System Overview
ForsetiDesk is a fully self-hosted IT service desk platform designed for teams that require complete control over their data and workflows. Unlike cloud-based solutions, ForsetiDesk runs entirely on your own Windows infrastructure — no external dependencies, no data leaving your network, no mandatory subscription fees.
ForsetiDesk was built by practitioners who lived the problem — born from years of frustration with rigid, uncustomizable service desk platforms. While designed for IT teams, ForsetiDesk is flexible enough for any service operation that needs accountability, workflow, and data ownership.
Key Features
- Complete ticket lifecycle management from creation through QA-verified closure
- Mandatory QA/QC review — technicians cannot close tickets without supervisor approval
- Configurable ticket ID numbering (auto, sequential, prefixed, custom)
- Hierarchical category system — up to 5 levels on Pro, 2 on Core
- Email notifications to clients on ticket events (new in 1.4)
- Email-to-ticket inbound mailbox — tickets auto-created from incoming email (new in 1.4, Pro)
- Self-service password reset — no admin needed for routine resets (new in 1.4)
- Canned responses — one-click reply templates for technicians (new in 1.4)
- Internal notes — private tech-only comments hidden from clients (new in 1.4)
- Knowledge base with markdown articles, attachments, and bidirectional ticket linking (new in 1.5)
- Public client-portal KB articles (new in 1.5, Pro)
- Ticket merging — combine duplicate or related tickets into a single primary (new in 1.6)
- Ticket-to-ticket linking — Related, Parent/Child, Blocks, and Duplicate relationships (new in 1.6)
- Automation rules — event-triggered workflow engine with condition/action builders (new in 1.7, Pro)
- Webhooks — HMAC-signed outbound HTTP POST on 12 ticket events with retry logic and delivery log (new in 1.8, Pro)
- Recurring tickets — template-based automatic ticket creation on daily, weekly, monthly, or custom CRON schedules (new in 1.8, Pro)
- Time tracking — per-ticket time entries with billable flag, global persistent timer bar, and analytics (new in 1.9, Pro)
- Per-organization SLA & QA policies — organization model with domain auto-matching, per-org SLA targets and QA requirement overrides (new in 1.9, Enterprise)
- LDAP / Active Directory SSO — authenticate users against your existing directory with auto-provisioning on first login (new in 1.9, Enterprise)
- Bring Your Own Database — point ForsetiDesk at your own external PostgreSQL instance instead of the bundled database (new in 1.9, Pro)
- Asset Management / ITAM — full lifecycle tracking (ORDERED through DISPOSED), structured location hierarchy, rack elevation diagrams, end user assignment, ticket linking, CSV import/export (new in 1.10, Pro)
- CMDB — CI relationship mapping with 5 relation types and interactive D3 topology graph (new in 1.10, Enterprise)
- Change Management — ITIL-aligned change requests with approval workflows, risk/impact scoring, and linked tickets/assets (new in 1.10, Pro)
- SLA management with visual breach indicators and alerts (Pro)
- Full analytics dashboard with custom widget builder (Pro)
- Data export: CSV, JSON, Excel (.xlsx), and TXT formats (Pro)
- PowerBI API integration for external dashboards (Enterprise)
- Custom fields — TEXT, TEXTAREA, DROPDOWN, MULTISELECT, DATE, CHECKBOX, CASCADE (Pro)
- Role-based access control — Admin, Tech, QA, Client
- Native Windows desktop application (all tiers)
- Database backup and restore (Pro)
- User audit log — tracks all admin actions (Enterprise)
- Problem Management — KEDB, Root Cause Analysis with 5 methods, and problem-to-incident linking (Pro)
- Service Catalog — configurable request forms with approval chains (Pro; catalog builder Enterprise)
- Service Request workflow — sequential multi-level approvals and fulfillment tracking (Pro)
- Dashboard customization — drag-and-drop widget layout with persistent save (all tiers)
- Asset and Change analytics charts — visual summaries of asset status and change activity (Pro)
- Change calendar view — Day, Week, Month, and Agenda modes for scheduled changes (Pro)
- Change export — CSV, JSON, and XLSX formats (Pro)
- Automation triggers for asset and change status events (Pro)
- Webhook events for assets, changes, problems, and service requests — 35 total events (Pro)
License Tiers
| Feature | Core (Free) | Pro $1,495/yr · 5 seats | Business $3,995/yr · 15 seats | Enterprise $8,995/yr · 50 seats |
|---|---|---|---|---|
| Ticket Management | ✓ (100 max) | ✓ Unlimited | ✓ Unlimited | ✓ Unlimited |
| QA/QC Workflow | ✓ | ✓ | ✓ | ✓ |
| User Management | 3 seats | 5 seats | 15 seats | 50 seats |
| Category Levels | 2 levels | 5 levels | 5 levels | 5 levels |
| Email Notifications | ✓ | ✓ | ✓ | ✓ |
| Self-Service Password Reset | ✓ | ✓ | ✓ | ✓ |
| Knowledge Base (Internal Articles) | ✓ | ✓ | ✓ | ✓ |
| Desktop & Mobile App | Desktop only | ✓ | ✓ | ✓ |
| 30-Day Pro Trial | ✓ (included) | — | — | — |
| Canned Responses & Internal Notes | — | ✓ | ✓ | ✓ |
| Public KB Articles | — | ✓ | ✓ | ✓ |
| Email-to-Ticket (Inbound IMAP) | — | ✓ | ✓ | ✓ |
| SLA Management | — | ✓ | ✓ | ✓ |
| Full Analytics & Export | — | ✓ | ✓ | ✓ |
| Custom Fields | — | ✓ | ✓ | ✓ |
| Database Backup & Restore | — | ✓ | ✓ | ✓ |
| Ticket Merging & Linking | — | ✓ | ✓ | ✓ |
| Asset Management / ITAM | — | — | ✓ | ✓ |
| Parts Inventory | — | — | ✓ | ✓ |
| Change Management | — | — | ✓ | ✓ |
| Problem Management & KEDB | — | — | ✓ | ✓ |
| Service Catalog & Requests | — | — | ✓ | ✓ |
| Approval Chains | — | — | ✓ | ✓ |
| Automation Rules | — | — | ✓ | ✓ |
| Webhooks (35+ events) | — | — | ✓ | ✓ |
| Time Tracking | — | — | ✓ | ✓ |
| Recurring Tickets | — | — | ✓ | ✓ |
| Custom Dashboard Widgets | — | — | ✓ | ✓ |
| PowerBI Integration | — | — | ✓ | ✓ |
| CMDB — CI Relationships & Topology | — | — | — | ✓ |
| Service Catalog Builder | — | — | — | ✓ |
| LDAP / Active Directory SSO | — | — | — | ✓ |
| Organizations & Per-Org SLA | — | — | — | ✓ |
| User Audit Log | — | — | — | ✓ |
| Bring Your Own Database (BYODB) | — | — | — | ✓ |
Getting Started
Accessing ForsetiDesk
ForsetiDesk can be accessed via the native Windows desktop application or through a web browser. Your administrator will provide the server address. The default URL is:
Logging In
Enter your email address and password on the login screen. Contact your administrator if you do not have credentials. On first login you will be required to change your password before accessing the system.
Forgot Your Password? NEW IN 1.4
If you cannot remember your password, you no longer need to contact an administrator. Use the self-service reset:
- On the login screen, click Forgot Password? below the password field.
- Enter the email address associated with your account and click Send Reset Link.
- Check your inbox. A message from ForsetiDesk arrives within a minute or two containing a one-time reset link.
- Click the link in the email. It opens the reset page where you set a new password (minimum 8 characters).
- After setting the new password, log in normally with your new credentials.
Navigation
| Menu Item | Description | Access |
|---|---|---|
| Dashboard | Overview of ticket activity, SLA alerts, and key metrics | All Users |
| Tickets | Hub with tabs: All Tickets, QA Queue (Admin/QA), Search | All Users |
| Service Desk | Hub with tabs: Catalog, Requests (My Requests for clients), My Approvals (staff) — Pro | All Users |
| Knowledge Base | Browse, search, and author KB articles — clients see published public articles only | All Users |
| Assets | Hub with tabs: Inventory, CMDB Topology (Enterprise) — Pro | Admin, Tech |
| Changes | Change request management — submit, review, approve, and track IT changes — Pro | Admin, Tech, QA |
| Problems | Hub with tabs: All Problems, Known Errors (KEDB) — Pro | Admin, Tech, QA |
| Metrics | Detailed analytics, charts, and custom widgets — Pro | Admin, Tech, QA |
| Themes | UI theme selection and customization | All Users |
| Admin | System configuration, users, categories, license, backup | Admin Only |
User Roles
| Role | Permissions |
|---|---|
| Admin | Full system access — configure settings, manage users, view all tickets, approve/reject QA, manage license and backups |
| Tech | Create and work tickets, submit for QA review, view all tickets, view analytics, manage assets, create/update change requests |
| QA | Review and approve/reject tickets in the QA queue, acknowledge SLA breaches, view all tickets, view and review change requests |
| Client | Submit tickets and view their own ticket status only |
End User Guide
Creating a New Ticket
Click the + New Ticket button in the sidebar or navigate to Tickets and click New Ticket in the top right corner.
Ticket Fields
| Field | Description | Required |
|---|---|---|
| Title | Brief one-line summary of the issue | Yes |
| Description | Detailed explanation including steps to reproduce and error messages | Yes |
| Priority | Severity level — Critical, High, Medium, or Low | Yes |
| Category | Issue type — select from the hierarchical category dropdown | No |
| Client Name | Name of the person experiencing the issue | No |
| Client Email | Contact email for the affected user | No |
| Assign To | Technician to handle the ticket (can be left unassigned) | No |
| Tags | Labels to categorize the ticket — click to toggle | No |
| Custom Fields | Additional fields configured by your administrator (Pro) | Varies |
Priority Levels & Default SLA Targets
| Priority | Description | Default Response | Default Resolution |
|---|---|---|---|
| Critical | System down, major outage, security breach | 1 hour | 4 hours |
| High | Significant impact, no workaround available | 4 hours | 24 hours |
| Medium | Moderate impact, workaround available | 8 hours | 72 hours |
| Low | Minor issue, cosmetic, general questions | 24 hours | 168 hours |
Ticket Status Flow
| Status | Meaning |
|---|---|
| Open | Ticket created, awaiting assignment or work to begin |
| In Progress | Technician is actively working on the issue |
| Pending QA | Technician has resolved the issue and submitted for QA review |
| QA Rejected | QA has rejected the resolution — ticket returned to technician for rework |
| Merged | Ticket has been merged into another ticket and is now read-only (new in 1.6) |
| Closed | Issue fully resolved and verified through the QA process |
Email Updates on Your Tickets NEW IN 1.4
If your administrator has configured email notifications and your ticket has a client email address set, you will automatically receive emails at the following points:
- When your ticket is first created — confirmation with the ticket ID
- When a technician is assigned to your ticket
- When the status changes
- When the ticket is approved by QA and closed
- If QA rejects the resolution and the ticket is reopened for rework
Each email includes the ticket ID, title, current status, and a direct link back to the ticket. If you stop receiving updates and you expect them, contact your administrator — email notifications can be toggled on or off per event by the admin.
Browsing the Knowledge Base NEW IN 1.5
Click Knowledge Base in the left sidebar to browse published articles your IT team has made available to you. Many common issues have a self-help article that may resolve your problem faster than submitting a ticket.
- Use the search bar at the top to find articles by keyword
- Filter by category to narrow the list
- Click any article title to read the full content, including any attached files like screenshots or PDFs
Merged Tickets NEW IN 1.6
If your ticket has been combined with another related ticket by the IT team, you will see a banner at the top of your ticket indicating it has been merged and providing a link to the primary ticket where work is continuing. Merged tickets are read-only.
Technician Guide
Working a Ticket
Click any ticket from the Tickets list to open the detail view. From here you can review all ticket information, edit fields, add notes, and track your work time.
Editing a Ticket
Click the Edit button on the ticket detail page. In edit mode you can modify:
- Title and description
- Priority and status (cannot set to Closed directly)
- Assigned technician and category
- Tags and custom field values
- Client name and email
- Troubleshooting notes — document your diagnostic steps clearly
- Resolution notes — describe exactly how the issue was resolved
- Start time, end time, and resolution date
Click Save to commit changes. All changes are logged in the Activity Log with your name and timestamp.
Submitting for QA Review
- Ensure your Resolution Notes clearly explain how the issue was resolved.
- Set the End Time and Resolution Date fields.
- Click the Submit for QA button in the ticket detail view.
- The ticket status changes to Pending QA and appears in the QA Queue.
- If QA rejects the ticket, it returns to you as QA Rejected with notes explaining what to address.
- Rework the ticket and resubmit when ready.
Activity Log
Every change to a ticket is automatically recorded in the Activity Log at the bottom of the ticket detail page. The log shows who made each change, when it was made, and what specifically changed — providing a complete audit trail.
Internal Notes NEW IN 1.4
Internal notes let you and your teammates leave private comments on a ticket that the client never sees. Useful for handoffs, vendor case numbers, behind-the-scenes context, or notes for the QA reviewer.
- Open the ticket detail page.
- Scroll to the Internal Notes panel (it sits beside the public Activity Log).
- Type your note. Basic markdown formatting is supported.
- Click Post Note. The note appears in the panel immediately, stamped with your name and the time.
- To remove a note you posted, click the trash icon on it. Administrators can remove any note.
Ticket Merging NEW IN 1.6
When duplicate or closely related tickets arrive, you can merge secondary tickets into a single primary ticket. Merging closes the secondary tickets with a Merged status and preserves all history, internal notes, and KB article links.
- Open the ticket you want to keep as the primary (surviving) ticket.
- Click the Merge button in the ticket actions area.
- In the merge modal, search for tickets to merge into this one. Select one or more tickets using the checkboxes.
- Click Merge Selected into This Ticket. A confirmation dialog warns that this cannot be undone.
- After merging, secondary tickets become read-only and display a banner linking back to the primary ticket.
What Happens When Tickets Are Merged
- Secondary tickets receive Merged status and cannot be edited further
- KB article links from secondary tickets are transferred to the primary ticket (duplicates are skipped)
- Internal notes from merged tickets are accessible from the primary ticket’s Merged Tickets section
- The Activity Log on both tickets records the merge action
- Merged tickets are excluded from analytics calculations (resolution time, tech performance)
- No email notifications are sent when tickets are merged — it is an internal housekeeping action
Ticket Linking NEW IN 1.6
Ticket linking creates typed, bidirectional relationships between tickets without closing or modifying either one. Use it to connect related issues, track dependencies, or flag duplicates you want to keep open separately.
- Open any ticket detail page.
- Scroll to the Linked Tickets section (below Linked KB Articles).
- Click Link Ticket. In the modal, search for the ticket to link.
- Select a link type from the dropdown: Related, Parent/Child, Blocks, or Duplicate.
- Click the target ticket to create the link.
- To remove a link, click the X next to it and confirm.
Link Types
| Type | From Source Ticket | From Target Ticket | Use Case |
|---|---|---|---|
| Related | Related to #XYZ | Related to #ABC | Similar or connected issues |
| Parent / Child | Parent of #XYZ | Child of #ABC | Breaking a large issue into sub-tasks |
| Blocks | Blocks #XYZ | Blocked by #ABC | Dependency tracking between tickets |
| Duplicate | Duplicate of #XYZ | Duplicate of #ABC | Flagging duplicates without merging |
Canned Responses NEW IN 1.4
Canned responses are pre-written replies that your administrator has set up for common issues. Insert one with a click instead of typing the same answer over and over.
- On the ticket detail page, place your cursor in the field you want to add text to — usually Resolution Notes or Troubleshooting Notes.
- Click the Canned Responses dropdown near that field.
- Select the response you want. The text is inserted at your cursor position.
- Edit the inserted text to fit the specific ticket before saving.
Canned responses are maintained by administrators. If a common situation is missing from the list, ask an admin to add it — it helps the whole team.
SLA Indicators
| Badge | Color | Meaning | Action |
|---|---|---|---|
| On Track — Xh left | 🟢 Green | More than 20% of SLA time remaining | Continue normally |
| At Risk — Xh left | 🟡 Yellow | Less than 20% of SLA time remaining | Prioritize immediately |
| Breached Xh ago | 🔴 Red | SLA deadline has passed | Escalate to supervisor |
Note: SLA indicators only appear when a Pro license is installed.
Knowledge Base NEW IN 1.5
The knowledge base is a central library of articles documenting solutions, procedures, and reference material. Technicians and administrators author articles; QA reviewers can read and link them to tickets; clients see only articles that have been published and marked public.
Accessing the Knowledge Base
Click Knowledge Base in the left sidebar. The list page shows all articles you have permission to see, with filters for status, visibility, and category, plus a full-text search across titles and bodies.
Article Visibility & Status
| Field | Values | Meaning |
|---|---|---|
| Status | Draft / Published / Archived | Drafts are works-in-progress. Published articles are visible per the visibility rule. Archived articles are hidden by default and act as a soft delete. |
| Visibility | Internal / Public | Internal articles are visible to Admin, Tech, and QA only. Public articles are visible to clients in the portal once published. Public visibility requires a Pro license. |
Authoring an Article
Admins and technicians can create articles. QA reviewers and clients cannot author articles but can read those they have access to.
- Open the Knowledge Base and click + New Article.
- Enter a title. The URL slug is generated automatically from the title.
- Choose a category (optional — uses the same category tree as tickets).
- Set status to Draft while you are writing. Switch to Published when ready.
- Set visibility:
- Internal for tech-only reference material
- Public for client-facing how-tos and FAQs (Pro license required)
- Add comma-separated tags for additional filtering.
- Write the body in the markdown editor. The editor supports headings, bold, italic, lists, code blocks, tables, links, and a live preview pane.
- Click Create article. After the first save you can return to the editor to upload attachments.
Attachments
Articles support file attachments for screenshots, diagrams, PDFs, and supporting documents.
- Maximum file size: 25 MB per file
- Allowed types: PNG, JPEG, GIF, WebP, SVG, PDF, plain text, ZIP, and Microsoft Office documents (Word, Excel, PowerPoint)
- Files are stored under
C:\Program Files (x86)\ForsetiDesk\kb-attachments\ - Original filenames are preserved for display and download; on-disk names are randomized to prevent collisions
To attach a file: open the article in the editor, click Upload file in the Attachments section, select the file. The upload progress shows briefly and the file appears in the attachments list. Click the X next to an attachment to remove it.
Readers download attachments by clicking them on the article view page.
Linking Articles to Tickets
Tickets and KB articles can be linked in both directions to surface the right reference material at the right time.
- Open any ticket detail page.
- Scroll to the Linked KB Articles section.
- Click Link article, search for the article by title, and click it to attach.
- The linked article appears on the ticket; the ticket appears under Linked Tickets when viewing the article.
- Click the X next to a link to remove it.
Search
The search bar matches across article titles and body text. Combine search with category, status, or visibility filters to narrow results. Filters reset to page 1 automatically when changed.
Revision History
Every article maintains an append-only revision log capturing creation, updates, status changes, attachment additions and removals, and archive actions. Each entry records the user, action, and a brief detail string — useful for tracking who changed what and when.
Archiving Articles
Administrators can archive articles by clicking Archive on the article view page. Archived articles are hidden from default listings (apply the Archived status filter to see them) and become inaccessible to clients. Archiving is the recommended way to retire outdated content while preserving its history.
Role Permissions Summary
| Action | Admin | Tech | QA | Client |
|---|---|---|---|---|
| Browse / read articles | All | All | All | Published + Public only |
| Create / edit articles | ✓ | ✓ | — | — |
| Archive articles | ✓ | — | — | — |
| Upload / remove attachments | ✓ | ✓ | — | — |
| Link / unlink articles on tickets | ✓ | ✓ | ✓ | — |
| View revision history | ✓ | ✓ | ✓ | — |
QA Reviewer Guide
Accessing the QA Queue
Click QA Queue in the left sidebar. This page shows all tickets submitted for review by technicians, displayed in chronological order with oldest submissions first.
Reviewing a Ticket
Before approving or rejecting, review the following on each ticket:
- Ticket description — does it clearly describe the original issue?
- Troubleshooting notes — did the technician document their diagnostic process?
- Resolution notes — is it clear and specific how the issue was resolved?
- Time fields — are start time, end time, and resolution date populated?
- Category — is the ticket properly categorized?
- Tags — are appropriate tags applied?
- Custom field values — are required fields completed?
Approving a Ticket
Click the Approve button on the ticket. You may optionally add approval notes. Once approved, the ticket status changes to Closed and is removed from the active queue.
Rejecting a Ticket
Click the Reject button. Rejection notes are required — you must explain why the ticket is being rejected and what needs to be addressed. The ticket returns to QA Rejected status.
Internal Notes for QA NEW IN 1.4
During review you can post internal notes on the ticket that the client never sees. These are useful for documenting QA observations that don't warrant a rejection, leaving context for the next reviewer, or recording why an exception was approved.
Open the ticket, find the Internal Notes panel beside the activity log, type your note, and click Post Note. Notes are stamped with your name and visible only to Admin, Tech, and QA users.
Administrator Guide
Accessing Admin Settings
Click Admin in the left sidebar. The Admin panel is organized into tabs: Users, Categories, Settings, Communications, Security (TLS/Certificates + LDAP/AD), Database, Automation, Asset Types (Pro), Locations (Pro), Approval Chains (Pro), Service Catalog (Pro/Enterprise). Sub-tabs group related settings within each top-level tab.
User Management
The Users tab allows you to create, edit, deactivate, and delete user accounts. A user count indicator shows current usage against your license limit (e.g., "3 of 10 users").
Creating a User
Click Add User and fill in the name, email address, password (minimum 8 characters), and role. Available roles are Admin, Tech, QA, and Client.
Managing Users
- Edit — modify name, email, role, or password
- Active/Inactive toggle — disable an account without deleting it; deactivated users cannot log in and existing sessions are immediately invalidated
- Delete — permanently remove a user (cannot delete yourself or the last admin)
- Reset Password — generate a temporary password; user must change it on next login
User Audit Log
The Audit Log button shows a complete history of all user management actions. Requires Enterprise license.
Category Management
The Categories tab manages the hierarchical dropdown used when creating tickets. Categories support up to 5 levels on Pro/Enterprise (2 levels on Core). Categories can be reordered and deactivated without deleting historical ticket data.
System Settings
| Setting | Description |
|---|---|
| Organization Name | Displayed in the app header and on all exports |
| Default Priority | Pre-selected priority when creating new tickets |
| Ticket Numbering | ID scheme: Auto (timestamp), Sequential, Prefixed (TKT0001), or Custom |
| Available Tags | Manage the global list of tags available on tickets |
| SLA Targets | Configure response and resolution time targets per priority (Pro) |
| SLA Enabled | Toggle SLA deadline calculation on or off globally |
| Port | HTTP server port (default 4000) — requires service restart to apply |
Ticket Numbering Schemes
| Scheme | Format | Example |
|---|---|---|
| Auto | Unix epoch timestamp (milliseconds) | #1777742555599 |
| Sequential | Plain incrementing integer | #42 |
| Prefixed | Configurable prefix + padded number | TKT0042 |
| Custom | Prefix + optional year/month + number + separator | TKT-2026-0042 |
Email Notifications (SMTP) NEW IN 1.4
The Notifications tab lets you configure outbound email so clients automatically receive updates when their tickets are created, assigned, changed, closed, or rejected. Available on all license tiers.
Configuring SMTP
- Go to Admin → Notifications.
- Fill in your SMTP server details: host, port, username, password, from address, and TLS option. Common defaults are port 587 with TLS, or 465 with SSL.
- Toggle the Enabled switch on.
- Click Save. The mailer reloads automatically — no service restart needed.
Per-Event Toggles
Below the SMTP settings is a list of notification events. Each one can be turned on or off independently:
- Ticket Created — confirmation email to the client
- Ticket Assigned — notice when a technician picks up the ticket
- Status Changed — updates as the ticket moves through the lifecycle
- QA Approved — closure notification
- QA Rejected — notice that the ticket has been reopened for rework
Send Test Email
Once SMTP is saved, the Send Test Email button at the bottom of the tab lets you verify the connection. Enter any recipient address, click the button, and watch for the test message in that inbox. If it doesn't arrive within a minute, see the Troubleshooting section.
Base URL for Email Links
Notification emails include a clickable link back to the ticket. For these links to work outside your server, set APP_BASE_URL in secrets.cfg to the public URL of your ForsetiDesk install (e.g., https://desk.example.com). Without it, emails will link to localhost, which only works on the server itself.
Security Tab — TLS / Certificate Management NEW IN 1.11.15
The Security tab has three sub-tabs: Session (configurable session timeout and refresh), TLS / Certificates (HTTPS certificate management), and LDAP / AD (Enterprise). TLS enables HTTPS on your ForsetiDesk server so all communication is encrypted.
Certificate Status
The status card shows current TLS state: HTTPS Enabled/Disabled, certificate source (Self-Signed, Let’s Encrypt, or Custom), subject, issuer, expiry date, and SANs. A yellow warning appears 30 days before expiry; red when expired.
Generating a Self-Signed Certificate
- Click + Generate Certificate → Self-Signed tab.
- Auto-detected local IP addresses are pre-checked. Uncheck any that should not be included.
- Add custom entries (domain names, public IPs) in the text field and click + Add.
- Click Generate Certificate.
- Enable the Enable HTTPS toggle.
- Restart the ForsetiDesk service.
- Distribute the CA certificate to client devices (see Distributing the CA Certificate below).
Requesting a Let’s Encrypt Certificate (Recommended for Public Access)
- Ensure your domain’s DNS A record points to your server’s public IP address.
- Ensure port 80 is accessible from the internet (temporarily during issuance; can be closed afterward).
- Click + Generate Certificate → Let’s Encrypt (Trusted) tab.
- Enter your fully qualified domain name (e.g.,
desk.yourcompany.com). - Enter your email address — used by Let’s Encrypt for expiry notifications only.
- Click Request Certificate (takes 30–60 seconds).
- Enable the Enable HTTPS toggle.
- Restart the ForsetiDesk service.
Let’s Encrypt certificates are automatically trusted by all modern browsers, mobile devices, and operating systems — no CA distribution needed. Certificates auto-renew 30 days before expiry via a daily background check.
Distributing the CA Certificate (Self-Signed Only)
- Windows: Click Download CA Certificate. Double-click the .pem file → Install Certificate → Local Machine → Trusted Root Certification Authorities.
- Android: Settings → Security → Install certificate → CA certificate. Tap the downloaded file.
- iOS: Open the .pem link on the device → tap “Allow” to install the profile → Settings → General → VPN & Device Management → tap the profile → Install. Then Settings → General → About → Certificate Trust Settings → enable trust for ForsetiDesk CA.
- Mobile App: On the login screen, tap “Download & Install Certificate” to open the CA cert URL in the system browser.
Other Certificate Actions
- Replace Certificate — upload a custom PEM cert + key (and optional CA) from a commercial certificate authority.
- Revoke Certificate — deletes all certificate files; server reverts to HTTP after restart.
- Renew Now (Let’s Encrypt only) — forces immediate renewal before the 30-day auto-renew window.
Push Notification Settings NEW IN 1.11.9
Below the SMTP event toggles, a Push Notifications section lets you control which events trigger mobile app push notifications (Pro license required).
- Ticket Assigned — notify assignee immediately
- Status Changed — notify when ticket status changes
- New Internal Note — notify relevant tech/manager
- SLA Breached — notify assignee and manager
- QA Approved / QA Rejected — notify the submitting tech
- Escalated — notify the receiving manager
- Routed to Team — notify team lead or dispatcher
- Service Request Approval Needed — notify the approver
- Service Request Approved / Rejected — notify the requestor
- Emergency Change Created — notify all admins and managers
Email Inbox (Email-to-Ticket) NEW IN 1.4 — PRO
The Email Inbox tab connects ForsetiDesk to an IMAP mailbox so that messages sent to that address are automatically converted into tickets. This is the standard way most IT teams accept ticket submissions. Requires a Pro license.
Setting Up the Inbox
- Provision a dedicated mailbox — for example
[email protected]. Use a dedicated mailbox, not a personal account. - Go to Admin → Email Inbox.
- Fill in IMAP server details: host, port (typically 993 with TLS, or 143 without), username, password, folder (usually
Inbox), and the TLS option. - Set the Polling Interval — how often ForsetiDesk checks for new mail. The default is 5 minutes; minimum is 1 minute.
- Choose a Default Category for tickets created from email. You can re-categorize tickets individually after creation.
- Toggle Enabled on and click Save.
What Happens to Incoming Mail
On each poll cycle the system fetches unread messages from the configured folder and turns each one into a new ticket using these mappings:
| Email Field | Becomes Ticket Field |
|---|---|
| Subject | Ticket Title |
| Body (plain text or HTML stripped) | Description |
| Sender display name | Client Name |
| Sender email address | Client Email |
| RFC822 Message-ID header | Internal dedup key (not displayed) |
After successful processing the message is marked as read on the mail server so it isn't picked up again. The Message-ID is also recorded internally as a second safety net — the same email cannot create two tickets.
Test Connection & Poll Now
Two buttons sit at the bottom of the tab. Test Connection tries to log into the IMAP server and reports success or the exact error. Poll Now triggers an immediate poll cycle, bypassing the schedule — useful for verifying setup without waiting.
Status Indicator
The tab shows the most recent poll time and a status of ok, error, or idle. If poll status shows error, click Test Connection to see the underlying message.
Canned Responses (Templates Tab) NEW IN 1.4
The Templates tab is where you build and maintain the reply templates (canned responses) that technicians insert into tickets with one click. Available on all license tiers.
Creating a Canned Response
- Go to Admin → Templates.
- Click + New Response.
- Enter a Title — this is what technicians see in the dropdown picker.
- Enter the Body — the actual text that gets inserted. Markdown formatting is supported.
- Optionally tie the response to a specific Category so it only appears for matching tickets.
- Set Sort Order to control where it appears in the dropdown (lower numbers first).
- Click Save.
Managing the Library
- Edit — modify the title, body, category scope, or sort order at any time.
- Active toggle — temporarily hide a response without deleting it. Inactive responses don't appear in the tech picker but preserve any past usage records.
- Delete — permanently remove a response.
Analytics & Reporting
The Analytics page provides comprehensive visibility into service desk operations. Access it by clicking Analytics in the sidebar. Full analytics features require a Pro license.
Date Range Selection
All analytics are filtered by a date range. Select from preset ranges (Today, This Week, This Month, This Year) or choose a custom start and end date and click Apply.
Key Metrics
| Metric | Description |
|---|---|
| Total Tickets | Count of all tickets in the selected date range |
| Avg Resolution | Average hours from ticket creation to closure |
| SLA Compliance | Percentage of tickets resolved within their SLA deadline |
| Avg Open Age | Average age in hours of currently open tickets |
| Closed Count | Count of tickets closed in the selected date range |
Available Charts
- Opened vs Closed — line chart showing daily ticket volume trends
- SLA Compliance by Priority — bar chart showing compliance rate per priority level
- Tech Performance — tickets assigned, resolved, and average resolution/response times per technician
- Top Issue Categories — expandable category tree showing most common issue types
- Repeat Faults by Client — clients with recurring issues in the same category
- MTBF by Category — Mean Time Between Failures for each issue category
- Time by Technician — total and billable hours per technician with switchable Bar, Horizontal Bar, and Pie views (new in 1.9)
- Time by Category — total and billable hours per category with switchable chart types (new in 1.9)
Custom Widgets
Build your own metric cards. Click + Add Widget on the Custom Widgets tab:
| Field | Options |
|---|---|
| Widget Name | Any descriptive label |
| Measure | Count Tickets, Average Resolution Time, SLA Compliance % |
| Group By | No Grouping, By Status, By Priority, By Category, By Technician, By Date |
| Chart Type | Number, Bar Chart, Line Chart, Pie Chart |
| Filters | Optionally filter by Priority, Status, or Client Name |
Exporting Data
| Format | Best For | Notes |
|---|---|---|
| CSV | Excel, Google Sheets, most data tools | Comma-separated, UTF-8 encoded |
| JSON | Developers, API consumers | Structured data with all ticket fields |
| Excel (.xlsx) | Formatted spreadsheets | Multi-sheet: Summary, Tickets, Priority breakdown |
| TXT | Plain text reports | Human-readable formatted report |
SLA Management
Service Level Agreement (SLA) management tracks commitments to respond to and resolve tickets within defined timeframes. SLA features require a Pro license and must be enabled in Settings.
How SLA Works
When a ticket is created, ForsetiDesk automatically calculates two deadlines based on the ticket's priority and your configured SLA targets:
- Response Deadline — when the ticket must first be acknowledged or assigned
- Resolution Deadline — when the ticket must be fully resolved and submitted for QA
SLA Status Badges
| Badge | Color | Meaning | Required Action |
|---|---|---|---|
| On Track — Xh left | 🟢 Green | More than 20% of SLA time remaining | Continue working normally |
| At Risk — Xh left | 🟡 Yellow | Less than 20% of SLA time remaining | Prioritize immediately |
| Breached Xh ago | 🔴 Red | SLA deadline has passed | Escalate and notify supervisor |
Acknowledging SLA Breaches
Admins and QA reviewers can acknowledge SLA breaches to log that the breach has been noted. Click Acknowledge on the breached ticket in the dashboard alert, optionally add notes. The acknowledgment is logged in the ticket's activity history.
Configuring SLA Targets
Go to Admin → Settings → SLA Targets. Set response and resolution hours for each priority level. Click Save SLA Targets to apply. New tickets created after saving will use the updated targets.
License Management
ForsetiDesk uses a cryptographically signed license key system to unlock Pro and Enterprise features. The Core tier is free with no license required.
Installing a License
- Go to Admin → License.
- Click Generate License Request to create a license request file and send it to your vendor.
- Once you receive your license key, paste it into the License Key field.
- Click Install License. The system validates the key and immediately unlocks licensed features.
License Information
| Field | Description |
|---|---|
| Edition | Core, Pro, Business, or Enterprise |
| Issued To | The organization the license was issued to |
| Max Users | Maximum number of active users allowed (or Unlimited) |
| Issued Date | When the license was generated |
| Expiration Date | When the license expires (or Never for perpetual licenses) |
| Unlocked Features | List of Pro/Enterprise features enabled by this license |
User Count Enforcement
The Users tab shows your current active user count against the license limit (e.g., "3 of 10 users"). When the limit is reached, new user creation is blocked until the license is upgraded or an existing user is deactivated.
Removing a License
Click Remove License to uninstall the current license. The system reverts to Core mode. Existing data is not affected, but Pro/Enterprise features will no longer be accessible.
30-Day Pro Trial
Fresh ForsetiDesk installations automatically include a 30-day Pro trial. No license key is required — all Pro-tier features are unlocked immediately after setup.
- The trial countdown begins on the date of first installation and cannot be paused or reset.
- A dismissible banner appears in the sidebar showing days remaining. The banner turns amber when fewer than 7 days remain.
- When the trial expires the system reverts to the Core tier (3 seats, 100 tickets). All data is preserved.
- Installing a valid license key at any time — including during or after the trial — immediately activates the purchased edition and hides all trial banners.
- The trial is bound to the machine and installation; reinstalling the application does not restart the trial period.
Export & PowerBI Integration
Data Export
All export options are available from the Analytics page via the Export dropdown. Exports include all ticket data within the selected date range. Export requires a Pro or Enterprise license.
PowerBI Integration
Setting Up the PowerBI Connection
- Go to Admin → Settings and scroll to PowerBI Integration.
- Click Generate PowerBI API Key.
- Copy the full API key — it will not be shown again after you navigate away.
- In PowerBI Desktop, click Get Data → Web.
- Enter the connection URL shown on the settings screen.
- Add the API key as the
x-powerbi-keyheader orapikeyquery parameter.
API Endpoint Reference
| Parameter | Values | Description |
|---|---|---|
apikey | Your API key | Required for authentication |
dataset | tickets, summary | Which data to return |
start | ISO date string | Filter start date (optional) |
end | ISO date string | Filter end date (optional) |
Themes & Customization
ForsetiDesk includes multiple built-in color themes and a fully customizable color editor. Theme settings are accessible via the theme toggle in the app header or at Admin → Settings.
Built-In Themes
| Theme | Description |
|---|---|
| Midnight | Deep dark blue-grey — default theme, easy on eyes in low light |
| Slate | Dark navy with green accents — high contrast, modern look |
| Carbon | Pure black with orange accents — maximum contrast dark theme |
| Light | Clean white interface — ideal for bright environments |
| High Contrast | Black and white with bright yellow accents — accessibility focused |
Custom Theme
Click any preset theme to load it as your starting point. Use the color pickers to adjust individual UI color variables. Click Apply Custom Theme to activate. Theme preferences are saved per browser session.
Backup & Restore
ForsetiDesk includes built-in database backup and restore functionality using PostgreSQL's native pg_dump and psql tools. Backups are stored as .sql files on the server.
Configuring Backup Storage
Go to Admin → Backup → Configuration. Enter the backup storage path and click Save. The default path is:
Creating a Backup
- Go to Admin → Backup.
- Click Create Backup.
- ForsetiDesk runs pg_dump and saves a timestamped .sql file to the configured backup path.
- The backup file appears in the backup list with size and creation date.
- Optionally click Download to save a copy to your local machine.
Restoring from Backup
- Go to Admin → Backup.
- Find the backup file you want to restore from the list.
- Click Restore next to that file and confirm when prompted.
- ForsetiDesk runs psql to restore the database from the selected .sql file.
- Restart the ForsetiDesk service after restoration completes.
Automation & Workflow Rules NEW IN 1.7
The automation rules engine lets you define event-driven workflows that execute automatically when ticket conditions are met. Rules eliminate repetitive manual tasks — assigning tickets to the right technician, escalating priority, adding tags, or firing notifications — without human intervention.
enforceProFeature('automations').Accessing Automation Rules
Go to Admin → Automations. The tab displays all existing rules with their name, trigger event, active status, and sort order. Rules execute in sort-order sequence — lower numbers fire first.
Creating a Rule
- Click + New Rule.
- Enter a descriptive Name for the rule (e.g., "Auto-assign network tickets to NetOps").
- Select a Trigger Event from the dropdown.
- Add one or more Conditions using the condition builder.
- Add one or more Actions using the action builder.
- Set the Sort Order to control execution priority relative to other rules.
- Toggle Active on or off.
- Click Save.
Trigger Events
Each rule fires on exactly one event. The available triggers are:
| Trigger | Fires When |
|---|---|
| Ticket Created | A new ticket is created (via UI, API, or email-to-ticket) |
| Ticket Updated | Any field on an existing ticket is modified |
| Status Changed | A ticket's status transitions (e.g., OPEN → IN_PROGRESS) |
| Priority Changed | A ticket's priority level is changed |
| SLA Breached | A ticket's response or resolution deadline is exceeded |
Condition Builder
Conditions filter which tickets a rule applies to. All conditions must be true for the rule to fire (AND logic). Each condition consists of a field, an operator, and a value.
| Field | Available Operators | Example |
|---|---|---|
| Status | equals, not equals | Status equals OPEN |
| Priority | equals, not equals | Priority equals CRITICAL |
| Category | equals, not equals | Category equals "Network Issues" |
| Assignee | equals, not equals, is empty | Assignee is empty (unassigned tickets) |
| Tags | contains, not contains | Tags contains "vpn" |
Add multiple conditions by clicking + Add Condition. Remove a condition by clicking the X next to it.
Action Builder
Actions define what happens when the rule fires. Multiple actions can be chained on a single rule.
| Action | Description |
|---|---|
| Assign Ticket | Set the ticket's assignee to a specific technician |
| Change Status | Transition the ticket to a specified status |
| Change Priority | Escalate or de-escalate the ticket priority |
| Add Tag | Append a tag to the ticket's tag list |
| Send Notification | Trigger an email notification (requires SMTP configured) |
Add multiple actions by clicking + Add Action. Remove an action by clicking the X next to it.
Managing Rules
- Edit — click a rule to modify its name, trigger, conditions, actions, or sort order
- Active toggle — disable a rule without deleting it; inactive rules do not fire
- Delete — permanently remove a rule
- Sort Order — controls execution sequence; lower numbers execute first
Example Rules
| Rule Name | Trigger | Conditions | Actions |
|---|---|---|---|
| Auto-assign network tickets | Ticket Created | Category equals "Network" | Assign to NetOps tech; Add tag "network" |
| Escalate critical SLA breaches | SLA Breached | Priority equals CRITICAL | Send Notification |
| Tag VPN tickets | Ticket Created | Tags contains "vpn" | Change Priority to HIGH; Assign to VPN specialist |
| Auto-progress assigned tickets | Ticket Updated | Status equals OPEN; Assignee is not empty | Change Status to IN_PROGRESS |
Webhooks NEW IN 1.8
Webhooks let ForsetiDesk push real-time notifications to external systems whenever key ticket events occur. Each webhook sends an HMAC-SHA256 signed HTTP POST request to a URL you configure, enabling integrations with chat platforms, monitoring tools, custom dashboards, and third-party APIs.
Accessing Webhooks
Go to Admin → Webhooks. The tab displays all configured webhooks with their name, URL, active status, and the events they subscribe to.
Creating a Webhook
- Click + New Webhook.
- Enter a descriptive Name (e.g., “Slack #helpdesk channel”).
- Enter the URL that will receive the POST requests.
- Select one or more Events to subscribe to from the checkbox list.
- Click Save. A unique signing secret is generated and displayed once — copy it immediately. You will not be able to view it again.
Supported Events
| Event | Fires When |
|---|---|
| TICKET_CREATED | A new ticket is created (UI, API, email, or recurring template) |
| TICKET_UPDATED | Any field on an existing ticket changes |
| TICKET_CLOSED | A ticket is approved by QA and closed |
| STATUS_CHANGED | A ticket’s status transitions |
| PRIORITY_CHANGED | A ticket’s priority level changes |
| TICKET_ASSIGNED | A ticket is assigned or reassigned to a technician |
| TICKET_MERGED | A ticket is merged into another |
| QA_SUBMITTED | A ticket is submitted for QA review |
| QA_APPROVED | QA approves a ticket |
| QA_REJECTED | QA rejects a ticket |
| NOTE_ADDED | An internal note is posted on a ticket |
| SLA_BREACHED | A ticket’s SLA deadline is exceeded |
Request Signing
Every webhook request is signed using HMAC-SHA256 with the webhook’s secret. The signature is sent in the X-ForsetiDesk-Signature HTTP header in the format sha256=<hex-digest>. Verify this signature on the receiving end to confirm the request originated from your ForsetiDesk instance and was not tampered with.
Retry Logic
If a webhook delivery fails (non-2xx response or network error), ForsetiDesk retries up to 3 times with increasing delays: immediately, after 30 seconds, and after 5 minutes. All delivery attempts are logged.
Delivery Log
Click any webhook to view its delivery history. Each entry shows the event, timestamp, HTTP status code, success/failure status, number of attempts, and the response body (expandable). Delivery records are automatically cleaned up after 30 days by a daily maintenance job.
Managing Webhooks
- Edit — modify the name, URL, or subscribed events
- Active toggle — temporarily disable a webhook without deleting it
- Regenerate Secret — generate a new signing secret (invalidates the old one immediately)
- Test Ping — send a test payload to verify the endpoint is reachable
- Delete — permanently remove the webhook and all its delivery history
Recurring Tickets NEW IN 1.8
Recurring tickets automate the creation of routine maintenance tickets, scheduled inspections, and periodic review tasks. Define a template once and ForsetiDesk creates tickets automatically on your chosen schedule.
Accessing Recurring Tickets
Go to Admin → Recurring. The tab lists all templates with their name, schedule, next run time, last run time, and enabled status.
Creating a Template
- Click + New Template.
- Enter a Name for internal reference (e.g., “Monthly server patching”).
- Enter the Ticket Title. You can use interpolation variables:
{{date}}— current date (YYYY-MM-DD){{month}}— current month name{{year}}— current year{{day}}— current day of the week{{seq}}— sequential run number
- Enter a Description for the generated tickets.
- Set Priority, Category, Assigned To, and Tags as desired.
- If custom fields are configured, set their values in the template.
- Choose a Schedule Type:
- Daily — runs every day at the specified time
- Weekly — runs on a selected day of the week at the specified time
- Monthly — runs on a selected day of the month at the specified time
- CRON — custom cron expression for advanced scheduling
- Set the Time (24-hour format) for when the ticket should be created.
- Toggle Enabled on and click Save.
How It Works
A background scheduler runs every 60 seconds. It checks all enabled templates and creates tickets for any where the current time has passed the calculated next run time. After each run, the next run time is recalculated based on the schedule.
At execution time, ForsetiDesk validates that the assigned technician and category are still active. If the assignee is inactive, the ticket is created unassigned. If the category is inactive, it is omitted. Generated tickets trigger automation rules, SMTP notifications, and webhooks just like manually created tickets.
Run Audit Log
Each template maintains a run history showing every execution: timestamp, whether it succeeded or failed, the created ticket ID (clickable link), and any error message. This provides accountability and makes it easy to verify that scheduled tickets are being created on time.
Manual Trigger
Click Run Now on any template to immediately create a ticket from that template, bypassing the schedule. This is useful for testing a new template or triggering an ad-hoc instance.
Managing Templates
- Edit — modify any template field including the schedule
- Enable/Disable toggle — pause a template without deleting it
- Delete — permanently remove the template and its run history
Time Tracking NEW IN 1.9
Time tracking lets technicians record the time they spend on each ticket. Entries can be marked as billable or non-billable, and a persistent global timer makes it easy to track time across navigation without losing your running clock.
Recording Time on a Ticket
Open any ticket detail page and scroll to the Time Tracker section (below Internal Notes). You can add time in two ways:
Manual Entry
- Enter the time spent in the Minutes field. You can type plain minutes (e.g.,
45) or useh:mmformat (e.g.,1:30for 90 minutes). - Optionally add Notes describing the work performed.
- Toggle the Billable checkbox as appropriate (defaults to billable).
- Click Add Entry.
Live Timer
- Click the Start Timer button on the ticket’s Time Tracker section.
- A persistent timer bar appears at the top of the screen showing elapsed time in HH:MM:SS format, along with a clickable link back to the ticket.
- Navigate freely — the timer survives page changes and continues running.
- When finished, click Stop on the timer bar. The elapsed time is saved as a new entry on the ticket. Click Cancel to discard the timer without saving.
Summary Bar
Above the time entries list, a summary bar shows the total time, billable time, and non-billable time for the current ticket.
Editing and Deleting Entries
Technicians can edit or delete their own time entries. Administrators can edit or delete any entry. All edits and deletions are recorded in an audit trail that captures the old and new values for changed fields.
Global Time Entries View
Administrators can access a global view of all time entries across all tickets via the Admin panel. This view supports filtering by technician, date range, and billable status, with pagination for large datasets.
Analytics Integration
The Analytics page includes two new charts when time tracking data is available:
- Time by Technician — shows total and billable hours per technician
- Time by Category — shows total and billable hours per ticket category
Both charts support switchable views: Bar chart, Horizontal Bar chart, and Pie chart.
Organizations NEW IN 1.9
Organizations enable MSP-ready multi-tenant support by letting you define client organizations with their own SLA targets, QA policies, default ticket settings, and contact information. Tickets are automatically matched to organizations based on the client’s email domain.
Managing Organizations
Go to Admin → Organizations. The tab lists all organizations with their name, domain, active status, and configured SLA/QA overrides.
Creating an Organization
- Click + New Organization.
- Enter the Name (must be unique).
- Enter the Domain for automatic email matching (e.g.,
acmecorp.com). - Optionally configure Per-Org SLA Targets — response and resolution hours per priority. Leave blank to use the global SLA targets.
- Set the QA Requirement using the three-state toggle:
- Use Global — follows the system-wide QA setting
- Require — always require QA review for this org’s tickets
- Skip — allow techs to close tickets directly without QA for this org
- Optionally set Default Priority and Default Category for new tickets from this org.
- Add Contact details (name, email, phone) and Notes for internal reference.
- Click Save.
Automatic Organization Matching
When a ticket is created with a client email address, ForsetiDesk extracts the email domain and matches it against configured organizations. If a match is found, the ticket is automatically linked to that organization and its defaults (priority, category, SLA targets, QA policy) are applied.
Global Organization Selector
A dropdown in the header bar (right side, near the user menu) lets you filter the entire application by organization. Selecting an organization scopes the dashboard, ticket list, analytics, and QA queue to show only that organization’s tickets. The default is “All Organizations” and the selection persists across navigation.
SLA & QA Resolution Order
- SLA targets: Organization-specific targets are used when set. Otherwise, the global SLA targets apply as a fallback.
- QA requirement: If the organization has a non-null QA override (Require or Skip), that takes precedence. Otherwise, the global QA setting applies.
Organization on Tickets
- Ticket create/edit: An Organization dropdown appears on the form. It auto-selects based on client email domain match.
- Ticket list: An Organization column is displayed and filterable.
- Ticket detail: An Organization badge appears near the client information.
Deactivating an Organization
Toggle the Active switch off to deactivate an organization. Deactivated organizations stop matching new tickets but existing tickets remain linked and unaffected. This is a soft delete that preserves history.
LDAP / Active Directory SSO NEW IN 1.9
LDAP/Active Directory SSO allows your users to authenticate with their existing corporate directory credentials instead of maintaining separate ForsetiDesk passwords. When enabled, users log in with their AD username and password, and ForsetiDesk verifies them against your LDAP or Active Directory server.
How It Works
When a user logs in and LDAP is enabled, ForsetiDesk performs a bind against your configured LDAP server using the user’s credentials. If the bind succeeds, the user is authenticated. On first login, the user account is auto-provisioned in ForsetiDesk — no manual account creation needed.
Configuring LDAP
Go to Admin → Settings and locate the LDAP/AD SSO configuration section. The following fields must be configured:
| Setting | Description | Example |
|---|---|---|
| LDAP Server URL | The URL of your LDAP or AD server. Use ldap:// for plain or ldaps:// for TLS. | ldaps://dc.yourcompany.com:636 |
| Bind DN | Distinguished Name used to bind to the directory for user lookups. | CN=svc_forseti,OU=ServiceAccounts,DC=corp,DC=local |
| Bind Password | Password for the bind DN. Stored encrypted with AES-256-GCM on the server — never stored in plain text. | — |
| Search Base | The base DN under which to search for user accounts. | OU=Users,DC=corp,DC=local |
| Search Filter | LDAP filter to locate the user. Use {{username}} as the placeholder for the login value. | (sAMAccountName={{username}}) |
| TLS / StartTLS | Enable TLS for the connection. Use ldaps:// URL for implicit TLS, or enable StartTLS for explicit negotiation on port 389. | — |
Auto-Provisioning
When a user authenticates via LDAP for the first time and no matching ForsetiDesk account exists, a new account is automatically created. The user’s name and email are pulled from the directory. The default role for auto-provisioned users is configurable (typically TECH or CLIENT). Administrators can change the role after provisioning.
Admin Local Auth Fallback
Even when LDAP is enabled, the built-in ADMIN account always falls back to local password authentication. This ensures you can still access ForsetiDesk if the LDAP server is unreachable. Other users must authenticate against the directory when LDAP is active.
startTLS: true together with an ldaps:// URL — this causes a TLS double-negotiation error. Use one or the other: ldaps:// for implicit TLS, or ldap:// with StartTLS enabled.Bring Your Own Database NEW IN 1.9
Bring Your Own Database (BYODB) lets you point ForsetiDesk at an external PostgreSQL instance you manage instead of using the bundled local database. This is useful for organizations that want to host ForsetiDesk’s data on a managed database service, a dedicated database server, or an existing PostgreSQL cluster with their own backup and HA strategy.
How It Works
You provide a standard PostgreSQL connection string pointing to your external database. ForsetiDesk connects and automatically creates the required tables and schema using its built-in migration tooling. Your existing data infrastructure handles backups, replication, and availability — ForsetiDesk just needs a valid connection.
Setting Up BYODB
- Provision a PostgreSQL database on your target server. ForsetiDesk requires PostgreSQL 14 or later (17 recommended).
- Create a dedicated database and user with full permissions on that database:
CREATE DATABASE forsetidb; CREATE USER forsetiuser WITH PASSWORD 'your_secure_password'; GRANT ALL PRIVILEGES ON DATABASE forsetidb TO forsetiuser;
- Ensure the ForsetiDesk server can reach the database host over the network (check firewalls, security groups, and pg_hba.conf).
- On the ForsetiDesk server, edit
secrets.cfgand update theDATABASE_URL:DATABASE_URL=postgresql://forsetiuser:your_secure_password@db-host:5432/forsetidb - Restart the ForsetiDesk service. On startup, the application detects the external database and automatically creates all required tables.
- Log in and verify the system is operational. Check Admin → Database to confirm the table list shows correctly.
Important Considerations
- The external database must be reachable from the ForsetiDesk server at all times. If the connection drops, the application will be unavailable until connectivity is restored.
- ForsetiDesk’s built-in backup feature (Admin → Backups) uses
pg_dumpand requires the PostgreSQL client binaries on the ForsetiDesk server. For remote databases, ensure the connection string credentials have the necessary permissions forpg_dump. - SSL/TLS connections to the remote database are supported. Append
?sslmode=requireto the connection string if your database requires encrypted connections. - Switching from a local database to BYODB (or vice versa) requires migrating data manually. ForsetiDesk does not provide an automatic migration between database instances.
DATABASE_URL to point to a new empty database means starting fresh — all existing tickets, users, and settings from the previous database are not carried over unless you manually migrate the data using pg_dump and psql.21 Asset Management (ITAM)
Pro Feature
ForsetiDesk's Asset Management module provides a full IT Asset Management (ITAM) solution. Track every piece of hardware and software from procurement through disposal, link assets to tickets, and manage physical locations down to the rack unit.
21.1 Asset Lifecycle Statuses
| Status | Meaning |
|---|---|
| ORDERED | Purchase order placed; asset not yet received |
| RECEIVED | Asset arrived but not yet deployed |
| ACTIVE | In production use |
| IN_MAINTENANCE | Temporarily out of service for repair |
| RETIRED | No longer in use; awaiting disposal |
| DISPOSED | Permanently removed from inventory |
21.2 Asset Fields
Each asset stores the following information, organized by category:
Identity
- Asset Tag — unique identifier (e.g.,
AST-0042) - Name — human-readable label
- Asset Type — category (Desktop Computer, Laptop, Server, etc.)
- Serial Number — manufacturer serial
- Model — device model name
- Manufacturer — brand/vendor
- Status — lifecycle stage (see 21.1)
- Notes — free-text field for additional context
Ownership & Assignment
- End User — the person the device is checked out to (name, email, department, phone). This is an independent record stored alongside the asset, not a system user account.
- Assigned Technician — the IT staff member responsible for this asset
- Organization — linked organization for multi-tenant environments (Enterprise)
- Department — organizational department
Hardware Details
- CPU — processor model
- RAM (GB) — memory amount
- Storage — disk size/type
- IP Address — primary network address
- MAC Address — network interface identifier
- OS / OS Version — operating system
- Firmware Version — firmware/BIOS version
Financial
- Purchase Date
- Purchase Price
- Vendor
- Warranty Expiry
- Lease Expiry
Location
- Location — selected from the location hierarchy (see 21.4)
- Rack Position (U) — starting rack unit (RACK locations only)
- Rack Height (U) — how many rack units the asset occupies
21.3 Custom Fields per Asset Type
Admins can create custom fields scoped to a specific Asset Type (e.g., a “License Key” field for Software License assets only). These appear on asset forms and detail pages only when the relevant type is selected. Manage them under Admin → Settings → Custom Fields and choose “Asset Type” as the entity type.
21.4 Location Hierarchy
Locations form a tree hierarchy, allowing precise placement from site down to individual rack units:
| Level | Type | Additional Fields |
|---|---|---|
| 1 | SITE | Address, City, State, ZIP, Country |
| 2 | BUILDING | Parent: Site |
| 3 | FLOOR | Parent: Building |
| 4 | ROOM | Parent: Floor or Building |
| 5 | RACK | Parent: Room; Rack Units capacity |
Manage locations at Admin → Settings → Locations (visible when Asset Management is licensed).
21.5 Rack Elevation Diagram
For RACK-type locations, the asset detail page shows a visual rack elevation diagram. Each asset in that rack is rendered as a colored block occupying its assigned rack units. This provides an at-a-glance view of rack utilization and asset placement.
- Assets with a Rack Position and Rack Height appear in the diagram
- Hovering over a block shows the asset name and tag
- Unoccupied units appear as empty grey slots
21.6 Asset List & Filtering
Navigate to Assets in the sidebar to see the full asset inventory. The list supports:
- Search by name, asset tag, or serial number
- Filter by status, asset type, location, assigned technician, and organization
- Sortable columns: Asset Tag, Name, Type, Status, Location, Assigned To
- Column visibility toggle — customize which columns appear
- CSV export of filtered results
21.7 Linking Assets to Tickets
Assets can be linked to tickets to track which equipment is affected by an issue:
- Open a ticket and scroll to the Linked Assets section
- Click Link Asset and search by name or asset tag
- Select an operational status for this link: OPERATIONAL, DEGRADED, FULL_FAILURE, or UNKNOWN
- Click Save
The linked asset appears in the ticket sidebar with its status badge and a link to the full asset record. Multiple assets can be linked to a single ticket.
21.8 Asset Types Administration
Asset types define the categories of assets in your inventory. Manage them at Admin → Asset Types:
- Create custom types with a name and Lucide icon
- Set sort order for display in dropdowns
- Deactivate types to hide them from new asset creation (existing assets are unaffected)
- Default types seeded at startup: Desktop Computer, Laptop, Monitor, Printer, Network Device, Server, Mobile Device, Software License, Peripheral, Other
21.9 Asset History
Every change to an asset is recorded in an append-only history log visible on the asset detail page. Each entry captures: the field changed, old value, new value, the user who made the change, and timestamp.
22 CMDB & CI Relationships
Enterprise Feature
The Configuration Management Database (CMDB) module lets you map relationships between Configuration Items (CIs) — your assets — to understand infrastructure dependencies, perform impact analysis, and visualize your entire environment as a network graph.
22.1 Relationship Types
| Type | Forward Label | Reverse Label | Use Case |
|---|---|---|---|
| RUNS_ON | Runs on | Has running | Application runs on a server or VM |
| DEPENDS_ON | Depends on | Is dependency of | Service depends on a database or API |
| CONNECTED_TO | Connected to | Connected to | Network connectivity between devices |
| PART_OF | Part of | Contains | Component is part of a larger assembly |
| HOSTS | Hosts | Hosted on | Physical server hosts a VM or container |
22.2 Adding Relationships
- Open an asset detail page
- Scroll to the CI Relationships section
- Click Add Relationship
- Select the target asset (search by name or tag)
- Choose a relationship type from the dropdown
- Optionally add notes describing the relationship
- Click Save
Relationships are displayed bidirectionally — both the source and target asset show the relationship with the appropriate forward or reverse label.
22.3 Impact Analysis
Impact Analysis answers: “If this asset fails, what else is affected?”
From any asset detail page, click View Impact to launch the Impact Analysis panel. The system performs a recursive traversal (up to 10 hops, max 500 nodes) following DEPENDS_ON, RUNS_ON, and HOSTS relationships to build a dependency tree of everything that relies on the selected asset.
The result shows a hierarchical tree with:
- Asset name, tag, status, and type at each node
- The relationship type that caused the dependency
- Depth level in the chain
A truncated warning appears if the traversal hit the 500-node safety cap.
22.4 Topology Graph
Navigate to CMDB in the sidebar to access the full network topology visualization (Admin and Tech roles only).
Controls
| Control | Description |
|---|---|
| Search | Filter nodes by name, tag, or serial number |
| Asset Type | Show only assets of a specific type |
| Relationship Type | Show only edges of a specific relationship type |
| Status | Filter assets by lifecycle status (default: excludes RETIRED/DISPOSED) |
| Organization | Filter by organization (Enterprise) |
| Assigned To | Filter by responsible technician |
| Root Asset + Depth | BFS traversal from a specific asset up to N hops (1–10, default 3) |
Graph Interaction
- Drag nodes to rearrange the layout
- Scroll to zoom in/out
- Click a node to open the asset detail page in a new tab
- Edges are labeled with the relationship type
- Node color indicates asset type; node size indicates connectivity
23 Change Management
Pro Feature
ForsetiDesk's Change Management module implements an ITIL-aligned change control process. Every planned modification to your IT environment goes through a structured workflow: request → review → approval → implementation → closure.
23.1 Change Types
| Type | Approval Required | Use Case |
|---|---|---|
| STANDARD | Auto-approved on submit | Pre-approved, low-risk, routine changes (e.g., scheduled patch Tuesday) |
| NORMAL | Manual approval by designated approvers | Planned changes with moderate risk requiring review board sign-off |
| EMERGENCY | Manual approval (expedited) | Urgent changes needed to restore service; bypass normal scheduling |
23.2 Change Lifecycle
| Status | Meaning | Who Can Advance |
|---|---|---|
| DRAFT | Change is being authored | Creator (ADMIN/TECH) |
| SUBMITTED | Submitted for review; STANDARD auto-advances to APPROVED | Creator |
| UNDER_REVIEW | Being evaluated by the change board | ADMIN only |
| APPROVED | Approved for implementation | ADMIN only |
| REJECTED | Change denied; returned with reason | ADMIN only |
| SCHEDULED | Approved and has a scheduled implementation window | ADMIN/TECH |
| IMPLEMENTING | Change is actively being applied | ADMIN/TECH |
| COMPLETED | Implementation finished successfully | ADMIN/TECH |
| FAILED | Implementation attempted but did not succeed (rollback may have occurred) | ADMIN/TECH |
| CLOSED | Post-implementation review done; change archived | ADMIN only |
23.3 Creating a Change Request
- Navigate to Changes in the sidebar and click New Change Request
- Fill in the Title and Description (what is being changed and why)
- Select Change Type: Standard, Normal, or Emergency
- Set Risk Level and Impact Level: LOW / MEDIUM / HIGH / CRITICAL
- Write the Implementation Plan — step-by-step instructions
- Write the Rollback Plan — how to revert if the change fails
- Write the Test Plan — how to verify success
- Set the Scheduled Start and Scheduled End (the planned maintenance window)
- Add Required Approvers (for Normal and Emergency types)
- Link related Tickets and Assets
- Click Create to save as DRAFT, or Submit to immediately advance to SUBMITTED
23.4 Risk & Impact
| Level | Risk Definition | Impact Definition |
|---|---|---|
| LOW | Minimal chance of failure or side effects | Affects a single user or non-critical system |
| MEDIUM | Some possibility of disruption with mitigation steps | Affects a department or non-core service |
| HIGH | Significant possibility of disruption; requires careful execution | Affects multiple departments or a core service |
| CRITICAL | High probability of major disruption; emergency change board review required | Affects the entire organization or production systems |
23.5 Approval Workflow
For Normal and Emergency changes, each required approver must record a decision:
| Decision | Meaning |
|---|---|
| PENDING | Awaiting approver decision (default) |
| APPROVED | Approver has signed off on this change |
| REJECTED | Approver has denied this change |
| DEFERRED | Approver requests more information or a later review date |
An ADMIN must advance the overall change status. Individual approver decisions are advisory; the ADMIN reviews all decisions and sets the change to APPROVED or REJECTED accordingly.
23.6 Linked Tickets & Assets
Changes can reference related tickets and assets:
- Linked Tickets — tickets that describe the problem this change addresses, or testing tickets created to verify success
- Linked Assets — assets that will be affected by or are the subject of this change
Links can be added or removed at any time while the change is not CLOSED.
23.7 Change Numbering
Change requests are automatically assigned a sequential number (e.g., CHG-0001). Configure the format at Admin → Settings → General:
- Prefix — default
CHG- - Pad Length — zero-padding width, default 4 digits
- Next Sequence — manually set if migrating from another system
23.8 History & Audit Trail
Every status transition, field edit, and approver decision is recorded in the change history log. Each entry captures the user, timestamp, action taken, and (for field edits) the old and new values. The history log is immutable and append-only.
Problem Management
Problem Management helps your team identify and address the root causes behind recurring incidents. A Problem is a cause (or potential cause) of one or more incidents — it may be raised proactively or reactively after a pattern of tickets is detected.
Problem Statuses
| Status | Description |
|---|---|
| OPEN | Problem identified but investigation has not started |
| INVESTIGATING | Active investigation underway — team is gathering data |
| ROOT_CAUSE_IDENTIFIED | Root cause has been determined; working toward resolution |
| KNOWN_ERROR | Documented with a known workaround; appears in the KEDB |
| RESOLVED | Permanent fix has been applied |
| CLOSED | Verified closed; no further action required |
Creating a Problem
- Click Problems in the sidebar, then click New Problem.
- Enter a title, description, priority, and optionally assign it to a technician.
- Save — the problem is created with status OPEN and a sequential problem number (e.g., PRB-0001).
Linking Incidents & Change Requests
On the Problem detail page, use the Linked Incidents panel to associate existing tickets with the problem. Use Linked Changes to connect related change requests. These links provide full traceability between root cause, affected incidents, and the change that resolved the problem.
Root Cause Analysis (RCA)
Open the RCA tab on the problem detail page and select a method:
| Method | Description |
|---|---|
| Five Whys | Iterative questioning to drill down to the root cause |
| Fishbone (Ishikawa) | Categorized cause-and-effect diagram |
| Fault Tree | Top-down logical diagram of failure causes |
| Timeline | Chronological sequence of events leading to the problem |
| Custom | Free-form narrative RCA for non-standard approaches |
Promoting to Known Error
When a workaround is identified but a permanent fix is not yet available, advance the problem to KNOWN_ERROR status. A workaround description is required before this transition is allowed. Once marked as a Known Error, the problem appears in the Known Error Database (KEDB).
Problem Detail Page
The problem detail page shows: metadata (status, priority, assignee), linked incidents count, linked change requests, RCA summary, workaround text, a full history timeline of all updates, and file attachments.
Known Error Database
The Known Error Database (KEDB) is a filtered view of all problems promoted to KNOWN_ERROR status. It serves as a quick-reference library of documented workarounds that technicians can consult while a permanent fix is in progress.
Searching Known Errors
Use the search bar at the top of the KEDB to filter entries by keyword. The search matches the problem title, description, and workaround text. Results update as you type.
KEDB Entry Fields
| Field | Description |
|---|---|
| Problem Number | Sequential identifier (e.g., PRB-0042) |
| Title | Short description of the known error |
| Workaround | Steps to mitigate impact until the permanent fix is applied |
| Linked Incidents | Count of tickets associated with this problem |
Using the KEDB
When a client reports an issue matching a known error, apply the documented workaround immediately and inform the client that a permanent fix is under investigation. Clicking a KEDB entry opens the full Problem detail page with linked incidents and RCA details.
Service Catalog
The Service Catalog is a self-service portal where users browse available IT services and submit structured requests. Each catalog item has a configurable request form, an estimated fulfillment time, and an optional approval chain.
Browsing the Catalog
Navigate to Service Desk → Catalog. Items are displayed as cards showing an icon, title, description, and estimated fulfillment time. Click a card to begin a request.
Pre-Seeded Catalog Items
| Catalog Item | Category | Est. Fulfillment |
|---|---|---|
| New Hire Onboarding | New Hire | 3 business days |
| System Access Request | Access Request | 1 business day |
| Software Installation Request | Software Request | 2 business days |
Submitting a Request
- Click a catalog item card to open its request form.
- Fill in all required fields (marked with an asterisk *).
- Click Submit Request. The request enters the approval workflow if configured, or goes directly to fulfillment if no approval is required.
Admin: Creating Catalog Items (Enterprise)
Enterprise administrators can create custom catalog items from Admin → Service Catalog. Configure the name, description, icon, category, estimated fulfillment days, form fields (via the form builder), approval chain, and active toggle.
Visual Form Builder
The form builder lets administrators design structured multi-section request forms without writing code. Forms are organized into named sections, each containing any number of typed fields.
Field Types
| Type | Description |
|---|---|
| Text | Single-line free text input |
| Textarea | Multi-line free text input |
| Dropdown | Single-select from a predefined list of options |
| Multi-select | Multiple selections from a predefined list |
| Date | Date picker |
| Checkbox | Boolean true/false toggle |
| Number | Numeric input |
| Email address with format validation | |
| Phone | Phone number input |
| URL | Web address input |
| File Upload | Attachment upload field |
| Heading | Non-input section heading for visual grouping |
| Paragraph | Non-input instructional text block |
| Divider | Horizontal rule for visual separation |
Conditional Fields
Any field can be shown or hidden based on the value of a preceding field. Select Show when and pick the controlling field plus the trigger value. Conditional logic is evaluated in real time as the user fills out the form.
Sections
Group related fields into named sections. Sections appear as collapsible panels on the request form. Drag sections and fields to reorder them. Click the pencil icon on any field to edit its label, placeholder, options, and required status inline.
Visual Workflow Designer
The Workflow Designer is a drag-and-drop canvas for designing fulfillment workflows attached to catalog items. It defines what happens after a request is approved, complementing the Approval Chain which defines the pre-approval steps.
Node Types
| Node | Description |
|---|---|
| Start | Entry point — workflow begins here when a request is approved |
| Task | A manual fulfillment step with an assignee and description |
| Approval | In-workflow approval gate (separate from the pre-submission approval chain) |
| Notification | Send an email or push notification to a user or role |
| Condition | Branching node — routes to different paths based on field values or prior step outcomes |
| Parallel | Split execution into concurrent branches that rejoin at a Merge node |
| Timer | Pause execution for a configurable duration; triggers escalation if a task is not completed in time |
| End | Terminal node — marks the workflow complete |
Service Requests
A Service Request is a formal request for a predefined IT service from the Service Catalog. Requests follow a structured approval and fulfillment workflow with full audit history.
Service Request Lifecycle
| Status | Description |
|---|---|
| DRAFT | Saved but not yet submitted |
| PENDING_APPROVAL | Submitted; waiting for approver action |
| APPROVED | All approvers approved; ready for fulfillment |
| REJECTED | An approver rejected the request |
| IN_FULFILLMENT | Fulfillment work is actively underway |
| FULFILLED | Work is complete; pending closure |
| CLOSED | Fully closed and archived |
| CANCELLED | Cancelled by the requestor before fulfillment |
Approval Chain Progress
The request detail page displays a visual stepper showing each approval step in sequence. Each step shows the approver, their decision (Pending / Approved / Rejected), and timestamp. Approval is sequential — step 2 activates only after step 1 is approved.
Approving or Rejecting
If you are the designated approver for the current step, Approve and Reject buttons appear on the request detail page. Add optional notes with your decision. Admins can act on any step regardless of designation.
My Approvals View
Navigate to Service Desk → My Approvals to see all pending requests waiting for your approval action — a single place to review and act without searching individual requests.
Fulfillment & Ticket Generation
Once all approvals are granted, the request moves to APPROVED. A fulfillment technician marks it IN_FULFILLMENT, optionally generates a linked ticket to track the work, then marks it FULFILLED and finally CLOSED.
Viewing Requests
Navigate to Service Desk → Requests. CLIENT users see only their own requests (My Requests). Staff users see all requests. Use the status filter to narrow the list.
Cancellation
Requestors can cancel their own requests while in DRAFT or PENDING_APPROVAL status. Admins can cancel any request that has not yet reached IN_FULFILLMENT.
Approval Chains
Approval Chains define the sequence of approvers a service request must pass through before moving to fulfillment. Chains are configured once and assigned to catalog items. Approval is sequential — each step must be approved before the next activates.
Approver Types
| Approver Type | Description |
|---|---|
| Specific User | A named individual. That exact user must approve the step. |
| Role | Any user with the specified role (ADMIN, TECH, or QA) can approve. |
| Manager | The manager of the requestor — set via the Manager field in Admin → Users. |
Creating an Approval Chain
- Go to Admin → Approval Chains and click New Chain.
- Give the chain a name (e.g., “Standard IT Approval”).
- Add steps in order. For each step, select the approver type and target.
- Save the chain, then assign it to a catalog item under Admin → Service Catalog (Enterprise).
How Sequential Approval Works
- Step 1 becomes active; the designated approver is notified.
- If approved, Step 2 activates and its approver is notified.
- This continues until all steps are approved — the request then moves to APPROVED.
- If any step is rejected, the entire request moves to REJECTED and no further steps are evaluated.
Dashboard Customization
The ForsetiDesk dashboard supports fully customizable widget layout. Each user can independently arrange, resize, add, and remove widgets. Layout changes are saved to your profile and persist across sessions and devices.
Entering Edit Mode
Click the Edit Dashboard button at the top-right of the dashboard. A dashed border appears around each widget, a drag handle appears in each widget header, and resize handles appear at the corners.
Moving Widgets
In edit mode, grab the drag handle (☰) in a widget’s header and drag it to the desired position. The grid uses free-form placement — widgets do not auto-compact. If you drag to a space already occupied, the move is cancelled and the widget snaps back.
Resizing Widgets
Drag the resize handle at the bottom-right corner of any widget to change its size. Minimum and maximum dimensions are enforced per widget type.
Adding Widgets
Click Add Widget (visible in edit mode) to open the widget picker. Select a widget to add it to the dashboard at the first available position.
Removing Widgets
In edit mode, click the × button in the top-right corner of any widget to remove it. The widget is not permanently deleted — it can be re-added via Add Widget at any time.
Saving and Discarding Changes
- Save Layout — saves your current arrangement to your user profile; persists across logins and devices.
- Cancel — discards all unsaved changes in the current edit session and reverts to the last saved layout.
- Reset Layout — returns the dashboard to the system default layout.
30 Troubleshooting
30.1 Login & Access Issues
Cannot log in — “Invalid credentials”
- Verify the email address is typed correctly (case-insensitive).
- Confirm the password is correct. If forgotten, use Forgot Password on the login page to receive a reset link via email.
- If the account was recently created by an admin, use the temporary password provided. You will be prompted to change it immediately.
- If LDAP/AD SSO is enabled, ensure your Active Directory password is current and the account is not locked in AD.
Account locked — “Too many login attempts”
- The rate limiter triggers after 5 failed attempts per IP+email within 15 minutes.
- Wait 15 minutes, then try again.
- If the lockout persists, contact your system administrator to verify there is no IP conflict or proxy issue routing all traffic from the same source IP.
- Localhost/loopback addresses are exempt from the rate limit (development environments).
Forced password change loop
- If you are redirected to the password change page on every login, the admin has set
mustChangePassword = trueon your account. - Complete the password change to clear the flag. If the loop persists after changing, clear your browser cookies and log in again.
LDAP login fails — “LDAP authentication failed”
- Check that the LDAP server is reachable from the ForsetiDesk server (ping the LDAP host; verify firewall rules for port 389 or 636).
- Verify the Base DN and Search Filter match your AD structure. Use Admin → LDAP/AD → Test Connection to confirm bind credentials work.
- Use Test Authentication with a known AD username and password to isolate whether the problem is the bind or the user search.
- Ensure the bind account has read access to the user objects in the specified Base DN.
- ADMIN accounts always authenticate locally, regardless of LDAP settings. If an ADMIN cannot log in, the issue is with the local password, not LDAP.
- Check the ForsetiDesk service logs at
C:\Program Files (x86)\ForsetiDesk\logs\for detailed LDAP error codes.
30.2 Ticket Issues
Ticket not appearing in list
- Check active filters: status, priority, category, assigned-to. A heavily filtered view may exclude the ticket.
- CLIENT role users only see tickets matching their email address (
clientEmailfield). If the ticket was created with a different email, it will not appear. - Merged tickets (status
MERGED) do not appear in the main list. Search by ticket ID or look in the target ticket's “Merged Tickets” section. - If you were recently assigned a ticket, refresh the page or clear the filter.
Cannot close ticket — QA required
- When QA workflow is enabled (globally or per-organization), tickets must be submitted for QA and approved before closing.
- Tech users: use Submit for QA to advance the ticket to
PENDING_QA. - If a specific organization has QA disabled (
requireQA = false), tickets for clients in that organization can be closed directly. - Admins can bypass QA and close tickets directly regardless of QA settings.
SLA deadline missing from ticket
- SLA must be enabled under Admin → Settings → General → SLA Enabled.
- SLA deadlines are set at ticket creation time. Enabling SLA after a ticket was created will not back-populate deadlines.
- If the organization has custom SLA targets, those override global targets for tickets with a matching client email domain.
- Verify the ticket has a
priorityset — SLA targets are per-priority.
Custom fields not appearing on ticket form
- Custom fields are scoped to a Category. Select the correct category on the ticket form for the relevant custom fields to appear.
- Verify the custom field is Active in Admin → Settings → Custom Fields.
- Custom fields require a Pro license. Confirm the license is installed and valid.
30.3 Email & Notification Issues
Outbound emails not sending
- Navigate to Admin → Communications → Notifications and verify SMTP settings (host, port, credentials, TLS mode).
- Use Send Test Email to confirm the SMTP connection works. Check the test result for specific SMTP error codes.
- Common causes: incorrect port (25, 465, or 587 depending on TLS), app password required for Gmail/Microsoft 365, firewall blocking outbound SMTP.
- Ensure Sender Email matches the authenticated account or an allowed sender alias.
- Notifications fire asynchronously — a ticket operation succeeds even if the email fails. Check server logs for
[Notifications]error lines.
Email-to-ticket (IMAP) not creating tickets
- Requires a Pro license with the
email_to_ticketfeature. - Check IMAP settings under Admin → Communications → Email Inbox. Test the connection and verify the mailbox is accessible.
- Confirm the poll interval is set and the poller is running (check Poll Status indicator).
- Emails already processed are tracked by
emailMessageId. Duplicate emails from the same Message-ID will be silently skipped. - Check that the mailbox folder being polled is correct (default: INBOX).
- Gmail users: enable IMAP in Gmail settings and use an App Password, not the account password.
Password reset email not arriving
- Confirm SMTP is configured and working (send a test email first).
- Check the user's spam/junk folder.
- Password reset tokens expire after 1 hour. If the link has expired, request a new one.
- Reset links are single-use. If the link was already clicked (even if the reset was not completed), it is invalidated.
30.4 License & Feature Issues
“Feature not available on your plan”
- Install or upgrade your license under Admin → Settings → License.
- After installing a new license, refresh the browser. License state is read on login; a page refresh is sufficient for most features.
- Verify the license is not expired (Admin → Settings → License → Status shows expiry date).
- Machine ID binding: the license is tied to the machine where ForsetiDesk is installed. If you reinstall on a new server, contact NTG for a license transfer.
“User limit reached”
- Core (Free) tier allows a maximum of 3 active users. Deactivate unused accounts or upgrade to Pro.
- Pro/Enterprise: the
maxUsersfield in the license JWT determines the limit. Contact NTG to add seats. - Deactivated users do not count against the limit.
License shows as invalid after server migration
- Licenses are machine-ID bound. The machine ID is derived from the server's hardware identifiers.
- Moving ForsetiDesk to a new physical server or VM with different hardware will invalidate the license.
- Contact [email protected] with your machine ID (visible in Admin → Settings → License) to request a reissue.
30.5 Automation, Webhook & Recurring Ticket Issues
Automation rule not triggering
- Verify the rule is Active in Admin → Automation → Rules.
- Check that the trigger event matches what you expect (TICKET_CREATED vs. TICKET_UPDATED).
- Conditions are evaluated with AND logic — all conditions must match for actions to fire.
- Automation fires asynchronously after the ticket operation completes. There may be a brief delay.
- Check server logs for
[Automation]error lines if actions appear to not execute.
Webhook deliveries failing
- Check the delivery log in Admin → Communications → Webhooks → Delivery Log for HTTP status codes and error responses.
- Verify the endpoint URL is reachable from the ForsetiDesk server. Internal/private URLs are only accessible if the server has network access to them.
- ForsetiDesk retries failed deliveries up to 3 times (0s, 30s, 5 min backoff). Check the
attemptscolumn in the delivery log. - If receiving a 401, verify the HMAC-SHA256 signature verification on your endpoint. The signature is in the
X-ForsetiDesk-Signatureheader (format:sha256=<hex>). - Webhook secrets are shown only once at creation. If lost, use Regenerate Secret and update your endpoint.
Recurring ticket not generating
- Confirm the template is Enabled in Admin → Automation → Recurring Tickets.
- The cron runner checks every 60 seconds. New templates may take up to 1 minute to generate their first ticket after
nextRunAtpasses. - Check Run History on the template for FAILED entries and their error messages.
- Common failure causes: assigned category or technician was deactivated (template falls back to OPEN/unassigned), invalid custom CRON expression.
- Validate custom CRON expressions using a CRON validator before saving.
30.6 Time Tracking Issues
Timer bar not appearing
- The timer bar only appears when a timer is actively running. Click Start Timer on any ticket to activate it.
- Only one timer can run at a time. If a timer is already running on another ticket, a link to that ticket is shown instead of the Start button.
- The timer bar persists across navigation but is reset on a full page reload. If you accidentally reload, any unsaved time is lost.
Time entry not saving
- Minimum 1 minute required. The form will not accept 0.
- Accepts plain minutes (e.g.,
45) or h:mm format (e.g.,1:30for 90 minutes). - TECH users can only edit or delete their own entries. ADMIN users can edit/delete any entry.
- Time tracking requires a Pro license.
30.7 Organization Issues (Enterprise)
Organization not auto-populating on ticket
- Auto-population requires the organization's Domain field to be set (e.g.,
acmecorp.com). - The domain match is triggered when a
clientEmailis entered on the Create Ticket form. The system checks if the email domain matches any active organization. - The organization must be Active. Deactivated organizations are excluded from domain matching.
- Domain matching is case-insensitive but requires an exact domain match (subdomains do not match the parent domain).
Organization SLA targets not applying
- Org SLA targets are applied only when the organization is resolved at ticket creation time. Changing the organization after creation does not recalculate SLA deadlines.
- Verify the organization's SLA Targets are set for the relevant priorities in Admin → Settings → Organizations → Edit.
- Global SLA must be enabled (Admin → Settings → General → SLA Enabled) for any SLA targets to apply.
30.8 LDAP / AD SSO Issues
Cannot save LDAP configuration
- Requires an Enterprise license with the
ldapfeature. Verify license status. - All required fields must be filled: Server Host, Port, Base DN, Bind DN, Bind Password.
LDAP users cannot change their password
- By design — LDAP-authenticated users manage their passwords in Active Directory, not in ForsetiDesk.
- The “Change Password” option is hidden for users with
authSource = LDAP. - If a user needs a password change, direct them to their AD administrator or self-service AD portal.
New LDAP user provisioned with wrong role
- The default role for auto-provisioned LDAP users is set in Admin → LDAP/AD → Default User Role.
- Change the role in Admin → Users after the user's first login.
- ADMIN role is never auto-assigned via LDAP provisioning for security reasons.
30.9 BYODB (Bring Your Own Database) Issues
External database connection test fails
- Verify the host, port, database name, username, and password are correct.
- Ensure the PostgreSQL server accepts remote connections: check
pg_hba.confandpostgresql.conf(listen_addresses). - For SSL mode verify-full, the server's SSL certificate must be trusted by the ForsetiDesk server's CA store.
- The test requires the user to have
CREATE TABLEprivilege on the target database. - Minimum supported PostgreSQL version is 14.
Schema push fails on external database
- The connecting user must have DDL privileges (
CREATE,ALTER,DROPon the schema). - If using a DBA-managed schema approach, provide the DBA with
installer/schema.sqland apply it manually instead of using the automated push. - After a successful schema push, restart the ForsetiDesk service for the new DATABASE_URL to take effect.
30.10 Asset Management Issues
Asset tag not auto-generating
- Asset tags are generated automatically (e.g.,
AST-0001) when creating a new asset. If you see a blank tag field, type a custom tag or save with the default. - Asset tags must be unique. If a conflict is reported, check for an existing asset with the same tag (including retired/disposed assets).
Custom fields not appearing on asset form
- Asset custom fields are scoped to an Asset Type. Select the correct asset type on the form for the relevant custom fields to appear.
- Verify the custom field is Active and the Entity Type is set to the correct asset type in Admin → Settings → Custom Fields.
Rack elevation diagram not showing
- The rack diagram only appears when viewing an asset whose Location is of type RACK.
- Assets must have both Rack Position and Rack Height set to appear in the diagram.
- If the rack appears empty, verify that other assets at that location have rack position/height values filled in.
Asset not appearing in ticket link search
- Only Active assets (status = ACTIVE) appear in the ticket asset link search by default.
- If you need to link a non-active asset, first update its status to ACTIVE, link it, then revert the status if needed.
- Search matches on asset name, asset tag, and serial number.
Cannot delete an asset
- Assets are soft-deleted (set to inactive) rather than permanently removed to preserve historical data and ticket links.
- To remove an asset from all views, set its status to DISPOSED and deactivate it. The asset will no longer appear in standard list views.
30.11 CMDB Issues (Enterprise)
“This relationship already exists” error
- Each combination of source asset, target asset, and relationship type must be unique.
- Check the existing relationships on both assets — the relationship may already be defined on the other asset (relationships are bidirectional in display but stored unidirectionally).
- Use a different relationship type or a different direction if the intent is different.
Topology graph shows no nodes
- By default, RETIRED and DISPOSED assets are excluded. Change the Status filter to ALL to include them.
- Verify at least one relationship exists between assets. The topology graph shows only assets connected by relationships (unless using Root Asset mode).
- In Root Asset mode with no relationships, only the root asset itself appears as an isolated node.
Impact analysis returns empty tree
- Impact analysis traverses only DEPENDS_ON, RUNS_ON, and HOSTS relationship types (not CONNECTED_TO or PART_OF).
- The traversal follows relationships pointing to the selected asset (i.e., it finds what depends on this asset). If no other assets have a DEPENDS_ON or RUNS_ON relationship targeting the selected asset, the tree will be empty.
- Check that the relationships are defined in the correct direction on the asset detail page.
30.12 Change Management Issues
Change number not generating
- Change numbers are assigned at creation time using the
change_numberingsetting. - If numbers appear as
CHG-0000or are missing, check Admin → Settings → General → Change Numbering to verify the prefix, pad length, and next sequence are configured.
Cannot advance change status
- Status transitions are enforced. The allowed transitions are:
- DRAFT → SUBMITTED
- SUBMITTED → UNDER_REVIEW or APPROVED (STANDARD auto-approves)
- UNDER_REVIEW → APPROVED or REJECTED (ADMIN only)
- APPROVED → SCHEDULED or IMPLEMENTING
- SCHEDULED → IMPLEMENTING
- IMPLEMENTING → COMPLETED or FAILED
- COMPLETED / FAILED → CLOSED (ADMIN only)
- REJECTED → DRAFT (to revise and resubmit)
- Transitions requiring ADMIN: UNDER_REVIEW, APPROVED, REJECTED, CLOSED.
- If the button is missing, your role does not permit the transition from the current status.
Standard change not auto-approving
- Auto-approval happens when the change is submitted (status moves from DRAFT to SUBMITTED). If you saved as DRAFT and did not click Submit, the change remains in DRAFT.
- Click Submit on the change detail page. A Standard change will immediately transition to APPROVED.
30.13 Problem Management Issues
Problem status won’t transition to Known Error
- Transitioning to KNOWN_ERROR status requires a workaround to be documented on the problem record. Fill in the Workaround field before attempting this status transition.
- Ensure all required fields are saved before changing status.
RCA not saving
- The RCA Summary field is required. Ensure it is filled in before saving the RCA record.
- Select an RCA method before filling in methodology-specific fields.
30.14 Service Request Issues
Cannot submit a service request
- Check that all required form fields are filled in. Required fields are marked with an asterisk (*).
- Verify the catalog item is still active. If the item was deactivated after you opened the form, submission will be blocked.
Approval chain stuck — no approver notified
- Verify the designated approver exists and is active in Admin → Users.
- For MANAGER-type approver steps, verify the requestor has a manager assigned in Admin → Users. If no manager is set, the step cannot activate.
- Confirm the approval chain is correctly configured under Admin → Approval Chains and each step has a valid approver defined.
Cannot approve a service request
- Only the designated approver for the current active step can act on it. If you are not that approver, the Approve/Reject buttons will not appear.
- ADMIN users can override and act on any step regardless of who is designated.
- Check the approval stepper on the request detail page to confirm which user or role is expected to approve the current step.
30.15 Dashboard Issues
Dashboard layout resets after navigation or login
- Ensure you clicked Save Layout before leaving edit mode. Clicking Cancel discards all unsaved changes from that session.
- If the layout still resets after saving, clear your browser cache and reload. Stale cached state can occasionally interfere with preference loading.
- Layout is saved per-user to the database. Logging in as a different user will show that user’s layout.
Widget shows “requires license” or is not available in the picker
- Some widgets require a Pro or Enterprise license (e.g., asset charts, change calendar). Verify your license is installed and active under Admin → Settings → License.
- Some widgets are role-restricted and will not appear in the picker for users without the required role.
30.16 Infrastructure & Service Issues
ForsetiDesk service not starting
- Check Windows Event Viewer → Application for errors related to
ForsetiDeskornode.exe. - Verify the
secrets.cfgfile exists atC:\Program Files (x86)\ForsetiDesk\config\secrets.cfgand contains validDATABASE_URL,JWT_SECRET, andPORTvalues. - Confirm PostgreSQL 17 service is running (Services → postgresql-x64-17).
- Test the database connection: open a command prompt and run
psql -U forsetiuser -d forsetidb -h localhost. - Check Node.js version:
node --versionfrom the installation directory. Requires Node.js 20+.
Port conflict — service starts but UI is not accessible
- Default port is 4000. If another service is using port 4000, change it under Admin → Settings → General → Port and restart the service.
- Identify the conflicting process:
netstat -ano | findstr :4000in Command Prompt, then check the PID in Task Manager.
Database migration / schema out of sync
- After upgrading ForsetiDesk, the installer runs
prisma db pushautomatically. - If tables are missing or columns are out of sync after a manual update, run from the backend directory:
npx prisma db pushfollowed bynpx prisma generate. - Stop the Node.js process before running
prisma generateon Windows to avoid EPERM file lock errors on the query engine DLL.
30.17 Log Files
ForsetiDesk logs to the Windows service output captured by NSSM. Log files are located at:
C:\Program Files (x86)\ForsetiDesk\logs\Forseti-out.log— stdout (normal output)C:\Program Files (x86)\ForsetiDesk\logs\Forseti-err.log— stderr (errors and warnings)
Key log prefixes to search for:
[Startup]— initialization, database connection, seeding[IMAP]— email-to-ticket poller activity[Notifications]— outbound SMTP results[Automation]— rule engine execution[Webhooks]— delivery attempts and results[Recurring]— recurring ticket cron results[LDAP]— LDAP connection and auth attempts[BYODB]— external database operations
30.18 Manual Backup Commands
If the Admin UI backup fails, run manually from Command Prompt (as Administrator):
"C:\Program Files\PostgreSQL\bin\pg_dump.exe" -U forsetiuser -d forsetidb -F c -f "C:\BackupForseti_manual.dump"
To restore:
"C:\Program Files\PostgreSQL\bin\psql.exe" -U forsetiuser -d forsetidb -f "C:\BackupForseti_manual.dump"
For BYODB (external database), replace localhost with your external DB host and set PGPASSWORD environment variable or use a .pgpass file to avoid password prompts.
30.19 Getting Support
- Email: [email protected]
- Website: forsetidesk.com
- Include your license edition, version number (shown in Admin → Settings → About), and relevant log excerpts when reporting issues.
30.20 Mobile App
- Cannot connect to server
- Verify the server URL includes
https://and the correct port (e.g.,https://helpdesk.example.com). Ensure the server is reachable from the mobile device's network. If using a self-signed certificate, install the CA certificate first. - Self-signed certificate error
- Tap Download & Install Certificate on the mobile login screen, then follow your device's trust prompt. On iOS, also go to Settings → General → About → Certificate Trust Settings and enable the ForsetiDesk CA. On Android, go to Settings → Security → Install Certificate.
- Push notifications not received
- Check Admin → Users → [user] → Mobile Devices to confirm a push token is registered. Ensure the Expo Push Notification service is reachable from the server. Check that mobile access is enabled for the user account.
- Mobile access disabled
- Contact your administrator to enable mobile access. Admins can toggle this per user under Admin → Users → Edit User → Mobile Access.
- App shows blank screen after login
- Force-close and reopen the app. If the issue persists, log out and log back in. Ensure the server's API is reachable and returning valid JSON (check
/healthendpoint).
30.21 HTTPS / TLS
- Let's Encrypt request fails
- Ensure your DNS A record points to your server's public IP address. Port 80 must be forwarded through your firewall/router to the ForsetiDesk server. The domain must be publicly resolvable — Let's Encrypt cannot validate internal/private domains. Check for firewall rules blocking inbound port 80.
- Browser shows "Not Secure" with self-signed certificate
- Install the ForsetiDesk CA certificate in your system or browser trust store. Download it from
https://your-server/ca-cert. On Windows, double-click the .pem file and install to "Trusted Root Certification Authorities". On macOS, add to Keychain Access and set to "Always Trust". - Port 443 in use
- Another service is already using port 443. Identify it with
netstat -ano | findstr :443in an elevated command prompt, then stop the conflicting service. Common causes: IIS, another web server, or a VPN client. - Certificate expired
- Self-signed certificates expire after 1 year. Let's Encrypt certificates renew automatically if the server is internet-accessible on port 80. For self-signed certs, go to Admin → Security → TLS / Certificates and click Generate New Certificate. A service restart is required after renewal.
- HTTPS enabled but browser redirects fail
- Ensure TLS Enabled is toggled on in Admin → Security → TLS / Certificates and the service has been restarted. The HTTP-to-HTTPS redirect runs on the configured PORT (default 4000) while HTTPS runs on 443.
31 Mobile App NEW IN 1.11
Audience: Technicians & Managers — Pro License Required
Overview
ForsetiDesk Mobile is available for Android and iOS. It gives field technicians quick access to their assigned tickets, asset inventory, and knowledge base from anywhere — over WiFi or cellular.
Installation & Setup
- Download the app from Google Play or the App Store, or install the APK provided by your administrator.
- Open the app and enter your ForsetiDesk server URL (e.g.,
https://desk.yourcompany.com). - Log in with your ForsetiDesk credentials.
- If your server uses a self-signed certificate: tap Download & Install Certificate on the login screen and follow the device-specific prompts.
- Allow push notification permission when prompted.
Navigation — 4-Tab Layout
| Tab | Contents |
|---|---|
| My Work | Your assigned tickets. Quick stats: Open, In Progress, Overdue counts. Create new tickets. |
| Assets | Search and filter asset inventory. Scan barcodes/QR codes to find assets instantly. |
| Knowledge | KB articles and Known Errors for field reference. |
| Account | Server info, push notification status, debug mode toggle, Help & Manual link, sign out. |
Working Tickets
Tap any ticket to open the full detail view. The ticket is organized in 9 collapsible sections:
- Info — status, priority, category, assigned to
- Details — description, client info
- Troubleshooting Notes
- Resolution Notes
- Internal Notes — private, not visible to clients
- Time Tracking — log time entries directly from the field
- Linked Assets
- Linked Items — linked tickets, problems, change requests
- History — append-only audit trail
Tap any editable field to modify it. Changes are saved immediately on each field update.
Routing Actions (TECH Role)
- Escalate — assigns the ticket to your supervisor (manager) and sends them a push notification.
- Route to Team — unassigns the ticket and places it in the category queue for a dispatcher.
- Flag — marks the ticket for dispatcher attention without changing assignment.
Team View (MANAGER Role)
Managers see a toggle on the My Work screen between My Tickets and Team Tickets. Team view shows all open tickets assigned to direct reports, filtered by current status.
Asset Scanner
Tap the scan icon in the Assets tab to open the barcode/QR scanner. Scanning a barcode looks up the matching asset by serial number or asset tag. If found, the asset detail opens. If not found, you can create a new asset pre-filled with the scanned code.
Push Notifications
Receive instant notifications for: ticket assigned to you, status changed, new internal note, QA approved/rejected, escalated to you, service request approval needed, emergency change created. Notification delivery requires the device to have notifications permitted for the app in OS settings.
Admin Controls
See Admin Guide → User Management for the Mobile Access toggle (enable/disable per user) and Mobile Devices list (revoke push tokens).
32 HTTPS / TLS Setup NEW IN 1.11.15
Audience: Administrators
Overview
ForsetiDesk supports HTTPS encryption via two certificate sources: self-signed (for internal/LAN use) and Let’s Encrypt (for internet-accessible deployments). TLS configuration lives in Admin → Security → TLS / Certificates.
When HTTPS is enabled, ForsetiDesk listens on port 443. HTTP requests to the previous configured port are redirected to HTTPS automatically. The port setting in Admin → Settings is locked while TLS is active.
Self-Signed Certificate Setup (Internal Use)
- Go to Admin → Security → TLS / Certificates.
- Click + Generate Certificate → Self-Signed tab.
- Review auto-detected IP addresses and check/uncheck as needed.
- Add domain names or additional IPs if required, then click Generate Certificate.
- Toggle Enable HTTPS on.
- Restart the ForsetiDesk service from the Start Menu or NSSM.
- Distribute the CA certificate to all client devices (see below).
Let’s Encrypt Certificate Setup (Recommended for Public Access)
Prerequisites:
- A domain name with DNS A record pointing to your server’s public IP
- Port 80 accessible from the internet (during issuance only — typically 60 seconds)
- Port 443 forwarded on your router to the server
- Go to Admin → Security → TLS / Certificates.
- Click + Generate Certificate → Let’s Encrypt (Trusted) tab.
- Enter your domain (e.g.,
desk.yourcompany.com) and email address. - Click Request Certificate. The process takes 30–60 seconds.
- Toggle Enable HTTPS on.
- Restart the ForsetiDesk service.
Let’s Encrypt certificates auto-renew 30 days before expiry. Port 80 must be briefly accessible during each renewal. Certificates are valid for 90 days.
Installing the CA Certificate (Self-Signed Only)
Click Download CA Certificate in the TLS panel to download forsetidesk-ca.pem. Install on each client device:
| Platform | Steps |
|---|---|
| Windows | Double-click the .pem file → Install Certificate → Local Machine → Trusted Root Certification Authorities → Finish. Close and reopen the browser. |
| Android | Settings → Security → Install certificate → CA certificate → select the file. Trust the certificate when prompted. |
| iOS | Open the .pem URL in Safari → Allow to install profile → Settings → General → VPN & Device Management → tap profile → Install. Then Settings → General → About → Certificate Trust Settings → enable full trust for ForsetiDesk CA. |
| Mobile App | Tap Download & Install Certificate on the login screen to open the CA cert URL in the system browser. |
Custom Certificate (Commercial CA)
Click Replace Certificate to upload your own PEM files (certificate, private key, and optional intermediate CA) from DigiCert, Sectigo, or another commercial authority.
Revoking or Disabling TLS
- Disable toggle — turns off HTTPS without deleting the certificate. The server returns to HTTP after restart.
- Revoke Certificate — deletes all certificate files. The server returns to HTTP after restart and the Generate button reappears.
33 Remote Access
Audience: Administrators
Accessing ForsetiDesk from Outside the LAN
ForsetiDesk runs on your Windows server and is accessible on your local network by default. For remote or mobile access, you need to expose it to the internet.
Port Forwarding (Direct Method)
- Assign a static IP address or DHCP reservation to the ForsetiDesk server on your router.
- Forward port 443 (TCP) on your router to the server’s internal IP address.
- Register a domain name and create a DNS A record pointing to your public IP address.
- Set up HTTPS using Let’s Encrypt for trusted certificates (see Section 32).
- Provide the URL (e.g.,
https://desk.yourcompany.com) to remote users and mobile app users.
For Mobile App Users
Field technicians enter the server URL on the mobile app login screen. The app works over any internet connection — cellular, WiFi, or VPN. The server URL must be reachable (not blocked by firewalls or carrier NAT). HTTPS is strongly recommended; HTTP is permitted but not recommended over cellular networks.
VPN Access
If your organization uses a VPN, you can keep ForsetiDesk on the internal network and require remote users to connect through the VPN. This avoids port forwarding entirely. However, mobile app users in the field must have the VPN client configured on their devices.
Firewall Considerations
- Allow inbound TCP 443 (HTTPS) to the ForsetiDesk server.
- Allow inbound TCP 80 only during Let’s Encrypt certificate issuance/renewal.
- The server does not require any inbound ports beyond 443 (and briefly 80 for ACME).
34 Session Management
Audience: Administrators
Configurable Session Timeout
ForsetiDesk allows administrators to control how long a user’s login session remains active before they must re-authenticate. The session timeout is configured from Admin → Security → Session.
Available Timeout Values
| Option | Suitable For |
|---|---|
| 10 minutes | High-security environments; shared workstations |
| 15 minutes | High-security with occasional brief inactivity |
| 30 minutes | Balanced security for most environments |
| 45 minutes | Moderate use with occasional interruptions |
| 60 minutes (default) | Standard office environment |
| 90 minutes | Longer work sessions with infrequent logins |
| 2 hours | Low-security or trusted internal network |
| 3 hours | Extended sessions; dedicated workstations |
| 4 hours | Maximum; dedicated single-user workstations only |
Session Warning Banners
ForsetiDesk warns users before their session expires so they can save work or refresh their session:
- 5 minutes remaining — A blue informational banner appears at the top of the page with a Refresh Session button.
- 1 minute remaining — The banner turns amber with bold text, indicating urgent action is needed.
- Session expired — The user is automatically logged out and redirected to the login page with an expiry notice.
Refreshing a Session
Click the Refresh Session button in the warning banner to extend the session without logging out. This issues a new token with a fresh expiry at the current timeout value. Users do not need to re-enter their password.
Applying the Change
- Go to Admin → Security → Session.
- Select a timeout duration from the dropdown.
- The setting saves automatically. New logins from this point on will use the updated duration.