Troubleshooting

Browser still says "Not secure" after installing the certificate

• Chain contains an old certificate. If the server's store holds several self-signed certificates with the same name (re-created over time), Windows attaches a stale one to the TLS chain and the browser judges that one. Run DicomServer.Setup cert prune on the server, restart the service, then re-run Trust-TekVaultPACS.cmd on the PC — it also removes stale copies from the PC's store.
• Name mismatch. The address bar must use a name the certificate covers; the login page flags it and lists the valid names. Browsing by IP needs a certificate that includes it: DicomServer.Setup cert new SERVER,192.168.1.10. New self-signed certificates include the server's IPv4 addresses automatically.
• Wrong store. It must be under Trusted Root Certification Authorities, not Personal; choose Local Machine so every user benefits.
• Browser not fully restarted. Edge and Chrome keep running in the background — close them from the tray or sign out and in.
• Firefox ignores the Windows store unless security.enterprise_roots.enabled is true in about:config.

Senders report "out of resources" / the dashboard says images are refused

Free space on the primary storage dropped below Minimum free space (Settings → Storage; default 1 GB) and no additional location has room. The server answers every C-STORE with Storage full; TekVault senders show that under the progress bar and keep retrying; the Audit Log lists each rejected image. Free space, add a storage location, or lower the minimum. The Low-disk warning (default 10 GB) is only a warning.

A send shows "waiting" with retries

The destination answered busy / out of storage, rejected the association for congestion, or dropped the connection. The reason is shown under the bar (the destination's own words when it gives any). Retries back off up to the limits in Settings → Bandwidth & sending; when they run out the job fails with the last error, and Retry re-sends only the undelivered images.

Backup shows "connection lost – retrying"

Normal during an internet or share outage, or while a workstation with the backup drive is asleep: the run pauses and retries with growing delays for up to Keep trying for minutes (Settings → Backups, default 120). If it still fails, the automatic job retry re-runs it later from where it stopped.

The agent will not pair or shows offline

• Agent version must match the server's major features: backups to a USB drive on a workstation need agent 1.2 or newer (Test on the target says so).
• The agent connects outbound over HTTPS to the server — nothing is opened on the workstation. If the server certificate was replaced, the agent pins the new one on the next pairing; use Forget this server and pair again.
• Right-click the tray icon → Show activity… to see live transfers, or Open log folder.

Service will not start / console unreachable

Start Menu → PACS - Service status shows each port (DICOM, TLS, HTTP, HTTPS), who holds it, and the firewall rules. HTTPS "connection reset" means the service account cannot read the certificate's private key: DicomServer.Setup grant. Log files are in the data folder's Logs subfolder; warnings also go to the Windows Event Log (source DicomServer).

Duplicate studies in the list

Two studies with the same accession number for one patient are flagged with an amber ×2 badge; clicking it highlights the set. This happens when a modality re-sends a study under new UIDs. TekVault stores by UID (so nothing is lost) and flags at the list level, as most PACS do.