User Manual
Version 1.11.18  ·  Complete Guide for All Users  ·  Published by Niles Technology Group LLC
Default Credentials
Admin Password
ForsetiDesk@Admin1
Default URL
http://[server-ip]:4000
⚠  Change all default passwords immediately after first login.
Published by Niles Technology Group LLC  ·  forsetidesk.com  ·  © 2026 All rights reserved.
Section 1

System Overview

Audience: All Users

ForsetiDesk is a fully self-hosted IT service desk platform designed for teams that require complete control over their data and workflows. Unlike cloud-based solutions, ForsetiDesk runs entirely on your own Windows infrastructure — no external dependencies, no data leaving your network, no mandatory subscription fees.

ForsetiDesk was built by practitioners who lived the problem — born from years of frustration with rigid, uncustomizable service desk platforms. While designed for IT teams, ForsetiDesk is flexible enough for any service operation that needs accountability, workflow, and data ownership.

Key Features

  • Complete ticket lifecycle management from creation through QA-verified closure
  • Mandatory QA/QC review — technicians cannot close tickets without supervisor approval
  • Configurable ticket ID numbering (auto, sequential, prefixed, custom)
  • Hierarchical category system — up to 5 levels on Pro, 2 on Core
  • Email notifications to clients on ticket events (new in 1.4)
  • Email-to-ticket inbound mailbox — tickets auto-created from incoming email (new in 1.4, Pro)
  • Self-service password reset — no admin needed for routine resets (new in 1.4)
  • Canned responses — one-click reply templates for technicians (new in 1.4)
  • Internal notes — private tech-only comments hidden from clients (new in 1.4)
  • Knowledge base with markdown articles, attachments, and bidirectional ticket linking (new in 1.5)
  • Public client-portal KB articles (new in 1.5, Pro)
  • Ticket merging — combine duplicate or related tickets into a single primary (new in 1.6)
  • Ticket-to-ticket linking — Related, Parent/Child, Blocks, and Duplicate relationships (new in 1.6)
  • Automation rules — event-triggered workflow engine with condition/action builders (new in 1.7, Pro)
  • Webhooks — HMAC-signed outbound HTTP POST on 12 ticket events with retry logic and delivery log (new in 1.8, Pro)
  • Recurring tickets — template-based automatic ticket creation on daily, weekly, monthly, or custom CRON schedules (new in 1.8, Pro)
  • Time tracking — per-ticket time entries with billable flag, global persistent timer bar, and analytics (new in 1.9, Pro)
  • Per-organization SLA & QA policies — organization model with domain auto-matching, per-org SLA targets and QA requirement overrides (new in 1.9, Enterprise)
  • LDAP / Active Directory SSO — authenticate users against your existing directory with auto-provisioning on first login (new in 1.9, Enterprise)
  • Bring Your Own Database — point ForsetiDesk at your own external PostgreSQL instance instead of the bundled database (new in 1.9, Pro)
  • Asset Management / ITAM — full lifecycle tracking (ORDERED through DISPOSED), structured location hierarchy, rack elevation diagrams, end user assignment, ticket linking, CSV import/export (new in 1.10, Pro)
  • CMDB — CI relationship mapping with 5 relation types and interactive D3 topology graph (new in 1.10, Enterprise)
  • Change Management — ITIL-aligned change requests with approval workflows, risk/impact scoring, and linked tickets/assets (new in 1.10, Pro)
  • SLA management with visual breach indicators and alerts (Pro)
  • Full analytics dashboard with custom widget builder (Pro)
  • Data export: CSV, JSON, Excel (.xlsx), and TXT formats (Pro)
  • PowerBI API integration for external dashboards (Enterprise)
  • Custom fields — TEXT, TEXTAREA, DROPDOWN, MULTISELECT, DATE, CHECKBOX, CASCADE (Pro)
  • Role-based access control — Admin, Tech, QA, Client
  • Native Windows desktop application (all tiers)
  • Database backup and restore (Pro)
  • User audit log — tracks all admin actions (Enterprise)
  • Problem Management — KEDB, Root Cause Analysis with 5 methods, and problem-to-incident linking (Pro)
  • Service Catalog — configurable request forms with approval chains (Pro; catalog builder Enterprise)
  • Service Request workflow — sequential multi-level approvals and fulfillment tracking (Pro)
  • Dashboard customization — drag-and-drop widget layout with persistent save (all tiers)
  • Asset and Change analytics charts — visual summaries of asset status and change activity (Pro)
  • Change calendar view — Day, Week, Month, and Agenda modes for scheduled changes (Pro)
  • Change export — CSV, JSON, and XLSX formats (Pro)
  • Automation triggers for asset and change status events (Pro)
  • Webhook events for assets, changes, problems, and service requests — 35 total events (Pro)

License Tiers

FeatureCore (Free)Pro
$1,495/yr · 5 seats
Business
$3,995/yr · 15 seats
Enterprise
$8,995/yr · 50 seats
Ticket Management✓ (100 max)✓ Unlimited✓ Unlimited✓ Unlimited
QA/QC Workflow
User Management3 seats5 seats15 seats50 seats
Category Levels2 levels5 levels5 levels5 levels
Email Notifications
Self-Service Password Reset
Knowledge Base (Internal Articles)
Desktop & Mobile AppDesktop only
30-Day Pro Trial✓ (included)
Canned Responses & Internal Notes
Public KB Articles
Email-to-Ticket (Inbound IMAP)
SLA Management
Full Analytics & Export
Custom Fields
Database Backup & Restore
Ticket Merging & Linking
Asset Management / ITAM
Parts Inventory
Change Management
Problem Management & KEDB
Service Catalog & Requests
Approval Chains
Automation Rules
Webhooks (35+ events)
Time Tracking
Recurring Tickets
Custom Dashboard Widgets
PowerBI Integration
CMDB — CI Relationships & Topology
Service Catalog Builder
LDAP / Active Directory SSO
Organizations & Per-Org SLA
User Audit Log
Bring Your Own Database (BYODB)
Section 2

Getting Started

Audience: All Users

Accessing ForsetiDesk

ForsetiDesk can be accessed via the native Windows desktop application or through a web browser. Your administrator will provide the server address. The default URL is:

http://[server-ip]:4000
💡 The desktop application is included with all license tiers and provides the best experience with native Windows integration.

Logging In

Enter your email address and password on the login screen. Contact your administrator if you do not have credentials. On first login you will be required to change your password before accessing the system.

Important: Change all default passwords immediately after first login. Default credentials are listed on the cover page of this manual.

Forgot Your Password? NEW IN 1.4

If you cannot remember your password, you no longer need to contact an administrator. Use the self-service reset:

  1. On the login screen, click Forgot Password? below the password field.
  2. Enter the email address associated with your account and click Send Reset Link.
  3. Check your inbox. A message from ForsetiDesk arrives within a minute or two containing a one-time reset link.
  4. Click the link in the email. It opens the reset page where you set a new password (minimum 8 characters).
  5. After setting the new password, log in normally with your new credentials.
ℹ Reset links expire one hour after they are sent and can only be used once. If you don't receive an email within a few minutes, check your spam folder — otherwise contact your administrator to verify your account email is correct and that the system has SMTP configured.

Navigation

Menu ItemDescriptionAccess
DashboardOverview of ticket activity, SLA alerts, and key metricsAll Users
TicketsHub with tabs: All Tickets, QA Queue (Admin/QA), SearchAll Users
Service DeskHub with tabs: Catalog, Requests (My Requests for clients), My Approvals (staff) — ProAll Users
Knowledge BaseBrowse, search, and author KB articles — clients see published public articles onlyAll Users
AssetsHub with tabs: Inventory, CMDB Topology (Enterprise) — ProAdmin, Tech
ChangesChange request management — submit, review, approve, and track IT changes — ProAdmin, Tech, QA
ProblemsHub with tabs: All Problems, Known Errors (KEDB) — ProAdmin, Tech, QA
MetricsDetailed analytics, charts, and custom widgets — ProAdmin, Tech, QA
ThemesUI theme selection and customizationAll Users
AdminSystem configuration, users, categories, license, backupAdmin Only
💡 Tabbed Navigation: Related features are grouped under tabbed hubs. Tickets includes All Tickets, QA Queue, and Search as sub-tabs. Service Desk includes Catalog, Requests, and My Approvals. Assets includes CMDB Topology (Enterprise). Problems includes the Known Errors (KEDB) tab.

User Roles

RolePermissions
AdminFull system access — configure settings, manage users, view all tickets, approve/reject QA, manage license and backups
TechCreate and work tickets, submit for QA review, view all tickets, view analytics, manage assets, create/update change requests
QAReview and approve/reject tickets in the QA queue, acknowledge SLA breaches, view all tickets, view and review change requests
ClientSubmit tickets and view their own ticket status only
Section 3

End User Guide

Audience: End Users / Client Role

Creating a New Ticket

Click the + New Ticket button in the sidebar or navigate to Tickets and click New Ticket in the top right corner.

Ticket Fields

FieldDescriptionRequired
TitleBrief one-line summary of the issueYes
DescriptionDetailed explanation including steps to reproduce and error messagesYes
PrioritySeverity level — Critical, High, Medium, or LowYes
CategoryIssue type — select from the hierarchical category dropdownNo
Client NameName of the person experiencing the issueNo
Client EmailContact email for the affected userNo
Assign ToTechnician to handle the ticket (can be left unassigned)No
TagsLabels to categorize the ticket — click to toggleNo
Custom FieldsAdditional fields configured by your administrator (Pro)Varies

Priority Levels & Default SLA Targets

PriorityDescriptionDefault ResponseDefault Resolution
CriticalSystem down, major outage, security breach1 hour4 hours
HighSignificant impact, no workaround available4 hours24 hours
MediumModerate impact, workaround available8 hours72 hours
LowMinor issue, cosmetic, general questions24 hours168 hours

Ticket Status Flow

StatusMeaning
OpenTicket created, awaiting assignment or work to begin
In ProgressTechnician is actively working on the issue
Pending QATechnician has resolved the issue and submitted for QA review
QA RejectedQA has rejected the resolution — ticket returned to technician for rework
MergedTicket has been merged into another ticket and is now read-only (new in 1.6)
ClosedIssue fully resolved and verified through the QA process
ℹ Tickets cannot be directly closed. Every ticket must pass QA review before it can be marked as Closed. This ensures quality and accountability.

Email Updates on Your Tickets NEW IN 1.4

If your administrator has configured email notifications and your ticket has a client email address set, you will automatically receive emails at the following points:

  • When your ticket is first created — confirmation with the ticket ID
  • When a technician is assigned to your ticket
  • When the status changes
  • When the ticket is approved by QA and closed
  • If QA rejects the resolution and the ticket is reopened for rework

Each email includes the ticket ID, title, current status, and a direct link back to the ticket. If you stop receiving updates and you expect them, contact your administrator — email notifications can be toggled on or off per event by the admin.

Browsing the Knowledge Base NEW IN 1.5

Click Knowledge Base in the left sidebar to browse published articles your IT team has made available to you. Many common issues have a self-help article that may resolve your problem faster than submitting a ticket.

  • Use the search bar at the top to find articles by keyword
  • Filter by category to narrow the list
  • Click any article title to read the full content, including any attached files like screenshots or PDFs
ℹ You only see articles that have been published and marked as public. If you can't find what you need, submit a ticket and your IT team will help.

Merged Tickets NEW IN 1.6

If your ticket has been combined with another related ticket by the IT team, you will see a banner at the top of your ticket indicating it has been merged and providing a link to the primary ticket where work is continuing. Merged tickets are read-only.

Section 4

Technician Guide

Audience: Technicians (TECH role)

Working a Ticket

Click any ticket from the Tickets list to open the detail view. From here you can review all ticket information, edit fields, add notes, and track your work time.

Editing a Ticket

Click the Edit button on the ticket detail page. In edit mode you can modify:

  • Title and description
  • Priority and status (cannot set to Closed directly)
  • Assigned technician and category
  • Tags and custom field values
  • Client name and email
  • Troubleshooting notes — document your diagnostic steps clearly
  • Resolution notes — describe exactly how the issue was resolved
  • Start time, end time, and resolution date

Click Save to commit changes. All changes are logged in the Activity Log with your name and timestamp.

Submitting for QA Review

  1. Ensure your Resolution Notes clearly explain how the issue was resolved.
  2. Set the End Time and Resolution Date fields.
  3. Click the Submit for QA button in the ticket detail view.
  4. The ticket status changes to Pending QA and appears in the QA Queue.
  5. If QA rejects the ticket, it returns to you as QA Rejected with notes explaining what to address.
  6. Rework the ticket and resubmit when ready.
⚠ You must fill in Resolution Notes before submitting for QA. Tickets without resolution documentation will typically be rejected.

Activity Log

Every change to a ticket is automatically recorded in the Activity Log at the bottom of the ticket detail page. The log shows who made each change, when it was made, and what specifically changed — providing a complete audit trail.

Internal Notes NEW IN 1.4

Internal notes let you and your teammates leave private comments on a ticket that the client never sees. Useful for handoffs, vendor case numbers, behind-the-scenes context, or notes for the QA reviewer.

  1. Open the ticket detail page.
  2. Scroll to the Internal Notes panel (it sits beside the public Activity Log).
  3. Type your note. Basic markdown formatting is supported.
  4. Click Post Note. The note appears in the panel immediately, stamped with your name and the time.
  5. To remove a note you posted, click the trash icon on it. Administrators can remove any note.
💡 Internal notes are visible only to Admin, Tech, and QA roles. Clients on the client portal never see them, and they are never included in outbound email notifications to clients.

Ticket Merging NEW IN 1.6

When duplicate or closely related tickets arrive, you can merge secondary tickets into a single primary ticket. Merging closes the secondary tickets with a Merged status and preserves all history, internal notes, and KB article links.

  1. Open the ticket you want to keep as the primary (surviving) ticket.
  2. Click the Merge button in the ticket actions area.
  3. In the merge modal, search for tickets to merge into this one. Select one or more tickets using the checkboxes.
  4. Click Merge Selected into This Ticket. A confirmation dialog warns that this cannot be undone.
  5. After merging, secondary tickets become read-only and display a banner linking back to the primary ticket.

What Happens When Tickets Are Merged

  • Secondary tickets receive Merged status and cannot be edited further
  • KB article links from secondary tickets are transferred to the primary ticket (duplicates are skipped)
  • Internal notes from merged tickets are accessible from the primary ticket’s Merged Tickets section
  • The Activity Log on both tickets records the merge action
  • Merged tickets are excluded from analytics calculations (resolution time, tech performance)
  • No email notifications are sent when tickets are merged — it is an internal housekeeping action
ℹ Only Admin and Tech roles can merge tickets. You cannot merge a ticket that is already merged, and you cannot merge a ticket into itself. Tickets already in Merged status do not appear in the merge search results.

Ticket Linking NEW IN 1.6

Ticket linking creates typed, bidirectional relationships between tickets without closing or modifying either one. Use it to connect related issues, track dependencies, or flag duplicates you want to keep open separately.

  1. Open any ticket detail page.
  2. Scroll to the Linked Tickets section (below Linked KB Articles).
  3. Click Link Ticket. In the modal, search for the ticket to link.
  4. Select a link type from the dropdown: Related, Parent/Child, Blocks, or Duplicate.
  5. Click the target ticket to create the link.
  6. To remove a link, click the X next to it and confirm.

Link Types

TypeFrom Source TicketFrom Target TicketUse Case
RelatedRelated to #XYZRelated to #ABCSimilar or connected issues
Parent / ChildParent of #XYZChild of #ABCBreaking a large issue into sub-tasks
BlocksBlocks #XYZBlocked by #ABCDependency tracking between tickets
DuplicateDuplicate of #XYZDuplicate of #ABCFlagging duplicates without merging
ℹ All link types are informational — they do not enforce workflow rules or prevent status changes. Admin, Tech, and QA roles can create and remove links. Clients cannot see the linked tickets section. Each pair of tickets can only have one link between them.

Canned Responses NEW IN 1.4

Canned responses are pre-written replies that your administrator has set up for common issues. Insert one with a click instead of typing the same answer over and over.

  1. On the ticket detail page, place your cursor in the field you want to add text to — usually Resolution Notes or Troubleshooting Notes.
  2. Click the Canned Responses dropdown near that field.
  3. Select the response you want. The text is inserted at your cursor position.
  4. Edit the inserted text to fit the specific ticket before saving.

Canned responses are maintained by administrators. If a common situation is missing from the list, ask an admin to add it — it helps the whole team.

SLA Indicators

BadgeColorMeaningAction
On Track — Xh left🟢 GreenMore than 20% of SLA time remainingContinue normally
At Risk — Xh left🟡 YellowLess than 20% of SLA time remainingPrioritize immediately
Breached Xh ago🔴 RedSLA deadline has passedEscalate to supervisor

Note: SLA indicators only appear when a Pro license is installed.

Section 5

Knowledge Base NEW IN 1.5

Audience: All Users

The knowledge base is a central library of articles documenting solutions, procedures, and reference material. Technicians and administrators author articles; QA reviewers can read and link them to tickets; clients see only articles that have been published and marked public.

Accessing the Knowledge Base

Click Knowledge Base in the left sidebar. The list page shows all articles you have permission to see, with filters for status, visibility, and category, plus a full-text search across titles and bodies.

Article Visibility & Status

FieldValuesMeaning
StatusDraft / Published / ArchivedDrafts are works-in-progress. Published articles are visible per the visibility rule. Archived articles are hidden by default and act as a soft delete.
VisibilityInternal / PublicInternal articles are visible to Admin, Tech, and QA only. Public articles are visible to clients in the portal once published. Public visibility requires a Pro license.
ℹ Clients only ever see articles that are both Published AND Public. Drafts and internal articles are completely hidden from the client portal.

Authoring an Article

Admins and technicians can create articles. QA reviewers and clients cannot author articles but can read those they have access to.

  1. Open the Knowledge Base and click + New Article.
  2. Enter a title. The URL slug is generated automatically from the title.
  3. Choose a category (optional — uses the same category tree as tickets).
  4. Set status to Draft while you are writing. Switch to Published when ready.
  5. Set visibility:
    • Internal for tech-only reference material
    • Public for client-facing how-tos and FAQs (Pro license required)
  6. Add comma-separated tags for additional filtering.
  7. Write the body in the markdown editor. The editor supports headings, bold, italic, lists, code blocks, tables, links, and a live preview pane.
  8. Click Create article. After the first save you can return to the editor to upload attachments.
💡 Save the article first — attachments cannot be uploaded until the article exists in the database. Once saved, click Edit to return and add files.

Attachments

Articles support file attachments for screenshots, diagrams, PDFs, and supporting documents.

  • Maximum file size: 25 MB per file
  • Allowed types: PNG, JPEG, GIF, WebP, SVG, PDF, plain text, ZIP, and Microsoft Office documents (Word, Excel, PowerPoint)
  • Files are stored under C:\Program Files (x86)\ForsetiDesk\kb-attachments\
  • Original filenames are preserved for display and download; on-disk names are randomized to prevent collisions

To attach a file: open the article in the editor, click Upload file in the Attachments section, select the file. The upload progress shows briefly and the file appears in the attachments list. Click the X next to an attachment to remove it.

Readers download attachments by clicking them on the article view page.

Linking Articles to Tickets

Tickets and KB articles can be linked in both directions to surface the right reference material at the right time.

  1. Open any ticket detail page.
  2. Scroll to the Linked KB Articles section.
  3. Click Link article, search for the article by title, and click it to attach.
  4. The linked article appears on the ticket; the ticket appears under Linked Tickets when viewing the article.
  5. Click the X next to a link to remove it.
ℹ Linking is bidirectional. Admins, Techs, and QA can manage links. Clients never see the linking UI or the linked-tickets section on articles.

Search

The search bar matches across article titles and body text. Combine search with category, status, or visibility filters to narrow results. Filters reset to page 1 automatically when changed.

Revision History

Every article maintains an append-only revision log capturing creation, updates, status changes, attachment additions and removals, and archive actions. Each entry records the user, action, and a brief detail string — useful for tracking who changed what and when.

Archiving Articles

Administrators can archive articles by clicking Archive on the article view page. Archived articles are hidden from default listings (apply the Archived status filter to see them) and become inaccessible to clients. Archiving is the recommended way to retire outdated content while preserving its history.

Role Permissions Summary

ActionAdminTechQAClient
Browse / read articlesAllAllAllPublished + Public only
Create / edit articles
Archive articles
Upload / remove attachments
Link / unlink articles on tickets
View revision history
Section 6

QA Reviewer Guide

Audience: QA Team (QA role)

Accessing the QA Queue

Click QA Queue in the left sidebar. This page shows all tickets submitted for review by technicians, displayed in chronological order with oldest submissions first.

Reviewing a Ticket

Before approving or rejecting, review the following on each ticket:

  • Ticket description — does it clearly describe the original issue?
  • Troubleshooting notes — did the technician document their diagnostic process?
  • Resolution notes — is it clear and specific how the issue was resolved?
  • Time fields — are start time, end time, and resolution date populated?
  • Category — is the ticket properly categorized?
  • Tags — are appropriate tags applied?
  • Custom field values — are required fields completed?

Approving a Ticket

Click the Approve button on the ticket. You may optionally add approval notes. Once approved, the ticket status changes to Closed and is removed from the active queue.

Rejecting a Ticket

Click the Reject button. Rejection notes are required — you must explain why the ticket is being rejected and what needs to be addressed. The ticket returns to QA Rejected status.

💡 Be specific in rejection notes. Clear feedback helps technicians resolve issues faster and improves overall ticket quality over time.

Internal Notes for QA NEW IN 1.4

During review you can post internal notes on the ticket that the client never sees. These are useful for documenting QA observations that don't warrant a rejection, leaving context for the next reviewer, or recording why an exception was approved.

Open the ticket, find the Internal Notes panel beside the activity log, type your note, and click Post Note. Notes are stamped with your name and visible only to Admin, Tech, and QA users.

Section 7

Administrator Guide

Audience: Administrators (ADMIN role)

Accessing Admin Settings

Click Admin in the left sidebar. The Admin panel is organized into tabs: Users, Categories, Settings, Communications, Security (TLS/Certificates + LDAP/AD), Database, Automation, Asset Types (Pro), Locations (Pro), Approval Chains (Pro), Service Catalog (Pro/Enterprise). Sub-tabs group related settings within each top-level tab.

ℹ Tab availability depends on your license tier. Automation, Recurring, Webhooks, and Time Tracking require a Pro license. Organizations and LDAP/AD SSO require an Enterprise license.

User Management

The Users tab allows you to create, edit, deactivate, and delete user accounts. A user count indicator shows current usage against your license limit (e.g., "3 of 10 users").

Creating a User

Click Add User and fill in the name, email address, password (minimum 8 characters), and role. Available roles are Admin, Tech, QA, and Client.

⚠ Core (free) tier is limited to 3 active users. Pro and Enterprise licenses define the user limit set during license generation.

Managing Users

  • Edit — modify name, email, role, or password
  • Active/Inactive toggle — disable an account without deleting it; deactivated users cannot log in and existing sessions are immediately invalidated
  • Delete — permanently remove a user (cannot delete yourself or the last admin)
  • Reset Password — generate a temporary password; user must change it on next login

User Audit Log

The Audit Log button shows a complete history of all user management actions. Requires Enterprise license.

Category Management

The Categories tab manages the hierarchical dropdown used when creating tickets. Categories support up to 5 levels on Pro/Enterprise (2 levels on Core). Categories can be reordered and deactivated without deleting historical ticket data.

System Settings

SettingDescription
Organization NameDisplayed in the app header and on all exports
Default PriorityPre-selected priority when creating new tickets
Ticket NumberingID scheme: Auto (timestamp), Sequential, Prefixed (TKT0001), or Custom
Available TagsManage the global list of tags available on tickets
SLA TargetsConfigure response and resolution time targets per priority (Pro)
SLA EnabledToggle SLA deadline calculation on or off globally
PortHTTP server port (default 4000) — requires service restart to apply
Port locked when TLS is enabled: When HTTPS is active, ForsetiDesk runs on port 443 and the Port setting is grayed out. Disable TLS in the Security → TLS/Certificates tab before changing the port.

Ticket Numbering Schemes

SchemeFormatExample
AutoUnix epoch timestamp (milliseconds)#1777742555599
SequentialPlain incrementing integer#42
PrefixedConfigurable prefix + padded numberTKT0042
CustomPrefix + optional year/month + number + separatorTKT-2026-0042

Email Notifications (SMTP) NEW IN 1.4

The Notifications tab lets you configure outbound email so clients automatically receive updates when their tickets are created, assigned, changed, closed, or rejected. Available on all license tiers.

Configuring SMTP

  1. Go to Admin → Notifications.
  2. Fill in your SMTP server details: host, port, username, password, from address, and TLS option. Common defaults are port 587 with TLS, or 465 with SSL.
  3. Toggle the Enabled switch on.
  4. Click Save. The mailer reloads automatically — no service restart needed.

Per-Event Toggles

Below the SMTP settings is a list of notification events. Each one can be turned on or off independently:

  • Ticket Created — confirmation email to the client
  • Ticket Assigned — notice when a technician picks up the ticket
  • Status Changed — updates as the ticket moves through the lifecycle
  • QA Approved — closure notification
  • QA Rejected — notice that the ticket has been reopened for rework

Send Test Email

Once SMTP is saved, the Send Test Email button at the bottom of the tab lets you verify the connection. Enter any recipient address, click the button, and watch for the test message in that inbox. If it doesn't arrive within a minute, see the Troubleshooting section.

Base URL for Email Links

Notification emails include a clickable link back to the ticket. For these links to work outside your server, set APP_BASE_URL in secrets.cfg to the public URL of your ForsetiDesk install (e.g., https://desk.example.com). Without it, emails will link to localhost, which only works on the server itself.

ℹ Notifications fire after the database is updated, not before. If SMTP is unreachable or a client email is missing, the ticket update still succeeds — only the email is skipped.

Security Tab — TLS / Certificate Management NEW IN 1.11.15

The Security tab has three sub-tabs: Session (configurable session timeout and refresh), TLS / Certificates (HTTPS certificate management), and LDAP / AD (Enterprise). TLS enables HTTPS on your ForsetiDesk server so all communication is encrypted.

Certificate Status

The status card shows current TLS state: HTTPS Enabled/Disabled, certificate source (Self-Signed, Let’s Encrypt, or Custom), subject, issuer, expiry date, and SANs. A yellow warning appears 30 days before expiry; red when expired.

Generating a Self-Signed Certificate

  1. Click + Generate CertificateSelf-Signed tab.
  2. Auto-detected local IP addresses are pre-checked. Uncheck any that should not be included.
  3. Add custom entries (domain names, public IPs) in the text field and click + Add.
  4. Click Generate Certificate.
  5. Enable the Enable HTTPS toggle.
  6. Restart the ForsetiDesk service.
  7. Distribute the CA certificate to client devices (see Distributing the CA Certificate below).
⚠ Self-signed certificates are not trusted by browsers or mobile devices by default. Clients must install the CA certificate manually, or use Let’s Encrypt for automatic trust.

Requesting a Let’s Encrypt Certificate (Recommended for Public Access)

  1. Ensure your domain’s DNS A record points to your server’s public IP address.
  2. Ensure port 80 is accessible from the internet (temporarily during issuance; can be closed afterward).
  3. Click + Generate CertificateLet’s Encrypt (Trusted) tab.
  4. Enter your fully qualified domain name (e.g., desk.yourcompany.com).
  5. Enter your email address — used by Let’s Encrypt for expiry notifications only.
  6. Click Request Certificate (takes 30–60 seconds).
  7. Enable the Enable HTTPS toggle.
  8. Restart the ForsetiDesk service.

Let’s Encrypt certificates are automatically trusted by all modern browsers, mobile devices, and operating systems — no CA distribution needed. Certificates auto-renew 30 days before expiry via a daily background check.

Distributing the CA Certificate (Self-Signed Only)

  • Windows: Click Download CA Certificate. Double-click the .pem file → Install Certificate → Local Machine → Trusted Root Certification Authorities.
  • Android: Settings → Security → Install certificate → CA certificate. Tap the downloaded file.
  • iOS: Open the .pem link on the device → tap “Allow” to install the profile → Settings → General → VPN & Device Management → tap the profile → Install. Then Settings → General → About → Certificate Trust Settings → enable trust for ForsetiDesk CA.
  • Mobile App: On the login screen, tap “Download & Install Certificate” to open the CA cert URL in the system browser.

Other Certificate Actions

  • Replace Certificate — upload a custom PEM cert + key (and optional CA) from a commercial certificate authority.
  • Revoke Certificate — deletes all certificate files; server reverts to HTTP after restart.
  • Renew Now (Let’s Encrypt only) — forces immediate renewal before the 30-day auto-renew window.

Push Notification Settings NEW IN 1.11.9

Below the SMTP event toggles, a Push Notifications section lets you control which events trigger mobile app push notifications (Pro license required).

  • Ticket Assigned — notify assignee immediately
  • Status Changed — notify when ticket status changes
  • New Internal Note — notify relevant tech/manager
  • SLA Breached — notify assignee and manager
  • QA Approved / QA Rejected — notify the submitting tech
  • Escalated — notify the receiving manager
  • Routed to Team — notify team lead or dispatcher
  • Service Request Approval Needed — notify the approver
  • Service Request Approved / Rejected — notify the requestor
  • Emergency Change Created — notify all admins and managers
ℹ Push notifications only reach devices where the user is logged in to the mobile app with notifications permitted in the device OS settings.

Email Inbox (Email-to-Ticket) NEW IN 1.4 — PRO

The Email Inbox tab connects ForsetiDesk to an IMAP mailbox so that messages sent to that address are automatically converted into tickets. This is the standard way most IT teams accept ticket submissions. Requires a Pro license.

Setting Up the Inbox

  1. Provision a dedicated mailbox — for example [email protected]. Use a dedicated mailbox, not a personal account.
  2. Go to Admin → Email Inbox.
  3. Fill in IMAP server details: host, port (typically 993 with TLS, or 143 without), username, password, folder (usually Inbox), and the TLS option.
  4. Set the Polling Interval — how often ForsetiDesk checks for new mail. The default is 5 minutes; minimum is 1 minute.
  5. Choose a Default Category for tickets created from email. You can re-categorize tickets individually after creation.
  6. Toggle Enabled on and click Save.

What Happens to Incoming Mail

On each poll cycle the system fetches unread messages from the configured folder and turns each one into a new ticket using these mappings:

Email FieldBecomes Ticket Field
SubjectTicket Title
Body (plain text or HTML stripped)Description
Sender display nameClient Name
Sender email addressClient Email
RFC822 Message-ID headerInternal dedup key (not displayed)

After successful processing the message is marked as read on the mail server so it isn't picked up again. The Message-ID is also recorded internally as a second safety net — the same email cannot create two tickets.

Test Connection & Poll Now

Two buttons sit at the bottom of the tab. Test Connection tries to log into the IMAP server and reports success or the exact error. Poll Now triggers an immediate poll cycle, bypassing the schedule — useful for verifying setup without waiting.

Status Indicator

The tab shows the most recent poll time and a status of ok, error, or idle. If poll status shows error, click Test Connection to see the underlying message.

⚠ Use a dedicated mailbox. The poller marks messages as read after processing — if you point it at a real inbox you actively use, it will mark your unread mail as read.

Canned Responses (Templates Tab) NEW IN 1.4

The Templates tab is where you build and maintain the reply templates (canned responses) that technicians insert into tickets with one click. Available on all license tiers.

Creating a Canned Response

  1. Go to Admin → Templates.
  2. Click + New Response.
  3. Enter a Title — this is what technicians see in the dropdown picker.
  4. Enter the Body — the actual text that gets inserted. Markdown formatting is supported.
  5. Optionally tie the response to a specific Category so it only appears for matching tickets.
  6. Set Sort Order to control where it appears in the dropdown (lower numbers first).
  7. Click Save.

Managing the Library

  • Edit — modify the title, body, category scope, or sort order at any time.
  • Active toggle — temporarily hide a response without deleting it. Inactive responses don't appear in the tech picker but preserve any past usage records.
  • Delete — permanently remove a response.
💡 Good canned response candidates: standard password reset instructions, VPN setup steps, printer driver download links, "ticket received, investigating" acknowledgments, and the most common 5–10 resolutions your team writes repeatedly.
Section 8

Analytics & Reporting

Audience: Admins / Supervisors — Pro License Required

The Analytics page provides comprehensive visibility into service desk operations. Access it by clicking Analytics in the sidebar. Full analytics features require a Pro license.

Date Range Selection

All analytics are filtered by a date range. Select from preset ranges (Today, This Week, This Month, This Year) or choose a custom start and end date and click Apply.

Key Metrics

MetricDescription
Total TicketsCount of all tickets in the selected date range
Avg ResolutionAverage hours from ticket creation to closure
SLA CompliancePercentage of tickets resolved within their SLA deadline
Avg Open AgeAverage age in hours of currently open tickets
Closed CountCount of tickets closed in the selected date range

Available Charts

  • Opened vs Closed — line chart showing daily ticket volume trends
  • SLA Compliance by Priority — bar chart showing compliance rate per priority level
  • Tech Performance — tickets assigned, resolved, and average resolution/response times per technician
  • Top Issue Categories — expandable category tree showing most common issue types
  • Repeat Faults by Client — clients with recurring issues in the same category
  • MTBF by Category — Mean Time Between Failures for each issue category
  • Time by Technician — total and billable hours per technician with switchable Bar, Horizontal Bar, and Pie views (new in 1.9)
  • Time by Category — total and billable hours per category with switchable chart types (new in 1.9)

Custom Widgets

Build your own metric cards. Click + Add Widget on the Custom Widgets tab:

FieldOptions
Widget NameAny descriptive label
MeasureCount Tickets, Average Resolution Time, SLA Compliance %
Group ByNo Grouping, By Status, By Priority, By Category, By Technician, By Date
Chart TypeNumber, Bar Chart, Line Chart, Pie Chart
FiltersOptionally filter by Priority, Status, or Client Name

Exporting Data

FormatBest ForNotes
CSVExcel, Google Sheets, most data toolsComma-separated, UTF-8 encoded
JSONDevelopers, API consumersStructured data with all ticket fields
Excel (.xlsx)Formatted spreadsheetsMulti-sheet: Summary, Tickets, Priority breakdown
TXTPlain text reportsHuman-readable formatted report
Section 9

SLA Management

Audience: Admins / Supervisors — Pro License Required

Service Level Agreement (SLA) management tracks commitments to respond to and resolve tickets within defined timeframes. SLA features require a Pro license and must be enabled in Settings.

How SLA Works

When a ticket is created, ForsetiDesk automatically calculates two deadlines based on the ticket's priority and your configured SLA targets:

  • Response Deadline — when the ticket must first be acknowledged or assigned
  • Resolution Deadline — when the ticket must be fully resolved and submitted for QA

SLA Status Badges

BadgeColorMeaningRequired Action
On Track — Xh left🟢 GreenMore than 20% of SLA time remainingContinue working normally
At Risk — Xh left🟡 YellowLess than 20% of SLA time remainingPrioritize immediately
Breached Xh ago🔴 RedSLA deadline has passedEscalate and notify supervisor

Acknowledging SLA Breaches

Admins and QA reviewers can acknowledge SLA breaches to log that the breach has been noted. Click Acknowledge on the breached ticket in the dashboard alert, optionally add notes. The acknowledgment is logged in the ticket's activity history.

Configuring SLA Targets

Go to Admin → Settings → SLA Targets. Set response and resolution hours for each priority level. Click Save SLA Targets to apply. New tickets created after saving will use the updated targets.

⚠ To enable or disable SLA globally, use the SLA Enabled toggle in Admin → Settings.
Section 10

License Management

Audience: Administrators

ForsetiDesk uses a cryptographically signed license key system to unlock Pro and Enterprise features. The Core tier is free with no license required.

Installing a License

  1. Go to Admin → License.
  2. Click Generate License Request to create a license request file and send it to your vendor.
  3. Once you receive your license key, paste it into the License Key field.
  4. Click Install License. The system validates the key and immediately unlocks licensed features.

License Information

FieldDescription
EditionCore, Pro, Business, or Enterprise
Issued ToThe organization the license was issued to
Max UsersMaximum number of active users allowed (or Unlimited)
Issued DateWhen the license was generated
Expiration DateWhen the license expires (or Never for perpetual licenses)
Unlocked FeaturesList of Pro/Enterprise features enabled by this license

User Count Enforcement

The Users tab shows your current active user count against the license limit (e.g., "3 of 10 users"). When the limit is reached, new user creation is blocked until the license is upgraded or an existing user is deactivated.

Removing a License

Click Remove License to uninstall the current license. The system reverts to Core mode. Existing data is not affected, but Pro/Enterprise features will no longer be accessible.

30-Day Pro Trial

Fresh ForsetiDesk installations automatically include a 30-day Pro trial. No license key is required — all Pro-tier features are unlocked immediately after setup.

  • The trial countdown begins on the date of first installation and cannot be paused or reset.
  • A dismissible banner appears in the sidebar showing days remaining. The banner turns amber when fewer than 7 days remain.
  • When the trial expires the system reverts to the Core tier (3 seats, 100 tickets). All data is preserved.
  • Installing a valid license key at any time — including during or after the trial — immediately activates the purchased edition and hides all trial banners.
  • The trial is bound to the machine and installation; reinstalling the application does not restart the trial period.
⚠ If the trial banner shows a verification failure message, the trial markers have become inconsistent. Contact [email protected] for assistance. Pro features are suspended until a valid license is installed.
Section 11

Export & PowerBI Integration

Audience: Admins — Enterprise License Required for PowerBI

Data Export

All export options are available from the Analytics page via the Export dropdown. Exports include all ticket data within the selected date range. Export requires a Pro or Enterprise license.

PowerBI Integration

ℹ PowerBI integration is an Enterprise feature. It provides a secure REST API endpoint that PowerBI can query directly for live data.

Setting Up the PowerBI Connection

  1. Go to Admin → Settings and scroll to PowerBI Integration.
  2. Click Generate PowerBI API Key.
  3. Copy the full API key — it will not be shown again after you navigate away.
  4. In PowerBI Desktop, click Get Data → Web.
  5. Enter the connection URL shown on the settings screen.
  6. Add the API key as the x-powerbi-key header or apikey query parameter.

API Endpoint Reference

ParameterValuesDescription
apikeyYour API keyRequired for authentication
datasettickets, summaryWhich data to return
startISO date stringFilter start date (optional)
endISO date stringFilter end date (optional)
http://[server]:4000/api/analytics/powerbi?apikey=YOUR_KEY&dataset=tickets http://[server]:4000/api/analytics/powerbi?apikey=YOUR_KEY&dataset=summary&start=2026-01-01
⚠ API keys are separate from user passwords and license keys. Regenerate regularly. Revoke immediately if compromised.
Section 12

Themes & Customization

Audience: All Users

ForsetiDesk includes multiple built-in color themes and a fully customizable color editor. Theme settings are accessible via the theme toggle in the app header or at Admin → Settings.

Built-In Themes

ThemeDescription
MidnightDeep dark blue-grey — default theme, easy on eyes in low light
SlateDark navy with green accents — high contrast, modern look
CarbonPure black with orange accents — maximum contrast dark theme
LightClean white interface — ideal for bright environments
High ContrastBlack and white with bright yellow accents — accessibility focused

Custom Theme

Click any preset theme to load it as your starting point. Use the color pickers to adjust individual UI color variables. Click Apply Custom Theme to activate. Theme preferences are saved per browser session.

Section 13

Backup & Restore

Audience: Administrators — Pro License Required

ForsetiDesk includes built-in database backup and restore functionality using PostgreSQL's native pg_dump and psql tools. Backups are stored as .sql files on the server.

Configuring Backup Storage

Go to Admin → Backup → Configuration. Enter the backup storage path and click Save. The default path is:

C:\Program Files (x86)\ForsetiDesk\backups\

Creating a Backup

  1. Go to Admin → Backup.
  2. Click Create Backup.
  3. ForsetiDesk runs pg_dump and saves a timestamped .sql file to the configured backup path.
  4. The backup file appears in the backup list with size and creation date.
  5. Optionally click Download to save a copy to your local machine.
💡 Create backups before major changes, before upgrading ForsetiDesk, or on a regular scheduled basis.

Restoring from Backup

Warning: Restoring from a backup will OVERWRITE your current database. All data created after the backup date will be lost. This action cannot be undone.
  1. Go to Admin → Backup.
  2. Find the backup file you want to restore from the list.
  3. Click Restore next to that file and confirm when prompted.
  4. ForsetiDesk runs psql to restore the database from the selected .sql file.
  5. Restart the ForsetiDesk service after restoration completes.
Section 14

Automation & Workflow Rules NEW IN 1.7

Audience: Administrators — Pro License Required

The automation rules engine lets you define event-driven workflows that execute automatically when ticket conditions are met. Rules eliminate repetitive manual tasks — assigning tickets to the right technician, escalating priority, adding tags, or firing notifications — without human intervention.

ℹ Automation rules require a Pro or Enterprise license. The feature is gated via enforceProFeature('automations').

Accessing Automation Rules

Go to Admin → Automations. The tab displays all existing rules with their name, trigger event, active status, and sort order. Rules execute in sort-order sequence — lower numbers fire first.

Creating a Rule

  1. Click + New Rule.
  2. Enter a descriptive Name for the rule (e.g., "Auto-assign network tickets to NetOps").
  3. Select a Trigger Event from the dropdown.
  4. Add one or more Conditions using the condition builder.
  5. Add one or more Actions using the action builder.
  6. Set the Sort Order to control execution priority relative to other rules.
  7. Toggle Active on or off.
  8. Click Save.

Trigger Events

Each rule fires on exactly one event. The available triggers are:

TriggerFires When
Ticket CreatedA new ticket is created (via UI, API, or email-to-ticket)
Ticket UpdatedAny field on an existing ticket is modified
Status ChangedA ticket's status transitions (e.g., OPEN → IN_PROGRESS)
Priority ChangedA ticket's priority level is changed
SLA BreachedA ticket's response or resolution deadline is exceeded

Condition Builder

Conditions filter which tickets a rule applies to. All conditions must be true for the rule to fire (AND logic). Each condition consists of a field, an operator, and a value.

FieldAvailable OperatorsExample
Statusequals, not equalsStatus equals OPEN
Priorityequals, not equalsPriority equals CRITICAL
Categoryequals, not equalsCategory equals "Network Issues"
Assigneeequals, not equals, is emptyAssignee is empty (unassigned tickets)
Tagscontains, not containsTags contains "vpn"

Add multiple conditions by clicking + Add Condition. Remove a condition by clicking the X next to it.

Action Builder

Actions define what happens when the rule fires. Multiple actions can be chained on a single rule.

ActionDescription
Assign TicketSet the ticket's assignee to a specific technician
Change StatusTransition the ticket to a specified status
Change PriorityEscalate or de-escalate the ticket priority
Add TagAppend a tag to the ticket's tag list
Send NotificationTrigger an email notification (requires SMTP configured)

Add multiple actions by clicking + Add Action. Remove an action by clicking the X next to it.

Managing Rules

  • Edit — click a rule to modify its name, trigger, conditions, actions, or sort order
  • Active toggle — disable a rule without deleting it; inactive rules do not fire
  • Delete — permanently remove a rule
  • Sort Order — controls execution sequence; lower numbers execute first

Example Rules

Rule NameTriggerConditionsActions
Auto-assign network ticketsTicket CreatedCategory equals "Network"Assign to NetOps tech; Add tag "network"
Escalate critical SLA breachesSLA BreachedPriority equals CRITICALSend Notification
Tag VPN ticketsTicket CreatedTags contains "vpn"Change Priority to HIGH; Assign to VPN specialist
Auto-progress assigned ticketsTicket UpdatedStatus equals OPEN; Assignee is not emptyChange Status to IN_PROGRESS
💡 Start with simple rules and test them thoroughly before adding complex condition chains. Use sort order to ensure rules execute in the intended sequence — for example, assignment rules should fire before status-change rules.
⚠ Be careful with rules that trigger on "Ticket Updated" — actions that modify the ticket (like changing status or adding tags) will themselves trigger another "Ticket Updated" event. Design your conditions to avoid infinite loops.
Section 15

Webhooks NEW IN 1.8

Audience: Administrators — Pro License Required

Webhooks let ForsetiDesk push real-time notifications to external systems whenever key ticket events occur. Each webhook sends an HMAC-SHA256 signed HTTP POST request to a URL you configure, enabling integrations with chat platforms, monitoring tools, custom dashboards, and third-party APIs.

ℹ Webhooks require a Pro or Enterprise license.

Accessing Webhooks

Go to Admin → Webhooks. The tab displays all configured webhooks with their name, URL, active status, and the events they subscribe to.

Creating a Webhook

  1. Click + New Webhook.
  2. Enter a descriptive Name (e.g., “Slack #helpdesk channel”).
  3. Enter the URL that will receive the POST requests.
  4. Select one or more Events to subscribe to from the checkbox list.
  5. Click Save. A unique signing secret is generated and displayed once — copy it immediately. You will not be able to view it again.

Supported Events

EventFires When
TICKET_CREATEDA new ticket is created (UI, API, email, or recurring template)
TICKET_UPDATEDAny field on an existing ticket changes
TICKET_CLOSEDA ticket is approved by QA and closed
STATUS_CHANGEDA ticket’s status transitions
PRIORITY_CHANGEDA ticket’s priority level changes
TICKET_ASSIGNEDA ticket is assigned or reassigned to a technician
TICKET_MERGEDA ticket is merged into another
QA_SUBMITTEDA ticket is submitted for QA review
QA_APPROVEDQA approves a ticket
QA_REJECTEDQA rejects a ticket
NOTE_ADDEDAn internal note is posted on a ticket
SLA_BREACHEDA ticket’s SLA deadline is exceeded

Request Signing

Every webhook request is signed using HMAC-SHA256 with the webhook’s secret. The signature is sent in the X-ForsetiDesk-Signature HTTP header in the format sha256=<hex-digest>. Verify this signature on the receiving end to confirm the request originated from your ForsetiDesk instance and was not tampered with.

Retry Logic

If a webhook delivery fails (non-2xx response or network error), ForsetiDesk retries up to 3 times with increasing delays: immediately, after 30 seconds, and after 5 minutes. All delivery attempts are logged.

Delivery Log

Click any webhook to view its delivery history. Each entry shows the event, timestamp, HTTP status code, success/failure status, number of attempts, and the response body (expandable). Delivery records are automatically cleaned up after 30 days by a daily maintenance job.

Managing Webhooks

  • Edit — modify the name, URL, or subscribed events
  • Active toggle — temporarily disable a webhook without deleting it
  • Regenerate Secret — generate a new signing secret (invalidates the old one immediately)
  • Test Ping — send a test payload to verify the endpoint is reachable
  • Delete — permanently remove the webhook and all its delivery history
💡 Webhook dispatches are fire-and-forget — they never block ticket operations. If your endpoint is slow or down, ticket updates still succeed normally.
Section 16

Recurring Tickets NEW IN 1.8

Audience: Administrators — Pro License Required

Recurring tickets automate the creation of routine maintenance tickets, scheduled inspections, and periodic review tasks. Define a template once and ForsetiDesk creates tickets automatically on your chosen schedule.

ℹ Recurring tickets require a Pro or Enterprise license.

Accessing Recurring Tickets

Go to Admin → Recurring. The tab lists all templates with their name, schedule, next run time, last run time, and enabled status.

Creating a Template

  1. Click + New Template.
  2. Enter a Name for internal reference (e.g., “Monthly server patching”).
  3. Enter the Ticket Title. You can use interpolation variables:
    • {{date}} — current date (YYYY-MM-DD)
    • {{month}} — current month name
    • {{year}} — current year
    • {{day}} — current day of the week
    • {{seq}} — sequential run number
  4. Enter a Description for the generated tickets.
  5. Set Priority, Category, Assigned To, and Tags as desired.
  6. If custom fields are configured, set their values in the template.
  7. Choose a Schedule Type:
    • Daily — runs every day at the specified time
    • Weekly — runs on a selected day of the week at the specified time
    • Monthly — runs on a selected day of the month at the specified time
    • CRON — custom cron expression for advanced scheduling
  8. Set the Time (24-hour format) for when the ticket should be created.
  9. Toggle Enabled on and click Save.

How It Works

A background scheduler runs every 60 seconds. It checks all enabled templates and creates tickets for any where the current time has passed the calculated next run time. After each run, the next run time is recalculated based on the schedule.

At execution time, ForsetiDesk validates that the assigned technician and category are still active. If the assignee is inactive, the ticket is created unassigned. If the category is inactive, it is omitted. Generated tickets trigger automation rules, SMTP notifications, and webhooks just like manually created tickets.

Run Audit Log

Each template maintains a run history showing every execution: timestamp, whether it succeeded or failed, the created ticket ID (clickable link), and any error message. This provides accountability and makes it easy to verify that scheduled tickets are being created on time.

Manual Trigger

Click Run Now on any template to immediately create a ticket from that template, bypassing the schedule. This is useful for testing a new template or triggering an ad-hoc instance.

Managing Templates

  • Edit — modify any template field including the schedule
  • Enable/Disable toggle — pause a template without deleting it
  • Delete — permanently remove the template and its run history
⚠ Deleting a recurring ticket template also deletes its entire run audit log. The tickets it previously created are not affected.
Section 17

Time Tracking NEW IN 1.9

Audience: Technicians & Administrators — Pro License Required

Time tracking lets technicians record the time they spend on each ticket. Entries can be marked as billable or non-billable, and a persistent global timer makes it easy to track time across navigation without losing your running clock.

ℹ Time tracking requires a Pro or Enterprise license.

Recording Time on a Ticket

Open any ticket detail page and scroll to the Time Tracker section (below Internal Notes). You can add time in two ways:

Manual Entry

  1. Enter the time spent in the Minutes field. You can type plain minutes (e.g., 45) or use h:mm format (e.g., 1:30 for 90 minutes).
  2. Optionally add Notes describing the work performed.
  3. Toggle the Billable checkbox as appropriate (defaults to billable).
  4. Click Add Entry.

Live Timer

  1. Click the Start Timer button on the ticket’s Time Tracker section.
  2. A persistent timer bar appears at the top of the screen showing elapsed time in HH:MM:SS format, along with a clickable link back to the ticket.
  3. Navigate freely — the timer survives page changes and continues running.
  4. When finished, click Stop on the timer bar. The elapsed time is saved as a new entry on the ticket. Click Cancel to discard the timer without saving.
💡 Only one timer can be running at a time. If you open a different ticket while a timer is running, the Time Tracker section shows a link to the ticket with the active timer instead of a Start button.

Summary Bar

Above the time entries list, a summary bar shows the total time, billable time, and non-billable time for the current ticket.

Editing and Deleting Entries

Technicians can edit or delete their own time entries. Administrators can edit or delete any entry. All edits and deletions are recorded in an audit trail that captures the old and new values for changed fields.

Global Time Entries View

Administrators can access a global view of all time entries across all tickets via the Admin panel. This view supports filtering by technician, date range, and billable status, with pagination for large datasets.

Analytics Integration

The Analytics page includes two new charts when time tracking data is available:

  • Time by Technician — shows total and billable hours per technician
  • Time by Category — shows total and billable hours per ticket category

Both charts support switchable views: Bar chart, Horizontal Bar chart, and Pie chart.

Section 18

Organizations NEW IN 1.9

Audience: Administrators — Enterprise License Required

Organizations enable MSP-ready multi-tenant support by letting you define client organizations with their own SLA targets, QA policies, default ticket settings, and contact information. Tickets are automatically matched to organizations based on the client’s email domain.

ℹ Organizations require an Enterprise license.

Managing Organizations

Go to Admin → Organizations. The tab lists all organizations with their name, domain, active status, and configured SLA/QA overrides.

Creating an Organization

  1. Click + New Organization.
  2. Enter the Name (must be unique).
  3. Enter the Domain for automatic email matching (e.g., acmecorp.com).
  4. Optionally configure Per-Org SLA Targets — response and resolution hours per priority. Leave blank to use the global SLA targets.
  5. Set the QA Requirement using the three-state toggle:
    • Use Global — follows the system-wide QA setting
    • Require — always require QA review for this org’s tickets
    • Skip — allow techs to close tickets directly without QA for this org
  6. Optionally set Default Priority and Default Category for new tickets from this org.
  7. Add Contact details (name, email, phone) and Notes for internal reference.
  8. Click Save.

Automatic Organization Matching

When a ticket is created with a client email address, ForsetiDesk extracts the email domain and matches it against configured organizations. If a match is found, the ticket is automatically linked to that organization and its defaults (priority, category, SLA targets, QA policy) are applied.

Global Organization Selector

A dropdown in the header bar (right side, near the user menu) lets you filter the entire application by organization. Selecting an organization scopes the dashboard, ticket list, analytics, and QA queue to show only that organization’s tickets. The default is “All Organizations” and the selection persists across navigation.

SLA & QA Resolution Order

  • SLA targets: Organization-specific targets are used when set. Otherwise, the global SLA targets apply as a fallback.
  • QA requirement: If the organization has a non-null QA override (Require or Skip), that takes precedence. Otherwise, the global QA setting applies.

Organization on Tickets

  • Ticket create/edit: An Organization dropdown appears on the form. It auto-selects based on client email domain match.
  • Ticket list: An Organization column is displayed and filterable.
  • Ticket detail: An Organization badge appears near the client information.

Deactivating an Organization

Toggle the Active switch off to deactivate an organization. Deactivated organizations stop matching new tickets but existing tickets remain linked and unaffected. This is a soft delete that preserves history.

Section 19

LDAP / Active Directory SSO NEW IN 1.9

Audience: Administrators — Enterprise License Required

LDAP/Active Directory SSO allows your users to authenticate with their existing corporate directory credentials instead of maintaining separate ForsetiDesk passwords. When enabled, users log in with their AD username and password, and ForsetiDesk verifies them against your LDAP or Active Directory server.

ℹ LDAP/AD SSO requires an Enterprise license.

How It Works

When a user logs in and LDAP is enabled, ForsetiDesk performs a bind against your configured LDAP server using the user’s credentials. If the bind succeeds, the user is authenticated. On first login, the user account is auto-provisioned in ForsetiDesk — no manual account creation needed.

Configuring LDAP

Go to Admin → Settings and locate the LDAP/AD SSO configuration section. The following fields must be configured:

SettingDescriptionExample
LDAP Server URLThe URL of your LDAP or AD server. Use ldap:// for plain or ldaps:// for TLS.ldaps://dc.yourcompany.com:636
Bind DNDistinguished Name used to bind to the directory for user lookups.CN=svc_forseti,OU=ServiceAccounts,DC=corp,DC=local
Bind PasswordPassword for the bind DN. Stored encrypted with AES-256-GCM on the server — never stored in plain text.
Search BaseThe base DN under which to search for user accounts.OU=Users,DC=corp,DC=local
Search FilterLDAP filter to locate the user. Use {{username}} as the placeholder for the login value.(sAMAccountName={{username}})
TLS / StartTLSEnable TLS for the connection. Use ldaps:// URL for implicit TLS, or enable StartTLS for explicit negotiation on port 389.

Auto-Provisioning

When a user authenticates via LDAP for the first time and no matching ForsetiDesk account exists, a new account is automatically created. The user’s name and email are pulled from the directory. The default role for auto-provisioned users is configurable (typically TECH or CLIENT). Administrators can change the role after provisioning.

Admin Local Auth Fallback

Even when LDAP is enabled, the built-in ADMIN account always falls back to local password authentication. This ensures you can still access ForsetiDesk if the LDAP server is unreachable. Other users must authenticate against the directory when LDAP is active.

⚠ Do not use startTLS: true together with an ldaps:// URL — this causes a TLS double-negotiation error. Use one or the other: ldaps:// for implicit TLS, or ldap:// with StartTLS enabled.
💡 Test your LDAP configuration thoroughly before rolling out to all users. Use the Test Connection button to verify connectivity and a test login with a known AD account to confirm the search filter and bind settings are correct.
Section 20

Bring Your Own Database NEW IN 1.9

Audience: Administrators — Pro License Required

Bring Your Own Database (BYODB) lets you point ForsetiDesk at an external PostgreSQL instance you manage instead of using the bundled local database. This is useful for organizations that want to host ForsetiDesk’s data on a managed database service, a dedicated database server, or an existing PostgreSQL cluster with their own backup and HA strategy.

ℹ BYODB requires a Pro or Enterprise license. Only PostgreSQL is supported in this release.

How It Works

You provide a standard PostgreSQL connection string pointing to your external database. ForsetiDesk connects and automatically creates the required tables and schema using its built-in migration tooling. Your existing data infrastructure handles backups, replication, and availability — ForsetiDesk just needs a valid connection.

Setting Up BYODB

  1. Provision a PostgreSQL database on your target server. ForsetiDesk requires PostgreSQL 14 or later (17 recommended).
  2. Create a dedicated database and user with full permissions on that database:
    CREATE DATABASE forsetidb; CREATE USER forsetiuser WITH PASSWORD 'your_secure_password'; GRANT ALL PRIVILEGES ON DATABASE forsetidb TO forsetiuser;
  3. Ensure the ForsetiDesk server can reach the database host over the network (check firewalls, security groups, and pg_hba.conf).
  4. On the ForsetiDesk server, edit secrets.cfg and update the DATABASE_URL:
    DATABASE_URL=postgresql://forsetiuser:your_secure_password@db-host:5432/forsetidb
  5. Restart the ForsetiDesk service. On startup, the application detects the external database and automatically creates all required tables.
  6. Log in and verify the system is operational. Check Admin → Database to confirm the table list shows correctly.

Important Considerations

  • The external database must be reachable from the ForsetiDesk server at all times. If the connection drops, the application will be unavailable until connectivity is restored.
  • ForsetiDesk’s built-in backup feature (Admin → Backups) uses pg_dump and requires the PostgreSQL client binaries on the ForsetiDesk server. For remote databases, ensure the connection string credentials have the necessary permissions for pg_dump.
  • SSL/TLS connections to the remote database are supported. Append ?sslmode=require to the connection string if your database requires encrypted connections.
  • Switching from a local database to BYODB (or vice versa) requires migrating data manually. ForsetiDesk does not provide an automatic migration between database instances.
⚠ Changing the DATABASE_URL to point to a new empty database means starting fresh — all existing tickets, users, and settings from the previous database are not carried over unless you manually migrate the data using pg_dump and psql.

21 Asset Management (ITAM)

Pro Feature

ForsetiDesk's Asset Management module provides a full IT Asset Management (ITAM) solution. Track every piece of hardware and software from procurement through disposal, link assets to tickets, and manage physical locations down to the rack unit.

21.1 Asset Lifecycle Statuses

StatusMeaning
ORDEREDPurchase order placed; asset not yet received
RECEIVEDAsset arrived but not yet deployed
ACTIVEIn production use
IN_MAINTENANCETemporarily out of service for repair
RETIREDNo longer in use; awaiting disposal
DISPOSEDPermanently removed from inventory

21.2 Asset Fields

Each asset stores the following information, organized by category:

Identity

  • Asset Tag — unique identifier (e.g., AST-0042)
  • Name — human-readable label
  • Asset Type — category (Desktop Computer, Laptop, Server, etc.)
  • Serial Number — manufacturer serial
  • Model — device model name
  • Manufacturer — brand/vendor
  • Status — lifecycle stage (see 21.1)
  • Notes — free-text field for additional context

Ownership & Assignment

  • End User — the person the device is checked out to (name, email, department, phone). This is an independent record stored alongside the asset, not a system user account.
  • Assigned Technician — the IT staff member responsible for this asset
  • Organization — linked organization for multi-tenant environments (Enterprise)
  • Department — organizational department
End User vs. Assigned Technician: The End User is the person who has the device (e.g., Jane Smith in Accounting). The Assigned Technician is the IT staff member accountable for maintaining it. Both fields are optional but highly recommended for accurate reporting.

Hardware Details

  • CPU — processor model
  • RAM (GB) — memory amount
  • Storage — disk size/type
  • IP Address — primary network address
  • MAC Address — network interface identifier
  • OS / OS Version — operating system
  • Firmware Version — firmware/BIOS version

Financial

  • Purchase Date
  • Purchase Price
  • Vendor
  • Warranty Expiry
  • Lease Expiry

Location

  • Location — selected from the location hierarchy (see 21.4)
  • Rack Position (U) — starting rack unit (RACK locations only)
  • Rack Height (U) — how many rack units the asset occupies

21.3 Custom Fields per Asset Type

Admins can create custom fields scoped to a specific Asset Type (e.g., a “License Key” field for Software License assets only). These appear on asset forms and detail pages only when the relevant type is selected. Manage them under Admin → Settings → Custom Fields and choose “Asset Type” as the entity type.

21.4 Location Hierarchy

Locations form a tree hierarchy, allowing precise placement from site down to individual rack units:

LevelTypeAdditional Fields
1SITEAddress, City, State, ZIP, Country
2BUILDINGParent: Site
3FLOORParent: Building
4ROOMParent: Floor or Building
5RACKParent: Room; Rack Units capacity

Manage locations at Admin → Settings → Locations (visible when Asset Management is licensed).

21.5 Rack Elevation Diagram

For RACK-type locations, the asset detail page shows a visual rack elevation diagram. Each asset in that rack is rendered as a colored block occupying its assigned rack units. This provides an at-a-glance view of rack utilization and asset placement.

  • Assets with a Rack Position and Rack Height appear in the diagram
  • Hovering over a block shows the asset name and tag
  • Unoccupied units appear as empty grey slots

21.6 Asset List & Filtering

Navigate to Assets in the sidebar to see the full asset inventory. The list supports:

  • Search by name, asset tag, or serial number
  • Filter by status, asset type, location, assigned technician, and organization
  • Sortable columns: Asset Tag, Name, Type, Status, Location, Assigned To
  • Column visibility toggle — customize which columns appear
  • CSV export of filtered results

21.7 Linking Assets to Tickets

Assets can be linked to tickets to track which equipment is affected by an issue:

  1. Open a ticket and scroll to the Linked Assets section
  2. Click Link Asset and search by name or asset tag
  3. Select an operational status for this link: OPERATIONAL, DEGRADED, FULL_FAILURE, or UNKNOWN
  4. Click Save

The linked asset appears in the ticket sidebar with its status badge and a link to the full asset record. Multiple assets can be linked to a single ticket.

21.8 Asset Types Administration

Asset types define the categories of assets in your inventory. Manage them at Admin → Asset Types:

  • Create custom types with a name and Lucide icon
  • Set sort order for display in dropdowns
  • Deactivate types to hide them from new asset creation (existing assets are unaffected)
  • Default types seeded at startup: Desktop Computer, Laptop, Monitor, Printer, Network Device, Server, Mobile Device, Software License, Peripheral, Other

21.9 Asset History

Every change to an asset is recorded in an append-only history log visible on the asset detail page. Each entry captures: the field changed, old value, new value, the user who made the change, and timestamp.

22 CMDB & CI Relationships

Enterprise Feature

The Configuration Management Database (CMDB) module lets you map relationships between Configuration Items (CIs) — your assets — to understand infrastructure dependencies, perform impact analysis, and visualize your entire environment as a network graph.

22.1 Relationship Types

TypeForward LabelReverse LabelUse Case
RUNS_ONRuns onHas runningApplication runs on a server or VM
DEPENDS_ONDepends onIs dependency ofService depends on a database or API
CONNECTED_TOConnected toConnected toNetwork connectivity between devices
PART_OFPart ofContainsComponent is part of a larger assembly
HOSTSHostsHosted onPhysical server hosts a VM or container

22.2 Adding Relationships

  1. Open an asset detail page
  2. Scroll to the CI Relationships section
  3. Click Add Relationship
  4. Select the target asset (search by name or tag)
  5. Choose a relationship type from the dropdown
  6. Optionally add notes describing the relationship
  7. Click Save

Relationships are displayed bidirectionally — both the source and target asset show the relationship with the appropriate forward or reverse label.

No duplicates: The system prevents creating the same relationship twice (same source, target, and type). A relationship already exists between two assets for the same type.

22.3 Impact Analysis

Impact Analysis answers: “If this asset fails, what else is affected?”

From any asset detail page, click View Impact to launch the Impact Analysis panel. The system performs a recursive traversal (up to 10 hops, max 500 nodes) following DEPENDS_ON, RUNS_ON, and HOSTS relationships to build a dependency tree of everything that relies on the selected asset.

The result shows a hierarchical tree with:

  • Asset name, tag, status, and type at each node
  • The relationship type that caused the dependency
  • Depth level in the chain

A truncated warning appears if the traversal hit the 500-node safety cap.

22.4 Topology Graph

Navigate to CMDB in the sidebar to access the full network topology visualization (Admin and Tech roles only).

Controls

ControlDescription
SearchFilter nodes by name, tag, or serial number
Asset TypeShow only assets of a specific type
Relationship TypeShow only edges of a specific relationship type
StatusFilter assets by lifecycle status (default: excludes RETIRED/DISPOSED)
OrganizationFilter by organization (Enterprise)
Assigned ToFilter by responsible technician
Root Asset + DepthBFS traversal from a specific asset up to N hops (1–10, default 3)

Graph Interaction

  • Drag nodes to rearrange the layout
  • Scroll to zoom in/out
  • Click a node to open the asset detail page in a new tab
  • Edges are labeled with the relationship type
  • Node color indicates asset type; node size indicates connectivity
Large environments: The topology graph caps at 500 nodes for performance. Use the Root Asset + Depth filter to focus on a specific subnet of your infrastructure.

23 Change Management

Pro Feature

ForsetiDesk's Change Management module implements an ITIL-aligned change control process. Every planned modification to your IT environment goes through a structured workflow: request → review → approval → implementation → closure.

23.1 Change Types

TypeApproval RequiredUse Case
STANDARDAuto-approved on submitPre-approved, low-risk, routine changes (e.g., scheduled patch Tuesday)
NORMALManual approval by designated approversPlanned changes with moderate risk requiring review board sign-off
EMERGENCYManual approval (expedited)Urgent changes needed to restore service; bypass normal scheduling

23.2 Change Lifecycle

StatusMeaningWho Can Advance
DRAFTChange is being authoredCreator (ADMIN/TECH)
SUBMITTEDSubmitted for review; STANDARD auto-advances to APPROVEDCreator
UNDER_REVIEWBeing evaluated by the change boardADMIN only
APPROVEDApproved for implementationADMIN only
REJECTEDChange denied; returned with reasonADMIN only
SCHEDULEDApproved and has a scheduled implementation windowADMIN/TECH
IMPLEMENTINGChange is actively being appliedADMIN/TECH
COMPLETEDImplementation finished successfullyADMIN/TECH
FAILEDImplementation attempted but did not succeed (rollback may have occurred)ADMIN/TECH
CLOSEDPost-implementation review done; change archivedADMIN only

23.3 Creating a Change Request

  1. Navigate to Changes in the sidebar and click New Change Request
  2. Fill in the Title and Description (what is being changed and why)
  3. Select Change Type: Standard, Normal, or Emergency
  4. Set Risk Level and Impact Level: LOW / MEDIUM / HIGH / CRITICAL
  5. Write the Implementation Plan — step-by-step instructions
  6. Write the Rollback Plan — how to revert if the change fails
  7. Write the Test Plan — how to verify success
  8. Set the Scheduled Start and Scheduled End (the planned maintenance window)
  9. Add Required Approvers (for Normal and Emergency types)
  10. Link related Tickets and Assets
  11. Click Create to save as DRAFT, or Submit to immediately advance to SUBMITTED
Standard changes auto-approve: When you submit a Standard change, it immediately transitions to APPROVED, skipping the UNDER_REVIEW and manual approval steps. Use this type only for pre-vetted, repeatable procedures.

23.4 Risk & Impact

LevelRisk DefinitionImpact Definition
LOWMinimal chance of failure or side effectsAffects a single user or non-critical system
MEDIUMSome possibility of disruption with mitigation stepsAffects a department or non-core service
HIGHSignificant possibility of disruption; requires careful executionAffects multiple departments or a core service
CRITICALHigh probability of major disruption; emergency change board review requiredAffects the entire organization or production systems

23.5 Approval Workflow

For Normal and Emergency changes, each required approver must record a decision:

DecisionMeaning
PENDINGAwaiting approver decision (default)
APPROVEDApprover has signed off on this change
REJECTEDApprover has denied this change
DEFERREDApprover requests more information or a later review date

An ADMIN must advance the overall change status. Individual approver decisions are advisory; the ADMIN reviews all decisions and sets the change to APPROVED or REJECTED accordingly.

23.6 Linked Tickets & Assets

Changes can reference related tickets and assets:

  • Linked Tickets — tickets that describe the problem this change addresses, or testing tickets created to verify success
  • Linked Assets — assets that will be affected by or are the subject of this change

Links can be added or removed at any time while the change is not CLOSED.

23.7 Change Numbering

Change requests are automatically assigned a sequential number (e.g., CHG-0001). Configure the format at Admin → Settings → General:

  • Prefix — default CHG-
  • Pad Length — zero-padding width, default 4 digits
  • Next Sequence — manually set if migrating from another system

23.8 History & Audit Trail

Every status transition, field edit, and approver decision is recorded in the change history log. Each entry captures the user, timestamp, action taken, and (for field edits) the old and new values. The history log is immutable and append-only.

Section 24

Problem Management

Audience: Technicians & Administrators — Pro License Required

Problem Management helps your team identify and address the root causes behind recurring incidents. A Problem is a cause (or potential cause) of one or more incidents — it may be raised proactively or reactively after a pattern of tickets is detected.

ℹ Problem Management requires a Pro license. The Problems item appears in the sidebar for Admin, Tech, and QA roles.

Problem Statuses

StatusDescription
OPENProblem identified but investigation has not started
INVESTIGATINGActive investigation underway — team is gathering data
ROOT_CAUSE_IDENTIFIEDRoot cause has been determined; working toward resolution
KNOWN_ERRORDocumented with a known workaround; appears in the KEDB
RESOLVEDPermanent fix has been applied
CLOSEDVerified closed; no further action required

Creating a Problem

  1. Click Problems in the sidebar, then click New Problem.
  2. Enter a title, description, priority, and optionally assign it to a technician.
  3. Save — the problem is created with status OPEN and a sequential problem number (e.g., PRB-0001).

Linking Incidents & Change Requests

On the Problem detail page, use the Linked Incidents panel to associate existing tickets with the problem. Use Linked Changes to connect related change requests. These links provide full traceability between root cause, affected incidents, and the change that resolved the problem.

Root Cause Analysis (RCA)

Open the RCA tab on the problem detail page and select a method:

MethodDescription
Five WhysIterative questioning to drill down to the root cause
Fishbone (Ishikawa)Categorized cause-and-effect diagram
Fault TreeTop-down logical diagram of failure causes
TimelineChronological sequence of events leading to the problem
CustomFree-form narrative RCA for non-standard approaches

Promoting to Known Error

When a workaround is identified but a permanent fix is not yet available, advance the problem to KNOWN_ERROR status. A workaround description is required before this transition is allowed. Once marked as a Known Error, the problem appears in the Known Error Database (KEDB).

Problem Detail Page

The problem detail page shows: metadata (status, priority, assignee), linked incidents count, linked change requests, RCA summary, workaround text, a full history timeline of all updates, and file attachments.

Section 25

Known Error Database

Audience: All Staff — Pro License Required

The Known Error Database (KEDB) is a filtered view of all problems promoted to KNOWN_ERROR status. It serves as a quick-reference library of documented workarounds that technicians can consult while a permanent fix is in progress.

ℹ The KEDB is accessed from Problems → Known Errors tab in the sidebar. It is read-only — entries appear automatically when a Problem is advanced to KNOWN_ERROR status.

Searching Known Errors

Use the search bar at the top of the KEDB to filter entries by keyword. The search matches the problem title, description, and workaround text. Results update as you type.

KEDB Entry Fields

FieldDescription
Problem NumberSequential identifier (e.g., PRB-0042)
TitleShort description of the known error
WorkaroundSteps to mitigate impact until the permanent fix is applied
Linked IncidentsCount of tickets associated with this problem

Using the KEDB

When a client reports an issue matching a known error, apply the documented workaround immediately and inform the client that a permanent fix is under investigation. Clicking a KEDB entry opens the full Problem detail page with linked incidents and RCA details.

Section 26

Service Catalog

Audience: All Users — Pro License Required (Catalog Builder: Enterprise)

The Service Catalog is a self-service portal where users browse available IT services and submit structured requests. Each catalog item has a configurable request form, an estimated fulfillment time, and an optional approval chain.

Browsing the Catalog

Navigate to Service Desk → Catalog. Items are displayed as cards showing an icon, title, description, and estimated fulfillment time. Click a card to begin a request.

Pre-Seeded Catalog Items

Catalog ItemCategoryEst. Fulfillment
New Hire OnboardingNew Hire3 business days
System Access RequestAccess Request1 business day
Software Installation RequestSoftware Request2 business days

Submitting a Request

  1. Click a catalog item card to open its request form.
  2. Fill in all required fields (marked with an asterisk *).
  3. Click Submit Request. The request enters the approval workflow if configured, or goes directly to fulfillment if no approval is required.

Admin: Creating Catalog Items (Enterprise)

Enterprise administrators can create custom catalog items from Admin → Service Catalog. Configure the name, description, icon, category, estimated fulfillment days, form fields (via the form builder), approval chain, and active toggle.

Visual Form Builder

The form builder lets administrators design structured multi-section request forms without writing code. Forms are organized into named sections, each containing any number of typed fields.

Field Types

TypeDescription
TextSingle-line free text input
TextareaMulti-line free text input
DropdownSingle-select from a predefined list of options
Multi-selectMultiple selections from a predefined list
DateDate picker
CheckboxBoolean true/false toggle
NumberNumeric input
EmailEmail address with format validation
PhonePhone number input
URLWeb address input
File UploadAttachment upload field
HeadingNon-input section heading for visual grouping
ParagraphNon-input instructional text block
DividerHorizontal rule for visual separation

Conditional Fields

Any field can be shown or hidden based on the value of a preceding field. Select Show when and pick the controlling field plus the trigger value. Conditional logic is evaluated in real time as the user fills out the form.

Sections

Group related fields into named sections. Sections appear as collapsible panels on the request form. Drag sections and fields to reorder them. Click the pencil icon on any field to edit its label, placeholder, options, and required status inline.

Visual Workflow Designer

The Workflow Designer is a drag-and-drop canvas for designing fulfillment workflows attached to catalog items. It defines what happens after a request is approved, complementing the Approval Chain which defines the pre-approval steps.

Node Types

NodeDescription
StartEntry point — workflow begins here when a request is approved
TaskA manual fulfillment step with an assignee and description
ApprovalIn-workflow approval gate (separate from the pre-submission approval chain)
NotificationSend an email or push notification to a user or role
ConditionBranching node — routes to different paths based on field values or prior step outcomes
ParallelSplit execution into concurrent branches that rejoin at a Merge node
TimerPause execution for a configurable duration; triggers escalation if a task is not completed in time
EndTerminal node — marks the workflow complete
ℹ The Workflow Designer is an Enterprise feature. Pro and Business tiers can configure approval chains and form fields but not visual fulfillment workflows.
Section 27

Service Requests

Audience: All Users — Pro License Required

A Service Request is a formal request for a predefined IT service from the Service Catalog. Requests follow a structured approval and fulfillment workflow with full audit history.

Service Request Lifecycle

StatusDescription
DRAFTSaved but not yet submitted
PENDING_APPROVALSubmitted; waiting for approver action
APPROVEDAll approvers approved; ready for fulfillment
REJECTEDAn approver rejected the request
IN_FULFILLMENTFulfillment work is actively underway
FULFILLEDWork is complete; pending closure
CLOSEDFully closed and archived
CANCELLEDCancelled by the requestor before fulfillment

Approval Chain Progress

The request detail page displays a visual stepper showing each approval step in sequence. Each step shows the approver, their decision (Pending / Approved / Rejected), and timestamp. Approval is sequential — step 2 activates only after step 1 is approved.

Approving or Rejecting

If you are the designated approver for the current step, Approve and Reject buttons appear on the request detail page. Add optional notes with your decision. Admins can act on any step regardless of designation.

My Approvals View

Navigate to Service Desk → My Approvals to see all pending requests waiting for your approval action — a single place to review and act without searching individual requests.

Fulfillment & Ticket Generation

Once all approvals are granted, the request moves to APPROVED. A fulfillment technician marks it IN_FULFILLMENT, optionally generates a linked ticket to track the work, then marks it FULFILLED and finally CLOSED.

Viewing Requests

Navigate to Service Desk → Requests. CLIENT users see only their own requests (My Requests). Staff users see all requests. Use the status filter to narrow the list.

Cancellation

Requestors can cancel their own requests while in DRAFT or PENDING_APPROVAL status. Admins can cancel any request that has not yet reached IN_FULFILLMENT.

Section 28

Approval Chains

Audience: Administrators — Pro License Required

Approval Chains define the sequence of approvers a service request must pass through before moving to fulfillment. Chains are configured once and assigned to catalog items. Approval is sequential — each step must be approved before the next activates.

ℹ Approval Chains are configured under Admin → Approval Chains.

Approver Types

Approver TypeDescription
Specific UserA named individual. That exact user must approve the step.
RoleAny user with the specified role (ADMIN, TECH, or QA) can approve.
ManagerThe manager of the requestor — set via the Manager field in Admin → Users.

Creating an Approval Chain

  1. Go to Admin → Approval Chains and click New Chain.
  2. Give the chain a name (e.g., “Standard IT Approval”).
  3. Add steps in order. For each step, select the approver type and target.
  4. Save the chain, then assign it to a catalog item under Admin → Service Catalog (Enterprise).

How Sequential Approval Works

  1. Step 1 becomes active; the designated approver is notified.
  2. If approved, Step 2 activates and its approver is notified.
  3. This continues until all steps are approved — the request then moves to APPROVED.
  4. If any step is rejected, the entire request moves to REJECTED and no further steps are evaluated.
ℹ For complex fulfillment workflows with parallel steps, conditional branching, or timer escalation, see the Visual Workflow Designer in Section 26 (Service Catalog). Approval Chains handle pre-submission approval; the Workflow Designer handles post-approval fulfillment automation.
Section 29

Dashboard Customization

Audience: All Users

The ForsetiDesk dashboard supports fully customizable widget layout. Each user can independently arrange, resize, add, and remove widgets. Layout changes are saved to your profile and persist across sessions and devices.

Entering Edit Mode

Click the Edit Dashboard button at the top-right of the dashboard. A dashed border appears around each widget, a drag handle appears in each widget header, and resize handles appear at the corners.

Moving Widgets

In edit mode, grab the drag handle (☰) in a widget’s header and drag it to the desired position. The grid uses free-form placement — widgets do not auto-compact. If you drag to a space already occupied, the move is cancelled and the widget snaps back.

Resizing Widgets

Drag the resize handle at the bottom-right corner of any widget to change its size. Minimum and maximum dimensions are enforced per widget type.

Adding Widgets

Click Add Widget (visible in edit mode) to open the widget picker. Select a widget to add it to the dashboard at the first available position.

Removing Widgets

In edit mode, click the × button in the top-right corner of any widget to remove it. The widget is not permanently deleted — it can be re-added via Add Widget at any time.

Saving and Discarding Changes

  • Save Layout — saves your current arrangement to your user profile; persists across logins and devices.
  • Cancel — discards all unsaved changes in the current edit session and reverts to the last saved layout.
  • Reset Layout — returns the dashboard to the system default layout.

30 Troubleshooting

30.1 Login & Access Issues

Cannot log in — “Invalid credentials”

  • Verify the email address is typed correctly (case-insensitive).
  • Confirm the password is correct. If forgotten, use Forgot Password on the login page to receive a reset link via email.
  • If the account was recently created by an admin, use the temporary password provided. You will be prompted to change it immediately.
  • If LDAP/AD SSO is enabled, ensure your Active Directory password is current and the account is not locked in AD.

Account locked — “Too many login attempts”

  • The rate limiter triggers after 5 failed attempts per IP+email within 15 minutes.
  • Wait 15 minutes, then try again.
  • If the lockout persists, contact your system administrator to verify there is no IP conflict or proxy issue routing all traffic from the same source IP.
  • Localhost/loopback addresses are exempt from the rate limit (development environments).

Forced password change loop

  • If you are redirected to the password change page on every login, the admin has set mustChangePassword = true on your account.
  • Complete the password change to clear the flag. If the loop persists after changing, clear your browser cookies and log in again.

LDAP login fails — “LDAP authentication failed”

  • Check that the LDAP server is reachable from the ForsetiDesk server (ping the LDAP host; verify firewall rules for port 389 or 636).
  • Verify the Base DN and Search Filter match your AD structure. Use Admin → LDAP/AD → Test Connection to confirm bind credentials work.
  • Use Test Authentication with a known AD username and password to isolate whether the problem is the bind or the user search.
  • Ensure the bind account has read access to the user objects in the specified Base DN.
  • ADMIN accounts always authenticate locally, regardless of LDAP settings. If an ADMIN cannot log in, the issue is with the local password, not LDAP.
  • Check the ForsetiDesk service logs at C:\Program Files (x86)\ForsetiDesk\logs\ for detailed LDAP error codes.

30.2 Ticket Issues

Ticket not appearing in list

  • Check active filters: status, priority, category, assigned-to. A heavily filtered view may exclude the ticket.
  • CLIENT role users only see tickets matching their email address (clientEmail field). If the ticket was created with a different email, it will not appear.
  • Merged tickets (status MERGED) do not appear in the main list. Search by ticket ID or look in the target ticket's “Merged Tickets” section.
  • If you were recently assigned a ticket, refresh the page or clear the filter.

Cannot close ticket — QA required

  • When QA workflow is enabled (globally or per-organization), tickets must be submitted for QA and approved before closing.
  • Tech users: use Submit for QA to advance the ticket to PENDING_QA.
  • If a specific organization has QA disabled (requireQA = false), tickets for clients in that organization can be closed directly.
  • Admins can bypass QA and close tickets directly regardless of QA settings.

SLA deadline missing from ticket

  • SLA must be enabled under Admin → Settings → General → SLA Enabled.
  • SLA deadlines are set at ticket creation time. Enabling SLA after a ticket was created will not back-populate deadlines.
  • If the organization has custom SLA targets, those override global targets for tickets with a matching client email domain.
  • Verify the ticket has a priority set — SLA targets are per-priority.

Custom fields not appearing on ticket form

  • Custom fields are scoped to a Category. Select the correct category on the ticket form for the relevant custom fields to appear.
  • Verify the custom field is Active in Admin → Settings → Custom Fields.
  • Custom fields require a Pro license. Confirm the license is installed and valid.

30.3 Email & Notification Issues

Outbound emails not sending

  • Navigate to Admin → Communications → Notifications and verify SMTP settings (host, port, credentials, TLS mode).
  • Use Send Test Email to confirm the SMTP connection works. Check the test result for specific SMTP error codes.
  • Common causes: incorrect port (25, 465, or 587 depending on TLS), app password required for Gmail/Microsoft 365, firewall blocking outbound SMTP.
  • Ensure Sender Email matches the authenticated account or an allowed sender alias.
  • Notifications fire asynchronously — a ticket operation succeeds even if the email fails. Check server logs for [Notifications] error lines.

Email-to-ticket (IMAP) not creating tickets

  • Requires a Pro license with the email_to_ticket feature.
  • Check IMAP settings under Admin → Communications → Email Inbox. Test the connection and verify the mailbox is accessible.
  • Confirm the poll interval is set and the poller is running (check Poll Status indicator).
  • Emails already processed are tracked by emailMessageId. Duplicate emails from the same Message-ID will be silently skipped.
  • Check that the mailbox folder being polled is correct (default: INBOX).
  • Gmail users: enable IMAP in Gmail settings and use an App Password, not the account password.

Password reset email not arriving

  • Confirm SMTP is configured and working (send a test email first).
  • Check the user's spam/junk folder.
  • Password reset tokens expire after 1 hour. If the link has expired, request a new one.
  • Reset links are single-use. If the link was already clicked (even if the reset was not completed), it is invalidated.

30.4 License & Feature Issues

“Feature not available on your plan”

  • Install or upgrade your license under Admin → Settings → License.
  • After installing a new license, refresh the browser. License state is read on login; a page refresh is sufficient for most features.
  • Verify the license is not expired (Admin → Settings → License → Status shows expiry date).
  • Machine ID binding: the license is tied to the machine where ForsetiDesk is installed. If you reinstall on a new server, contact NTG for a license transfer.

“User limit reached”

  • Core (Free) tier allows a maximum of 3 active users. Deactivate unused accounts or upgrade to Pro.
  • Pro/Enterprise: the maxUsers field in the license JWT determines the limit. Contact NTG to add seats.
  • Deactivated users do not count against the limit.

License shows as invalid after server migration

  • Licenses are machine-ID bound. The machine ID is derived from the server's hardware identifiers.
  • Moving ForsetiDesk to a new physical server or VM with different hardware will invalidate the license.
  • Contact [email protected] with your machine ID (visible in Admin → Settings → License) to request a reissue.

30.5 Automation, Webhook & Recurring Ticket Issues

Automation rule not triggering

  • Verify the rule is Active in Admin → Automation → Rules.
  • Check that the trigger event matches what you expect (TICKET_CREATED vs. TICKET_UPDATED).
  • Conditions are evaluated with AND logic — all conditions must match for actions to fire.
  • Automation fires asynchronously after the ticket operation completes. There may be a brief delay.
  • Check server logs for [Automation] error lines if actions appear to not execute.

Webhook deliveries failing

  • Check the delivery log in Admin → Communications → Webhooks → Delivery Log for HTTP status codes and error responses.
  • Verify the endpoint URL is reachable from the ForsetiDesk server. Internal/private URLs are only accessible if the server has network access to them.
  • ForsetiDesk retries failed deliveries up to 3 times (0s, 30s, 5 min backoff). Check the attempts column in the delivery log.
  • If receiving a 401, verify the HMAC-SHA256 signature verification on your endpoint. The signature is in the X-ForsetiDesk-Signature header (format: sha256=<hex>).
  • Webhook secrets are shown only once at creation. If lost, use Regenerate Secret and update your endpoint.

Recurring ticket not generating

  • Confirm the template is Enabled in Admin → Automation → Recurring Tickets.
  • The cron runner checks every 60 seconds. New templates may take up to 1 minute to generate their first ticket after nextRunAt passes.
  • Check Run History on the template for FAILED entries and their error messages.
  • Common failure causes: assigned category or technician was deactivated (template falls back to OPEN/unassigned), invalid custom CRON expression.
  • Validate custom CRON expressions using a CRON validator before saving.

30.6 Time Tracking Issues

Timer bar not appearing

  • The timer bar only appears when a timer is actively running. Click Start Timer on any ticket to activate it.
  • Only one timer can run at a time. If a timer is already running on another ticket, a link to that ticket is shown instead of the Start button.
  • The timer bar persists across navigation but is reset on a full page reload. If you accidentally reload, any unsaved time is lost.

Time entry not saving

  • Minimum 1 minute required. The form will not accept 0.
  • Accepts plain minutes (e.g., 45) or h:mm format (e.g., 1:30 for 90 minutes).
  • TECH users can only edit or delete their own entries. ADMIN users can edit/delete any entry.
  • Time tracking requires a Pro license.

30.7 Organization Issues (Enterprise)

Organization not auto-populating on ticket

  • Auto-population requires the organization's Domain field to be set (e.g., acmecorp.com).
  • The domain match is triggered when a clientEmail is entered on the Create Ticket form. The system checks if the email domain matches any active organization.
  • The organization must be Active. Deactivated organizations are excluded from domain matching.
  • Domain matching is case-insensitive but requires an exact domain match (subdomains do not match the parent domain).

Organization SLA targets not applying

  • Org SLA targets are applied only when the organization is resolved at ticket creation time. Changing the organization after creation does not recalculate SLA deadlines.
  • Verify the organization's SLA Targets are set for the relevant priorities in Admin → Settings → Organizations → Edit.
  • Global SLA must be enabled (Admin → Settings → General → SLA Enabled) for any SLA targets to apply.

30.8 LDAP / AD SSO Issues

Cannot save LDAP configuration

  • Requires an Enterprise license with the ldap feature. Verify license status.
  • All required fields must be filled: Server Host, Port, Base DN, Bind DN, Bind Password.

LDAP users cannot change their password

  • By design — LDAP-authenticated users manage their passwords in Active Directory, not in ForsetiDesk.
  • The “Change Password” option is hidden for users with authSource = LDAP.
  • If a user needs a password change, direct them to their AD administrator or self-service AD portal.

New LDAP user provisioned with wrong role

  • The default role for auto-provisioned LDAP users is set in Admin → LDAP/AD → Default User Role.
  • Change the role in Admin → Users after the user's first login.
  • ADMIN role is never auto-assigned via LDAP provisioning for security reasons.

30.9 BYODB (Bring Your Own Database) Issues

External database connection test fails

  • Verify the host, port, database name, username, and password are correct.
  • Ensure the PostgreSQL server accepts remote connections: check pg_hba.conf and postgresql.conf (listen_addresses).
  • For SSL mode verify-full, the server's SSL certificate must be trusted by the ForsetiDesk server's CA store.
  • The test requires the user to have CREATE TABLE privilege on the target database.
  • Minimum supported PostgreSQL version is 14.

Schema push fails on external database

  • The connecting user must have DDL privileges (CREATE, ALTER, DROP on the schema).
  • If using a DBA-managed schema approach, provide the DBA with installer/schema.sql and apply it manually instead of using the automated push.
  • After a successful schema push, restart the ForsetiDesk service for the new DATABASE_URL to take effect.

30.10 Asset Management Issues

Asset tag not auto-generating

  • Asset tags are generated automatically (e.g., AST-0001) when creating a new asset. If you see a blank tag field, type a custom tag or save with the default.
  • Asset tags must be unique. If a conflict is reported, check for an existing asset with the same tag (including retired/disposed assets).

Custom fields not appearing on asset form

  • Asset custom fields are scoped to an Asset Type. Select the correct asset type on the form for the relevant custom fields to appear.
  • Verify the custom field is Active and the Entity Type is set to the correct asset type in Admin → Settings → Custom Fields.

Rack elevation diagram not showing

  • The rack diagram only appears when viewing an asset whose Location is of type RACK.
  • Assets must have both Rack Position and Rack Height set to appear in the diagram.
  • If the rack appears empty, verify that other assets at that location have rack position/height values filled in.

Asset not appearing in ticket link search

  • Only Active assets (status = ACTIVE) appear in the ticket asset link search by default.
  • If you need to link a non-active asset, first update its status to ACTIVE, link it, then revert the status if needed.
  • Search matches on asset name, asset tag, and serial number.

Cannot delete an asset

  • Assets are soft-deleted (set to inactive) rather than permanently removed to preserve historical data and ticket links.
  • To remove an asset from all views, set its status to DISPOSED and deactivate it. The asset will no longer appear in standard list views.

30.11 CMDB Issues (Enterprise)

“This relationship already exists” error

  • Each combination of source asset, target asset, and relationship type must be unique.
  • Check the existing relationships on both assets — the relationship may already be defined on the other asset (relationships are bidirectional in display but stored unidirectionally).
  • Use a different relationship type or a different direction if the intent is different.

Topology graph shows no nodes

  • By default, RETIRED and DISPOSED assets are excluded. Change the Status filter to ALL to include them.
  • Verify at least one relationship exists between assets. The topology graph shows only assets connected by relationships (unless using Root Asset mode).
  • In Root Asset mode with no relationships, only the root asset itself appears as an isolated node.

Impact analysis returns empty tree

  • Impact analysis traverses only DEPENDS_ON, RUNS_ON, and HOSTS relationship types (not CONNECTED_TO or PART_OF).
  • The traversal follows relationships pointing to the selected asset (i.e., it finds what depends on this asset). If no other assets have a DEPENDS_ON or RUNS_ON relationship targeting the selected asset, the tree will be empty.
  • Check that the relationships are defined in the correct direction on the asset detail page.

30.12 Change Management Issues

Change number not generating

  • Change numbers are assigned at creation time using the change_numbering setting.
  • If numbers appear as CHG-0000 or are missing, check Admin → Settings → General → Change Numbering to verify the prefix, pad length, and next sequence are configured.

Cannot advance change status

  • Status transitions are enforced. The allowed transitions are:
    • DRAFT → SUBMITTED
    • SUBMITTED → UNDER_REVIEW or APPROVED (STANDARD auto-approves)
    • UNDER_REVIEW → APPROVED or REJECTED (ADMIN only)
    • APPROVED → SCHEDULED or IMPLEMENTING
    • SCHEDULED → IMPLEMENTING
    • IMPLEMENTING → COMPLETED or FAILED
    • COMPLETED / FAILED → CLOSED (ADMIN only)
    • REJECTED → DRAFT (to revise and resubmit)
  • Transitions requiring ADMIN: UNDER_REVIEW, APPROVED, REJECTED, CLOSED.
  • If the button is missing, your role does not permit the transition from the current status.

Standard change not auto-approving

  • Auto-approval happens when the change is submitted (status moves from DRAFT to SUBMITTED). If you saved as DRAFT and did not click Submit, the change remains in DRAFT.
  • Click Submit on the change detail page. A Standard change will immediately transition to APPROVED.

30.13 Problem Management Issues

Problem status won’t transition to Known Error

  • Transitioning to KNOWN_ERROR status requires a workaround to be documented on the problem record. Fill in the Workaround field before attempting this status transition.
  • Ensure all required fields are saved before changing status.

RCA not saving

  • The RCA Summary field is required. Ensure it is filled in before saving the RCA record.
  • Select an RCA method before filling in methodology-specific fields.

30.14 Service Request Issues

Cannot submit a service request

  • Check that all required form fields are filled in. Required fields are marked with an asterisk (*).
  • Verify the catalog item is still active. If the item was deactivated after you opened the form, submission will be blocked.

Approval chain stuck — no approver notified

  • Verify the designated approver exists and is active in Admin → Users.
  • For MANAGER-type approver steps, verify the requestor has a manager assigned in Admin → Users. If no manager is set, the step cannot activate.
  • Confirm the approval chain is correctly configured under Admin → Approval Chains and each step has a valid approver defined.

Cannot approve a service request

  • Only the designated approver for the current active step can act on it. If you are not that approver, the Approve/Reject buttons will not appear.
  • ADMIN users can override and act on any step regardless of who is designated.
  • Check the approval stepper on the request detail page to confirm which user or role is expected to approve the current step.

30.15 Dashboard Issues

Dashboard layout resets after navigation or login

  • Ensure you clicked Save Layout before leaving edit mode. Clicking Cancel discards all unsaved changes from that session.
  • If the layout still resets after saving, clear your browser cache and reload. Stale cached state can occasionally interfere with preference loading.
  • Layout is saved per-user to the database. Logging in as a different user will show that user’s layout.

Widget shows “requires license” or is not available in the picker

  • Some widgets require a Pro or Enterprise license (e.g., asset charts, change calendar). Verify your license is installed and active under Admin → Settings → License.
  • Some widgets are role-restricted and will not appear in the picker for users without the required role.

30.16 Infrastructure & Service Issues

ForsetiDesk service not starting

  • Check Windows Event Viewer → Application for errors related to ForsetiDesk or node.exe.
  • Verify the secrets.cfg file exists at C:\Program Files (x86)\ForsetiDesk\config\secrets.cfg and contains valid DATABASE_URL, JWT_SECRET, and PORT values.
  • Confirm PostgreSQL 17 service is running (Services → postgresql-x64-17).
  • Test the database connection: open a command prompt and run psql -U forsetiuser -d forsetidb -h localhost.
  • Check Node.js version: node --version from the installation directory. Requires Node.js 20+.

Port conflict — service starts but UI is not accessible

  • Default port is 4000. If another service is using port 4000, change it under Admin → Settings → General → Port and restart the service.
  • Identify the conflicting process: netstat -ano | findstr :4000 in Command Prompt, then check the PID in Task Manager.

Database migration / schema out of sync

  • After upgrading ForsetiDesk, the installer runs prisma db push automatically.
  • If tables are missing or columns are out of sync after a manual update, run from the backend directory: npx prisma db push followed by npx prisma generate.
  • Stop the Node.js process before running prisma generate on Windows to avoid EPERM file lock errors on the query engine DLL.

30.17 Log Files

ForsetiDesk logs to the Windows service output captured by NSSM. Log files are located at:

  • C:\Program Files (x86)\ForsetiDesk\logs\Forseti-out.log — stdout (normal output)
  • C:\Program Files (x86)\ForsetiDesk\logs\Forseti-err.log — stderr (errors and warnings)

Key log prefixes to search for:

  • [Startup] — initialization, database connection, seeding
  • [IMAP] — email-to-ticket poller activity
  • [Notifications] — outbound SMTP results
  • [Automation] — rule engine execution
  • [Webhooks] — delivery attempts and results
  • [Recurring] — recurring ticket cron results
  • [LDAP] — LDAP connection and auth attempts
  • [BYODB] — external database operations

30.18 Manual Backup Commands

If the Admin UI backup fails, run manually from Command Prompt (as Administrator):

"C:\Program Files\PostgreSQL\bin\pg_dump.exe" -U forsetiuser -d forsetidb -F c -f "C:\BackupForseti_manual.dump"

To restore:

"C:\Program Files\PostgreSQL\bin\psql.exe" -U forsetiuser -d forsetidb -f "C:\BackupForseti_manual.dump"

For BYODB (external database), replace localhost with your external DB host and set PGPASSWORD environment variable or use a .pgpass file to avoid password prompts.

30.19 Getting Support

  • Email: [email protected]
  • Website: forsetidesk.com
  • Include your license edition, version number (shown in Admin → Settings → About), and relevant log excerpts when reporting issues.

30.20 Mobile App

Cannot connect to server
Verify the server URL includes https:// and the correct port (e.g., https://helpdesk.example.com). Ensure the server is reachable from the mobile device's network. If using a self-signed certificate, install the CA certificate first.
Self-signed certificate error
Tap Download & Install Certificate on the mobile login screen, then follow your device's trust prompt. On iOS, also go to Settings → General → About → Certificate Trust Settings and enable the ForsetiDesk CA. On Android, go to Settings → Security → Install Certificate.
Push notifications not received
Check Admin → Users → [user] → Mobile Devices to confirm a push token is registered. Ensure the Expo Push Notification service is reachable from the server. Check that mobile access is enabled for the user account.
Mobile access disabled
Contact your administrator to enable mobile access. Admins can toggle this per user under Admin → Users → Edit User → Mobile Access.
App shows blank screen after login
Force-close and reopen the app. If the issue persists, log out and log back in. Ensure the server's API is reachable and returning valid JSON (check /health endpoint).

30.21 HTTPS / TLS

Let's Encrypt request fails
Ensure your DNS A record points to your server's public IP address. Port 80 must be forwarded through your firewall/router to the ForsetiDesk server. The domain must be publicly resolvable — Let's Encrypt cannot validate internal/private domains. Check for firewall rules blocking inbound port 80.
Browser shows "Not Secure" with self-signed certificate
Install the ForsetiDesk CA certificate in your system or browser trust store. Download it from https://your-server/ca-cert. On Windows, double-click the .pem file and install to "Trusted Root Certification Authorities". On macOS, add to Keychain Access and set to "Always Trust".
Port 443 in use
Another service is already using port 443. Identify it with netstat -ano | findstr :443 in an elevated command prompt, then stop the conflicting service. Common causes: IIS, another web server, or a VPN client.
Certificate expired
Self-signed certificates expire after 1 year. Let's Encrypt certificates renew automatically if the server is internet-accessible on port 80. For self-signed certs, go to Admin → Security → TLS / Certificates and click Generate New Certificate. A service restart is required after renewal.
HTTPS enabled but browser redirects fail
Ensure TLS Enabled is toggled on in Admin → Security → TLS / Certificates and the service has been restarted. The HTTP-to-HTTPS redirect runs on the configured PORT (default 4000) while HTTPS runs on 443.

31 Mobile App NEW IN 1.11

Audience: Technicians & Managers — Pro License Required

Overview

ForsetiDesk Mobile is available for Android and iOS. It gives field technicians quick access to their assigned tickets, asset inventory, and knowledge base from anywhere — over WiFi or cellular.

Installation & Setup

  1. Download the app from Google Play or the App Store, or install the APK provided by your administrator.
  2. Open the app and enter your ForsetiDesk server URL (e.g., https://desk.yourcompany.com).
  3. Log in with your ForsetiDesk credentials.
  4. If your server uses a self-signed certificate: tap Download & Install Certificate on the login screen and follow the device-specific prompts.
  5. Allow push notification permission when prompted.
ℹ Mobile access must be enabled per user by an administrator (Admin → Users → Mobile Access toggle).

Navigation — 4-Tab Layout

TabContents
My WorkYour assigned tickets. Quick stats: Open, In Progress, Overdue counts. Create new tickets.
AssetsSearch and filter asset inventory. Scan barcodes/QR codes to find assets instantly.
KnowledgeKB articles and Known Errors for field reference.
AccountServer info, push notification status, debug mode toggle, Help & Manual link, sign out.

Working Tickets

Tap any ticket to open the full detail view. The ticket is organized in 9 collapsible sections:

  • Info — status, priority, category, assigned to
  • Details — description, client info
  • Troubleshooting Notes
  • Resolution Notes
  • Internal Notes — private, not visible to clients
  • Time Tracking — log time entries directly from the field
  • Linked Assets
  • Linked Items — linked tickets, problems, change requests
  • History — append-only audit trail

Tap any editable field to modify it. Changes are saved immediately on each field update.

Routing Actions (TECH Role)

  • Escalate — assigns the ticket to your supervisor (manager) and sends them a push notification.
  • Route to Team — unassigns the ticket and places it in the category queue for a dispatcher.
  • Flag — marks the ticket for dispatcher attention without changing assignment.

Team View (MANAGER Role)

Managers see a toggle on the My Work screen between My Tickets and Team Tickets. Team view shows all open tickets assigned to direct reports, filtered by current status.

Asset Scanner

Tap the scan icon in the Assets tab to open the barcode/QR scanner. Scanning a barcode looks up the matching asset by serial number or asset tag. If found, the asset detail opens. If not found, you can create a new asset pre-filled with the scanned code.

Push Notifications

Receive instant notifications for: ticket assigned to you, status changed, new internal note, QA approved/rejected, escalated to you, service request approval needed, emergency change created. Notification delivery requires the device to have notifications permitted for the app in OS settings.

Admin Controls

See Admin Guide → User Management for the Mobile Access toggle (enable/disable per user) and Mobile Devices list (revoke push tokens).

32 HTTPS / TLS Setup NEW IN 1.11.15

Audience: Administrators

Overview

ForsetiDesk supports HTTPS encryption via two certificate sources: self-signed (for internal/LAN use) and Let’s Encrypt (for internet-accessible deployments). TLS configuration lives in Admin → Security → TLS / Certificates.

When HTTPS is enabled, ForsetiDesk listens on port 443. HTTP requests to the previous configured port are redirected to HTTPS automatically. The port setting in Admin → Settings is locked while TLS is active.

Self-Signed Certificate Setup (Internal Use)

  1. Go to Admin → Security → TLS / Certificates.
  2. Click + Generate CertificateSelf-Signed tab.
  3. Review auto-detected IP addresses and check/uncheck as needed.
  4. Add domain names or additional IPs if required, then click Generate Certificate.
  5. Toggle Enable HTTPS on.
  6. Restart the ForsetiDesk service from the Start Menu or NSSM.
  7. Distribute the CA certificate to all client devices (see below).

Let’s Encrypt Certificate Setup (Recommended for Public Access)

Prerequisites:

  • A domain name with DNS A record pointing to your server’s public IP
  • Port 80 accessible from the internet (during issuance only — typically 60 seconds)
  • Port 443 forwarded on your router to the server
  1. Go to Admin → Security → TLS / Certificates.
  2. Click + Generate CertificateLet’s Encrypt (Trusted) tab.
  3. Enter your domain (e.g., desk.yourcompany.com) and email address.
  4. Click Request Certificate. The process takes 30–60 seconds.
  5. Toggle Enable HTTPS on.
  6. Restart the ForsetiDesk service.

Let’s Encrypt certificates auto-renew 30 days before expiry. Port 80 must be briefly accessible during each renewal. Certificates are valid for 90 days.

💡 After enabling Let’s Encrypt, you can remove the port 80 forward from your router until the next renewal cycle. The server will need port 80 again at the ~60-day renewal check.

Installing the CA Certificate (Self-Signed Only)

Click Download CA Certificate in the TLS panel to download forsetidesk-ca.pem. Install on each client device:

PlatformSteps
WindowsDouble-click the .pem file → Install Certificate → Local Machine → Trusted Root Certification Authorities → Finish. Close and reopen the browser.
AndroidSettings → Security → Install certificate → CA certificate → select the file. Trust the certificate when prompted.
iOSOpen the .pem URL in Safari → Allow to install profile → Settings → General → VPN & Device Management → tap profile → Install. Then Settings → General → About → Certificate Trust Settings → enable full trust for ForsetiDesk CA.
Mobile AppTap Download & Install Certificate on the login screen to open the CA cert URL in the system browser.

Custom Certificate (Commercial CA)

Click Replace Certificate to upload your own PEM files (certificate, private key, and optional intermediate CA) from DigiCert, Sectigo, or another commercial authority.

Revoking or Disabling TLS

  • Disable toggle — turns off HTTPS without deleting the certificate. The server returns to HTTP after restart.
  • Revoke Certificate — deletes all certificate files. The server returns to HTTP after restart and the Generate button reappears.

33 Remote Access

Audience: Administrators

Accessing ForsetiDesk from Outside the LAN

ForsetiDesk runs on your Windows server and is accessible on your local network by default. For remote or mobile access, you need to expose it to the internet.

Port Forwarding (Direct Method)

  1. Assign a static IP address or DHCP reservation to the ForsetiDesk server on your router.
  2. Forward port 443 (TCP) on your router to the server’s internal IP address.
  3. Register a domain name and create a DNS A record pointing to your public IP address.
  4. Set up HTTPS using Let’s Encrypt for trusted certificates (see Section 32).
  5. Provide the URL (e.g., https://desk.yourcompany.com) to remote users and mobile app users.
Dynamic IP: If your ISP assigns a dynamic public IP, use a Dynamic DNS (DDNS) service (Cloudflare, DuckDNS, No-IP) to keep your domain pointing to the correct address automatically.

For Mobile App Users

Field technicians enter the server URL on the mobile app login screen. The app works over any internet connection — cellular, WiFi, or VPN. The server URL must be reachable (not blocked by firewalls or carrier NAT). HTTPS is strongly recommended; HTTP is permitted but not recommended over cellular networks.

VPN Access

If your organization uses a VPN, you can keep ForsetiDesk on the internal network and require remote users to connect through the VPN. This avoids port forwarding entirely. However, mobile app users in the field must have the VPN client configured on their devices.

Firewall Considerations

  • Allow inbound TCP 443 (HTTPS) to the ForsetiDesk server.
  • Allow inbound TCP 80 only during Let’s Encrypt certificate issuance/renewal.
  • The server does not require any inbound ports beyond 443 (and briefly 80 for ACME).

34 Session Management

Audience: Administrators

Configurable Session Timeout

ForsetiDesk allows administrators to control how long a user’s login session remains active before they must re-authenticate. The session timeout is configured from Admin → Security → Session.

Available Timeout Values

OptionSuitable For
10 minutesHigh-security environments; shared workstations
15 minutesHigh-security with occasional brief inactivity
30 minutesBalanced security for most environments
45 minutesModerate use with occasional interruptions
60 minutes (default)Standard office environment
90 minutesLonger work sessions with infrequent logins
2 hoursLow-security or trusted internal network
3 hoursExtended sessions; dedicated workstations
4 hoursMaximum; dedicated single-user workstations only
⚠ Changing the session timeout affects all newly issued tokens. Existing logged-in sessions continue with their original expiry until users log out and back in.

Session Warning Banners

ForsetiDesk warns users before their session expires so they can save work or refresh their session:

  • 5 minutes remaining — A blue informational banner appears at the top of the page with a Refresh Session button.
  • 1 minute remaining — The banner turns amber with bold text, indicating urgent action is needed.
  • Session expired — The user is automatically logged out and redirected to the login page with an expiry notice.

Refreshing a Session

Click the Refresh Session button in the warning banner to extend the session without logging out. This issues a new token with a fresh expiry at the current timeout value. Users do not need to re-enter their password.

Applying the Change

  1. Go to Admin → Security → Session.
  2. Select a timeout duration from the dropdown.
  3. The setting saves automatically. New logins from this point on will use the updated duration.