Edition and capacity headroom
Which edition is installed, what it limits, and how close the estate is to those limits on doors, gateways, sites and workstations. The most common finding on this platform and the one with the longest lead time to fix.
// KANTECH ENTRAPASS HEALTH CHECK · HANS STUDY · ONTARIO, CANADA
Kantech EntraPass health check
EntraPass sells in editions, and editions have ceilings. Most estates were sized for the building they started in, then grew. The constraint that eventually bites is usually commercial rather than technical, and it surfaces at the point somebody wants to add a site.
What the health check covers
EntraPass environments are usually smaller and simpler than an OnGuard or C-CURE estate, which changes what matters. The questions here are about headroom, topology and whether the system was ever configured beyond getting the doors working.
Gateway and site topology
How gateways are deployed and what depends on each one, whether the layout still matches the estate, and what happens to the sites behind a gateway when it is unavailable.
Controller firmware and field devices
Firmware consistency across controllers, reader and lock configuration, downstream device health, and offline behaviour when the gateway or server is unreachable.
Database and event history
Database size and maintenance, event history growth, archiving strategy, and whether backups have ever been restored rather than merely scheduled.
Cardholders and access levels
Stale records, schedule and access level sprawl, and whether the permission model reflects the organisation as it is now or as it was at installation.
Video and integrations
Video integration where present, intrusion, elevator and visitor management, and whether integrations are still operational or configured once and never verified since.
Doors and supervision
Held and forced door handling, request to exit behaviour, lock power and battery calculations, and whether alarms are acted on or routinely cleared unread.
Security and hardening
Operator accounts and privilege, workstation access, encryption posture, audit trail retention, and version currency against support.
Where EntraPass estates commonly sit
- Approaching an edition ceiling that nobody has checked, so the next expansion turns into an unbudgeted platform decision.
- A gateway topology inherited from the original building, with sites added onto it in whatever way was convenient at the time.
- Controller firmware drifted across successive service visits, so field behaviour is inconsistent between doors that should be identical.
- Event history growing without a retention decision, because nobody was ever asked what the policy should be.
- Configured to the point where the doors worked and then left, with supervision, alarms and reporting never taken past defaults.
- Backups scheduled but never restored, which is a plan rather than a capability.
Who this is for
Organisations running EntraPass across one site or several, particularly where the system has grown past its original design or where an expansion is being planned. Commercial property, education, healthcare, light industrial and municipal.
Most useful before adding a site, before a budget cycle, or when doors have started behaving in ways nobody can explain.
What you receive
The deliverable is a prioritized remediation plan, not a pile of observations you have to triage yourself.
- A findings report organized by severity and by system layer, readable by both the security team and the IT team.
- A clear position on edition headroom, with what the next expansion would actually require.
- Specific, configuration-level recommendations tied to published guidance.
- A working session to walk through the findings and answer what the report raises.
Recommendations do not change based on who is selling. There is no product being steered toward at the end of this.
Delivery and scope
Remote delivery via the DHD, a remote access device, where the system cannot be reached over the network.
How the work is delivered
Remote
Screen share, supplied configuration exports, logs and documentation. Most of what a health check examines is visible without anyone travelling, and this is how the majority of engagements run.
DHD
The DHD, a pre-configured remote access device, ships to the site. Somebody on site plugs it into power and network, which takes minutes and needs no technical skill. It provides the access needed to examine the system properly, then ships back. Covers configuration, shipping both directions, and retrieval.
Cheaper and faster than travel for a single site, and it is what makes distance stop mattering. A site in another province costs the same to review as one an hour away.
On site
For work that needs someone in the room: physical inspection, cabling and rack conditions, commissioning witness, or an environment that cannot be reached remotely. Travel and on-site time are added to the written quote before work starts.
What a health check does not include
Listed because an unstated exclusion is what turns an agreed scope into an argument at invoice time, and that is the exact failure this practice exists to review other people for.
- Remediation. The report says what to fix; fixing it is a separate engagement or your own team.
- Configuration changes. Nothing is altered on a live system during a review.
- Licence, hardware or software costs, which are yours and are bought direct.
- Vendor support cases, escalations, or dealings with your integrator on your behalf.
- On-site attendance, unless added explicitly.
- Ongoing monitoring or a retainer. A health check is a point-in-time assessment.
Health checks for other platforms
Same structure and the same fixed pricing across every platform. The layers reviewed differ, because the ways these systems fail differ.
Genetec Security Center →
Architecture, roles and sizing under real load.
C-CURE 9000 →
CrossFire, iSTAR estate, SQL dependency and integrations.
Milestone XProtect →
Edition, Device Pack currency and support entitlement.
Avigilon Unity and Alta →
Which product family you are in, and what that decides.
AXIS Camera Station →
Edge analytics, and the device estate that limits them.
Lenel OnGuard →
Version position, database age, and access level sprawl.
Check the headroom before you need it
Edition limits are cheap to plan around and expensive to discover. The good time to find out is a budget cycle ahead of the expansion, not during it.
Independent of Kantech, Johnson Controls, and every integrator involved. See the independence policy.