This runbook lists the recurring VaultPilot checks after go-live, plus the incident and change-window routines.
Operating principles
- Treat the VaultPilot server as a local security system, not as a cloud dependency.
- Verify health from the console first, then collect redacted server evidence only when needed.
- Keep backups, databases and certificate private keys in access-restricted storage; never attach them to support email.
- Download only from the official release; trust update assets through the signed manifest.
Daily checks
| Check | Where | Healthy signal |
|---|---|---|
| Service reachability | Browser and Windows service state | Console loads and VaultPilot Server is running. |
| Security posture | Overview | Known actions are either closed or owned. |
| Audit chain | Audit view | Latest events show expected chain state. |
| License | License page | Active state, capacity and expiry are expected. |
| Extension devices | Extension page | Paired devices are known; no unexpected pending device. |
| Update jobs | Update Center | No blocked or stale update job. |
| Scheduled work | Tasks > Scheduled | No unexplained Blocked, long-waiting Due, or persistent Retrying item. |
| Directory agent | Integrations > Active Directory | Health is CONNECTED; service and worker report the expected version and ready. |
Weekly checks
| Check | Expected action |
|---|---|
| Full backup | Keep the Backup Tool ZIP outside the server disk, offline and access-restricted; assume the ZIP is not password protected. |
| Quick recovery | Confirm the .vpr.json file and its key are stored separately and documented as not being a full backup. |
| Restore drill | Validate restore in staging or a disposable profile when policy requires it. |
| User review | Confirm disabled users, role assignments and 2FA state. |
| AD sync review | Confirm provider health, last sync, sign-in and vault scope, and reconciliation results for selected existing records. |
| Rotation review | Confirm next run and logs for daily, weekly, monthly, and custom policies. |
| Extension review | Revoke stale devices and confirm the Chrome Web Store version. |
| Release review | Compare installed version to the latest official release. |
Monthly checks
| Area | Evidence |
|---|---|
| Certificate lifecycle | Certificate expiry date, SAN coverage and browser validation. |
| Server System settings | Public host, port, HTTPS state, notification test, log retention and audit retention. |
| License lifecycle | Expiry date, user cap and read-only risk. |
| Update trust | Manifest signature and asset hash for the current release; the signer only when a release names one (3.0.3 is unsigned). |
| Incident readiness | Support evidence pack still matches the current environment. |
| Recovery readiness | Backup location and restore procedure are still accessible. |
Incident routine
- Identify the affected surface: login, vault records, sharing, extension, AD sync, update, backup, license, certificate or installer.
- Open the matching knowledge base article.
- Collect only the listed safe evidence.
- Redact hosts, users, internal URLs and timestamps when needed.
- Do not attach databases, backups, PFX/P12 files, private keys or screenshots with real vault records.
- Escalate privately to support@vaultpilot.io, attaching the support evidence pack.
Active Directory action triage
- Do not use sync success as proof that sensitive actions are ready. In Status, verify service and PowerShell worker separately, including version.
- If the agent token must be rotated, plan for immediate invalidation of the old value. The command must contain only
-PromptAgentToken; paste the token into the local secure PowerShell prompt. - Distinguish Require password change from Assign random password now. The first forces a password change at next sign-in; the second changes AD immediately and reports the vault update separately.
- Do not repeat an unclear result blindly. Compare the task, agent, and vault-update results first.
- Stop for built-in accounts and the agent’s bind account. For other privileged targets, confirm the second manual prompt or the standing automated-rotation approval.
Choose the correct recovery path
- Use Quick Recovery
.vpr.jsonto rebuild a profile only; files, history, license, server settings, and logs are excluded. - Use the Backup Tool ZIP for full-server recovery. Verify source and integrity, and plan for every session to close after successful import.
- Never treat an audit, Discovery, or Executions maintenance backup as a full backup. It restores only its category and can replace newer records in that category.
Change windows
Use a planned change window for:
- MSI upgrades.
- Public host or certificate changes.
- Server System host, notification, retention or maintenance changes.
- License replacement.
- AD provider or DC Agent changes.
- Browser extension rollout policy changes.
- Backup import or restore tests.
Before the change, export a backup and record current version, service state and support contact. After the change, confirm login, license, audit, extension devices, update status and backups.