Milestone XProtect Hardening Guide: Securing Servers, Encryption, Roles and Evidence

A Milestone XProtect video management system concentrates camera credentials, live and recorded video and evidential footage on a few Windows servers, so an unencrypted recording server, a shared administrator or an exposed mobile server undermines every camera behind it. Milestone publishes an XProtect Hardening Guide, a certificates guide and, for XProtect Corporate 2026 R2, an EUCC compliance deployment and secure operation guide. This page turns the product documentation into a working baseline: how users and roles are authenticated, which connections can be encrypted and what the certificates must contain, how to limit the mobile server and client exposure, how evidence lock protects footage, and what the audit logs record. It is for VMS administrators, integrators and security engineers. Camera-level and vendor-neutral controls are in the IP Camera and CCTV Security Guide; this page stays at the XProtect layer. Product facts were checked against Milestone documentation on 8 November 2026; menu names can differ between releases.

This is an independent guide from NHI Mgmt Group, based on Milestone Systems' public documentation as of November 2026. It is not sponsored or reviewed by Milestone Systems. Product features change, so confirm settings against Milestone Systems' current documentation.

Key takeaways

• Prefer Windows users to basic users. Basic users are VMS-local accounts with a username and password scoped to one site; Windows users come from Active Directory and inherit your domain password, lockout and lifecycle controls.
• The built-in Administrators role has full access. Create narrower administrative and operator roles and use Smart Client and Management Client profiles so the interface matches the permissions.
• Encryption is a set of separate switches. Management server to recording server, recording server to clients and the mobile server are each enabled separately and each need a certificate whose host name matches the server.
• Certificates expire silently. Milestone states XProtect does not warn before certificate expiry, and an expired certificate stops clients and servers trusting each other, so expiry monitoring is part of hardening.
• Evidence and audit need configuration. Evidence lock (XProtect Corporate only) protects footage from retention deletion, and user access logging must be switched on in the audit log settings.

How identity and access work in XProtect

XProtect separates the management server (configuration, authentication, the built-in Identity Provider and the API Gateway, served on ports 80 and 443) from recording servers (camera connections and storage), the event server (events, alarms and integrations) and the mobile server (XProtect Mobile and Web Client access). Configuration lives in a SQL Server database reached from the management server, conventionally on TCP 1433. Users connect with XProtect Smart Client for operations and Management Client for administration.

Every role needs the Connect permission on the management server, set under Overall Security, Role Settings, Management Server. A role needs read permission on the management server to launch Management Client. Milestone notes that the full set of permissions is only available in XProtect Corporate; smaller editions expose fewer, so check what your edition can restrict before designing roles.

• Decision guidance: small single-site systems with no domain can run on basic users, provided each person has their own account and integration accounts are documented. Any organisation with Active Directory should move people to Windows users and keep basic users for integrations only.
• Federated sites: because a basic user exists only on its own site, identical credentials on several sites are separate accounts that must be rotated separately.

Admin roles and privileged access

The default Administrators role has full access to all system functionality. Milestone's guidance is to create as many roles as you need, including administrative roles that cover only a subset of administration, and Smart Client roles limited to specific cameras.

The EUCC secure operation guide for XProtect Corporate 2026 R2 describes three roles defined in its Security Target, Built-in Administrator, Hardware Device Administrator and Security Guard, which is a useful model for separating duties even outside a certified deployment. Milestone states that roles control permissions, not what users see; Smart Client profiles and Management Client profiles control the interface, so pair each role with a profile that hides what it cannot use.

• Management Client reach: restrict Management Client use to trusted management networks, since the management server web services on ports 80 and 443 also carry the Identity Provider and API Gateway. Milestone's port reference advises restricting these to trusted management networks.
• Windows administrators: local administrators on VMS servers can bypass the VMS role model entirely (stop services, read the database, take private keys). Keep that group small and separate from VMS administrators.

Integrations, API tokens and service accounts

XProtect runs as Windows services and talks to integrations through the MIP SDK, the API Gateway (REST, WebSocket and WebRTC) and event server ports. Each of these is a non-human identity path.

Use group managed service accounts or dedicated domain service accounts where your release supports them, and deny interactive logon to service accounts. See the Group Managed Service Accounts (gMSA) Guide and the Device and IoT Identity Guide.

Encryption and certificates

XProtect encryption uses TLS with RSA keys over HTTPS. Certificates are issued by a trusted root CA, which must be trusted on the servers and clients that connect.

Because XProtect does not warn before certificates expire, add every VMS certificate to your certificate inventory and alert at least 30 days before expiry. Renewal repeats the original setup steps. See the Machine Identity, PKI and Certificate Lifecycle Guide if your PKI process needs work.

Mobile server and client exposure

The mobile server listens on 8081 (HTTP) and 8082 (HTTPS), both configurable, and is often the only XProtect component reachable from the internet. Enable mobile server encryption, close 8081 at the perimeter, publish 8082 only through a reverse proxy or VPN with your own access controls, and keep Video Push (port 40001 plus channel index, disabled by default) off unless needed. Apply Milestone's security updates promptly and keep the mobile server on a current, supported release before it is exposed (NHI Mgmt Group recommendation).

Evidence lock and retention

Evidence lock, available only in XProtect Corporate, protects selected recordings from deletion when their normal retention time ends. Locks are created in Smart Client playback, are flagged in the media database so the recording server protects them even when the management server is unreachable, and lock at least one one-hour segment per device.

• Limit durations: administrators can restrict the "Keep evidence lock for" options per installation or user. Milestone discourages indefinite locks because full storage of locked recordings stops new recording; export to external storage instead.
• Protect deletion: editing, adding or removing devices and deleting locks require security permissions. Give these to a small investigator group, not to operators.
• Know the side effects: deleting a lock deletes recordings older than standard retention. If the final archive fills with locked footage, locked recordings in the previous location are deleted to make room.
• Integrity: pair evidence lock with role-restricted export and audit logging so the chain of custody shows who locked, viewed and exported footage.

Logging and detection

In Management Client, the Server Logs options tab configures three log types: system logs (message level, default Errors), audit logs and rule-triggered logs, each with enable and retention settings. Under audit logs, Enable user access logging records Smart Client actions such as exports, activating outputs and viewing cameras live or in playback. Playback sequence length and Records (frames) seen before logging control how many entries playback generates.

The pages reviewed do not describe syslog or SIEM export, so plan to collect audit data through Milestone's supported integration options for your release and forward Windows logs from the servers directly. See the CIS Control 8 Audit Log Management Guide.

Metrics

• Encryption coverage: percentage of recording servers, mobile servers and event servers with encryption enabled.
• Certificate runway: days to the nearest VMS certificate expiry.
• Named access: number of basic users not tied to a documented person or integration (target zero).
• Patch currency: releases and cumulative patches behind the latest for each server.
• Audit coverage: user access logging enabled on every site, with retention meeting your evidence policy.

Hardening baseline

1. Inventory and back up: list sites, servers, release versions, users, roles and certificates; back up the configuration database before changes.
2. Patch: bring every server to a current release and cumulative patch, checking the Milestone Security Advisory list for issues affecting your version. Milestone announced on 6 February 2024 that it had joined the CVE Program as a CVE Numbering Authority.
3. Enable audit logging: turn on audit logs with user access logging and set retention, so the hardening work itself is recorded.
4. Roles and users: move staff to Windows users, create named roles below Administrators, pair each with Smart Client and Management Client profiles, and remove unused basic users.
5. Certificates: issue CA certificates with correct host names, import them into the Windows Certificate Store and grant private key access to the service accounts.
6. Encrypt in stages: enable recording server to client encryption on a pilot recording server and test Smart Client, mobile and integrations; then enable management server encryption once every recording server, including failover servers, has a certificate. Rollback is disabling encryption on the affected server, which restores clear-text connections.
7. Network: allow only the documented ports between components (for example 9000 and 9001 between management and recording servers, 7563 to recording servers, 1433 to SQL), block event server ports that are disabled by default unless used, and keep Management Client on a management network.
8. Mobile exposure: enable mobile server encryption, publish only 8082 through a controlled path, and confirm the release is patched.
9. Evidence: on XProtect Corporate, restrict evidence lock durations and deletion rights.

Common misconfigurations

• Shared Administrators login: one integrator account in the Administrators role used by everyone, so audit logs cannot attribute changes.
• Partial encryption: recording server encryption enabled but the mobile server or event server still serving clear text, or failover servers forgotten.
• Expired certificates after a year: no expiry alert, so clients suddenly cannot connect and someone disables encryption to restore service.
• Mobile server on 8081 to the internet: HTTP left open at the perimeter on an unpatched release.
• Indefinite evidence locks: locks without end dates filling storage until new recording stops.
• Audit logging never enabled: no record of who exported footage when an incident is investigated.

Framework mapping

Practitioner checklist

• Move staff to Windows users and limit basic users to documented integrations.
• Keep the Administrators role to a few named people and create narrower roles with matching client profiles.
• Issue CA certificates with correct host names and grant private key access only to the right service accounts.
• Enable encryption for management to recording servers, recording servers to clients, the mobile server and failover servers.
• Monitor every VMS certificate for expiry, since XProtect does not warn.
• Expose only mobile server port 8082 through a controlled path, on a patched release.
• Enable audit logs with user access logging and set retention to your evidence policy.
• Restrict evidence lock durations and deletion to an investigator group (XProtect Corporate).
• Review the Milestone Security Advisory list at every release and apply cumulative patches.

Standards and references

• Milestone: XProtect Hardening Guide
• Milestone: Secure communication (explained)
• Milestone: Ports used by XProtect VMS
• Milestone: Evidence Lock
• Milestone: Roles and permissions of a role (explained)
• Milestone: Server Logs tab (options)
• Milestone: Security Advisory
• Milestone: Compliance deployment and secure operation guide (EUCC)

Related NHI Mgmt Group resources: IP Camera and CCTV Security Guide · Physical Access Control Systems Security Guide · Physical and cyber security convergence · Device and IoT Identity Guide