Troubleshooting

Troubleshooting

Common problems and what to check. If something here does not cover it, ask in RSJ Software's shared Discussions, or report a problem as an Issue.

Courier is new, and some of its paths have not been proven on real machines yet (see Getting Started). If you meet something unexpected, please tell us.

Installing and signing in

My browser shows a certificate warning

This is expected. Courier serves the console over HTTPS with a self-signed certificate that it makes the first time it starts, so browsers warn that they cannot verify it. On a self-hosted server on your own network that is normal: choose to continue.

The console will not open

• Use the right address: https://localhost:8445 on the server, or https://<server name or address>:8445 from another computer on your network (https, port 8445). The server's name or address must be one it knows itself by; a different name (for example a DNS alias) is refused. The Start menu's Courier -> Open Console opens it on the server.
• "The console is not available from this address". An administrator has limited the console to certain computers under General Settings -> Access. Open the console on the server (that always works) and add the computer's address, or clear the list.
• "Too many attempts. Try again in a minute." Five wrong passwords from one computer lock that computer out of signing in for a minute.
• Is the service running? Check the Courier service is started (services.msc, or sc query Courier). The Start menu also has Stop Service, which asks for administrator approval; start the service again from services.msc. If the service stops by itself, Windows starts it again after 5 seconds, then 30 seconds, then 2 minutes (the installer sets this); a service that you stopped yourself stays stopped.
• Is something else using port 8445? Courier logs "Cannot listen on port" and stops. Find the other application and move it; do not change the firewall to get round it.

The first-administrator page does not appear

It appears only on the server itself and only while Courier has no accounts. If someone has already created one, you see the ordinary sign-in. If every account has been lost, run Courier.exe --setup-admin from an elevated prompt in the program folder (C:\Program Files\RSJ Software\Courier); it refuses to replace an account that exists.

I am locked out, or forgot my password

After several wrong passwords from one address Courier asks you to try again in a minute. If you have forgotten the password, an administrator can reset it under General Settings -> Users; the person is signed out everywhere and signs in with the new one.

Computers

A computer does not appear under Registered

• Did you run Deploy-RSJAgent-Courier.ps1 from an elevated PowerShell window? It installs the RSJ Agent and enrols it, and exits with an error if the agent's configuration does not then hold a Courier section. If the agent came from Groundskeeper or Caretaker, Enrol-Courier.ps1 -Server <server name> adds Courier to it; that script stops and says so if the agent is not installed.
• Can the computer reach the server on TCP port 8445? If you unticked the firewall option at install, add an inbound rule for TCP 8445 yourself. Check the server's name resolves from the computer.
• Did you use the current connection secret? Rotating the secret on Agent Settings (Deploy) means every computer enrolled with the old one must be enrolled again. A computer that was rebuilt can be given a new key with Reset machine key.

Deploy selected says it could not reach a computer

The computer is shown under Agent Settings -> Devices -> Unreachable with the reason. WinRM is switched off on Windows 10 and 11 computers until Enable-PSRemoting -Force is run on them, and their firewall must allow TCP 5985 from the Courier server. Nothing was sent to that computer. Use the deploy script on it instead, or fix WinRM and choose Deploy selected again.

A computer is listed but "No Courier module"

Enable Courier on it: Agent Settings -> Courier module -> Enable on selected. The computer collects the module at its next check-in, about a minute later. The card says Waiting for the computer to collect it until then, and Refused by the computer or Failed with the reason if it did not take. If the card says there is no package on the server, reinstall Courier or tell us.

A notice stays on Waiting

Waiting means the computer has not collected it. Usual reasons: the computer is off or offline (it collects the notice when it returns, if that is before the notice closes), it has no Courier module, or it cannot reach the server. For a People notice it also means no computer has reported that person signed in yet. If the deadline passes before the computer collects it, the copy becomes Expired -- never Acknowledged.

A notice says Displayed but nobody acknowledged it

Displayed means it was on a screen. It does not mean anyone read it. Courier does not guess; the copy stays Displayed until it is acknowledged or expires.

A notice says Failed

Results gives the reason the computer reported:

• The computer could not open the notice window -- the module could not show it on that computer. Note the detail in brackets and tell us.
• The computer refused the notice because it was not in a form it could show -- tell us the exact wording.
• Courier was removed from this computer -- the Courier module was removed before the notice was shown.

A locked or signed-out screen

Showing a notice on a locked screen or at the sign-in screen has not been proven. Do not assume a notice will be seen there.

Sending

"A notice is still being sent"

Courier sends one notice at a time from a page. Wait for the answer. If the answer never comes, preview the same notice again: Courier asks the server whether the earlier send made a notice, and offers to open it or send it again as a new one.

Preview says what it reaches has changed

Between opening the preview and pressing Send, a computer went offline, an enrolment changed or a group's members moved. Check the new summary and press Send again.

Active Directory groups: Test fails, or Preview refuses

Test says in words what failed. Common causes: the account or password is wrong, a listed OU does not exist, or Courier could not read the directory's list of its domains (without it Courier cannot tell which domain a person belongs to, so it refuses every group lookup). Check the account can sign in to the domain from the server. Group lookups have been seen working against a real domain on a lab server (October 2026). Please report anything surprising, with counts you can compare against Active Directory Users and Computers.

Logs and updating

Collect logs for support

An administrator can open General Settings -> Logs. It shows the latest lines of Courier's log, with credentials, names and addresses removed, and Collect logs for support downloads a single .zip for a support request: the version, the environment, your settings with secrets masked, counts of what the database holds and recent log lines. It is built on the server and saved to the computer you are using; nothing is sent anywhere automatically. The removal of sensitive details is best-effort, so open the .zip and check it before you share it.

Where are the logs?

In C:\ProgramData\RSJ Software\Courier\Data\logs: courier.log (one file a day, kept for seven days) holds startup, port conflicts and errors; the shawl_for_Courier logs hold the service wrapper's output. That folder is limited to Administrators, SYSTEM and Local Service, so use an elevated PowerShell window if Explorer refuses. The installer's own log from the latest service set-up is service-install.log in the update-state folder under the program folder. Check any file before you share it: they can contain local paths and computer names. Never share the database, a connection secret or a password.

How do I update?

Run the newer CourierSetup.exe over the existing install, having taken a copy of the data folder first with the service stopped. See Getting Started. The Settings Updates tab belongs to the private preview channel and is not the way to update from a public release yet.