# IT Deployment Guide > [!note] Tato stránka ještě není přeložena do češtiny a zobrazuje se anglicky. This page is for the **IT administrators** who roll out and support Rhopoint Appearance Elements (AE) and the Aesthetix instrument on company PCs. It explains what is installed where, which privileges are needed and why, and what network access the software uses. It is split into two parts: - **Appearance Elements** — the software installation and the software itself. - **Aesthetix** — what additionally applies when an Aesthetix instrument is used. For hardware and OS requirements see [System Requirements](rhopoint-appearance-elements-system-requirements.md). For the end-user installation walkthrough see [Install AE](rhopoint-appearance-elements-install-ae.md). ## Prerequisites - **Operating system:** Windows 11, x64. See [System Requirements](rhopoint-appearance-elements-system-requirements.md). - Not supported: x86 and ARM. - **Runtime:** AE needs the **.NET 10 Desktop Runtime** and the **ASP.NET Core Runtime 10** (x64). These are bundled with the installer and installed automatically if not already present — no separate runtime deployment is required. - **WebView2:** parts of the interface use the **Microsoft Edge WebView2 Runtime**, which is included with Windows 11. - **Privileges:** local administrator rights are needed for installation and for the one-time driver installation (see below). ## Appearance Elements (software only) - AE is installed **per machine** into `%PROGRAMFILES%\Rhopoint Instruments Ltd\Rhopoint Appearance Elements 2`. Because it writes to Program Files, the installer **must be run with administrator rights**. - The installation itself installs **no device drivers**. Drivers are handled at first run — see [Aesthetix](#aesthetix-instrument-specific) below. - Per-user settings, the local measurement database and log files live in the user profile at `%LOCALAPPDATA%\Rhopoint Instruments Ltd\Rhopoint Appearance Elements 2`: - `\Settings` — application settings - `\Vault-` — local measurement database - `\Logs\` — log files - `\Screenshots` — saved screenshots This data is per user and is not roamed by default — keep it in mind for roaming profiles, non-persistent VDI and backup. > [!info] Without an attached instrument AE still runs — it can review, analyse and report existing data. Drivers are only needed to talk to hardware. ## Aesthetix (instrument-specific) When an Aesthetix is used, AE has to communicate with the instrument. This adds an inter-process communication (IPC) requirement and a one-time driver installation. ### The Aesthetix kernel process - To talk to the instrument, AE starts a separate process, **`Aesthetix.exe`**, from `…\Rhopoint Appearance Elements 2\Aesthetix_Kernel\bin`. - `Aesthetix.exe` communicates with AE over **TCP on port 45681**. Although AE only ever connects to it locally, the kernel currently binds the listener to **all interfaces (`0.0.0.0`)**, not just loopback. > [!warning] Because `Aesthetix.exe` binds to `0.0.0.0`, Windows Firewall treats it as a listening service and shows a **firewall prompt on first run**. Either approve that prompt, or pre-deploy an **inbound allow rule for TCP 45681** (or for `Aesthetix.exe`). IT must also make sure no other application already occupies port 45681 on that PC. AE's built-in System Check verifies both the port and the firewall. ### Driver installation (first run with a device) - On the **first start with an Aesthetix connected**, and with drivers not yet present, `Aesthetix.exe` triggers the **driver installation**. Because this installs drivers, Windows shows a **UAC elevation prompt** that an administrator must approve. - **Why can this not happen during installation?** The exact hardware configuration of the connected instrument must first be identified — and only `Aesthetix.exe` can do that. Knowing which drivers are needed, and how they must be installed, therefore requires the device to be attached and the kernel running. That is not possible at install time. - So: **start AE once with the Aesthetix connected** and approve the UAC prompt (a standard user can complete this if an administrator approves the elevation). - Once the drivers have been installed this one time, **subsequent starts do not raise the prompt and do not require administrator rights**. > [!warning] If AE is installed but never started once as admin with the instrument attached, the drivers stay missing and the device will not connect. ### Connection / USB - The Aesthetix connects over **USB 3.0 (USB-C or Thunderbolt)** and presents a machine-vision (USB3 Vision) camera. Use a genuine USB 3.x port; USB 2 ports and some hubs cause connection or bandwidth problems. ### USB mass storage (calibration data) > [!warning] In addition to the camera, the Aesthetix presents itself as a **USB flash drive (removable mass storage)**. On startup, `Aesthetix.exe` reads the instrument's calibration data, serial number and optical map from this drive. If IT policy **blocks USB mass storage**, the kernel cannot read this data and **the instrument will not work** — an exception is mandatory. Allow USB mass storage for the Aesthetix — ideally scoped to this device (by its hardware ID) rather than opening USB storage globally. The Windows mechanisms that can block it — all checked by Symmetron's *USB Flash Drive Access* test and by AE's built-in System Check — are: - `HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR` — the USBSTOR service must be enabled (`Start` = 3), not disabled (`Start` = 4). - `HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageAccess` — the *Removable Disks: Deny all access* policy (`Deny_All`) must be off, or the device must be exempted. - `HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies` — `WriteProtect` should be off; read access is essential and the instrument may also need write access. - Any third-party DLP / endpoint-protection USB control must likewise allow (allowlist) the device. ## Network access (updates, licensing, diagnostics) AE runs fully offline for measurement. The endpoints below are **outbound HTTPS (443)** only and enable online features; allow them in the proxy/firewall where those features are wanted: - `*.rhopointservice.net` — software updates, asset download, update checks, error and feedback reporting. - `*.rhopointservice.com` — licence activation and checks, changelog, error-code lookup, assets. - `www.rhopointinstruments.com` — product news feed and software downloads. No inbound connections from the internet are required. ## Diagnostics and troubleshooting ### Rhopoint Symmetron (recommended) **Rhopoint Symmetron** is a free, standalone diagnostic tool and the best starting point for IT: it needs no licence and does not require any Rhopoint software to be installed. Download it from — it keeps itself up to date, and all of its checks are read-only. See [Rhopoint Symmetron](rhopoint-symmetron.md). Use it to: - **Before installing** — run the compatibility checks for the intended product (e.g. *Appearance Elements + Aesthetix*) to confirm the PC meets every requirement: OS, memory, USB 3 controllers and ports, camera driver and connectivity. See [Running Compatibility Checks](rhopoint-symmetron-running-compatibility-checks.md). - **Verify connectivity** — confirm the PC can reach the Rhopoint online services, which is useful when a proxy or firewall is in the way. See [Connectivity](rhopoint-symmetron-connectivity.md). - **When something breaks** — the [Diagnose](rhopoint-symmetron-diagnose.md) tab collects application logs, Windows Error Reporting crash reports and relevant Event Log entries for Appearance Elements or the Aesthetix kernel, then bundles them as a ZIP or sends them to Rhopoint Support in one click. ### AE built-in System Check AE also includes a built-in **System Check** that reports on the OS, CPU architecture, memory, the .NET runtime, USB 3 controllers and ports, USB flash drive access, TCP port 45681 availability, Windows Firewall rules and registered antivirus — handy once AE is installed and a PC will not connect. ### Antivirus / endpoint protection Antivirus or endpoint protection can interfere — through real-time scanning of capture files, USB device blocking, or behavioural detection of the kernel. If connection or performance problems appear, consider allow-listing the install directory and `Aesthetix.exe`, and permitting the USB device. See also [Device Connection Problems](rhopoint-appearance-elements-trouble-shooting-device-connection-problems.md).