Edition and licensing position
Which edition you are on, what it can and cannot do, and whether the features being asked for sit behind an edition wall. Device licence count against devices actually connected.
// MILESTONE XPROTECT HEALTH CHECK · HANS STUDY · ONTARIO, CANADA
Milestone XProtect health check
XProtect is the platform where the constraint is most often commercial rather than technical. Editions, Device Packs and support entitlement each set a ceiling, and estates routinely run into one of them years after the decision that put it there was made by somebody who has since left.
What the health check covers
XProtect separates its functions across several servers and versions several things independently of each other. That flexibility is the platform's strength and the source of most of the confusion in estates that were installed once and left alone.
Support entitlement
Whether care and support entitlement is current. This decides whether an upgrade is an upgrade or a repurchase, and it is the single most expensive thing to discover late.
Device Pack currency
Device Packs version independently of the platform. A camera that will not connect, or connects without its full feature set, is frequently a Device Pack question rather than a camera fault.
Server roles and topology
Management, recording, event, log and mobile server placement. Where roles have been collapsed onto one box, and whether that was a decision or an accident of the original install.
Recording and storage
Storage configuration and archiving behaviour, retention against real bitrates, write performance under sustained load, and whether archiving is doing what was intended.
Failover and resilience
Failover recording servers where deployed, whether failover has ever been tested rather than assumed, and what is actually lost during a switch.
SQL and database health
Database placement, maintenance, growth and backup. Frequently installed alongside the management server and then never looked at again.
Security and hardening
Service accounts and privilege, certificate and encrypted communication configuration, operator roles, device credentials, and the distance from the published hardening guide.
Where XProtect estates commonly sit
The structural traps on this platform are well documented and they are mostly about version and entitlement rather than about configuration.
- An edition chosen for the original site that now constrains a much larger estate, where the feature everyone wants requires a different edition entirely.
- Support entitlement lapsed without anyone noticing, so the upgrade path carries a cost nobody has budgeted.
- Device Pack well behind the platform, which surfaces as individual cameras behaving oddly and gets chased at the camera instead of at the server.
- Roles collapsed onto a single server during a small initial deployment and never separated as the estate grew.
- Failover configured and never tested, which is not resilience so much as an assumption.
- Smart Client performance blamed on the network when the constraint is client-side decoding and hardware acceleration.
Who this is for
Organisations running XProtect at scale who need to know where they stand before an upgrade, an expansion, or a budget cycle. Particularly useful where the estate was installed by an integrator who is no longer involved, or where the platform decision predates everyone currently responsible for it.
What you receive
The deliverable is a prioritized remediation plan, not a pile of observations you have to triage yourself.
- A findings report organized by severity and by system layer, readable by both the security team and the IT team.
- A clear position on edition, licensing and entitlement, with the cost consequences of each option set out plainly.
- Specific, configuration-level recommendations tied to published guidance.
- A working session to walk through the findings and answer what the report raises.
Recommendations do not change based on who is selling. There is no product being steered toward at the end of this.
Delivery and scope
Remote delivery via the DHD, a remote access device, where the system cannot be reached over the network.
How the work is delivered
Remote
Screen share, supplied configuration exports, logs and documentation. Most of what a health check examines is visible without anyone travelling, and this is how the majority of engagements run.
DHD
The DHD, a pre-configured remote access device, ships to the site. Somebody on site plugs it into power and network, which takes minutes and needs no technical skill. It provides the access needed to examine the system properly, then ships back. Covers configuration, shipping both directions, and retrieval.
Cheaper and faster than travel for a single site, and it is what makes distance stop mattering. A site in another province costs the same to review as one an hour away.
On site
For work that needs someone in the room: physical inspection, cabling and rack conditions, commissioning witness, or an environment that cannot be reached remotely. Travel and on-site time are added to the written quote before work starts.
What a health check does not include
Listed because an unstated exclusion is what turns an agreed scope into an argument at invoice time, and that is the exact failure this practice exists to review other people for.
- Remediation. The report says what to fix; fixing it is a separate engagement or your own team.
- Configuration changes. Nothing is altered on a live system during a review.
- Licence, hardware or software costs, which are yours and are bought direct.
- Vendor support cases, escalations, or dealings with your integrator on your behalf.
- On-site attendance, unless added explicitly.
- Ongoing monitoring or a retainer. A health check is a point-in-time assessment.
Related advisory areas
Video surveillance design →
Purpose per view, pixel density, storage sizing. Platform neutral, before selection.
Pre-purchase design review →
If an upgrade or migration has been quoted and you want it checked before signing.
Security network design →
The network under the recording servers, which is where a share of the faults live.
Health checks for other platforms
Same structure and the same fixed pricing across every platform. The layers reviewed differ, because the ways these systems fail differ.
Genetec Security Center →
Architecture, roles and sizing under real load.
C-CURE 9000 →
CrossFire, iSTAR estate, SQL dependency and integrations.
Avigilon Unity and Alta →
Which product family you are in, and what that decides.
AXIS Camera Station →
Edge analytics, and the device estate that limits them.
Lenel OnGuard →
Version position, database age, and access level sprawl.
Kantech EntraPass →
Edition ceiling, gateway topology, and controller firmware.
Know your position before the budget cycle
On this platform the expensive surprises are commercial. Finding out where you stand on edition and entitlement while there is still time to plan is worth considerably more than finding out during a quote.
Independent of Milestone and every integrator involved. See the independence policy.