> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/knowledge-base-articles/devolutions-server-security-dashboard.md).

# Devolutions Server security dashboard

The ***Security dashboard*** is a tool to offer guidance on how to improve the security of the Devolutions Server platform and also tips on reducing the workload for administrators. Some tips are common infosec best practices, others are a consensus between our owns teams.

The scores are admittedly open to question and we do not pretend each topic has the same relative value for all of our community members. Achieving 100% is surely not an end goal in itself, we simply aim to raise awareness and provide ideas for your own security hardening.

<figure><img src="https://cdnweb.devolutions.net/docs/docs_en_kb_KB4707.png" alt=""><figcaption></figcaption></figure>

### Improvement action items

#### Active directory should be configured to use a secure communication channel

<table><thead><tr><th width="116"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>The LDAPS protocol should be used to provide communication confidentiality and integrity over the network. Otherwise, actions such as password resets could send the password in cleartext over the network.</td></tr><tr><td>Mitigation</td><td>In the web interface <em><strong>Administration – Server Settings – Authentication – Domain</strong></em>, check <em><strong>Enable LDAPS</strong></em>.</td></tr></tbody></table>

#### Backups should be enabled and configured

<table><thead><tr><th width="120"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Backups should be configured to an external media or cloud storage to avoid permanent loss of data.</td></tr></tbody></table>

#### Database accounts should be different for web application, scheduler and management tools

<table><thead><tr><th width="113"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Minimum privileges should be granted and applied for service and database accounts to operate. Shared and excessively privileged service and database accounts may induce unnecessary security risk exposure.</td></tr></tbody></table>

#### Email notifications should be configured

<table><thead><tr><th width="115"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>An email server configuration is required to transmit important application messages such as security events or errors.</td></tr><tr><td>Mitigation</td><td>Email server settings are in the web interface <em><strong>Administration – Server Settings – Email</strong></em>.</td></tr></tbody></table>

#### External logging destination should be configured

<table><thead><tr><th width="114"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Sending logs to an external system is recommended to maintain integrity and availability of event information.</td></tr><tr><td>Mitigation</td><td>Logging is configured in the web interface <em><strong>Administration – Server Settings – Logging</strong></em>.</td></tr></tbody></table>

#### Secure https communications should be enabled

<table><thead><tr><th width="120"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Secure communications guarantee the integrity and confidentiality of the data transmitted between the client and the server.</td></tr></tbody></table>

#### Sessions should be revalidated within 24 hours

<table><thead><tr><th width="121"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Excessive session duration may allow exposure beyond necessary to unauthorized users. Refresh token lifetime should therefore be configured within 24 hours (1440 min).</td></tr></tbody></table>

#### The administrator count should be no more than 5

<table><thead><tr><th width="122"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Limiting the number of active administrators within the platform will reduce the attack surface of an attacker to only those accounts configured. Having more than 5 administrators can also be a sign of poor segregation of duty within the business unit or organization.</td></tr></tbody></table>

#### The default mssql “sa” database account should be avoided

<table><thead><tr><th width="113"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>The default MSSQL administrative account is a high privilege account that should only be used to manage the database instance. A less privileged user or service account is preferred to reduce impact of compromise.</td></tr></tbody></table>

#### The server configuration file should be encrypted

<table><thead><tr><th width="113"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Sensitive information is stored in the server configuration file (<strong>appsettings.json</strong>). It is recommended to enable encryption to prevent tampering and ensure confidentiality</td></tr></tbody></table>

#### Vault security level should be set to high

<table><thead><tr><th width="113"></th><th></th></tr></thead><tbody><tr><td>Description</td><td>Vault security level should be set to high in the <em><strong>vault settings</strong></em>. A high-level security vault does not have access to offline mode.</td></tr><tr><td>Mitigation</td><td><em><strong>Vault settings</strong></em> are in the web interface of Devolutions Server under <em><strong>Administration – User and Security Management – Vaults</strong></em>. Edit a vault to open the <em><strong>Edit vault settings window</strong></em> and select <em><strong>High</strong></em> in the drop-down menu under <em><strong>General – Security level</strong></em>.</td></tr></tbody></table>

#### See also

* [Devolutions Academy – Configuration and security](https://docs.devolutions.net/server/kb/knowledge-base/server-security-dashboard/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.devolutions.net/server/knowledge-base/knowledge-base-articles/devolutions-server-security-dashboard.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.