Skip to main content

Articles in this section

See more
Print

Planning and preparation: Cayosoft Guardian system requirements

  • Updated

Planning and preparation: Cayosoft Guardian system requirements

NOTE    Installing the Administrator Service and Cayosoft Guardian on the same server is not supported. Cayosoft strongly recommends installing them on separate servers to ensure optimal performance.

Hardware Requirements

Component

Requirements

Platform

2 GHz or higher Intel-compatible dual or quad-core CPU

Memory

8 GB minimum, 16 GB recommended

NOTE     For environments with 100k user accounts or more, 32 GB RAM or more is recommended.

Disk

180 GB or more of free disk space

Machine

Physical, on-premises virtual, Azure VM, or AWS virtual server

NOTE    For Azure recovery-site deployments, use Windows Server with Desktop Experience even if the source server is Server Core.

To help you determine the optimal hardware requirements for your environment, check the hardware configuration calculator.

Software Requirements

Component

Requirements

OS

Windows Server 2016, 2019, 2022, and 2025

NOTE    When deploying domain controllers with Windows Server 2025 in AWS-based Forest Recovery scenarios, ensure that the selected EC2 instance types support UEFI boot mode. Older instance types such as t2.medium are not compatible and will result in provisioning errors. Cayosoft Guardian now defaults to t3 instances, which are supported. However, customers using legacy recovery plans may need to manually update the instance type to avoid deployment issues.

Windows 10 Pro

Active Directory Forest Functional level

2012R2, 2016, 2025

Active Directory Domain Functional level

2012R2, 2016, 2025
Active Directory connectivity Each managed domain controller must be reachable from the Cayosoft Guardian server on either LDAP (TCP 389) and Global Catalog (TCP 3268), or LDAPS (TCP 636) and Global Catalog over SSL (TCP 3269). LDAPS is required when the environment enforces LDAP channel binding and signing (ADV190023) or has disabled plaintext LDAP.

Web browsers

  • Google Chrome (versions released within the past 12 months)

  • Apple Safari (versions released within the past 12 months, only versions 14.x or higher)

  • Microsoft Edge based on Chromium

IMPORTANT    Microsoft Internet Explorer is not supported.

Database

Cayosoft Guardian includes a built-in SQL Server Express LocalDB option for local deployments.

NOTE    Starting with Cayosoft Guardian 7.2, Cayosoft Guardian uses the latest supported SQL Server Express LocalDB version 2025 for the built-in database, increasing the default maximum local database size to 50 GB (previously 10 GB).

This applies to new installations and upgrades that use the built-in database.

RECOMMENDED     SQL Server 2017 or later, Azure SQL/Azure SQL PaaS, or SQL Server on AWS is strongly recommended for production workloads.

Azure SQL standard database must be created with one of the following configurations:

  1. S3 or higher pricing tiers

  2. 100 eDTU at least, 400 eDTU or equivalent vCore for production usage

SQL Server on AWS must be created with at least db.m5.large model.

NOTE    When installing Cayosoft Guardian on Windows Server 2016, install Microsoft SQL Server 2019 Express manually before running the Guardian installer. The bundled SQL Server Express 2025 installer is not supported on Windows Server 2016.

Required ports

See Required Ports for Cayosoft Guardian.

Microsoft cloud environment

Commercial, GCC, and GCC High are supported. The Microsoft cloud environment is set for the whole installation in Service Settings > Authentication Settings before the first tenant is added, and each cloud resolves to its own set of service endpoints. See Configuration: Add a Tenant and Planning and preparation: Required ports for Cayosoft Guardian for endpoints and prerequisites specific to GCC and GCC High.

LDAPS prerequisites

If LDAPS will be used, either because useLdaps = true is set or to support automatic fallback in mixed environments, the following prerequisites must be in place:

  • Each domain controller has a valid server authentication certificate with the domain controller's fully qualified domain name (FQDN) in the Subject or Subject Alternative Name. LDAPS becomes available on a domain controller automatically when such a certificate is present in the domain controller's Personal certificate store.

  • TCP port 636, and TCP port 3269 for Global Catalog over SSL, is reachable from every Guardian server and Forest Recovery Agent host.

  • If ldapsSkipCertificateValidation = false, the issuing CA chain is installed in the Trusted Root Certification Authorities and Intermediate Certification Authorities stores on every Guardian server and Forest Recovery Agent host.

Learn more: Configure LDAPS for Active Directory connections in Cayosoft Guardian.
Virtual address network space

When configuring the virtual network for the standby recovery site, the address space must be /24 or larger. This requirement ensures that the virtual network has enough IP addresses to support all deployed components during the recovery operation.

NOTE    Smaller subnets, such as /27 (32 IP addresses), will result in deployment failure.

Permissions required for Cayosoft Guardian

The permissions Cayosoft Guardian needs in Active Directory depend on the capabilities you select for each domain or partition. When you add domains and partitions, the Select capabilities page of the wizard lists two capabilities. Both are selected by default:

  • Forest recovery: back up Active Directory and recover the forest or a domain to a known good state.
  • Change monitoring and threat detection: track changes with before and after values, and raise alerts on suspicious activity.

Guardian requests only the permissions that the selected capabilities need. Your license is not affected by this choice.

NOTE    Domains and partitions that were added before version 7.4 keep both capabilities after an upgrade, and their permission requirements do not change.

Permissions by capability

Capabilities selected Active Directory connection account Not required
Change monitoring and threat detection, with or without Forest recovery (default) An account with the permissions listed in Permissions for Change Monitoring and Rollback in Cayosoft Guardian. These include Replicate Directory Changes on the domain object and membership in Event Log Readers and Remote Management Users. Rollback requires administrative group membership. —
Forest recovery only A least-privileged account. This can be a standard domain user account with no administrative group membership, or a gMSA. Use this option when you cannot grant administrative credentials, for example when a managed service provider (MSP) adds a customer's domain. For details, see Permissions for Forest Recovery in Cayosoft Guardian. Replicate Directory Changes, the audit policy (GPO), and event collection. WinRM access (Remote Management Users) is not required when the account has no administrative rights.

IMPORTANT    In all cases, the Cayosoft Guardian server must reach the domain controllers over LDAP or LDAPS. See Active Directory connectivity in Software Requirements.

Permissions for each functional area

Use these articles to plan least-privilege access for each functional area.

Area Description Reference
Change monitoring and rollback Roles and scopes required to collect changes across AD and Entra ID and to perform rollback operations. Applies when the Change monitoring and threat detection capability is selected.
Communication Channel permissions Minimum permissions for sending notifications and integrating with external services such as Microsoft Teams, Exchange Online, and SMTP. Permissions for Communication channels in Cayosoft Guardian
Forest Recovery permissions Active Directory accounts for domains added for Forest recovery only, and the Azure and AWS roles needed for backup, standby site preparation, and automated forest recovery. Permissions for Forest Recovery in Cayosoft Guardian

© Copyright 2013-2026 Cayosoft Inc. All rights reserved.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request
Return to top

Related articles

Comments

0 comments

Please sign in to leave a comment.