Installing the Security Center main server - The main server in your Security Center system hosts the Directory role. You must install the main server first. - Security Center 5.14.0.0 - Installation guides

The main server in your Security Center system hosts the Directory role. You must install the main server first.

1. Right-click either Security Center Setup.exe (standalone version) or SecurityCenterWebSetup.exe (web version), and click Run as administrator.
   The InstallShield Wizard opens.

   NOTE: Only the standalone installer is illustrated in this procedure.
2. On the Choose setup language page, select the language of the InstallShield Wizard, and click Next.
3. On the welcome page, click Next.
   

   Links to relevant Security Center information are provided.

4. On the License agreement page, read the terms in the Genetec Software License Agreement, select I accept the terms in the license agreement, and click Next.
   If you’re upgrading from a previous major version, a Backward Compatibility notice opens. Ensure that you understand the backward compatibility requirements before proceeding.
5. On the Setup type page, click the Security Center features you want to install.
   

   NOTE: When you install the Security Center main server, the Server is mandatory. All other features are optional.

   The following options are available:

   Client and Server

   Installs Security Center Client and Server in C:\Program Files (x86).

   Client

   Installs Security Center Client in C:\Program Files (x86).

   NOTE: This option includes Config Tool, Security Desk, Genetec Video Player, and the Genetec Access Control Mustering plugin.

   Server

   Installs Security Center Server in C:\Program Files (x86).

   Custom

   Installs the Security Center packages you choose and allows you to change the file destination.

   

   You can change only the root folder where the Genetec Security Center 5.14 folder is created. On a 64-bit machine, the default root folder is C:\Program Files (x86)\.

   NOTE: All the setup options include CertSigning (Certificate Signing plugin), Clearance (Clearance Video Request plugin), and SynergisIntrusion (Synergis IX Intrusion extension).
6. On the Genetec™ Security Center 5.14 language selection page, select the user interface language for Security Center applications, and click Next.
   NOTE: After installing Security Center, you can click Start > Genetec Security Center 5.14 > Language Tool to change the user interface language for Config Tool and Security Desk. Online help for Security Center applications isn’t available in all languages supported by the user interface.
7. On the Server installation type page, select Main server, and click Next.
   IMPORTANT: There must be only one Main server installation per system. If your Security Center license supports more Directory servers, they must be installed as expansion servers. For more information, see Setting up Directory failover and load balancing.

   
8. On the Help improve Genetec™ products page, select how much you want to participate in our data collection, and click Next.
   

   A short description of each option and a link to our Global Privacy Policy are available by clicking View more details.

9. On the Database server page, select an SQL database, and click Next.
   

   The following options are available:

   Use an existing database server

   Selects an existing Microsoft SQL Server instance on the local machine or another server.

   Tip: Click Browse to see a list of SQL Server instances you can connect to in a dialog box. If you don’t see the SQL Server instance you want, close the dialog box and enter its name manually.

   Best Practice: Replace (local) with either the computer name or hostname, and port, if required.

   For example: DB_SERVER.GENETEC.COM,1433\SQLEXPRESS

   Use a computer name or hostname if you’re configuring the Directory for load balancing. For more information, see Directory failover and load balancing.

   If you’re using an old version of SQL Server Express, you can upgrade your database server to SQL Server 2022 Express Advanced if the following conditions are met:

   • You’re running a version of Windows that supports SQL Server 2022 Express Advanced. This means the 64-bit version of Windows 11 or Windows Server 2016 or later.
   • Your current version of SQL Server can be upgraded to SQL Server 2022 Express Advanced. See Supported version and edition upgrades (SQL Server 2022) for details.

   To upgrade your SQL Server instance:

   1. Click Cancel to close the message box, and then click Cancel to cancel the installation.
   2. Download and install a SQL Server version that can be upgraded to SQL Server 2022 Express Advanced.
   3. Rerun the Security Center Installer.

   Install a new database server

   Installs Microsoft SQL Server 2022 Express on this computer. You must choose a database server name. The default is SQLEXPRESS.

   NOTE: The database server name is not case-sensitive but must meet all following criteria:

   • It cannot be the same name as an existing SQL instance on your server.
   • It cannot match any of the SQL Server reserved keywords, such as DEFAULT, PRIMARY, and so on.
   • It cannot be longer than 16 characters.
   • The first character of the instance name must be a letter or an underscore (_). Acceptable letters are defined by the Unicode Standard 2.0, including Latin characters a-z and A-Z, and letter characters from other languages.
   • Subsequent characters can be letters defined by the Unicode Standard 2.0, decimal numbers from Basic Latin, or other national scripts, the dollar sign ($), or an underscore (_).
   • It cannot contain spaces or the following characters: \ , : ; ' & # @

   Use an existing Azure SQL database

   Selects a predefined Microsoft Azure SQL database.

10. On the Database server authentication page, select a database server authentication method, and click Next.
    

    The following options are available:

    Windows authentication

    This is the default option. We recommend using this method wherever possible. With Windows authentication, users who are already logged on to Windows don’t need to log on separately to SQL Server. The only time you can’t use Windows authentication is if you’re using an Azure SQL database.

    SQL Server and Windows authentication (mixed mode)

    Use the mixed mode if you’re using an Azure SQL database. Also provide the credentials to be used to connect to SQL Server.

11. On the Genetec Server - Service logon credentials page, set the username and password used to run Security Center services, and click Next.
    

    The following options are available:

    Use default name and password

    Select this option to use the LocalSystem account to run your Security Center services. The LocalSystem account has extensive privileges on the local computer and acts as the computer on the network.

    Specify the username and password for all services

    Select this option if you want to restrict the privileges granted to the service user. Enter a valid domain username and a strong password, and record them in a safe place. You must provide these credentials every time you upgrade your Security Center software. Use industry best practices for creating strong passwords.

    IMPORTANT: Make sure that the service user is a local administrator and not a domain administrator. The service user must have sufficient rights to the local or remote database, and Log on as service user rights. If this server hosts the Active Directory role, the specified user must also have read and write access to the Active Directory that you want the server to connect to.

    NOTE: The service user automatically creates all the necessary databases when the system is started for the first time. For this reason, the service user needs the SQL Server role, dbCreator, for its first run. After the databases are created, you can remove the dbCreator role.

    To avoid having to grant the dbCreator role to the service user, you can create the databases required by the Security Center roles yourself, as empty databases. When the system is started for the first time, the service user has to create only the tables, without going through the database creations. For the list of Security Center roles that need a database and the minimum SQL Server roles they require, see Avoiding connections to SQL Server with an account that has administrative privileges (Basic).

    You can also deny the service user the dbCreator role and create the databases later. In this case, the Security Center roles that require a database fail at system startup. Then create the databases and restart each role manually. You can also change the service user later from Microsoft Management Console.

    Specify a gMSA account

    Select this option to use a Group Managed Service Account to run your Security Center services. A gMSA is a managed domain account that provides automatic password management, simplified service principal name (SPN) management, and the ability to delegate the management to other administrators, over multiple servers.

    IMPORTANT: The gMSA user must be added as a user on the machine and must have Administrator privileges.

12. On the Server configuration page, set the server connection parameters, and click Next.
    

    The following options are available:

    Server port

    The TCP port through which the servers in your system communicate.

    Web server port

    The HTTP port that is used for the web-based Server Admin. If you change the default port, the Server Admin address must include the port number in the URL. For example, http://computer:port/Genetec instead of http://computer/Genetec. The link to Server Admin, accessible through Start menu, automatically includes this port.

    CAUTION:

    Watch out for conflicts with other software, such as a Skype, running on the server that might use port 80.

    Password and Confirm password

    Enter and confirm the password to open the web-based Server Admin.

    Best Practice: If you are upgrading your Security Center installation, the existing server password is kept by default. If you are using a blank password, we recommend that you enter a new one that contains at least one uppercase character, one lowercase character, one number, and one special character.

    IMPORTANT: If you lose the server password, contact the Genetec™ Technical Assistance Center (GTAC) to reset it.

13. On the Firewall rules page, grant the installer permission to automatically configure the Windows Firewall for Security Center, and click Next.
    

    NOTE: This option affects only the Windows Firewall. After installation, you must also configure the required ports on other firewalls that control Security Center communication. Firewall ports must also be updated after a major upgrade. For more information about firewall ports, see Default ports used by Security Center.
14. If old configuration files (ConfigurationFiles\*.gconfig) are detected on your computer, you can select which configuration to use. This step is skipped if you’re upgrading your system.
    
    1. Select one of the following options:

       Keep existing settings

       Use the existing configuration files detected for an older release of the current major version (5.14). This option is hidden if Security Center 5.14 was never installed on this computer.

       Deploy new settings

       Disregard any existing configuration files you might have on your computer and install the default configuration files for the version you’re installing.

       Use settings found in <Security Center Installation Folder>

       Use the configuration files found in an older Security Center installation Directory role. This option is available only if an older major version of Security Center is detected.

    2. Click Next.
15. On the Security settings page, configure features to make your system more secure.
    
    • Select Recommended to set the default security settings, and click Install to start the installation.

      The recommended security settings are:

      • If the certificate is self-signed, whitelist the identity certificate of the first Directory server this machine connects to.
      • Disable basic access authentication for cameras in favor of the more secure digest access authentication.
      • Automatically check for software updates.
      • Enable Genetec™ Update Service (GUS) integration in Config Tool.
    • Select Custom (Advanced) to configure the security settings, and click Next.
16. If you selected Custom (Advanced), configure the security settings.
    
    1. Configure the following settings:

       Always validate the Directory certificate

       Select this option to force all client and server applications on the current machine to validate the identity certificate of the Directory before connecting to it.

       Best Practice: If you enable Directory authentication, use a certificate issued by a trusted certificate authority (CA). Otherwise, the first time that this computer connects to the Directory, the user is prompted to confirm the identity of the Directory server.

       For more information, see What is Directory authentication?.

       Refuse basic authentication

       Basic access authentication for cameras is turned off by default to prevent camera credentials from being compromised when the Archiver connects to a video unit.

       IMPORTANT: When this option is selected, cameras that support only basic access authentication don’t work.

       Tip: Most recent video unit models support digest access authentication. If you aren’t sure whether your cameras support digest or not, leave the default setting as is. After installation, if some cameras don’t work, you can always turn basic access authentication on again.

       Automatically check for security and enhancement updates for Genetec™ products

       Select this option to allow GUS to check automatically for updates of all installed Genetec products.

       Enable Genetec™ Update Service (GUS) integration in Config Tool

       Enable this option to make GUS available in Config Tool.

    2. Select I acknowledge that I have read and understood the implications of selecting these security settings, and click Install to start the installation.
    NOTE: If you are missing cached MSI files, the Installation interrupted windows opens. For more information on cached MSI files, click View explanations on missing cached MSI files. See Restoring missing MSI files in Windows cache for information on resolving this issue.
17. On the Windows features summary page, click Next.
    

    The following icons indicate Windows feature installation status:

    • – Windows feature installed successfully.
    • – Windows feature not required.
    • – Windows feature not installed.
    • – Action required. Any required action is explained on the Windows features summary page.

    The Security Center installation doesn’t fail if a Windows feature can’t be installed for some reason.
18. On the Installation complete page:
    • Click Operations summary to see a list of successful and failed installation operations.
    • Click Installation logs to view log files in the C:\ProgramData folder.
    • Select checkboxes for the post-installation options you want to see, and click Finish.
      NOTE: Post-installation options differ depending on the Security Center components you installed, and are displayed only when a reboot is not required at the end of the installation workflow.
    
    • If you selected Launch Server Admin, Server Admin opens in a browser window. Before using Security Center, you must connect to Server Admin and activate your product license.
    • If you selected Connect me to GTAP for the latest updates now and your machine has internet access, you’re connected to the Product Download page on the Genetec™ Portal. You need a username and a password to sign in.
    • If you selected Launch Security Desk, Security Desk opens automatically. However, you can’t log on to the Directory until your product license is activated.
    • If you get a message asking you to restart your computer, click Yes.
    • If you get a warning message that the SQL Server 2022 Express Advanced telemetry service can’t be disabled, disable it manually.