Installation Guide

This guide covers installing Tagnet on a Windows server or workstation and completing first-run setup using the Tagnet Admin Console.

System Requirements

• Operating System: Windows 10/11 or Windows Server 2016+
• Architecture: 64-bit (x64)
• Memory: 4 GB RAM minimum (8 GB recommended)
• Disk Space: 500 MB for application files
• Network: TCP port 5000 (the default; change it on the Admin Console's Web Server Setup page), plus TCP port 443 if you enable HTTPS. HTTP and HTTPS can each be turned off independently, so a server can end up serving HTTPS only. The server also needs to reach every reader it manages: TCP 80 or 443 from the server to each reader subnet. Finding readers with Discover needs more than that (multicast on the same network segment); see Reader Discovery for the full table and what to do on a locked-down network

Download

Download the latest Tagnet installer (Tagnet v{version}.msi) from the releases page or your organization's software distribution system.

Installation Steps

Fresh install

1. Run the installer

   Double-click the MSI file to launch the installation wizard.

2. Accept the license agreement

   Review and accept the software license agreement to continue.

3. Choose installation folder

   The default installation path is:

   C:\Program Files\Stratum Global\Tagnet

   Click Browse to select a different location if needed.

4. Complete installation

   Click Install to begin the installation. Administrator privileges are required.

5. Launch the Admin Console for first-run setup

   The final installer dialog includes an Open Tagnet Admin Console to start first-run setup checkbox, checked by default. Leave it checked and click Finish, and the Admin Console opens automatically on its first-run checklist. See First-run setup below.

Upgrading from an existing installation

Run the new MSI installer. The upgrade wizard skips the license and installation folder steps and goes straight to installing; your previous path is reused automatically. Your data and configuration are preserved throughout the upgrade.

The installer stops the Tagnet service before it replaces any files, and after the new version has started it stays on the progress page with the line Upgrading the Tagnet database. Do not restart or stop the service. until the service has finished applying any database changes the new version brings. On a large SQLite database that can take several minutes; the elapsed time is shown. Wait for the finish page before restarting the computer. If the Tagnet Admin Console is open, the installer asks you to close it first. Cancelling at any point rolls the upgrade back and leaves the previous version installed and running. A cancel during the database step is not immediate: the service finishes the database changes first (it cannot be interrupted part-way through them), then the previous version and, on SQLite, the pre-migration copy of the database are put back.

Stopping the service for an upgrade interrupts RFID processing for a short time. Scan windows open at that moment are saved as scan events, unfinished workflows are caught up at the next start, and reads a reader sends in the meantime are refused (see Reads while the service is stopped). Where you can, schedule upgrades for a time when no load is passing a portal.

If the database step fails, the installer does not give up at once. Windows restarts the service on an unexpected exit, twice, a minute apart (see Startup type and recovery), and the installer follows those attempts on its progress page (Attempt 2, elapsed ...), so a failure that clears on its own does not cost you the upgrade.

If the database server cannot be reached when the new version starts, the service waits for it (see Startup type and recovery) and the progress page shows Waiting for the database server. The installer allows that five minutes. After that it rolls the upgrade back with The Tagnet service could not reach its database within 5 minutes. Nothing in the database has changed at that point, so there is nothing to put back. Run the installer again once the database server is reachable.

If the database changes do not complete, the installer says so, with the reason and the log to look at, and then rolls the upgrade back: the previous version is reinstalled and started, and on SQLite the database is put back from the copy the service took before the changes (the database the failed upgrade left behind is kept beside it as app.db.failed-upgrade-<timestamp>Z). You are where you were before running the installer. When the failure came before any change was made (the service could not open the database, or could not take the copy), there is nothing to put back and the installer says so. On SQL Server there is no copy, so if some changes had been applied before the failure the database is ahead of the reinstalled version, and Pre-migration backups describes the recovery. The reinstalled version detects this and does not start against that database: its log says the database was upgraded by a newer version of Tagnet and names the newest change it does not know.

Running the installer again after fixing the cause is simply another upgrade; the database changes start over from the copy.

Unattended installs and upgrades

Everything the wizard does can be driven from a command line or a deployment tool (SCCM, Intune, Group Policy, a scheduled task). Run these elevated; a per-machine install needs administrator rights either way.

Task	Command
Fresh install	msiexec /i Tagnet.msi /qn /l*v C:\Logs\tagnet-install.log
Upgrade	the same command with the newer MSI; the installed version is detected and replaced
Repair (reinstall the current version's files)	msiexec /i Tagnet.msi REINSTALL=ALL REINSTALLMODE=amus /qn /l*v C:\Logs\tagnet-repair.log
Uninstall	msiexec /x Tagnet.msi /qn /l*v C:\Logs\tagnet-uninstall.log

INSTALLFOLDER=<path> on a fresh install chooses the program folder; upgrades reuse the recorded one. Always keep the /l*v log: it is the first thing support asks for.

A plain re-run of the same version (msiexec /i with no REINSTALL) reinstalls nothing; if the service is stopped it is started, and the installer waits for its database check as usual. There is no previous version to go back to on such a run, so if the check fails the service is stopped again and the database is left as it is; fix the cause and start the service.

Silent installs never show the elevation prompt, so run them from an elevated session (or a deployment tool's SYSTEM context). A 1603 whose log contains Error 1925. You do not have sufficient privileges is that, not a product problem.

Exit codes

Code	Meaning
0	Installed or upgraded, and the database changes completed.
1602	Cancelled by the user; the previous version is rolled back and running. A cancel during the database step returns only after the service has finished its database changes and the rollback has put the previous version and the pre-migration copy back; a cancel while the service is still waiting for its database server rolls back at once.
1603	Failed, and rolled back. On an upgrade whose database changes did not complete, the previous version is reinstalled and started and, on SQLite, the database is restored from the pre-migration copy; the log names the change that failed. It is also returned when the service could not reach its database within 5 minutes; nothing was changed then, and nothing is restored. Run the installer again once the cause is fixed.
1619	The MSI path could not be opened. Check the path and quoting.
3010	A restart is pending. Tagnet's installer does not itself produce this any more; when it appears, another product left a rename pending (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations shows which).

The installer returns only after the database changes have finished, whatever the UI level (/qn, /qb, /passive). Two consequences for a deployment tool: its maximum run time for the package must cover a large SQLite database (minutes, not seconds; the elapsed time is in the log) plus up to five minutes if the database server cannot be reached, plus, if the changes fail, up to two automatic restarts of the service a minute apart and then the rollback (the previous version's files and the database copy are put back), and a "restart if required" step is safe to leave on, because it can only run after that return.

What to check afterwards

• Get-Service TagNet is Running.
• C:\ProgramData\Stratum Global\Tagnet\.initialization.json has "state": "Completed". After a rolled-back upgrade it may still hold the failed run ("Failed", the phase it failed in and the error), which is the quickest way to find out why. This file is what the installer itself waits on.
• The service log, C:\ProgramData\Stratum Global\Tagnet\logs\tagnet-<date>.log.

Detecting the installed version

Programs and Features lists Tagnet Enterprise v<MAJOR.MINOR.BUILD>, and HKLM\Software\StratumGlobal\Tagnet\InstallPath holds the program folder. A detection rule on the product's DisplayVersion works for every version; the MSI's product code changes with each release, so do not key on it.

Limitation: a fresh install can be run unattended, but the first-run setup (database, web server, and email in the Admin Console, then the admin account, license, and first site in the browser wizard) is done afterwards; see First-run setup. Upgrades need nothing after the exit code.

If you had typed an External URL on the System Settings page in an earlier version, check that page after upgrading: the address is now derived from the server configuration, and the old value is shown only when it differs. See Web Server Setup.

What Gets Installed

The installer performs the following:

Component	Location	Description
Application files	C:\Program Files\Stratum Global\Tagnet	Main application binaries
Tagnet Admin Console	C:\Program Files\Stratum Global\Tagnet	WPF management tool (StratumGlobal.TagNet.Admin.exe)
Data folder	C:\ProgramData\Stratum Global\Tagnet	Database, configuration, and logs
Windows Service	TagNet	Runs the application. Starts automatically at boot and is restarted by Windows after an unexpected exit; see Startup type and recovery
Firewall rules	Tagnet Web Server (Domain), Tagnet Web Server (Private)	Allow inbound connections on port 5000. One rule per network profile, because Windows applies a rule only to the profiles it names. Both are replaced by a single console-owned rule once you configure the web server
Start Menu entry	Tagnet Admin Console	Opens the Admin Console
Desktop shortcut	Tagnet Admin Console	Shortcut on the Public Desktop

Security posture

The data folder (C:\ProgramData\Stratum Global\Tagnet) is locked to SYSTEM, Administrators, and LOCAL SERVICE with full control. appsettings.Production.json in particular is explicitly admin-only; any rewrite by the Admin Console re-asserts that ACL. The folder itself grants Authenticated Users read access so the non-elevated Admin Console can monitor for token file changes during first-run setup. This is the intended security posture for a service configuration directory on a shared Windows server.

First-run setup

After a fresh install, the Tagnet service is running but has not been configured with an admin account. The Tagnet Admin Console opens on a first-run checklist with four steps in order: Database, Web Server, Email Server, and Finish setup in the browser. The first three decide the database, the address, and the mail provider the setup wizard and your readers use, so the checklist puts them before the wizard.

1. Open the Admin Console

   If you left the Open Tagnet Admin Console checkbox checked at the end of the installer, the console is already open. Otherwise, launch it from the Start Menu or the desktop shortcut.

2. Restart as administrator

   If the checklist shows a Restart as administrator prompt, click it. The installer normally opens the console without administrator rights, and the Database and Web Server rows need them to show the current settings. The console relaunches through UAC and returns to the Home page with both rows filled in.

3. Database

   Tagnet uses SQLite by default, and the row says so. To use SQL Server instead, click Database Setup, choose SQL Server, test the connection, and save. See SQL Server Setup. For Windows Authentication, set the account the service runs as on the Service Account page first; see Service Account.

4. Web Server

   The row shows the HTTP port (5000 by default) and whether HTTPS is on. To change the port, or to serve Tagnet over HTTPS with a certificate from the server's certificate store, click Web Server Setup. See Web Server Setup.

5. Email Server

   The row shows the configured mail provider, or that none is configured yet. To send invitations and password resets by email, click Email Setup, choose SMTP, SendGrid, or Azure Communication Services, and save. See Email Settings. You can leave this step for later: with no provider configured, invitations and password resets show their link in the admin UI instead of emailing it.

6. Finish setup in the browser

   The last row shows a Setup token, a one-time code generated by the Tagnet service. You can:

   • Click Copy token to copy it, then navigate to http://localhost:5000 (or the address you configured above) in your browser and paste the token into the setup wizard.
   • Click Open Setup Wizard to have the Admin Console open your default browser directly at the authenticated deeplink, with no copying or pasting required.
   • Click Copy link to copy that same deeplink instead, so you can paste it into a browser of your choosing. Useful on servers whose default browser is locked down by policy.

   The browser-based setup wizard walks you through:

   1. Server: a read-only check of what the service is configured to use: the database (SQLite or SQL Server), the web server (the address readers and links use, HTTPS and certificate, HTTP port), and the email provider. Each is set in the Admin Console; if something is wrong, change it there and come back.
   2. Admin account: create the first administrator user.
   3. License: apply the .lic file Stratum Global emailed you. Drop the file into the upload area or paste the contents directly. This step is required before you can continue; the wizard will not advance without a valid license on disk. See License for details.
   4. Your first site: name the site this installation starts with (for example "Toledo Plant"), with an optional short code for the API. Tagnet keeps shared definitions in the System scope and everything operational (locations, readers, inventory) in a site, so one must exist before you add a reader. You can rename it and add more sites later under Users, Access Scopes. Installations that already have a site skip this step. The organization name comes from your license, and the address devices use is derived from the server configuration (see Web Server Setup).

   When you click Finish in the wizard, the Tagnet service invalidates the token, and your browser shows a brief Tagnet is Ready confirmation screen before redirecting you to the dashboard.

7. Admin Console auto-transitions

   Once the server invalidates the token, the Admin Console detects the change automatically. The Home page becomes a status summary: each row shows a check mark with the database and web server settings in place (when the console runs as administrator), and Open Tagnet takes you directly to the application.

Note: The setup token is single-use. Once the setup wizard completes, the token is permanently invalidated and the Home page transitions to the status summary. If the console reports that it could not read the token file, click Try again in the Finish setup row.

Accessing Tagnet

After installation and first-run setup, Tagnet runs as a Windows service and starts automatically.

1. Open your web browser
2. Navigate to: http://localhost:5000
3. Or use the Open Tagnet button in the Admin Console's Home page

To change the port, or to serve Tagnet over HTTPS with a certificate from the server's certificate store, use the Admin Console's Web Server Setup page. See Web Server Setup.

Tagnet Admin Console

The Tagnet Admin Console (StratumGlobal.TagNet.Admin.exe) is a WPF management tool installed alongside the application. Its pages are accessible from the left navigation:

Page	Purpose
Home	First-run checklist (Database, Web Server, Email Server, Finish setup in the browser) that becomes a status summary with an Open Tagnet button once setup is complete
Database Setup	Choose SQLite or SQL Server before you start using Tagnet, test the connection, and save the configuration
Database Maintenance	Backup, restore, integrity check, and compact for SQLite
Web Server	Turn HTTP and HTTPS on or off independently, set their ports and the certificate, and set the External URL (see Web Server Setup)
Email	Choose a mail provider (SMTP, SendGrid, Azure Communication Services, or none), the From address, and connection details; test the connection and save (see Email Settings)
Scheduled Jobs	Choose when background jobs run
App Settings	Guided editor for appsettings.Production.json, for settings the pages above do not own
Diagnostics	Read-only view of how Tagnet is deployed on this server, with a Copy button for a quick question and a Collect support bundle button for a deeper support case
Rotate Keys	Replace the keys that protect stored credentials
Recover Account	Reset an administrator password

Pages that write configuration or control the Windows service require the console to run as administrator, since both appsettings.Production.json and the service control API are admin-only resources. When you open such a page non-elevated, the console shows a Restart as administrator button that relaunches with a UAC prompt and returns you to the same page.

For detailed instructions on pointing Tagnet at SQL Server, see SQL Server Setup.

Uninstalling

To remove Tagnet:

1. Open Settings > Apps > Installed apps
2. Find Tagnet in the list
3. Click the menu (...) and select Uninstall

Note: The data folder at C:\ProgramData\Stratum Global\Tagnet is preserved during uninstall. Delete it manually if you want to remove all data.

Troubleshooting

Service fails to start

1. Open Services (services.msc)
2. Find TagNet
3. Check the service status and startup type (the installer sets Automatic)
4. Review logs at C:\ProgramData\Stratum Global\Tagnet\logs. After an unexpected exit Windows restarts the service twice, a minute apart, before leaving it stopped, so the log usually holds one failure per attempt; see Startup type and recovery

Cannot access web interface

1. Verify the service is running
2. Check that port 5000 is not in use by another application
3. Ensure the firewall rule is enabled, and that it covers this server's network profile (see Network profiles)
4. Try accessing via http://127.0.0.1:5000

Port conflict

If port 5000 is already in use, open the Web Server Setup page in the Admin Console (elevated), enter a different HTTP port, click Validate, then Save and restart. The page opens the new port in Windows Firewall and restarts the service. See Web Server Setup.

Admin Console text looks scrambled or shows the wrong labels

The console renders through Windows' software rasterizer rather than the GPU, because some virtual display adapters and remote-desktop drivers place text at the wrong position, which shows up as labels painted with text belonging to other controls. If you are on hardware where GPU rendering behaves and you would rather use it, set the environment variable TAGNET_ADMIN_HARDWARE_RENDERING to true before launching the console. If text problems appear after doing that, clear the variable again.

Setup token is missing or unreadable

If the Finish setup row on the Admin Console Home page shows an error reading the token file rather than the token itself:

1. Click Try again. The Tagnet service writes the token file a moment after startup and may not have finished when the console first opened.
2. If the error persists, click Restart as administrator. The token file is in the admin-only data folder and requires elevation to read in some environments.
3. If neither resolves it, check that the Tagnet service is running via services.msc. The token is only written when the service starts for the first time on a fresh install.