Skip to content
VMSTools Pro

How it works

Outbound only. That's the whole idea.

A small Windows agent sits next to your Management Server and calls out to the cloud. Your dashboard reaches the agent over that connection. Nothing ever connects in.

Apply for early access Read about security

The connection, end to end

Your network Firewall: no inbound rules XProtect Management Server VMSTools Pro agent local only XProtect credentials stored here only Outbound HTTPS · port 443 VMSTools Pro cloud dashboard and command queue Your browser No inbound connections
The agent opens the only connection, outbound on port 443. Nothing connects in.

What happens when you click a button

Take a camera report as an example.

  1. Step 1: You ask for something

    You request a camera report from the dashboard, in any browser, anywhere.

  2. Step 2: The cloud passes it to your agent

    The request travels down the connection your agent already has open. No new connection is made into your network.

  3. Step 3: The agent runs it locally

    The agent runs the work on your side using MilestonePSTools and the XProtect credentials stored on that machine.

  4. Step 4: Results come back

    Structured results are stored for your organization only and appear in your dashboard.

What the agent needs

The agent runs as a Windows service on your Management Server, or on any machine that can reach it. It needs:

  • Windows PowerShell 5.1 and the free MilestonePSTools PowerShell module. If the module isn’t installed, the installer downloads it from the PowerShell Gallery.
  • Outbound HTTPS to connect.vmstools.pro on port 443
  • Optional: outbound HTTPS to api.ipify.org, a public lookup service the agent uses to find your network’s public IP address for the dashboard. If it’s blocked, everything else still works.
  • An XProtect account for the agent to use, stored only on that machine
  • XProtect 2022 R3 or newer is recommended. On older versions, some tools may not be available.

What it doesn’t need

No VPN, no port forwarding, no inbound firewall rules, and no remote desktop access for us.

One agent, or one per server

The main agent on your Management Server does the XProtect work: reports, tools and audit log collection. You can also install a secondary agent on each Recording Server to report that machine’s own CPU, memory, disk and network health.

If the connection drops

Your XProtect system keeps running exactly as before. VMSTools Pro watches it, but nothing in XProtect depends on it. The agent reconnects by itself when the connection returns.

Updates and removal

Agent updates are started from the dashboard or the agent’s system tray app. To remove the agent, run the uninstaller that comes with it. It removes the service, its scheduled tasks and its files, and lists anything it deliberately leaves in place, such as the XProtect account you created for the agent.

Ready to connect your first system?

Apply for early access Read the getting-started guide