Skip to main content

Articles in this section

See more
Print

Planning and preparation: Cayosoft Guardian system requirements

  • Updated

Planning and preparation: Cayosoft Guardian system requirements

NOTE: Installing the Administrator Service and Cayosoft Guardian on the same server is not supported. Cayosoft strongly recommends installing them on separate servers to ensure optimal performance.

Hardware Requirements

Component

Requirements

Platform

2 GHz or higher Intel-compatible dual or quad-core CPU

Memory

8 GB minimum, 16 GB recommended

NOTE: For environments with 100k user accounts or more, 32 GB RAM or more is recommended.

Disk

180 GB or more of free disk space

Machine

Physical, on-premises virtual, Azure VM, or AWS virtual server

NOTE: For Azure recovery-site deployments, use Windows Server with Desktop Experience even if the source server is Server Core.

To help you determine the optimal hardware requirements for your environment, check the hardware configuration calculator.

Software Requirements

Component

Requirements

OS

Windows Server 2016, 2019, 2022, and 2025

NOTE: When deploying domain controllers with Windows Server 2025 in AWS-based Forest Recovery scenarios, ensure that the selected EC2 instance types support UEFI boot mode. Older instance types such as t2.medium are not compatible and will result in provisioning errors. Cayosoft Guardian now defaults to t3 instances, which are supported. However, customers using legacy recovery plans may need to manually update the instance type to avoid deployment issues.

Windows 10 Pro

Active Directory Forest Functional level

2012R2, 2016, 2025

Active Directory Domain Functional level

2012R2, 2016, 2025
Active Directory connectivity Each managed domain controller must be reachable from the Cayosoft Guardian server on either LDAP (TCP 389) and Global Catalog (TCP 3268), or LDAPS (TCP 636) and Global Catalog over SSL (TCP 3269). LDAPS is required when the environment enforces LDAP channel binding and signing (ADV190023) or has disabled plaintext LDAP.

Web browsers

  • Google Chrome (versions released within the past 12 months)

  • Apple Safari (versions released within the past 12 months, only versions 14.x or higher)

  • Microsoft Edge based on Chromium

IMPORTANT: Microsoft Internet Explorer is not supported.

Database

Cayosoft Guardian includes a built-in SQL Server Express LocalDB option for local deployments.

Starting with Cayosoft Guardian 7.2, Cayosoft Guardian uses the latest supported SQL Server Express LocalDB version 2025 for the built-in database, increasing the default maximum local database size to 50 GB (previously 10 GB).

This applies to new installations and upgrades that use the built-in database.

SQL Server 2017 or later, Azure SQL/Azure SQL PaaS, or SQL Server on AWS is strongly recommended for production workloads.

SQL Server 2017 or later, Azure SQL/Azure SQL PaaS, or SQL Server on AWS is strongly recommended for production workloads.

Azure SQL standard database must be created with one of the following configurations:

  1. S3 or higher pricing tiers

  2. 100 eDTU at least, 400 eDTU or equivalent vCore for production usage

SQL Server on AWS must be created with at least db.m5.large model.

Required ports

See Required Ports for Cayosoft Guardian.

LDAPS prerequisites

If LDAPS will be used, either because useLdaps = true is set or to support automatic fallback in mixed environments, the following prerequisites must be in place:

  • Each domain controller has a valid server authentication certificate with the domain controller's fully qualified domain name (FQDN) in the Subject or Subject Alternative Name. LDAPS becomes available on a domain controller automatically when such a certificate is present in the domain controller's Personal certificate store.

  • TCP port 636, and TCP port 3269 for Global Catalog over SSL, is reachable from every Guardian server and Forest Recovery Agent host.

  • If ldapsSkipCertificateValidation = false, the issuing CA chain is installed in the Trusted Root Certification Authorities and Intermediate Certification Authorities stores on every Guardian server and Forest Recovery Agent host.

Learn more: Configure LDAPS for Active Directory connections in Cayosoft Guardian.
Virtual address network space

When configuring the virtual network for the standby recovery site, the address space must be /24 or larger. This requirement ensures that the virtual network has enough IP addresses to support all deployed components during the recovery operation.

NOTE: Smaller subnets, such as /27 (32 IP addresses), will result in deployment failure.

Permissions required for Cayosoft Guardian

The following permissions have been moved into dedicated articles. Use these references to plan least-privilege access for each functional area.

Area Description Reference
Change monitoring and rollback Roles and scopes required for collecting changes across AD and Entra ID, and for performing safe rollback operations.
Communication Channel permissions Minimum permissions for sending notifications and integrating with external services such as Microsoft Teams, Exchange Online, SMTP. Permissions for Communication channels in Cayosoft Guardian
Forest Recovery permissions Required accounts, roles, and cloud provider privileges for performing backup, standby site preparation, and automated forest recovery. Permissions for Forest Recovery in Cayosoft Guardian

© Copyright 2013-2026 Cayosoft Inc. All rights reserved.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request
Return to top

Comments

0 comments

Please sign in to leave a comment.