Docs / Administration

Sign-in and security

Admin passwords, two-step sign-in, resetting a forgotten password, and how Vistapane keeps your data on your network.

#The admin password

Change it under Settings → Admin password. Use a long password that you don't use anywhere else.

#Two-step sign-in

Two-step sign-in asks for a 6-digit code from your phone as well as the password.

1. Go to Settings → Two-step sign-in → Turn on and enter your password.
2. Scan the QR code with an authenticator app, such as Microsoft Authenticator, Google Authenticator, 1Password or Authy. If you can't scan it, type the key shown under it.
3. Type the 6-digit code the app shows.
4. Save the 10 recovery codes somewhere safe. Each one lets you sign in once if you don't have your phone, and they aren't shown again.

When you're running low on recovery codes, the page offers to make new ones. Your old codes stop working when you do.

#Forgot the admin password

Only someone at the server PC can reset the password, so no email is involved.

1. On the server PC, right-click the Vistapane icon in the taskbar and choose Reset admin password. Windows asks for administrator permission.
2. It shows a one-time reset code that lasts 30 minutes.
3. On the admin sign-in page, click Forgot password?, enter the code, and choose a new password.

This signs everyone out and turns off two-step sign-in, so turn it back on afterwards.

From an administrator command prompt, "C:\Program Files\Vistapane Server\VistapaneServer.exe" --reset-password does the same.

#Lost your phone

Sign in with one of your recovery codes, then turn two-step sign-in off and on again to set up your new phone. If you have no recovery codes left, reset the password at the server PC as above.

#How your data is protected

• Your content stays on your network. Content, screen shares and settings live on your server, and screen shares go straight from the laptop to the display. Works fully offline with an offline license.
• The data folder (C:\ProgramData\Vistapane\data) can only be opened by administrators and the service. It holds password hashes, the license and the HTTPS certificate.
• The only outside connections the server makes are license check-ins, room calendars, weather and RSS. Display PCs only reach the internet to show YouTube or public web pages. See Requirements and network.

#Recommendations

• Use the admin over HTTPS. Settings → Connecting devices shows the HTTPS address.
• Keep the server on your staff network, not on guest Wi-Fi.
• Turn on two-step sign-in.
• Turn on daily backups to a second drive or a network share.
• Install updates when they come out: Update the server.