From 62884229f8cc66fe0164b3eab580034ff90a3b8e Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Thu, 13 Aug 2026 03:06:37 -0700 Subject: [PATCH 01/12] Add installer log guidance for PingCastle Enterprise 4.0 Support needs installer logs when install fails or a case opens. Adds a Collecting Installer Logs subsection with the /l*v flag steps, and notes deep-linking to it from both install tabs. Co-Authored-By: Claude Sonnet 5 --- docs/pingcastle/4.0/enterpriseinstall.md | 8 ++++++++ docs/pingcastle/4.0/enterprisetroubleshooting.md | 12 ++++++++++++ 2 files changed, 20 insertions(+) diff --git a/docs/pingcastle/4.0/enterpriseinstall.md b/docs/pingcastle/4.0/enterpriseinstall.md index 89adda72f3..d1dc3b792c 100644 --- a/docs/pingcastle/4.0/enterpriseinstall.md +++ b/docs/pingcastle/4.0/enterpriseinstall.md @@ -34,6 +34,10 @@ For SQL Express, visit [SQL Server Express Downloads](https://learn.microsoft.co #### Step 2 - Run PingCastleEnterpriseInstaller.exe (production) +:::note +Having trouble installing? See [Collecting Installer Logs](/docs/pingcastle/4.0/enterprisetroubleshooting#collecting-installer-logs) in the Troubleshooting guide. +::: + The installer wizard walks you through prerequisite checks, licensing, and configuration screens in the following order. 1. **Prerequisite check**: the installer checks the server for IIS and the ASP.NET 10.0 Hosting Bundle. If either is missing, it offers to install them for you. @@ -125,6 +129,10 @@ choco install sql-server-express #### Step 2 - Run PingCastleEnterpriseInstaller.exe (test/POC) +:::note +Having trouble installing? See [Collecting Installer Logs](/docs/pingcastle/4.0/enterprisetroubleshooting#collecting-installer-logs) in the Troubleshooting guide. +::: + 1. Run PingCastleEnterpriseInstaller.exe. The installer checks for IIS and the ASP.NET 10.0 Hosting Bundle and offers to install them if they're missing. :::warning diff --git a/docs/pingcastle/4.0/enterprisetroubleshooting.md b/docs/pingcastle/4.0/enterprisetroubleshooting.md index 76e6c65f14..280eb5fe06 100644 --- a/docs/pingcastle/4.0/enterprisetroubleshooting.md +++ b/docs/pingcastle/4.0/enterprisetroubleshooting.md @@ -54,6 +54,18 @@ Before pasting file contents into any online JSON validator, redact passwords, c Only restart the PingCastle Enterprise application pool or service after the file passes validation. +### Collecting Installer Logs + +If the installer fails or exits unexpectedly, generate a verbose installer log to diagnose the issue or attach to a support case. + +Run the installer with the `/l*v` flag and a log file path: + +``` +pingcastle-enterprise-installer.exe /l*v C:\path\to\install.log +``` + +Include this log file when opening a support case for installation issues. + ### Common Errors and Solutions Here are common errors, their causes, and how to fix them. From e382511a869443b50f5739d127f66bbc1deddb35 Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Thu, 13 Aug 2026 09:02:08 -0700 Subject: [PATCH 02/12] Document known upgrade issue: installer misdetects install directory The 4.0 installer sometimes fails to detect the existing installation directory during an in-place upgrade. Documents the INSTALLFOLDER command-line workaround. Co-Authored-By: Claude Sonnet 5 --- docs/pingcastle/4.0/enterpriseupgrade.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/pingcastle/4.0/enterpriseupgrade.md b/docs/pingcastle/4.0/enterpriseupgrade.md index fa2e31ed92..ed3b9eba0a 100644 --- a/docs/pingcastle/4.0/enterpriseupgrade.md +++ b/docs/pingcastle/4.0/enterpriseupgrade.md @@ -26,6 +26,16 @@ Test the upgrade in a non-production environment first if one is available. This PingCastle Enterprise 4.0 replaces the MSI-based installer with a single installer executable, `PingCastleEnterpriseInstaller.exe`. Upgrading from 3.5.1 to 4.0 is an in-place upgrade: you run the new installer on top of your existing 3.5.1 installation, and it detects and upgrades that installation automatically. The installer also detects and applies any prerequisite changes 4.0 requires, such as the correct ASP.NET Hosting Bundle version, so you don't need to update prerequisites manually. +:::warning Known Issue +In this release, the installer sometimes fails to detect the existing installation directory during an upgrade. If this happens, run the installer from the command line and specify the installation directory with the `INSTALLFOLDER` parameter: + +``` +pingcastle-enterprise-installer.exe INSTALLFOLDER="D:\PingCastleEnterprise\" /l*v upgrade.log +``` + +Replace `D:\PingCastleEnterprise\` with your actual installation directory. +::: + To upgrade PingCastle Enterprise from 3.5.1 to 4.0: 1. Download `PingCastleEnterpriseInstaller.exe` for version 4.0. From 21f0f0956957c13124d33dbb6bdd4d40afc0794f Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 16:06:41 +0000 Subject: [PATCH 03/12] fix(vale): auto-fix style issues (Vale + Dale) --- docs/pingcastle/4.0/enterpriseinstall.md | 8 ++++---- docs/pingcastle/4.0/enterprisetroubleshooting.md | 4 ++-- docs/pingcastle/4.0/enterpriseupgrade.md | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseinstall.md b/docs/pingcastle/4.0/enterpriseinstall.md index d1dc3b792c..923b724cf5 100644 --- a/docs/pingcastle/4.0/enterpriseinstall.md +++ b/docs/pingcastle/4.0/enterpriseinstall.md @@ -69,7 +69,7 @@ The installer wizard walks you through prerequisite checks, licensing, and confi ::: :::tip Remote SQL Server Setup - If you're configuring a remote SQL Server (not on the local machine), see the [Remote Database Configuration](#remote-database-configuration) section for detailed setup instructions including SQL Authentication and Windows Authentication options. + If you're configuring a remote SQL Server (not on the local machine), see the [Remote Database Configuration](#remote-database-configuration) section for setup instructions covering SQL Authentication and Windows Authentication. ::: 7. **Authentication method**: enable **Windows Authentication**, **OpenID Connect**, **SAML2**, or a combination, and optionally disable local password login. See [Authentication](enterpriseauthsetup.md#authentication) for full configuration details for each method. @@ -136,7 +136,7 @@ Having trouble installing? See [Collecting Installer Logs](/docs/pingcastle/4.0/ 1. Run PingCastleEnterpriseInstaller.exe. The installer checks for IIS and the ASP.NET 10.0 Hosting Bundle and offers to install them if they're missing. :::warning - Installing missing prerequisites can require a server restart. If prompted, restart the server and run the installer again to continue. + Installing missing prerequisites can require a server restart. If the installer prompts you to restart, restart the server and run the installer again to continue. ::: 2. Accept the license agreement and enter your license key. @@ -152,7 +152,7 @@ For a detailed description of each wizard screen, see the Production Installatio ::: :::tip Remote SQL Server Setup -If you're configuring a remote SQL Server instead of using the local instance, see the [Remote Database Configuration](#remote-database-configuration) section for detailed setup instructions including SQL Authentication and Windows Authentication options. +If you're configuring a remote SQL Server instead of using the local instance, see the [Remote Database Configuration](#remote-database-configuration) section for setup instructions covering SQL Authentication and Windows Authentication. ::: @@ -170,7 +170,7 @@ PingCastle Enterprise requires a database user account with database owner permi ### SQL Server Permissions -When connecting to an existing database, the account PingCastle Enterprise uses requires database owner permissions. If PingCastle Enterprise runs under the IIS application pool's Windows account, grant permissions with the following SQL: +When you connect to an existing database, the account PingCastle Enterprise uses requires database owner permissions. If PingCastle Enterprise runs under the IIS application pool's Windows account, grant permissions with the following SQL: ```sql IF NOT EXISTS (SELECT loginname FROM master.dbo.syslogins diff --git a/docs/pingcastle/4.0/enterprisetroubleshooting.md b/docs/pingcastle/4.0/enterprisetroubleshooting.md index 280eb5fe06..8806e5ff71 100644 --- a/docs/pingcastle/4.0/enterprisetroubleshooting.md +++ b/docs/pingcastle/4.0/enterprisetroubleshooting.md @@ -7,7 +7,7 @@ sidebar_label: Troubleshooting ### Viewing Application Logs and Errors -When troubleshooting issues with PingCastle Enterprise, you need to view error messages and logs to diagnose problems. +To diagnose problems with PingCastle Enterprise, view its error messages and logs. Configure logging from the web portal at **Configuration** > **Settings** > **Logging**: @@ -133,7 +133,7 @@ You can find more detailed error messages in the event log or by running the app - Invalid license key - Missing or misconfigured application settings -- Runtime dependencies not installed +- Missing runtime dependencies **Solution:** diff --git a/docs/pingcastle/4.0/enterpriseupgrade.md b/docs/pingcastle/4.0/enterpriseupgrade.md index ed3b9eba0a..4d4a8297eb 100644 --- a/docs/pingcastle/4.0/enterpriseupgrade.md +++ b/docs/pingcastle/4.0/enterpriseupgrade.md @@ -44,7 +44,7 @@ To upgrade PingCastle Enterprise from 3.5.1 to 4.0: ![A screenshot of the installer installing the required ASP.NET Hosting Bundle version as part of the upgrade.](/images/pingcastle/enterpriseupgrade/prereq-install.webp) - The installer bundles the required prerequisites, including the ASP.NET Hosting Bundle, directly. The upgrade doesn't need web access to download them. + The installer bundles the required prerequisites directly, including the ASP.NET Hosting Bundle. The upgrade doesn't need web access to download them. ## Configuration migration From 025a2139dc82208ec86aa972901e2feb6d5115e6 Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Fri, 11 Sep 2026 11:49:44 +0100 Subject: [PATCH 04/12] Fix PingCastle Enterprise silent install property docs Removes ACCEPT_KEY_LOSS (not wired up) and UI-only/orphaned properties (WINDOWSGROUPADMINVISIBLE, WINDOWSGROUPVISIBLE, WINDOWSORAZURE, AZUREGROUPID), corrects DB_SERVER_TYPE valid values and behavior, clarifies USE_ENCRYPTION/TRUST_SERVER_CERTIFICATE defaults, and documents all three APPPOOL_IDENTITY_TYPE values including the gMSA password exception. Generated with AI Co-Authored-By: Claude Code --- .../pingcastle/4.0/enterprisesilentinstall.md | 249 ++++++++++++++++++ 1 file changed, 249 insertions(+) create mode 100644 docs/pingcastle/4.0/enterprisesilentinstall.md diff --git a/docs/pingcastle/4.0/enterprisesilentinstall.md b/docs/pingcastle/4.0/enterprisesilentinstall.md new file mode 100644 index 0000000000..c1e12938f5 --- /dev/null +++ b/docs/pingcastle/4.0/enterprisesilentinstall.md @@ -0,0 +1,249 @@ +--- +sidebar_label: Silent installation +--- +# Silent Installation of PingCastle Enterprise + +`PingCastle-Enterprise-Installer-.exe` supports a fully scripted, unattended installation. Use this for automated deployments, such as installing PingCastle Enterprise from a configuration management tool or a CI/CD pipeline. + +## How It Works + +`PingCastle-Enterprise-Installer-.exe` is a thin wrapper around an embedded Windows Installer (MSI) package, not an interactive-only installer. When you run it, the wrapper: + +1. Extracts the embedded MSI to `%ProgramData%\PingCastle\Installer\\`. +2. Runs `msiexec.exe /i` against the extracted MSI, forwarding every command-line argument you passed to the wrapper unchanged. +3. Requires elevation. Running the wrapper triggers a UAC prompt, and nothing runs until you accept it. + +Because the wrapper forwards its arguments verbatim, `PingCastle-Enterprise-Installer-.exe` passes every install option and every logging switch through to `msiexec` as an MSI switch or property. The wrapper also preserves quoting verbatim, so quote any property value that contains spaces exactly as you would for `msiexec` directly. + +:::warning +The license key and any other secrets you pass as MSI properties appear in plain text in Task Manager and other process command-line auditing tools while the install runs. They also appear in a verbose install log unless PingCastle Enterprise scrubs them. See [Collecting Support Logs](enterprisesupportlogs.md#installer-logs) for how installer logging works. +::: + +## Installation Options + +Run `PingCastle-Enterprise-Installer-.exe` with the same arguments you'd give `msiexec /i`: + +``` +PingCastle-Enterprise-Installer-.exe /quiet /norestart PROPERTY1=value PROPERTY2="value with spaces" +``` + +The following tables list the switches and MSI properties that control a silent installation, grouped by what they configure. + +### Core Install Switches + +| Switch/property | Purpose | +|---|---| +| `/quiet` | Runs a fully silent install with no UI. | +| `/passive` | Runs an unattended install that still shows progress UI. | +| `/norestart` | Suppresses any restart the install would otherwise trigger. | +| `SERIALNUMBERPROPERTY=""` | Sets the license key. | +| `CUSTOM_INSTALL_PATH=""` | Sets a custom install directory. | +| `SKIP_PREREQUISITE_CHECK` | Bypasses the prerequisite validation the wizard normally runs. | + +### Database Connection Properties + +See [Remote Database Configuration](enterpriseinstall.md#remote-database-configuration) for background on connecting to an existing database. + +| Property | Purpose | Notes | +|---|---|---| +| `CONNECTIONSTRINGWAY` | `AUTO` \| `MANUAL` | Default `AUTO`. `AUTO` builds a connection string from the properties below; `MANUAL` uses `CONNECTIONSTRINGPROPERTY` as-is. | +| `DB_SERVER_TYPE` | `LOCAL` \| `REMOTE` | Default `LOCAL`. `LOCAL` uses SQL Express on the local server (`.\SQLExpress`). `REMOTE` uses `DATABASE_SERVER` as the SQL host, along with `SQL_AUTH_TYPE` and any SQL authentication credentials it requires. | +| `DATABASE_SERVER` | SQL Server instance (`AUTO` mode) | Used to build the connection string. | +| `SQL_AUTH_TYPE` | `WINDOWS` \| `SQL` | Default `WINDOWS`. `SQL` requires `SQL_USERNAME`/`SQL_PASSWORD`. | +| `SQL_USERNAME` / `SQL_PASSWORD` | SQL authentication credentials | Only used when `SQL_AUTH_TYPE=SQL`. | +| `USE_ENCRYPTION` | Appended to the built connection string | Default `Encrypt=True;`. Omit this property to set it to `False`. | +| `TRUST_SERVER_CERTIFICATE` | Appended to the built connection string | Default `TrustServerCertificate=True;`. Omit this property to set it to `False`. | +| `CONNECTIONSTRINGPROPERTY` | Full manual connection string | Required when `CONNECTIONSTRINGWAY=MANUAL`. | + +### Windows Authentication Properties + +Used when `AUTH_WINDOWS=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. + +| Property | Purpose | Notes | +|---|---|---| +| `WINDOWSGROUP` | SID of the Windows group granted general access | Default `S-1-1-0` (`Everyone`). | +| `WINDOWSGROUPADMIN` | SID of the Windows group granted admin access | No default. Must be set explicitly to grant admin rights to a specific group. | + +### IIS Application Pool Identity Properties + +| Property | Purpose | Notes | +|---|---|---| +| `APPPOOL_IDENTITY_TYPE` | `APPPOOL_IDENTITY` \| `LOCAL_SYSTEM` \| `CUSTOM` | Default `APPPOOL_IDENTITY` (recommended). `APPPOOL_IDENTITY` runs the IIS application pool under the built-in virtual app pool identity (`IIS AppPool\`); no credentials needed. `LOCAL_SYSTEM` runs it under the Local System account. `CUSTOM` runs it under an explicit domain or service account and requires `APPPOOL_USERNAME`/`APPPOOL_PASSWORD`. | +| `APPPOOL_USERNAME` | Custom account to run the app pool as | Required when `APPPOOL_IDENTITY_TYPE=CUSTOM`. | +| `APPPOOL_PASSWORD` | Password for `APPPOOL_USERNAME` | Required when `APPPOOL_IDENTITY_TYPE=CUSTOM`, unless `APPPOOL_USERNAME` ends in `$` (a group Managed Service Account (gMSA)), which doesn't need a password. | + +### Scheduler Service Account Properties + +| Property | Purpose | Notes | +|---|---|---| +| `SCHEDULER_ACCOUNT_CHOICE` | `SAME_AS_APPPOOL` \| `CUSTOM` \| ... | Selects which account the Scheduler Windows service logs on as. | +| `SCHEDULER_SERVICE_ACCOUNT` | Resolved service account | Default `LocalSystem`. Set to the app pool's account automatically when `SCHEDULER_ACCOUNT_CHOICE=SAME_AS_APPPOOL`. | +| `SCHEDULER_USERNAME` / `SCHEDULER_PASSWORD` | Custom account credentials | Used when `SCHEDULER_ACCOUNT_CHOICE=CUSTOM`. | +| `SCHEDULER_ADD_TO_LOCAL_ADMINS` | Adds the scheduler account to local Administrators | Optional. | +| `SCHEDULER_API_KEY` | API key the Scheduler service uses to call the Enterprise API | Auto-generated if not supplied. | + +### SAML Properties + +Used when `AUTH_SAML=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. + +| Property | Purpose | Notes | +|---|---|---| +| `SAML_ALLOWED_ISSUER` | Expected issuer/entity ID from the identity provider | Required. | +| `SAML_SSO_URL` | Identity provider single sign-on URL | Required. Must be a valid `http`/`https` URL. | +| `SAML_ISSUER` | This service provider's issuer/entity ID | — | +| `SAML_DISPLAY_NAME` | Label shown on the sign-in page | — | +| `SAML_METADATA_URL` | Identity provider metadata URL | Alternative to manual issuer/single sign-on URL entry. | +| `SAML_CERTIFICATE_PATH` | Path to the identity provider's signing certificate | Optional. If supplied, the installer verifies the file exists. | + +### OpenID Connect Properties + +Set `AUTH_OIDC=1` (alongside any other `AUTH_*` providers you want enabled) plus the properties below. See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. + +| Property | Purpose | Notes | +|---|---|---| +| `OIDC_AUTHORITY` | OpenID Connect authority/issuer URL | Required. Must be a valid absolute `http`/`https` URL. | +| `OIDC_CLIENT_ID` | Application (client) ID registered with the identity provider | Required. | +| `OIDC_CLIENT_SECRET` | Application client secret | Not echoed in the UI, and masked in the verbose log. | +| `OIDC_DISPLAY_NAME` | Label shown for this provider on the sign-in page | Optional. Defaults to `Entra ID` if omitted. | +| `OIDC_GROUP_ID` | Group claim/ID used for role mapping | Optional. | + +### CloudAPI Properties + +The CloudAPI component has its own database and secrets, separate from the main Enterprise application. These aren't typically set on a fresh install. + +| Property | Purpose | Notes | +|---|---|---| +| `CLOUDAPI_CONFIGURED` | Marks whether CloudAPI was previously configured | Used on upgrade to decide whether to reconfigure secrets or preserve them. | +| `CLOUDAPI_CONNECTIONSTRINGPROPERTY` | CloudAPI's own database connection string | Built the same way as the main `CONNECTIONSTRINGPROPERTY` if not supplied directly. | +| `CLOUDAPI_MICROSERVICE_API_KEY` | API key used to call the CloudAPI microservice | Auto-generated if empty. | +| `CLOUDAPI_HMAC_KEY` | HMAC signing key for CloudAPI requests | Auto-generated if empty. | +| `CLOUDAPI_ENCRYPTION_KEY` | Encryption key for CloudAPI stored data | Auto-generated if empty. | + +### Email and Notification Properties + +Set `EMAIL_PROVIDER` to `None`, `SMTP`, or `Graph` (default `SMTP`). See [Email](enterpriseemailsetup.md#email) for background. + +Common to both `SMTP` and `Graph`: + +| Property | Purpose | Notes | +|---|---|---| +| `EMAIL_PROVIDER` | `None` \| `SMTP` \| `Graph` | Default `SMTP`. | +| `EMAILFROM` | From address used to send email | Required for `SMTP`/`Graph`. Validated as a well-formed email address. | +| `FULLHTTPFQDN` | URL of the PingCastle instance shown in email bodies | Validated as a well-formed URI. | + +**`EMAIL_PROVIDER=SMTP`:** + +| Property | Purpose | Notes | +|---|---|---| +| `SMTPSERVER` | SMTP host | Required. | +| `SMTPPORT` | SMTP port | Default `25`. Must parse as an integer. | +| `SMTPLOGIN` | SMTP authentication username | Optional. | +| `SMTPPASSWORD` | SMTP authentication password | — | + +**`EMAIL_PROVIDER=Graph`** (send mail through Microsoft Graph): + +| Property | Purpose | Notes | +|---|---|---| +| `EMAIL_TENANT_ID` | Entra ID tenant ID | Required. | +| `EMAIL_CLIENT_ID` | App registration client ID | Required. | +| `GRAPH_AUTH_METHOD` | `ClientSecret` \| `Certificate` | Default `ClientSecret`. | +| `GRAPH_CLIENT_SECRET` | Client secret | Required when `GRAPH_AUTH_METHOD=ClientSecret`. | +| `GRAPH_CERT_MODE` | `File` \| `Store` | Only used when `GRAPH_AUTH_METHOD=Certificate`. Default `File`. | +| `GRAPH_CERT_PATH` | Path to certificate file | Required when `GRAPH_CERT_MODE=File`. | +| `GRAPH_CERT_PASSWORD` | Certificate file password | — | +| `GRAPH_CERT_STORE_LOCATION` | `CurrentUser` \| ... | Only used when `GRAPH_CERT_MODE=Store`. Default `CurrentUser`. | +| `GRAPH_CERT_STORE_NAME` | Certificate store name | Required when `GRAPH_CERT_MODE=Store`. Default `Personal`. | +| `GRAPH_CERT_THUMBPRINT` | Certificate thumbprint | Required when `GRAPH_CERT_MODE=Store`. | + +### SSL and HTTPS Properties + +See [Configuring HTTPS](enterprisehttpssetup.md#configuring-https) for background. + +| Property | Purpose | Notes | +|---|---|---| +| `SSL_ENABLED` | `1` to bind HTTPS, `0`/unset to stay HTTP-only | Default `1`. | +| `SSL_PORT` | HTTPS port for the IIS binding | Default `443`. Must be an integer from `1`–`65535`. | +| `SSL_CERT_TYPE` | `SELFSIGNED` \| `EXISTING` \| `STORE` | Default `SELFSIGNED` (installer generates a self-signed certificate). | +| `SSL_CERT_PATH` | Path to a `.pfx`/certificate file | Required when `SSL_CERT_TYPE=EXISTING`. | +| `SSL_CERT_PASSWORD` | Password for the certificate file | Used with `EXISTING`. | +| `SSL_CERT_THUMBPRINT` | Thumbprint of a certificate already in the Windows certificate store | Required when `SSL_CERT_TYPE=STORE`. | +| `SSL_FORCE_REBIND` | Forces the IIS binding to be reconfigured even if unchanged | Optional. Used mainly for upgrade scenarios. | + +## Example Installations + +Each example is a PowerShell snippet. Edit the variables at the top, then paste the whole block into an elevated PowerShell session. + +### Basic Installation + +The minimum needed to install: a license key. The installer keeps every other default: it creates the database locally, generates a self-signed certificate, and enables no authentication provider besides local login. + +```powershell +$installer = "C:\Temp\PingCastle-Enterprise-Installer-4.0.exe" +$licenseKey = "" + +& $installer /quiet /norestart SERIALNUMBERPROPERTY="$licenseKey" +``` + +### Secure Installation + +Adds HTTPS using a certificate that's already in the Windows certificate store, specified by its thumbprint. + +```powershell +$installer = "C:\Temp\PingCastle-Enterprise-Installer-4.0.exe" +$licenseKey = "" +$sslThumbprint = "<40-character-certificate-thumbprint>" +$fqdn = "https://pingcastle.example.com" + +& $installer /quiet /norestart ` + SERIALNUMBERPROPERTY="$licenseKey" ` + SSL_ENABLED=1 ` + SSL_CERT_TYPE=STORE ` + SSL_CERT_THUMBPRINT="$sslThumbprint" ` + FULLHTTPFQDN="$fqdn" +``` + +### Connect to an Existing Database + +Uses a manual connection string to connect to a database you've already provisioned, instead of letting the installer create one. + +```powershell +$installer = "C:\Temp\PingCastle-Enterprise-Installer-4.0.exe" +$licenseKey = "" +$connectionString = "Server=sql01;Database=PingCastleEnterprise;User Id=svc_pc;Password=;MultipleActiveResultSets=True;Encrypt=True;TrustServerCertificate=True;" + +& $installer /quiet /norestart ` + SERIALNUMBERPROPERTY="$licenseKey" ` + CONNECTIONSTRINGWAY=MANUAL ` + CONNECTIONSTRINGPROPERTY="$connectionString" +``` + +### Full Configuration + +Combines a license, HTTPS, Windows Authentication, and SMTP email settings in a single install. + +```powershell +$installer = "C:\Temp\PingCastle-Enterprise-Installer-4.0.exe" +$licenseKey = "" +$sslThumbprint = "<40-character-certificate-thumbprint>" +$fqdn = "https://pingcastle.example.com" +$windowsAdminGroupSid = "" +$smtpServer = "smtp.example.com" +$smtpFrom = "pingcastle@example.com" + +& $installer /quiet /norestart ` + SERIALNUMBERPROPERTY="$licenseKey" ` + SSL_ENABLED=1 ` + SSL_CERT_TYPE=STORE ` + SSL_CERT_THUMBPRINT="$sslThumbprint" ` + FULLHTTPFQDN="$fqdn" ` + AUTH_WINDOWS=1 ` + WINDOWSGROUPADMIN="$windowsAdminGroupSid" ` + EMAIL_PROVIDER=SMTP ` + EMAILFROM="$smtpFrom" ` + SMTPSERVER="$smtpServer" ` + SMTPPORT=587 +``` + +:::tip +See [Collecting Support Logs](enterprisesupportlogs.md#installer-logs) for how to capture a verbose install log if a silent installation fails. +::: From 32edcaa43aee0ab70034e2b9360eca461493196e Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Fri, 11 Sep 2026 12:19:39 +0100 Subject: [PATCH 05/12] Split support logs and action plans/exceptions into dedicated pages Extracts logging guidance into a new "Collecting Support Logs" article covering application, CloudAPI, scheduler, and installer logs, and adds installer failure troubleshooting. Splits action plans/exceptions content out of the Entities page into its own article, and updates the sidebar to match. Generated with AI Co-Authored-By: Claude Code --- docs/pingcastle/4.0/enterpriseinstall.md | 3 + docs/pingcastle/4.0/enterprisesupportlogs.md | 44 ++++++++++ .../4.0/enterprisetroubleshooting.md | 68 +++++++++++----- .../enterpriseuser-actionplans-exceptions.md | 81 +++++++++++++++++++ .../pingcastle/4.0/enterpriseuser-entities.md | 58 +------------ sidebars/pingcastle/4.0.js | 13 ++- 6 files changed, 190 insertions(+), 77 deletions(-) create mode 100644 docs/pingcastle/4.0/enterprisesupportlogs.md create mode 100644 docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md diff --git a/docs/pingcastle/4.0/enterpriseinstall.md b/docs/pingcastle/4.0/enterpriseinstall.md index 923b724cf5..c549601cf4 100644 --- a/docs/pingcastle/4.0/enterpriseinstall.md +++ b/docs/pingcastle/4.0/enterpriseinstall.md @@ -8,6 +8,9 @@ import TabItem from '@theme/TabItem'; ## Installation +:::tip Scripted or Unattended Installs +For automated deployments, see [Silent Installation of PingCastle Enterprise](enterprisesilentinstall.md). +::: diff --git a/docs/pingcastle/4.0/enterprisesupportlogs.md b/docs/pingcastle/4.0/enterprisesupportlogs.md new file mode 100644 index 0000000000..24844e7f83 --- /dev/null +++ b/docs/pingcastle/4.0/enterprisesupportlogs.md @@ -0,0 +1,44 @@ +--- +sidebar_label: Collecting support logs +--- +# Collecting Support Logs for PingCastle Enterprise + +Use this page to gather logs before opening a support ticket. It covers two kinds of logs: + +- **Application and service logs** — for issues after installation, such as errors in the web portal, scanning, or the scheduler. +- **Installer logs** — for issues during installation or upgrade. + +## Application and Service Logs + +PingCastle Enterprise, CloudAPI (which handles Entra ID scanning), and PingCastleSchedulerService all use Serilog for logging, each writing to its own `logs` folder: + +- PingCastle Enterprise: `logs` in the installation directory +- CloudAPI: `CloudAPI\logs` in the installation directory +- PingCastleSchedulerService: `Scheduler\logs` in the installation directory + +Configure logging from the web portal at **Configuration** > **Settings** > **Logging**: + +- **Write log to file**: Enables or disables file logging +- **Logging levels**: Control how much detail PingCastle Enterprise captures +- This page includes additional logging settings + +To download PingCastle Enterprise and CloudAPI logs from the web portal, go to **Configuration** > **Settings** > **Logging** and click **Download Today's Logs** or **Download All Logs**. + +PingCastleSchedulerService has no web interface, so the portal download doesn't include its logs. Check `Scheduler\logs` directly, or the Windows Event Log on the server, to troubleshoot the scheduler. + +## Installer Logs + +`PingCastle-Enterprise-Installer-.exe` itself doesn't write a log file. All install-time detail comes from the MSI log, which you enable the same way you would with `msiexec` directly: + +``` +PingCastle-Enterprise-Installer-.exe /l*v "C:\Temp\PingCastleEnterprise_install.log" +``` + +- `/l*v` enables verbose logging for all message types. +- msiexec forwards the log path unchanged from the wrapper, so the path must be writable by the elevated process running the install, not just by the account that launched `PingCastle-Enterprise-Installer-.exe`. Avoid a path under a non-administrator user's profile unless that location also grants write access to `SYSTEM` or the administrator account. + +If the installer never reaches `msiexec` — for example, you decline the UAC prompt, or the embedded MSI fails to extract — no log file appears at all. See [Common Errors and Solutions](enterprisetroubleshooting.md#common-errors-and-solutions) for those symptoms. + +:::note +PingCastle Enterprise scrubs sensitive values, such as connection strings and keys, before writing them to the log. Even so, review the log for other configuration details before sharing it outside your organization. +::: diff --git a/docs/pingcastle/4.0/enterprisetroubleshooting.md b/docs/pingcastle/4.0/enterprisetroubleshooting.md index 8806e5ff71..b9b507083e 100644 --- a/docs/pingcastle/4.0/enterprisetroubleshooting.md +++ b/docs/pingcastle/4.0/enterprisetroubleshooting.md @@ -9,25 +9,9 @@ sidebar_label: Troubleshooting To diagnose problems with PingCastle Enterprise, view its error messages and logs. -Configure logging from the web portal at **Configuration** > **Settings** > **Logging**: - -- **Write log to file**: Enables or disables file logging -- **Logging levels**: Control how much detail PingCastle Enterprise captures -- This page includes additional logging settings - -See [Log Files](#log-files) for how to download the generated logs. - -#### Log Files - -PingCastle Enterprise, CloudAPI (which handles Entra ID scanning), and PingCastleSchedulerService all use Serilog for logging, each writing to its own `logs` folder: - -- PingCastle Enterprise: `logs` in the installation directory -- CloudAPI: `CloudAPI\logs` in the installation directory -- PingCastleSchedulerService: `Scheduler\logs` in the installation directory - -To download PingCastle Enterprise and CloudAPI logs from the web portal, go to **Configuration** > **Settings** > **Logging** and click **Download Today's Logs** or **Download All Logs**. - -PingCastleSchedulerService has no web interface, so the portal download doesn't include its logs. Check `Scheduler\logs` directly, or the Windows Event Log on the server, to troubleshoot the scheduler. +:::tip +See [Collecting Support Logs](enterprisesupportlogs.md) for where to find and how to download application, CloudAPI, and scheduler logs, and how to capture installer logs. +::: ### Editing the appsettings.Production.json File @@ -209,6 +193,52 @@ If the Entra Scan Config or settings are still missing after the restart, collec +
+Installer Fails Before Setup Runs + +`PingCastle-Enterprise-Installer-.exe` is a wrapper that extracts an embedded MSI and hands it to `msiexec`. If it fails before `msiexec` starts, no MSI log exists yet, because only `msiexec` writes install logs. Check for these symptoms: + +- **"Another installation is already running" dialog** — a prior `msiexec` process is still running, or a stale mutex or lock remains. Check Task Manager for a lingering `msiexec.exe` process. +- **UAC prompt declined or dismissed** — `PingCastle-Enterprise-Installer-.exe` requires elevation. Nothing runs until you accept the prompt. +- **Embedded MSI missing or extraction failure** — verify `%ProgramData%\PingCastle\Installer\\` exists and is writable. If it's a reparse point or symlink, the wrapper refuses to use it. +- **msiexec failed to start** — verify `msiexec.exe` is present and confirm Group Policy or antivirus software doesn't block it. + +**Solution:** + +None of these failures produce a log file. They only appear as a message box at the time of the failure. If you run the installer with `/l*v` and no log file appears at all, the failure happened before `msiexec` launched. Capture a screenshot of the message box instead of a log, and use it to identify which of these causes applies. + +
+ +
+Diagnosing a Failed Installation with Verbose Logging + +If the installer reaches `msiexec` but the install still fails, a verbose log gives you the detail you need to diagnose it. See [Installer Logs](enterprisesupportlogs.md#installer-logs) for the exact syntax. + +**Custom actions to check:** + +Every custom action writes to the MSI session log, so search the log for these action names to find where the install failed: + +- `DetectServerOS` +- `TestDbConnection` +- `ValidateManualConnectionString` +- `BuildAutoConnectionString` +- `InstallIIS` +- `InstallHostingBundleUI` +- `ExtractHostingBundle` + +:::note +PingCastle Enterprise scrubs sensitive values, such as connection strings and keys, before writing them to the log. Even so, review the log for other configuration details before sharing it outside your organization. +::: + +**General troubleshooting checklist:** + +1. Re-run the install with `/quiet /l*v ""` (or `/passive /l*v ""` if you want to see progress) to capture full detail. +2. If no log file appears at all, the failure occurred in the installer wrapper before `msiexec` started. See **Installer Fails Before Setup Runs**. +3. If the log shows a custom action failure, check that action's logged exit code and output instead of treating the failure as a generic MSI error. +4. Confirm the properties you passed, such as install path, connection string mode, and authentication providers, match what you expected. The installer wrapper doesn't validate these values itself, so a malformed property only surfaces when the corresponding custom action runs. + +
+ ## Emergency Procedures ### Reset Administrator Password diff --git a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md new file mode 100644 index 0000000000..e911c24013 --- /dev/null +++ b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md @@ -0,0 +1,81 @@ +--- +sidebar_label: Action plans and exceptions +--- +# PingCastle Enterprise Action Plans and Exceptions + +## Action plans management + +This part lets an administrator configure a remediation schedule so reports can display it. + +:::note +This page covers how to manage action plans for a specific domain or entity in the UI. To configure the default due-date and comment-template settings that action plans use, see [Action Plans settings](enterprisesettings-actionplans.md). +::: + +![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image51.webp) + +You can act on it directly in the domain details where the rules appear: + +![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image52.webp) + +Pay attention to the following chart. It represents the evolution of the number of rules per maturity level. Because you defined an action plan, a vertical line represents today. Everything to the right is the projected evolution of the maturity level based on the action items. + +![](/images/pingcastle/enterpriseuser/image53.webp) + +## Exceptions management + +This part lets an administrator configure PingCastle Enterprise so that it adapts to the company's specific context. You can configure how PingCastle Enterprise handles exceptions specific to your perimeter. + +![](/images/pingcastle/enterpriseuser/image54.webp) + +**Rule exceptions** + +You can set "Rule exceptions" to completely disable a rule within a specific domain. It means the application doesn't apply this rule for a period that you specify. + +Use this only for very specific reasons, such as when a rule doesn't apply in your organization. + +Contact Netwrix support if you have doubts or need extra assistance about exception management. + +For clarity: if you define no start date and no end date, the exception applies to all reports. If you define a start date but no end date, the exception applies starting from the start date. The same holds for the opposite case. When you define both start and end dates, the exception applies only during a limited period. + +**Excluding specific findings with wildcards** + +Instead of disabling a rule entirely, you can exclude specific findings from it by editing the **Rule Item to Handle** field on the exception. + +From the report, click **No Action Plan** next to the specific finding you want to exclude. This pre-fills the **Rule Item to Handle** field with the data from that finding. Edit this pre-filled value to add wildcards. + +:::note +Don't fill in the **Rule Item to Handle** field yourself, starting from nothing. This field is complex and easy to get wrong when written manually. Always start from the value PingCastle pre-fills after you click **No Action Plan** on a finding, then add wildcards to it. +::: + +Two wildcard characters are available: + +- `*` matches any sequence of characters. +- `?` matches a single character. + +For example, `svc-*` matches every account name that starts with `svc-`. + +Wildcards can only match data that appears in the finding's own output. PingCastle formats this output as `Column: Data` pairs — a single-word column label followed by its value, which runs up to the next column label. For example, an output of `Account: jdoe SID: S-1-5-...` only gives you an account name and a SID to build a wildcard from. If the output only shows an `Account:` value, you can wildcard the account name, but you can't substitute a distinguished name pattern, since that data was never part of the output for that finding. + +:::note +Some output values change from scan to scan even though the underlying risk stays the same — for example, `LastLogonDate` or a service principal name (SPN). These are good candidates for a wildcard exception. Contact Netwrix support to log a ticket for these cases, so the team can evaluate updating the rule to generate wildcards for this data automatically in the future. +::: + +**Migration** + +In the same way you can set exceptions for a specific domain, you can inform the application when one of your domains is migrating. It automatically applies a set of exceptions during the timetable of the migration. + +**Bulk actions** + +If you need to create or remove many exceptions, you can do so in bulk. + +:::note +If an exception already exists, the application doesn't create it again. +::: + +![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image55.webp) + +:::note +Since PingCastle 2.11, the application tracks all exceptions, migrations, or action plans with their creation or last modification date and the user who performed the change. +::: + +![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image56.webp) diff --git a/docs/pingcastle/4.0/enterpriseuser-entities.md b/docs/pingcastle/4.0/enterpriseuser-entities.md index 688c03e3e5..5b42c8f9fa 100644 --- a/docs/pingcastle/4.0/enterpriseuser-entities.md +++ b/docs/pingcastle/4.0/enterpriseuser-entities.md @@ -1,7 +1,7 @@ --- -sidebar_label: Entities and action plans +sidebar_label: Entities --- -# PingCastle Enterprise Entities and Action Plans +# PingCastle Enterprise Entities The "Configuration" view of the PingCastle Enterprise application lets you set up the tool completely. In this view, you can also personalize settings so the tool better fits your company's needs. @@ -38,57 +38,3 @@ Each entity has a dedicated "Details" page that contains information. On this pa For instance, the page for the PingCastle Enterprise entity: ![](/images/pingcastle/enterpriseuser/image50.webp) - -## Action plans management - -This part lets an administrator configure a remediation schedule so reports can display it. - -:::note -This page covers how to manage action plans for a specific domain or entity in the UI. To configure the default due-date and comment-template settings that action plans use, see [Action Plans settings](enterprisesettings-actionplans.md). -::: - -![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image51.webp) - -You can act on it directly in the domain details where the rules appear: - -![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image52.webp) - -Pay attention to the following chart. It represents the evolution of the number of rules per maturity level. Because you defined an action plan, a vertical line represents today. Everything to the right is the projected evolution of the maturity level based on the action items. - -![](/images/pingcastle/enterpriseuser/image53.webp) - -**Exceptions management** - -This part lets an administrator configure PingCastle Enterprise so that it adapts to the company's specific context. You can configure how PingCastle Enterprise handles exceptions specific to your perimeter. - -![](/images/pingcastle/enterpriseuser/image54.webp) - -**Rule exceptions** - -You can set "Rule exceptions" to completely disable a rule within a specific domain. It means the application doesn't apply this rule for a period that you specify. - -Use this only for very specific reasons, such as when a rule doesn't apply in your organization. - -Contact Netwrix support if you have doubts or need extra assistance about exception management. - -For clarity: if you define no start date and no end date, the exception applies to all reports. If you define a start date but no end date, the exception applies starting from the start date. The same holds for the opposite case. When you define both start and end dates, the exception applies only during a limited period. - -**Migration** - -In the same way you can set exceptions for a specific domain, you can inform the application when one of your domains is migrating. It automatically applies a set of exceptions during the timetable of the migration. - -**Bulk actions** - -If you need to create or remove many exceptions, you can do so in bulk. - -:::note -If an exception already exists, the application doesn't create it again. -::: - -![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image55.webp) - -:::note -Since PingCastle 2.11, the application tracks all exceptions, migrations, or action plans with their creation or last modification date and the user who performed the change. -::: - -![Une image contenant texte Description générée automatiquement](/images/pingcastle/enterpriseuser/image56.webp) diff --git a/sidebars/pingcastle/4.0.js b/sidebars/pingcastle/4.0.js index 22f2acf7d1..85a385ed41 100644 --- a/sidebars/pingcastle/4.0.js +++ b/sidebars/pingcastle/4.0.js @@ -17,7 +17,7 @@ module.exports = { { type: 'category', label: 'Installation', - items: ['enterpriseinstall', 'enterprisehttpssetup'], + items: ['enterpriseinstall', 'enterprisesilentinstall', 'enterprisehttpssetup'], }, { type: 'category', @@ -74,13 +74,22 @@ module.exports = { 'enterpriseuser-dashboard', 'enterpriseuser-infrastructure', 'enterpriseuser-entities', + 'enterpriseuser-actionplans-exceptions', 'enterpriseuser-import', 'enterpriseuser-account', 'enterpriseauditlog', ], }, 'enterpriseupgrade', - 'enterprisetroubleshooting', + { + type: 'category', + label: 'Troubleshooting', + link: { + type: 'doc', + id: 'enterprisetroubleshooting', + }, + items: ['enterprisesupportlogs'], + }, ], }, { From ab778eae7147d06d86236b724a2dac4916ef0a25 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 11:25:32 +0000 Subject: [PATCH 06/12] fix(vale): auto-fix style issues (Vale + Dale) --- docs/pingcastle/4.0/enterpriseinstall.md | 2 +- docs/pingcastle/4.0/enterprisesilentinstall.md | 14 +++++++------- docs/pingcastle/4.0/enterprisesupportlogs.md | 2 +- .../4.0/enterpriseuser-actionplans-exceptions.md | 10 +++++----- docs/pingcastle/4.0/enterpriseuser-entities.md | 2 +- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseinstall.md b/docs/pingcastle/4.0/enterpriseinstall.md index c549601cf4..577f250bd4 100644 --- a/docs/pingcastle/4.0/enterpriseinstall.md +++ b/docs/pingcastle/4.0/enterpriseinstall.md @@ -99,7 +99,7 @@ The installer wizard walks you through prerequisite checks, licensing, and confi -For testing and proof-of-concept environments, you can streamline the installation process using automation tools such as Chocolatey. +For testing and proof-of-concept environments, you can streamline installation with automation tools such as Chocolatey. :::warning Use this simplified setup for **testing only**. For production environments, use the Production Installation tab for proper configuration and upgrade support. diff --git a/docs/pingcastle/4.0/enterprisesilentinstall.md b/docs/pingcastle/4.0/enterprisesilentinstall.md index c1e12938f5..d30d5a93a5 100644 --- a/docs/pingcastle/4.0/enterprisesilentinstall.md +++ b/docs/pingcastle/4.0/enterprisesilentinstall.md @@ -7,7 +7,7 @@ sidebar_label: Silent installation ## How It Works -`PingCastle-Enterprise-Installer-.exe` is a thin wrapper around an embedded Windows Installer (MSI) package, not an interactive-only installer. When you run it, the wrapper: +`PingCastle-Enterprise-Installer-.exe` is a thin wrapper around an embedded Windows Installer (MSI) package. When you run it, the wrapper: 1. Extracts the embedded MSI to `%ProgramData%\PingCastle\Installer\\`. 2. Runs `msiexec.exe /i` against the extracted MSI, forwarding every command-line argument you passed to the wrapper unchanged. @@ -46,7 +46,7 @@ See [Remote Database Configuration](enterpriseinstall.md#remote-database-configu | Property | Purpose | Notes | |---|---|---| -| `CONNECTIONSTRINGWAY` | `AUTO` \| `MANUAL` | Default `AUTO`. `AUTO` builds a connection string from the properties below; `MANUAL` uses `CONNECTIONSTRINGPROPERTY` as-is. | +| `CONNECTIONSTRINGWAY` | `AUTO` \| `MANUAL` | Default `AUTO`. `AUTO` builds a connection string from the other properties in this table; `MANUAL` uses `CONNECTIONSTRINGPROPERTY` as-is. | | `DB_SERVER_TYPE` | `LOCAL` \| `REMOTE` | Default `LOCAL`. `LOCAL` uses SQL Express on the local server (`.\SQLExpress`). `REMOTE` uses `DATABASE_SERVER` as the SQL host, along with `SQL_AUTH_TYPE` and any SQL authentication credentials it requires. | | `DATABASE_SERVER` | SQL Server instance (`AUTO` mode) | Used to build the connection string. | | `SQL_AUTH_TYPE` | `WINDOWS` \| `SQL` | Default `WINDOWS`. `SQL` requires `SQL_USERNAME`/`SQL_PASSWORD`. | @@ -57,7 +57,7 @@ See [Remote Database Configuration](enterpriseinstall.md#remote-database-configu ### Windows Authentication Properties -Used when `AUTH_WINDOWS=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. +These properties apply when `AUTH_WINDOWS=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. | Property | Purpose | Notes | |---|---|---| @@ -84,7 +84,7 @@ Used when `AUTH_WINDOWS=1`. See [Authentication](enterpriseauthsetup.md#authenti ### SAML Properties -Used when `AUTH_SAML=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. +These properties apply when `AUTH_SAML=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. | Property | Purpose | Notes | |---|---|---| @@ -97,7 +97,7 @@ Used when `AUTH_SAML=1`. See [Authentication](enterpriseauthsetup.md#authenticat ### OpenID Connect Properties -Set `AUTH_OIDC=1` (alongside any other `AUTH_*` providers you want enabled) plus the properties below. See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. +Set `AUTH_OIDC=1` (alongside any other `AUTH_*` providers you want enabled) plus the following properties. See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. | Property | Purpose | Notes | |---|---|---| @@ -109,7 +109,7 @@ Set `AUTH_OIDC=1` (alongside any other `AUTH_*` providers you want enabled) plus ### CloudAPI Properties -The CloudAPI component has its own database and secrets, separate from the main Enterprise application. These aren't typically set on a fresh install. +The CloudAPI component has its own database and secrets, separate from the main Enterprise application. You don't typically set these on a fresh install. | Property | Purpose | Notes | |---|---|---| @@ -186,7 +186,7 @@ $licenseKey = "" ### Secure Installation -Adds HTTPS using a certificate that's already in the Windows certificate store, specified by its thumbprint. +Adds HTTPS using a certificate that's already in the Windows certificate store, which you identify by its thumbprint. ```powershell $installer = "C:\Temp\PingCastle-Enterprise-Installer-4.0.exe" diff --git a/docs/pingcastle/4.0/enterprisesupportlogs.md b/docs/pingcastle/4.0/enterprisesupportlogs.md index 24844e7f83..6595a05076 100644 --- a/docs/pingcastle/4.0/enterprisesupportlogs.md +++ b/docs/pingcastle/4.0/enterprisesupportlogs.md @@ -35,7 +35,7 @@ PingCastle-Enterprise-Installer-.exe /l*v "C:\Temp\PingCastleEnterprise ``` - `/l*v` enables verbose logging for all message types. -- msiexec forwards the log path unchanged from the wrapper, so the path must be writable by the elevated process running the install, not just by the account that launched `PingCastle-Enterprise-Installer-.exe`. Avoid a path under a non-administrator user's profile unless that location also grants write access to `SYSTEM` or the administrator account. +- msiexec forwards the log path unchanged from the wrapper, so the elevated process running the install needs write access to the path, not just the account that launched `PingCastle-Enterprise-Installer-.exe`. Avoid a path under a non-administrator user's profile unless that location also grants write access to `SYSTEM` or the administrator account. If the installer never reaches `msiexec` — for example, you decline the UAC prompt, or the embedded MSI fails to extract — no log file appears at all. See [Common Errors and Solutions](enterprisetroubleshooting.md#common-errors-and-solutions) for those symptoms. diff --git a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md index e911c24013..1f71603879 100644 --- a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md +++ b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md @@ -29,13 +29,13 @@ This part lets an administrator configure PingCastle Enterprise so that it adapt **Rule exceptions** -You can set "Rule exceptions" to completely disable a rule within a specific domain. It means the application doesn't apply this rule for a period that you specify. +You can set "Rule exceptions" to completely disable a rule within a specific domain. The application then doesn't apply this rule for a period that you specify. Use this only for very specific reasons, such as when a rule doesn't apply in your organization. -Contact Netwrix support if you have doubts or need extra assistance about exception management. +Contact Netwrix support if you have questions or need help with exception management. -For clarity: if you define no start date and no end date, the exception applies to all reports. If you define a start date but no end date, the exception applies starting from the start date. The same holds for the opposite case. When you define both start and end dates, the exception applies only during a limited period. +If you define no start date and no end date, the exception applies to all reports. If you define a start date but no end date, the exception applies starting from the start date. The same holds for the opposite case. When you define both start and end dates, the exception applies only during a limited period. **Excluding specific findings with wildcards** @@ -44,7 +44,7 @@ Instead of disabling a rule entirely, you can exclude specific findings from it From the report, click **No Action Plan** next to the specific finding you want to exclude. This pre-fills the **Rule Item to Handle** field with the data from that finding. Edit this pre-filled value to add wildcards. :::note -Don't fill in the **Rule Item to Handle** field yourself, starting from nothing. This field is complex and easy to get wrong when written manually. Always start from the value PingCastle pre-fills after you click **No Action Plan** on a finding, then add wildcards to it. +Don't fill in the **Rule Item to Handle** field yourself, starting from nothing. This field is complex and easy to get wrong if you write it manually. Always start from the value PingCastle pre-fills after you click **No Action Plan** on a finding, then add wildcards to it. ::: Two wildcard characters are available: @@ -62,7 +62,7 @@ Some output values change from scan to scan even though the underlying risk stay **Migration** -In the same way you can set exceptions for a specific domain, you can inform the application when one of your domains is migrating. It automatically applies a set of exceptions during the timetable of the migration. +In the same way you can set exceptions for a specific domain, you can inform the application when one of your domains is migrating. It automatically applies a set of exceptions during the migration timetable. **Bulk actions** diff --git a/docs/pingcastle/4.0/enterpriseuser-entities.md b/docs/pingcastle/4.0/enterpriseuser-entities.md index 5b42c8f9fa..24a36a7b30 100644 --- a/docs/pingcastle/4.0/enterpriseuser-entities.md +++ b/docs/pingcastle/4.0/enterpriseuser-entities.md @@ -33,7 +33,7 @@ Example to show how to reorganize entities: **Details of an Entity** -Each entity has a dedicated "Details" page that contains information. On this page, you can access all the information of the entity, including the Owner permissions. Here you can also edit these rights to establish which key people are accountable for a specified entity. +Each entity has a dedicated "Details" page. On this page, you can access all the entity's information, including the Owner permissions. Here you can also edit these rights to establish which key people are accountable for a specified entity. For instance, the page for the PingCastle Enterprise entity: From f2668f915b16da45800e059ee173e7462a9f69de Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Fri, 11 Sep 2026 12:56:48 +0100 Subject: [PATCH 07/12] Clarify CloudAPI connection string requirements and auth setup restart notes Remove the unverified claim about verbose install logs scrubbing secrets, clarify when CLOUDAPI_CONNECTIONSTRINGPROPERTY must be set explicitly for MANUAL connection strings, and reorganize authentication property sections. --- docs/pingcastle/4.0/enterpriseauthsetup.md | 2 +- .../pingcastle/4.0/enterprisesilentinstall.md | 65 +++++++++++-------- 2 files changed, 39 insertions(+), 28 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseauthsetup.md b/docs/pingcastle/4.0/enterpriseauthsetup.md index 8344cc7ae1..9adf7b44c0 100644 --- a/docs/pingcastle/4.0/enterpriseauthsetup.md +++ b/docs/pingcastle/4.0/enterpriseauthsetup.md @@ -13,7 +13,7 @@ PingCastle Enterprise supports multiple authentication methods that can work sim Set up each method's identity provider using the instructions on this page, then enter the resulting values on the **Login options**, **Windows authentication**, **Certificate authentication**, **Header authentication**, **OIDC Connect**, and **SAML** screens under **Configuration** > **Settings** in the PingCastle Enterprise web interface. :::note -Most changes on these screens take effect within about 30 seconds, without a restart. Two setting groups — HTTPS redirection and allowed hosts settings, and database schema changes — restart PingCastle Enterprise automatically: it stops itself about 1 second after you save, then IIS restarts it. Six other restart-flagged settings — the three file logging settings, maximum concurrent scans, and both SCIM rate limit settings — require you to restart PingCastle Enterprise manually after saving. +Most changes on these screens take effect within about 30 seconds, without a restart. ::: :::tip diff --git a/docs/pingcastle/4.0/enterprisesilentinstall.md b/docs/pingcastle/4.0/enterprisesilentinstall.md index d30d5a93a5..3ff23b2b12 100644 --- a/docs/pingcastle/4.0/enterprisesilentinstall.md +++ b/docs/pingcastle/4.0/enterprisesilentinstall.md @@ -16,7 +16,7 @@ sidebar_label: Silent installation Because the wrapper forwards its arguments verbatim, `PingCastle-Enterprise-Installer-.exe` passes every install option and every logging switch through to `msiexec` as an MSI switch or property. The wrapper also preserves quoting verbatim, so quote any property value that contains spaces exactly as you would for `msiexec` directly. :::warning -The license key and any other secrets you pass as MSI properties appear in plain text in Task Manager and other process command-line auditing tools while the install runs. They also appear in a verbose install log unless PingCastle Enterprise scrubs them. See [Collecting Support Logs](enterprisesupportlogs.md#installer-logs) for how installer logging works. +The license key and any other secrets you pass as MSI properties appear in plain text in Task Manager and other process command-line auditing tools while the install runs. See [Collecting Support Logs](enterprisesupportlogs.md#installer-logs) for how installer logging works. ::: ## Installation Options @@ -55,36 +55,28 @@ See [Remote Database Configuration](enterpriseinstall.md#remote-database-configu | `TRUST_SERVER_CERTIFICATE` | Appended to the built connection string | Default `TrustServerCertificate=True;`. Omit this property to set it to `False`. | | `CONNECTIONSTRINGPROPERTY` | Full manual connection string | Required when `CONNECTIONSTRINGWAY=MANUAL`. | -### Windows Authentication Properties +### Authentication -These properties apply when `AUTH_WINDOWS=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. +Enable one or more authentication providers by setting the corresponding `AUTH_*` property to `1`. See [Authentication](enterpriseauthsetup.md#authentication) for background on each method. -| Property | Purpose | Notes | +| Authentication method | Enable with | Property details | |---|---|---| -| `WINDOWSGROUP` | SID of the Windows group granted general access | Default `S-1-1-0` (`Everyone`). | -| `WINDOWSGROUPADMIN` | SID of the Windows group granted admin access | No default. Must be set explicitly to grant admin rights to a specific group. | - -### IIS Application Pool Identity Properties +| Windows Authentication | `AUTH_WINDOWS=1` | [Windows Authentication Properties](#windows-authentication-properties) | +| SAML | `AUTH_SAML=1` | [SAML Properties](#saml-properties) | +| OpenID Connect | `AUTH_OIDC=1` | [OpenID Connect Properties](#openid-connect-properties) | -| Property | Purpose | Notes | -|---|---|---| -| `APPPOOL_IDENTITY_TYPE` | `APPPOOL_IDENTITY` \| `LOCAL_SYSTEM` \| `CUSTOM` | Default `APPPOOL_IDENTITY` (recommended). `APPPOOL_IDENTITY` runs the IIS application pool under the built-in virtual app pool identity (`IIS AppPool\`); no credentials needed. `LOCAL_SYSTEM` runs it under the Local System account. `CUSTOM` runs it under an explicit domain or service account and requires `APPPOOL_USERNAME`/`APPPOOL_PASSWORD`. | -| `APPPOOL_USERNAME` | Custom account to run the app pool as | Required when `APPPOOL_IDENTITY_TYPE=CUSTOM`. | -| `APPPOOL_PASSWORD` | Password for `APPPOOL_USERNAME` | Required when `APPPOOL_IDENTITY_TYPE=CUSTOM`, unless `APPPOOL_USERNAME` ends in `$` (a group Managed Service Account (gMSA)), which doesn't need a password. | +:::note +You can enable multiple authentication methods at the same time by setting more than one `AUTH_*` property. +::: -### Scheduler Service Account Properties +#### Windows Authentication Properties | Property | Purpose | Notes | |---|---|---| -| `SCHEDULER_ACCOUNT_CHOICE` | `SAME_AS_APPPOOL` \| `CUSTOM` \| ... | Selects which account the Scheduler Windows service logs on as. | -| `SCHEDULER_SERVICE_ACCOUNT` | Resolved service account | Default `LocalSystem`. Set to the app pool's account automatically when `SCHEDULER_ACCOUNT_CHOICE=SAME_AS_APPPOOL`. | -| `SCHEDULER_USERNAME` / `SCHEDULER_PASSWORD` | Custom account credentials | Used when `SCHEDULER_ACCOUNT_CHOICE=CUSTOM`. | -| `SCHEDULER_ADD_TO_LOCAL_ADMINS` | Adds the scheduler account to local Administrators | Optional. | -| `SCHEDULER_API_KEY` | API key the Scheduler service uses to call the Enterprise API | Auto-generated if not supplied. | - -### SAML Properties +| `WINDOWSGROUP` | SID of the Windows group granted general access | Default `S-1-1-0` (`Everyone`). | +| `WINDOWSGROUPADMIN` | SID of the Windows group granted admin access | No default. Must be set explicitly to grant admin rights to a specific group. | -These properties apply when `AUTH_SAML=1`. See [Authentication](enterpriseauthsetup.md#authentication) for background. +#### SAML Properties | Property | Purpose | Notes | |---|---|---| @@ -95,9 +87,9 @@ These properties apply when `AUTH_SAML=1`. See [Authentication](enterpriseauthse | `SAML_METADATA_URL` | Identity provider metadata URL | Alternative to manual issuer/single sign-on URL entry. | | `SAML_CERTIFICATE_PATH` | Path to the identity provider's signing certificate | Optional. If supplied, the installer verifies the file exists. | -### OpenID Connect Properties +#### OpenID Connect Properties -Set `AUTH_OIDC=1` (alongside any other `AUTH_*` providers you want enabled) plus the following properties. See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. +See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. | Property | Purpose | Notes | |---|---|---| @@ -107,14 +99,31 @@ Set `AUTH_OIDC=1` (alongside any other `AUTH_*` providers you want enabled) plus | `OIDC_DISPLAY_NAME` | Label shown for this provider on the sign-in page | Optional. Defaults to `Entra ID` if omitted. | | `OIDC_GROUP_ID` | Group claim/ID used for role mapping | Optional. | +### IIS Application Pool Identity Properties + +| Property | Purpose | Notes | +|---|---|---| +| `APPPOOL_IDENTITY_TYPE` | `APPPOOL_IDENTITY` \| `LOCAL_SYSTEM` \| `CUSTOM` | Default `APPPOOL_IDENTITY` (recommended). `APPPOOL_IDENTITY` runs the IIS application pool under the built-in virtual app pool identity (`IIS AppPool\`); no credentials needed. `LOCAL_SYSTEM` runs it under the Local System account. `CUSTOM` runs it under an explicit domain or service account and requires `APPPOOL_USERNAME`/`APPPOOL_PASSWORD`. | +| `APPPOOL_USERNAME` | Custom account to run the app pool as | Required when `APPPOOL_IDENTITY_TYPE=CUSTOM`. | +| `APPPOOL_PASSWORD` | Password for `APPPOOL_USERNAME` | Required when `APPPOOL_IDENTITY_TYPE=CUSTOM`, unless `APPPOOL_USERNAME` ends in `$` (a group Managed Service Account (gMSA)), which doesn't need a password. | + +### Scheduler Service Account Properties + +| Property | Purpose | Notes | +|---|---|---| +| `SCHEDULER_ACCOUNT_CHOICE` | `SAME_AS_APPPOOL` \| `CUSTOM` \| ... | Selects which account the Scheduler Windows service logs on as. | +| `SCHEDULER_SERVICE_ACCOUNT` | Resolved service account | Default `LocalSystem`. Set to the app pool's account automatically when `SCHEDULER_ACCOUNT_CHOICE=SAME_AS_APPPOOL`. | +| `SCHEDULER_USERNAME` / `SCHEDULER_PASSWORD` | Custom account credentials | Used when `SCHEDULER_ACCOUNT_CHOICE=CUSTOM`. | +| `SCHEDULER_ADD_TO_LOCAL_ADMINS` | Adds the scheduler account to local Administrators | Optional. | +| `SCHEDULER_API_KEY` | API key the Scheduler service uses to call the Enterprise API | Auto-generated if not supplied. | + ### CloudAPI Properties The CloudAPI component has its own database and secrets, separate from the main Enterprise application. You don't typically set these on a fresh install. | Property | Purpose | Notes | |---|---|---| -| `CLOUDAPI_CONFIGURED` | Marks whether CloudAPI was previously configured | Used on upgrade to decide whether to reconfigure secrets or preserve them. | -| `CLOUDAPI_CONNECTIONSTRINGPROPERTY` | CloudAPI's own database connection string | Built the same way as the main `CONNECTIONSTRINGPROPERTY` if not supplied directly. | +| `CLOUDAPI_CONNECTIONSTRINGPROPERTY` | CloudAPI's own database connection string | If `CONNECTIONSTRINGWAY` is `AUTO`, the installer derives this from `DATABASE_SERVER`, `SQL_AUTH_TYPE`, and the other database properties when left empty. If `CONNECTIONSTRINGWAY` is `MANUAL`, you must pass this property explicitly. | | `CLOUDAPI_MICROSERVICE_API_KEY` | API key used to call the CloudAPI microservice | Auto-generated if empty. | | `CLOUDAPI_HMAC_KEY` | HMAC signing key for CloudAPI requests | Auto-generated if empty. | | `CLOUDAPI_ENCRYPTION_KEY` | Encryption key for CloudAPI stored data | Auto-generated if empty. | @@ -210,11 +219,13 @@ Uses a manual connection string to connect to a database you've already provisio $installer = "C:\Temp\PingCastle-Enterprise-Installer-4.0.exe" $licenseKey = "" $connectionString = "Server=sql01;Database=PingCastleEnterprise;User Id=svc_pc;Password=;MultipleActiveResultSets=True;Encrypt=True;TrustServerCertificate=True;" +$cloudApiConnectionString = "Server=sql01;Database=PingCastleCloudAPI;User Id=svc_pc;Password=;MultipleActiveResultSets=True;Encrypt=True;TrustServerCertificate=True;" & $installer /quiet /norestart ` SERIALNUMBERPROPERTY="$licenseKey" ` CONNECTIONSTRINGWAY=MANUAL ` - CONNECTIONSTRINGPROPERTY="$connectionString" + CONNECTIONSTRINGPROPERTY="$connectionString" ` + CLOUDAPI_CONNECTIONSTRINGPROPERTY="$cloudApiConnectionString" ``` ### Full Configuration From fc7dab8fec53bbf06676d7b634a99646395381e8 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 12:04:51 +0000 Subject: [PATCH 08/12] fix(vale): auto-fix style issues (Vale + Dale) --- docs/pingcastle/4.0/enterpriseauthsetup.md | 8 +++--- .../pingcastle/4.0/enterprisesilentinstall.md | 28 +++++++++---------- .../enterpriseuser-actionplans-exceptions.md | 2 +- .../pingcastle/4.0/enterpriseuser-entities.md | 6 ++-- 4 files changed, 22 insertions(+), 22 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseauthsetup.md b/docs/pingcastle/4.0/enterpriseauthsetup.md index 9adf7b44c0..d09980e7ba 100644 --- a/docs/pingcastle/4.0/enterpriseauthsetup.md +++ b/docs/pingcastle/4.0/enterpriseauthsetup.md @@ -70,7 +70,7 @@ Windows Authentication uses Active Directory groups to provision access to PingC Add users to the appropriate groups based on the level of access they require. -**Getting AD Group SIDs** +**Getting Active Directory Group SIDs** PingCastle Enterprise needs the Security Identifiers (SIDs) of the groups for setup. Use the tabs to choose a method for retrieving them. @@ -141,7 +141,7 @@ To hide the internal username/password login option, enable **Disable Password L :::warning API Access This setup affects all pages for authentication. When you enable **Disable Password Login** with Windows Authentication, API calls require both an API key and a calling account that belongs to the group you set in **Windows Group**. -To restrict NTLM authentication to specific pages, edit the `web.config` file using the `` directive to restrict authentication to the WindowsAuth page. See [IIS URL Authorization documentation](https://docs.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization). +To restrict NTLM authentication to specific pages, edit the `web.config` file and use the `` directive to scope authentication to the WindowsAuth page. See [IIS URL Authorization documentation](https://docs.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization). ::: @@ -151,7 +151,7 @@ To restrict NTLM authentication to specific pages, edit the `web.config` file us ### OpenID Connect -PingCastle Enterprise supports OpenID Connect authentication using the ASP.NET Core API. Configuration options are [documented here](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectoptions?view=aspnetcore-10.0). +PingCastle Enterprise supports OpenID Connect authentication using the ASP.NET Core API. See [OpenIdConnectOptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectoptions?view=aspnetcore-10.0) for the available configuration options. Proxy settings rely on the current user proxy configuration, which you can define [using netsh for IIS running as SYSTEM](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-proxy-internet?view=o365-worldwide). @@ -239,7 +239,7 @@ To hide the internal username/password login option, enable **Disable Password L ### SAML2 authentication -PingCastle Enterprise supports SAML2 authentication using the [ITfoxtec Identity SAML 2.0](https://www.itfoxtec.com/IdentitySaml2) package. Advanced configuration settings are [documented here](https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/master/src/ITfoxtec.Identity.Saml2/Configuration/Saml2Configuration.cs). +PingCastle Enterprise supports SAML2 authentication using the [ITfoxtec Identity SAML 2.0](https://www.itfoxtec.com/IdentitySaml2) package. See [Saml2Configuration](https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/master/src/ITfoxtec.Identity.Saml2/Configuration/Saml2Configuration.cs) for the advanced configuration settings. Proxy settings rely on the current user proxy configuration, which you can define [using netsh for IIS running as SYSTEM](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-proxy-internet?view=o365-worldwide). diff --git a/docs/pingcastle/4.0/enterprisesilentinstall.md b/docs/pingcastle/4.0/enterprisesilentinstall.md index 3ff23b2b12..971f400626 100644 --- a/docs/pingcastle/4.0/enterprisesilentinstall.md +++ b/docs/pingcastle/4.0/enterprisesilentinstall.md @@ -50,7 +50,7 @@ See [Remote Database Configuration](enterpriseinstall.md#remote-database-configu | `DB_SERVER_TYPE` | `LOCAL` \| `REMOTE` | Default `LOCAL`. `LOCAL` uses SQL Express on the local server (`.\SQLExpress`). `REMOTE` uses `DATABASE_SERVER` as the SQL host, along with `SQL_AUTH_TYPE` and any SQL authentication credentials it requires. | | `DATABASE_SERVER` | SQL Server instance (`AUTO` mode) | Used to build the connection string. | | `SQL_AUTH_TYPE` | `WINDOWS` \| `SQL` | Default `WINDOWS`. `SQL` requires `SQL_USERNAME`/`SQL_PASSWORD`. | -| `SQL_USERNAME` / `SQL_PASSWORD` | SQL authentication credentials | Only used when `SQL_AUTH_TYPE=SQL`. | +| `SQL_USERNAME` / `SQL_PASSWORD` | SQL authentication credentials | The installer uses these only when `SQL_AUTH_TYPE=SQL`. | | `USE_ENCRYPTION` | Appended to the built connection string | Default `Encrypt=True;`. Omit this property to set it to `False`. | | `TRUST_SERVER_CERTIFICATE` | Appended to the built connection string | Default `TrustServerCertificate=True;`. Omit this property to set it to `False`. | | `CONNECTIONSTRINGPROPERTY` | Full manual connection string | Required when `CONNECTIONSTRINGWAY=MANUAL`. | @@ -74,7 +74,7 @@ You can enable multiple authentication methods at the same time by setting more | Property | Purpose | Notes | |---|---|---| | `WINDOWSGROUP` | SID of the Windows group granted general access | Default `S-1-1-0` (`Everyone`). | -| `WINDOWSGROUPADMIN` | SID of the Windows group granted admin access | No default. Must be set explicitly to grant admin rights to a specific group. | +| `WINDOWSGROUPADMIN` | SID of the Windows group granted admin access | No default. Set this explicitly to grant admin rights to a specific group. | #### SAML Properties @@ -85,7 +85,7 @@ You can enable multiple authentication methods at the same time by setting more | `SAML_ISSUER` | This service provider's issuer/entity ID | — | | `SAML_DISPLAY_NAME` | Label shown on the sign-in page | — | | `SAML_METADATA_URL` | Identity provider metadata URL | Alternative to manual issuer/single sign-on URL entry. | -| `SAML_CERTIFICATE_PATH` | Path to the identity provider's signing certificate | Optional. If supplied, the installer verifies the file exists. | +| `SAML_CERTIFICATE_PATH` | Path to the identity provider's signing certificate | Optional. If you supply one, the installer verifies the file exists. | #### OpenID Connect Properties @@ -95,7 +95,7 @@ See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. |---|---|---| | `OIDC_AUTHORITY` | OpenID Connect authority/issuer URL | Required. Must be a valid absolute `http`/`https` URL. | | `OIDC_CLIENT_ID` | Application (client) ID registered with the identity provider | Required. | -| `OIDC_CLIENT_SECRET` | Application client secret | Not echoed in the UI, and masked in the verbose log. | +| `OIDC_CLIENT_SECRET` | Application client secret | The installer doesn't echo this in the UI and masks it in the verbose log. | | `OIDC_DISPLAY_NAME` | Label shown for this provider on the sign-in page | Optional. Defaults to `Entra ID` if omitted. | | `OIDC_GROUP_ID` | Group claim/ID used for role mapping | Optional. | @@ -112,10 +112,10 @@ See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. | Property | Purpose | Notes | |---|---|---| | `SCHEDULER_ACCOUNT_CHOICE` | `SAME_AS_APPPOOL` \| `CUSTOM` \| ... | Selects which account the Scheduler Windows service logs on as. | -| `SCHEDULER_SERVICE_ACCOUNT` | Resolved service account | Default `LocalSystem`. Set to the app pool's account automatically when `SCHEDULER_ACCOUNT_CHOICE=SAME_AS_APPPOOL`. | +| `SCHEDULER_SERVICE_ACCOUNT` | Resolved service account | Default `LocalSystem`. The installer sets this to the app pool's account automatically when `SCHEDULER_ACCOUNT_CHOICE=SAME_AS_APPPOOL`. | | `SCHEDULER_USERNAME` / `SCHEDULER_PASSWORD` | Custom account credentials | Used when `SCHEDULER_ACCOUNT_CHOICE=CUSTOM`. | | `SCHEDULER_ADD_TO_LOCAL_ADMINS` | Adds the scheduler account to local Administrators | Optional. | -| `SCHEDULER_API_KEY` | API key the Scheduler service uses to call the Enterprise API | Auto-generated if not supplied. | +| `SCHEDULER_API_KEY` | API key the Scheduler service uses to call the Enterprise API | The installer generates one if you don't supply it. | ### CloudAPI Properties @@ -123,10 +123,10 @@ The CloudAPI component has its own database and secrets, separate from the main | Property | Purpose | Notes | |---|---|---| -| `CLOUDAPI_CONNECTIONSTRINGPROPERTY` | CloudAPI's own database connection string | If `CONNECTIONSTRINGWAY` is `AUTO`, the installer derives this from `DATABASE_SERVER`, `SQL_AUTH_TYPE`, and the other database properties when left empty. If `CONNECTIONSTRINGWAY` is `MANUAL`, you must pass this property explicitly. | -| `CLOUDAPI_MICROSERVICE_API_KEY` | API key used to call the CloudAPI microservice | Auto-generated if empty. | -| `CLOUDAPI_HMAC_KEY` | HMAC signing key for CloudAPI requests | Auto-generated if empty. | -| `CLOUDAPI_ENCRYPTION_KEY` | Encryption key for CloudAPI stored data | Auto-generated if empty. | +| `CLOUDAPI_CONNECTIONSTRINGPROPERTY` | CloudAPI's own database connection string | If `CONNECTIONSTRINGWAY` is `AUTO`, the installer derives this from `DATABASE_SERVER`, `SQL_AUTH_TYPE`, and the other database properties when you leave it empty. If `CONNECTIONSTRINGWAY` is `MANUAL`, you must pass this property explicitly. | +| `CLOUDAPI_MICROSERVICE_API_KEY` | API key for calls to the CloudAPI microservice | The installer generates one if you leave it empty. | +| `CLOUDAPI_HMAC_KEY` | HMAC signing key for CloudAPI requests | The installer generates one if you leave it empty. | +| `CLOUDAPI_ENCRYPTION_KEY` | Encryption key for CloudAPI stored data | The installer generates one if you leave it empty. | ### Email and Notification Properties @@ -137,8 +137,8 @@ Common to both `SMTP` and `Graph`: | Property | Purpose | Notes | |---|---|---| | `EMAIL_PROVIDER` | `None` \| `SMTP` \| `Graph` | Default `SMTP`. | -| `EMAILFROM` | From address used to send email | Required for `SMTP`/`Graph`. Validated as a well-formed email address. | -| `FULLHTTPFQDN` | URL of the PingCastle instance shown in email bodies | Validated as a well-formed URI. | +| `EMAILFROM` | From address for outgoing email | Required for `SMTP`/`Graph`. The installer validates this as a well-formed email address. | +| `FULLHTTPFQDN` | URL of the PingCastle instance that appears in email bodies | The installer validates this as a well-formed URI. | **`EMAIL_PROVIDER=SMTP`:** @@ -174,9 +174,9 @@ See [Configuring HTTPS](enterprisehttpssetup.md#configuring-https) for backgroun | `SSL_PORT` | HTTPS port for the IIS binding | Default `443`. Must be an integer from `1`–`65535`. | | `SSL_CERT_TYPE` | `SELFSIGNED` \| `EXISTING` \| `STORE` | Default `SELFSIGNED` (installer generates a self-signed certificate). | | `SSL_CERT_PATH` | Path to a `.pfx`/certificate file | Required when `SSL_CERT_TYPE=EXISTING`. | -| `SSL_CERT_PASSWORD` | Password for the certificate file | Used with `EXISTING`. | +| `SSL_CERT_PASSWORD` | Password for the certificate file | Applies when `SSL_CERT_TYPE=EXISTING`. | | `SSL_CERT_THUMBPRINT` | Thumbprint of a certificate already in the Windows certificate store | Required when `SSL_CERT_TYPE=STORE`. | -| `SSL_FORCE_REBIND` | Forces the IIS binding to be reconfigured even if unchanged | Optional. Used mainly for upgrade scenarios. | +| `SSL_FORCE_REBIND` | Forces the installer to reconfigure the IIS binding even if it hasn't changed | Optional. Applies mainly to upgrade scenarios. | ## Example Installations diff --git a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md index 1f71603879..817285ba60 100644 --- a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md +++ b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md @@ -23,7 +23,7 @@ Pay attention to the following chart. It represents the evolution of the number ## Exceptions management -This part lets an administrator configure PingCastle Enterprise so that it adapts to the company's specific context. You can configure how PingCastle Enterprise handles exceptions specific to your perimeter. +This part lets an administrator adapt PingCastle Enterprise to the company's specific context by configuring how it handles exceptions specific to your perimeter. ![](/images/pingcastle/enterpriseuser/image54.webp) diff --git a/docs/pingcastle/4.0/enterpriseuser-entities.md b/docs/pingcastle/4.0/enterpriseuser-entities.md index 24a36a7b30..68403bf2f7 100644 --- a/docs/pingcastle/4.0/enterpriseuser-entities.md +++ b/docs/pingcastle/4.0/enterpriseuser-entities.md @@ -25,15 +25,15 @@ You can also use entities to identify administrators for specific perimeters, me **Reorganize the tree view of entities** -The PingCastle Enterprise solution provides an ergonomic view to reorganize the various entities that may compose your company. This view works through drag and drop to improve the user experience. +PingCastle Enterprise provides a view for reorganizing the entities that make up your company. This view works through drag and drop. -Example to show how to reorganize entities: +Example of reorganizing entities: ![](/images/pingcastle/enterpriseuser/image49.webp) **Details of an Entity** -Each entity has a dedicated "Details" page. On this page, you can access all the entity's information, including the Owner permissions. Here you can also edit these rights to establish which key people are accountable for a specified entity. +Each entity has a dedicated "Details" page. On this page, you can access all the entity's information, including the Owner permissions. You can also edit these rights to set which people are accountable for the entity. For instance, the page for the PingCastle Enterprise entity: From 7ffe973bd80c8264c6ab05abcbc3748b330210f0 Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Fri, 11 Sep 2026 13:14:34 +0100 Subject: [PATCH 09/12] Add tabs for support log collection methods, link to Logging page --- docs/pingcastle/4.0/enterprisesupportlogs.md | 26 +++++++++++++------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/pingcastle/4.0/enterprisesupportlogs.md b/docs/pingcastle/4.0/enterprisesupportlogs.md index 6595a05076..2c3680180a 100644 --- a/docs/pingcastle/4.0/enterprisesupportlogs.md +++ b/docs/pingcastle/4.0/enterprisesupportlogs.md @@ -1,6 +1,9 @@ --- sidebar_label: Collecting support logs --- +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + # Collecting Support Logs for PingCastle Enterprise Use this page to gather logs before opening a support ticket. It covers two kinds of logs: @@ -10,21 +13,26 @@ Use this page to gather logs before opening a support ticket. It covers two kind ## Application and Service Logs -PingCastle Enterprise, CloudAPI (which handles Entra ID scanning), and PingCastleSchedulerService all use Serilog for logging, each writing to its own `logs` folder: +PingCastle Enterprise, CloudAPI (which handles Entra ID scanning), and PingCastleSchedulerService all use Serilog for logging, each writing to its own `logs` folder. See [Logging](enterprisesettings-logging.md) for how to configure log levels and file logging from the web portal. + + + + +Go to **Configuration** > **Settings** > **Logging** and click **Download Today's Logs** or **Download All Logs**. See [Logging](enterprisesettings-logging.md#downloading-logs) for what each download includes. + + + + +Sign in to the server and collect the `logs` folder for each component directly: - PingCastle Enterprise: `logs` in the installation directory - CloudAPI: `CloudAPI\logs` in the installation directory - PingCastleSchedulerService: `Scheduler\logs` in the installation directory -Configure logging from the web portal at **Configuration** > **Settings** > **Logging**: - -- **Write log to file**: Enables or disables file logging -- **Logging levels**: Control how much detail PingCastle Enterprise captures -- This page includes additional logging settings - -To download PingCastle Enterprise and CloudAPI logs from the web portal, go to **Configuration** > **Settings** > **Logging** and click **Download Today's Logs** or **Download All Logs**. +For PingCastleSchedulerService, you can also check the Windows Event Log on the server to troubleshoot the scheduler. -PingCastleSchedulerService has no web interface, so the portal download doesn't include its logs. Check `Scheduler\logs` directly, or the Windows Event Log on the server, to troubleshoot the scheduler. + + ## Installer Logs From cb3a1019c6f56fe9af932428039e9957aee70341 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 12:22:06 +0000 Subject: [PATCH 10/12] fix(vale): auto-fix style issues (Vale + Dale) --- docs/pingcastle/4.0/enterpriseauthsetup.md | 14 +++++++------- docs/pingcastle/4.0/enterprisesilentinstall.md | 12 ++++++------ docs/pingcastle/4.0/enterprisetroubleshooting.md | 2 +- docs/pingcastle/4.0/enterpriseupgrade.md | 2 +- .../4.0/enterpriseuser-actionplans-exceptions.md | 2 +- 5 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseauthsetup.md b/docs/pingcastle/4.0/enterpriseauthsetup.md index d09980e7ba..41fe320867 100644 --- a/docs/pingcastle/4.0/enterpriseauthsetup.md +++ b/docs/pingcastle/4.0/enterpriseauthsetup.md @@ -8,7 +8,7 @@ import TabItem from '@theme/TabItem'; ## Authentication -PingCastle Enterprise supports multiple authentication methods that can work simultaneously. You can configure any combination of Local Authentication, Windows Authentication, OpenID Connect, Entra ID Authentication, Header Authentication, SAML2, and Client Certificate authentication, allowing users to choose their preferred login method. +PingCastle Enterprise supports multiple authentication methods that can work simultaneously. You can configure any combination of Local Authentication, Windows Authentication, OpenID Connect, Entra ID Authentication, Header Authentication, SAML2, and Client Certificate authentication, so users can choose their preferred login method. Set up each method's identity provider using the instructions on this page, then enter the resulting values on the **Login options**, **Windows authentication**, **Certificate authentication**, **Header authentication**, **OIDC Connect**, and **SAML** screens under **Configuration** > **Settings** in the PingCastle Enterprise web interface. @@ -123,7 +123,7 @@ On **Configuration** > **Settings** > **Windows authentication**, enter the SIDs | Windows Group | SID of the Active Directory group that grants login access (e.g., PingCastle_Users) | | Windows Group Admin | SID of the Active Directory group that grants administrator privileges (e.g., PingCastle_Admins) | -PingCastle Enterprise can also remove a user's access if they no longer belong to the group set in **Windows Group**. The `RemoveUserIfNotInWindowsGroupAnymore` configuration key controls this behavior; PingCastle Enterprise checks the key at every Windows login. The key is off by default and has no toggle on the **Settings** screens — enable it by adding it to the application configuration. +PingCastle Enterprise can also remove a user's access if they no longer belong to the group you set in **Windows Group**. The `RemoveUserIfNotInWindowsGroupAnymore` configuration key controls this behavior; PingCastle Enterprise checks the key at every Windows login. The key is off by default and has no toggle on the **Settings** screens — enable it by adding it to the application configuration. :::note Windows Authentication doesn't provide an email address when PingCastle Enterprise creates accounts. PingCastle Enterprise sets email addresses to a default value that disables notifications. @@ -308,15 +308,15 @@ On **Configuration** > **Settings** > **SAML**, enable SAML login and enter the | Enabled | Turns on SAML login. | | Display Name | The text shown on the SAML login button. | | Issuer | The identifier PingCastle Enterprise presents to your identity provider as the SAML issuer. | -| IdP Metadata | The URL of your identity provider's SAML metadata, used to fetch signing certificates and endpoint information automatically. | -| Single Sign-On Destination | The SSO endpoint on your identity provider, used when you configure SAML manually instead of through IdP metadata. | -| Certificate | The base64-encoded signing certificate from your identity provider, used when you configure SAML manually. | +| IdP Metadata | The URL of your identity provider's SAML metadata. PingCastle Enterprise fetches signing certificates and endpoint information from it automatically. | +| Single Sign-On Destination | The SSO endpoint on your identity provider. Set this when you configure SAML manually instead of through IdP metadata. | +| Certificate | The base64-encoded signing certificate from your identity provider. Set this when you configure SAML manually. | | Ignore Certificate Validation | Skips validation of the identity provider's certificate. Use this only for testing, since it removes a security check. | Set **IdP Metadata** to fetch your identity provider's signing certificate and endpoints automatically, as with Okta or ADFS metadata URLs. :::warning Availability Requirement -When using **IdP Metadata**, PingCastle Enterprise accesses the metadata URL at application startup. If the URL is unavailable, PingCastle Enterprise will be unavailable until the metadata becomes accessible again. +When you use **IdP Metadata**, PingCastle Enterprise accesses the metadata URL at application startup. If the URL is unavailable, PingCastle Enterprise will be unavailable until the metadata becomes accessible again. ::: To avoid a startup dependency on the metadata URL, leave **IdP Metadata** blank and set **Single Sign-On Destination** and **Certificate** instead, using the values from your identity provider's metadata: @@ -375,7 +375,7 @@ Create a user account with a login matching the certificate subject (DNS form). **Troubleshooting** -If PingCastle can't recognize the certificate, it displays an error. Ensure the user account login matches one of the preceding certificate identifiers. +If PingCastle can't recognize the certificate, it displays an error. Ensure the user account login matches one of the certificate mapping identifiers. diff --git a/docs/pingcastle/4.0/enterprisesilentinstall.md b/docs/pingcastle/4.0/enterprisesilentinstall.md index 971f400626..7b35f8297f 100644 --- a/docs/pingcastle/4.0/enterprisesilentinstall.md +++ b/docs/pingcastle/4.0/enterprisesilentinstall.md @@ -48,11 +48,11 @@ See [Remote Database Configuration](enterpriseinstall.md#remote-database-configu |---|---|---| | `CONNECTIONSTRINGWAY` | `AUTO` \| `MANUAL` | Default `AUTO`. `AUTO` builds a connection string from the other properties in this table; `MANUAL` uses `CONNECTIONSTRINGPROPERTY` as-is. | | `DB_SERVER_TYPE` | `LOCAL` \| `REMOTE` | Default `LOCAL`. `LOCAL` uses SQL Express on the local server (`.\SQLExpress`). `REMOTE` uses `DATABASE_SERVER` as the SQL host, along with `SQL_AUTH_TYPE` and any SQL authentication credentials it requires. | -| `DATABASE_SERVER` | SQL Server instance (`AUTO` mode) | Used to build the connection string. | +| `DATABASE_SERVER` | SQL Server instance (`AUTO` mode) | The installer uses this to build the connection string. | | `SQL_AUTH_TYPE` | `WINDOWS` \| `SQL` | Default `WINDOWS`. `SQL` requires `SQL_USERNAME`/`SQL_PASSWORD`. | | `SQL_USERNAME` / `SQL_PASSWORD` | SQL authentication credentials | The installer uses these only when `SQL_AUTH_TYPE=SQL`. | -| `USE_ENCRYPTION` | Appended to the built connection string | Default `Encrypt=True;`. Omit this property to set it to `False`. | -| `TRUST_SERVER_CERTIFICATE` | Appended to the built connection string | Default `TrustServerCertificate=True;`. Omit this property to set it to `False`. | +| `USE_ENCRYPTION` | The installer appends this to the connection string it builds | Default `Encrypt=True;`. Omit this property to set it to `False`. | +| `TRUST_SERVER_CERTIFICATE` | The installer appends this to the connection string it builds | Default `TrustServerCertificate=True;`. Omit this property to set it to `False`. | | `CONNECTIONSTRINGPROPERTY` | Full manual connection string | Required when `CONNECTIONSTRINGWAY=MANUAL`. | ### Authentication @@ -113,7 +113,7 @@ See [OpenID Connect](enterpriseauthsetup.md#openid-connect) for background. |---|---|---| | `SCHEDULER_ACCOUNT_CHOICE` | `SAME_AS_APPPOOL` \| `CUSTOM` \| ... | Selects which account the Scheduler Windows service logs on as. | | `SCHEDULER_SERVICE_ACCOUNT` | Resolved service account | Default `LocalSystem`. The installer sets this to the app pool's account automatically when `SCHEDULER_ACCOUNT_CHOICE=SAME_AS_APPPOOL`. | -| `SCHEDULER_USERNAME` / `SCHEDULER_PASSWORD` | Custom account credentials | Used when `SCHEDULER_ACCOUNT_CHOICE=CUSTOM`. | +| `SCHEDULER_USERNAME` / `SCHEDULER_PASSWORD` | Custom account credentials | The installer uses these when `SCHEDULER_ACCOUNT_CHOICE=CUSTOM`. | | `SCHEDULER_ADD_TO_LOCAL_ADMINS` | Adds the scheduler account to local Administrators | Optional. | | `SCHEDULER_API_KEY` | API key the Scheduler service uses to call the Enterprise API | The installer generates one if you don't supply it. | @@ -157,10 +157,10 @@ Common to both `SMTP` and `Graph`: | `EMAIL_CLIENT_ID` | App registration client ID | Required. | | `GRAPH_AUTH_METHOD` | `ClientSecret` \| `Certificate` | Default `ClientSecret`. | | `GRAPH_CLIENT_SECRET` | Client secret | Required when `GRAPH_AUTH_METHOD=ClientSecret`. | -| `GRAPH_CERT_MODE` | `File` \| `Store` | Only used when `GRAPH_AUTH_METHOD=Certificate`. Default `File`. | +| `GRAPH_CERT_MODE` | `File` \| `Store` | Applies only when `GRAPH_AUTH_METHOD=Certificate`. Default `File`. | | `GRAPH_CERT_PATH` | Path to certificate file | Required when `GRAPH_CERT_MODE=File`. | | `GRAPH_CERT_PASSWORD` | Certificate file password | — | -| `GRAPH_CERT_STORE_LOCATION` | `CurrentUser` \| ... | Only used when `GRAPH_CERT_MODE=Store`. Default `CurrentUser`. | +| `GRAPH_CERT_STORE_LOCATION` | `CurrentUser` \| ... | Applies only when `GRAPH_CERT_MODE=Store`. Default `CurrentUser`. | | `GRAPH_CERT_STORE_NAME` | Certificate store name | Required when `GRAPH_CERT_MODE=Store`. Default `Personal`. | | `GRAPH_CERT_THUMBPRINT` | Certificate thumbprint | Required when `GRAPH_CERT_MODE=Store`. | diff --git a/docs/pingcastle/4.0/enterprisetroubleshooting.md b/docs/pingcastle/4.0/enterprisetroubleshooting.md index b9b507083e..70050760dc 100644 --- a/docs/pingcastle/4.0/enterprisetroubleshooting.md +++ b/docs/pingcastle/4.0/enterprisetroubleshooting.md @@ -196,7 +196,7 @@ If the Entra Scan Config or settings are still missing after the restart, collec
Installer Fails Before Setup Runs -`PingCastle-Enterprise-Installer-.exe` is a wrapper that extracts an embedded MSI and hands it to `msiexec`. If it fails before `msiexec` starts, no MSI log exists yet, because only `msiexec` writes install logs. Check for these symptoms: +`PingCastle-Enterprise-Installer-.exe` is a wrapper that extracts an embedded MSI and passes it to `msiexec`. If it fails before `msiexec` starts, no MSI log exists yet, because only `msiexec` writes install logs. Check for these symptoms: - **"Another installation is already running" dialog** — a prior `msiexec` process is still running, or a stale mutex or lock remains. Check Task Manager for a lingering `msiexec.exe` process. - **UAC prompt declined or dismissed** — `PingCastle-Enterprise-Installer-.exe` requires elevation. Nothing runs until you accept the prompt. diff --git a/docs/pingcastle/4.0/enterpriseupgrade.md b/docs/pingcastle/4.0/enterpriseupgrade.md index 4d4a8297eb..2779a49e5c 100644 --- a/docs/pingcastle/4.0/enterpriseupgrade.md +++ b/docs/pingcastle/4.0/enterpriseupgrade.md @@ -39,7 +39,7 @@ Replace `D:\PingCastleEnterprise\` with your actual installation directory. To upgrade PingCastle Enterprise from 3.5.1 to 4.0: 1. Download `PingCastleEnterpriseInstaller.exe` for version 4.0. -2. Run `PingCastleEnterpriseInstaller.exe` on the server where PingCastle Enterprise 3.5.1 is installed. +2. Run `PingCastleEnterpriseInstaller.exe` on the server running PingCastle Enterprise 3.5.1. 3. The installer detects the existing 3.5.1 installation, checks for and applies any required prerequisite changes, and performs an in-place upgrade. Because this is an upgrade, it skips most configuration screens, preserves your existing settings, and shows only a minimal set of prompts. ![A screenshot of the installer installing the required ASP.NET Hosting Bundle version as part of the upgrade.](/images/pingcastle/enterpriseupgrade/prereq-install.webp) diff --git a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md index 817285ba60..d5b2da7d17 100644 --- a/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md +++ b/docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md @@ -31,7 +31,7 @@ This part lets an administrator adapt PingCastle Enterprise to the company's spe You can set "Rule exceptions" to completely disable a rule within a specific domain. The application then doesn't apply this rule for a period that you specify. -Use this only for very specific reasons, such as when a rule doesn't apply in your organization. +Use this only for specific reasons, such as when a rule doesn't apply in your organization. Contact Netwrix support if you have questions or need help with exception management. From 5d5d1a3456571d148a3b2e1169181d218273162e Mon Sep 17 00:00:00 2001 From: Joe Dibley Date: Fri, 11 Sep 2026 14:54:30 +0100 Subject: [PATCH 11/12] Fix broken installer log links and remove stale duplicate section --- docs/pingcastle/4.0/enterpriseinstall.md | 4 ++-- docs/pingcastle/4.0/enterprisetroubleshooting.md | 12 ------------ 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseinstall.md b/docs/pingcastle/4.0/enterpriseinstall.md index 577f250bd4..0dc9909279 100644 --- a/docs/pingcastle/4.0/enterpriseinstall.md +++ b/docs/pingcastle/4.0/enterpriseinstall.md @@ -38,7 +38,7 @@ For SQL Express, visit [SQL Server Express Downloads](https://learn.microsoft.co #### Step 2 - Run PingCastleEnterpriseInstaller.exe (production) :::note -Having trouble installing? See [Collecting Installer Logs](/docs/pingcastle/4.0/enterprisetroubleshooting#collecting-installer-logs) in the Troubleshooting guide. +Having trouble installing? See [Installer Logs](enterprisesupportlogs.md#installer-logs) in the Collecting Support Logs guide. ::: The installer wizard walks you through prerequisite checks, licensing, and configuration screens in the following order. @@ -133,7 +133,7 @@ choco install sql-server-express #### Step 2 - Run PingCastleEnterpriseInstaller.exe (test/POC) :::note -Having trouble installing? See [Collecting Installer Logs](/docs/pingcastle/4.0/enterprisetroubleshooting#collecting-installer-logs) in the Troubleshooting guide. +Having trouble installing? See [Installer Logs](enterprisesupportlogs.md#installer-logs) in the Collecting Support Logs guide. ::: 1. Run PingCastleEnterpriseInstaller.exe. The installer checks for IIS and the ASP.NET 10.0 Hosting Bundle and offers to install them if they're missing. diff --git a/docs/pingcastle/4.0/enterprisetroubleshooting.md b/docs/pingcastle/4.0/enterprisetroubleshooting.md index 70050760dc..e023a5eb40 100644 --- a/docs/pingcastle/4.0/enterprisetroubleshooting.md +++ b/docs/pingcastle/4.0/enterprisetroubleshooting.md @@ -38,18 +38,6 @@ Before pasting file contents into any online JSON validator, redact passwords, c Only restart the PingCastle Enterprise application pool or service after the file passes validation. -### Collecting Installer Logs - -If the installer fails or exits unexpectedly, generate a verbose installer log to diagnose the issue or attach to a support case. - -Run the installer with the `/l*v` flag and a log file path: - -``` -pingcastle-enterprise-installer.exe /l*v C:\path\to\install.log -``` - -Include this log file when opening a support case for installation issues. - ### Common Errors and Solutions Here are common errors, their causes, and how to fix them. From 7dafbf77e54502bf3fb973a98bac08b27b83aabd Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 14:01:37 +0000 Subject: [PATCH 12/12] fix(vale): auto-fix style issues (Vale + Dale) --- docs/pingcastle/4.0/enterpriseinstall.md | 2 +- docs/pingcastle/4.0/enterprisetroubleshooting.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/pingcastle/4.0/enterpriseinstall.md b/docs/pingcastle/4.0/enterpriseinstall.md index 0dc9909279..aefb029fad 100644 --- a/docs/pingcastle/4.0/enterpriseinstall.md +++ b/docs/pingcastle/4.0/enterpriseinstall.md @@ -41,7 +41,7 @@ For SQL Express, visit [SQL Server Express Downloads](https://learn.microsoft.co Having trouble installing? See [Installer Logs](enterprisesupportlogs.md#installer-logs) in the Collecting Support Logs guide. ::: -The installer wizard walks you through prerequisite checks, licensing, and configuration screens in the following order. +The installer wizard presents prerequisite checks, licensing, and configuration screens in the following order. 1. **Prerequisite check**: the installer checks the server for IIS and the ASP.NET 10.0 Hosting Bundle. If either is missing, it offers to install them for you. diff --git a/docs/pingcastle/4.0/enterprisetroubleshooting.md b/docs/pingcastle/4.0/enterprisetroubleshooting.md index e023a5eb40..ee6b272c92 100644 --- a/docs/pingcastle/4.0/enterprisetroubleshooting.md +++ b/docs/pingcastle/4.0/enterprisetroubleshooting.md @@ -158,7 +158,7 @@ Add SQL Server credentials to the connection string in `appsettings.Production.j
Entra Scan Config Missing -If Entra ID scanning isn't available, Enterprise and CloudAPI aren't integrated correctly. Check for either of these signs: +If Entra ID scanning isn't available, the Enterprise and CloudAPI services aren't integrated correctly. Check for either of these signs: - **Entra Scan Config** isn't available in the **Configuration** dropdown menu. - **Configuration** > **Settings** doesn't show any Entra configuration settings.