Documentation

Getting Started

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/Getting-Started

Prefer to watch? The getting started videos on YouTube show installing, adding your first connector and rolling out the agent, in under two minutes each.

This guide walks through installing Groundskeeper and completing the first-run setup wizard. The whole process takes a few minutes, and you can change anything later from Settings.

Before you start, Groundskeeper is built to be safe by default:

• All data stays on your network -- nothing is stored externally.
• Every connection is read-only -- Groundskeeper never changes anything on the systems it monitors.
• You can skip any step in setup and come back to it later.

Requirements #

• Operating system: Windows Server 2019 or later -- Groundskeeper is built and tested on Windows Server 2022 (domain-joined recommended for the Active Directory and Windows Server connectors), or Windows 10/11 version 1809 or later for evaluation.
• Hardware: 8 cores / 16 GB RAM recommended. A CPU-only VM is sufficient for most connectors; local AI summaries run more comfortably with more RAM (see AI Features). Bare minimum is 8 GB RAM.
• Disk: ~2 GB free. Python is bundled in the installer -- there is no separate Python install to manage.
• Network: outbound HTTPS to the cloud services you want to monitor (Meraki, Microsoft 365 / Graph, Action1, Veeam, etc.) and to api.rsjsoftware.com for licence activation. No inbound access from the internet is required. Inside your network, open TCP 8443 to the server if you want to reach the dashboard from other machines, and for the RSJ Agent on PCs (see Firewall and Network).
• Permissions: Administrator rights to install (it runs as a Windows service).

Step 1 -- Download #

Download the latest GroundskeeperSetup.exe from the Releases page.

That one installer is all you need. The RSJ Agent -- the optional endpoint agent for per-device monitoring -- is inside it: Groundskeeper serves the agent's installer to your machines, and you deploy it from Agent Settings (the deploy script, push-deploy or Group Policy) once the server is running. The two Source code links GitHub shows on every release hold only the repository's README and security policy, not the product.

Step 2 -- Install #

What to expect: two security prompts that are normal. The installer is code-signed by RSJ Software Ltd, but while the signature is new Windows SmartScreen may still show "Windows protected your PC" the first time you run it. Click More info: it should name the publisher as RSJ Software Ltd. Then click Run anyway. A second warning, about the dashboard's certificate, comes later in this step and is explained below. Neither means anything is wrong; both are expected for a new, self-hosted tool that isn't on the public internet. Each GitHub release also lists the installer's SHA-256 checksum if you want to verify your download first (Get-FileHash .\GroundskeeperSetup.exe in PowerShell shows yours).

Run GroundskeeperSetup.exe as Administrator and follow the wizard. It will:

• Install Groundskeeper to C:\Program Files\RSJ Software\Groundskeeper
• Register and start the Groundskeeper Windows service (it starts automatically on boot from now on)
• Offer to add a Windows Firewall rule for inbound TCP 8443, so other machines can reach the dashboard (ticked by default; untick it if your firewall is managed by Group Policy)
• On a fresh install, offer to open the first-run setup wizard in your browser when it finishes

Groundskeeper serves its dashboard over HTTPS on port 8443 by default, using a self-signed certificate made the first time the service starts. On the server itself the dashboard is at https://localhost:8443. From another machine, use https://<server-address>:8443.

A different port: if another program on the server already uses 8443, a fresh install asks which port to use (or accepts /PORT=9443 when installed silently), and an upgrade keeps the port you already have. You can change it later under General Settings, About, Web address port; computers running the agent then need setting up again. See Firewall and Network for the firewall rule.

Note on the certificate: because the certificate is self-signed, the first time you open the dashboard your browser will show a security warning. This is expected for a self-hosted tool on your own network. To remove the warning on managed devices, the installer includes tools\Trust-GroundskeeperCert.ps1, which can be pushed via Group Policy to trust the certificate estate-wide. See Troubleshooting & FAQ.

Step 3 -- Set your admin password #

The first time you open the dashboard, Groundskeeper asks you to create the first admin account (the username defaults to admin; the password must be at least 10 characters). This protects the dashboard and all API endpoints.

Do this on the server itself, at https://localhost:8443. For safety the first admin account can only be created from the server's own browser; other machines can sign in once it exists.

Keep the password safe. If it is forgotten: Forgot password? on the sign-in page emails a reset link (once email is set up under Settings > Notifications), or another admin can reset it under Settings > Users. The last resort is in Troubleshooting & FAQ.

Step 4 -- First-run setup wizard #

With the password set, you'll see the five-step setup wizard. Each step is optional and reversible -- anything you skip can be configured later from Settings.

Welcome #

The opening screen confirms the safety model (data stays local, read-only connections, skip-and-return). Click Get started to begin. If you already have a Pro, Central or Community key, there is a box for it on this screen: a key entered here lifts the connector limit straight away.

AI Assistant #

Groundskeeper can produce plain-English summaries of your IT status. AI is optional and off until you choose a provider. You can pick:

• Ollama (local) -- runs entirely on the server, no data leaves your network, free. Recommended for most schools. Needs ~8 GB RAM.
• A cloud provider (Azure OpenAI, Anthropic Claude) -- more capable, but data is sent to that provider. If you choose cloud, prefer a UK/EU region for data residency.
• Skip for now -- no AI. The dashboard, alerts and SLT view all work fully without it. Other cloud providers (OpenAI, Google Gemini, a custom endpoint) are under General Settings > AI later.

See AI Features for the full comparison.

Connectors #

Connectors are how Groundskeeper reads from the systems you already run -- Meraki, M365, Veeam, your MIS, domain security, and more. Pick the ones relevant to your school now; you can add the rest any time.

Every connector is read-only and most just need an API key or a hostname. Anything marked Quick start needs no credentials at all, so it is a quick way to see something working. See Connectors for setup details for each one.

Setting up a Central hub for a trust? It doesn't monitor systems itself, so enter your Central key in the box on the welcome screen, then click Skip -- this is a Central hub to go straight to the end (see Central Edition).

On the free Community edition you can enable up to 5 connectors. Pro lifts that limit. If you already have a Pro, Central or Community key, enter it in the box on the welcome screen or above the connector list on this step: the limit lifts at once and your choices are kept.

Configure #

Here you enter the details for the connectors you enabled -- API keys, hostnames, and similar. Each field has inline help explaining where to find the value in the source system.

Done #

The final step confirms setup is complete and takes you to the dashboard.

Step 5 -- Activate your licence key #

Register for the free Community key. Groundskeeper keeps working without one, but the dashboard shows a banner asking you to request it until you do. The key is requested from within the dashboard:

1. On first load, the dashboard shows a key request banner.
2. Enter your name, email, school name, and your school URN (or your trust's Group UID). Groundskeeper looks the identifier up to confirm your school.
3. Submit the request. With a school email address your Community key is issued and activated straight away. From a webmail address a person checks the request and emails the key within a business day: paste it into Settings > Licence to activate it. If a request cannot be approved, the banner says so and lets you ask again, ideally with your school email address.

If you already have a key (for example you're reinstalling, or upgrading from Community to Pro), you can enter it during setup, in the box on the welcome screen or above the connector list, or later in Settings > Licence -- there's an "Already have a Pro or Community key?" link on the banner for exactly this.

Running a Multi-Academy Trust? The banner also has a Groundskeeper Central enquiry option -- enter your Group UID and we'll be in touch to arrange a Central licence.

Step 6 -- You're up and running #

Once at least one connector is configured, the dashboard begins populating as connectors run their first checks (this can take a few minutes depending on which connectors are enabled). From here you might want to:

• Set up the SLT Dashboard traffic-light view for leadership
• Add more Connectors
• Configure AI Features if you skipped them in setup
• Read Backup & Restore to protect your configuration
• Use the search box above the dashboard's activity feed to find every event mentioning a device or a word, and Export CSV (on the feed, and on the Devices page) when a governor or insurer wants a spreadsheet

Keeping Groundskeeper up to date #

Groundskeeper checks the public Groundskeeper releases for a newer version: shortly after every service start, and then daily by default (hourly or weekly under Settings -> Updates). When one is found, a notice appears once in the Dashboard feed and a banner offers three things:

• Download -- the installer, fetched through your server, to run yourself.
• Update now -- the server downloads the installer, checks its SHA-256 against the checksum published in the release notes, runs it and restarts itself. The dashboard goes offline for a minute or two and reloads on the new version.
• Release notes -- what changed.

Tick Allow automatic updates on Settings -> Updates and the scheduled check does the same without asking: one installation attempt per version (an installer not yet visible on GitHub is tried again at a later check), with every outcome (and any failure) recorded in the Dashboard feed. It is off by default. The installers are code-signed by RSJ Software Ltd, and each release is scanned on VirusTotal before it is published, with the scan linked in its notes.

Your machines follow the server: each release bundles a version of the RSJ Agent, and every machine's agent updates itself to it at a following check-in.

Trying new features early: the beta channel #

Choose Beta under Settings -> Updates -> Update channel to be offered beta builds: newer than the weekly release, for trying what is coming. They are tested by RSJ Software but may still have rough edges, and are published at groundskeeper-beta. On Beta your server is offered whichever is newer, the latest beta or the latest weekly release, so you get every weekly release too; no GitHub token is needed. Switching back to Stable never installs an older version: the server stays on the beta it has until a newer weekly release arrives. Feedback on a beta goes in Discussions.

Stuck on anything? See Troubleshooting & FAQ or ask in Discussions.

Last updated: 2026-11-05 (v0.195.0)