self-signed HTTPS until a trusted certificate is configured

Post-install validation

Run these checks before creating broad access:

sc.exe query VaultPilotServer

https://127.0.0.1:1734

Expected result:

  • The service is installed and running.
  • The local address opens the VaultPilot sign-in page.
  • The remote URL opens from an approved workstation.
  • The firewall rule allows only the intended network path.
  • No installer error remains in the VaultPilot log folder.

First login path

After service validation:

  1. Create the owner profile.
  2. Unlock the vault with the master password.
  3. Apply the license.
  4. Configure public host and HTTPS.
  5. Enable 2FA before adding additional users.

Upgrade notes

  • Export a backup before production upgrades.
  • Let the MSI update the server and support components together.
  • The Offline Share Decrypter and DC Agent script are refreshed by the MSI and also documented in release notes.
  • Do not manually replace files in the server’s install folder unless support explicitly asks for that diagnostic step.

Upgrade from PassMan-branded installs

Before upgrading, export a server backup and record the current service name, data directory, port, and running version. Run the verified VaultPilot-3.0.3-x64.msi as Administrator after completing the same release asset verification. Do not manually rename C:\ProgramData\PassMan or existing service entries.

After upgrade, verify VaultPilotServer, the data directory, Update Center, extension pairing, license state, audit retention, and Server System diagnostics. Older PassMan names may remain for compatibility and rollback.

Public evidence for support

Safe to share after redaction:

  • MSI filename.
  • VaultPilot server version.
  • Windows service status.
  • Redacted installer log excerpt.
  • Browser URL shape, with real host replaced by <SERVER_HOST>.

Do not share databases, backups, PFX/P12 files, private keys, master passwords, secret values or real internal hostnames.

Back to Documentation