Deployment guide for IT admins

This guide is for the IT admin rolling out desktest.net across a fleet of front-desk workstations. The goal is simple: get the diagnostics working reliably on every machine so your tier-1 staff can use desktest.net as the first stop when a user reports "the scanner stopped working" or "the signature pad isn't responding." Done right, your tier-1 team triages most peripheral tickets from a copy-pasted report, without screen-sharing.

Why centralize on desktest.net

One URL your users land on. One set of diagnostics you have read the source of. Copy-paste reports that go straight into your ticket system. No per-workstation installation for most of the tools (the page runs in any modern browser). The two tools that depend on local services (Scanner Test and Signature Pad Test) only need the same vendor driver your line-of-business app already requires, so deploying desktest.net usually adds zero new agents to your image.

Whether you are a solo IT manager at a 200-unit property management company or running 80 sites for a self-storage operator, the deployment shape is the same: seed two config files, push managed bookmarks to all fifteen tools, train tier-1 on the copy-report button.

Per-tool deployment matrix

Most of the site needs nothing on the workstation. Two tools (Scanner Test and Signature Pad Test) depend on local vendor services. Here is the full breakdown.

If your fleet does not use check scanners, ignore the FIS section below. If you do not use Topaz signature pads, skip the SigWeb section. The remaining thirteen tools work on any machine with a modern Chrome, Edge, or Firefox.

FIS WebScan whitelist (most important)

This is the single most common blocker for Scanner Test after a rollout. FIS WebScan validates the calling page's Origin header against a configured whitelist stored in %ProgramData%\FIS\WebScan\config\domain.xml. If the origin is not on the list, WebScan rejects the SignalR negotiate with HTTP 403 and the Scanner Test reports a whitelist failure. The page does correctly diagnose this, but you do not want every user adding the domain by hand.

Pre-seed the whitelist at install time by placing a WebScanCapture_Setup.xml file next to the WebScan MSI before running it. The installer reads this file and writes the configured origins into domain.xml on first launch. Use the same base name as the MSI so the installer picks it up.

<root>
  <CheckUpdate>Y</CheckUpdate>
  <UpdateURL>https://your-fis-update-server/webscan</UpdateURL>
  <IsQuiet>Y</IsQuiet>
  <OriginDomains>
    <domain>https://desktest.net</domain>
    <domain>https://your-rdc-domain.example.com</domain>
  </OriginDomains>
</root>

Distribute the MSI plus the seed XML together via SCCM, Intune Win32 app, or a GPO software-install package. The IsQuiet flag suppresses installer dialogs. Add any other origins your remote deposit capture portal lives on while you are at it; the whitelist is additive.

For workstations that are already deployed, the per-workstation fallback is fine: right-click the blue WS tray icon, choose Settings, then Origin Domain Settings, click Add Domain, enter https://desktest.net, click Update, and accept the prompt to restart WebScan. If a single user reports a whitelist failure, that is the 30 second fix. If a dozen do, push the XML.

Topaz SigWeb (simpler, no whitelist)

SigWeb does not have an origin whitelist. Any HTTPS page on the workstation can talk to the local SigWeb service at 127.0.0.1:47290 (the HTTPS port; SigWeb also binds 47289 for plain HTTP). Deployment is just the MSI.

Run the SigWeb MSI silently as part of your image build: msiexec /i SigWeb.msi /qn. Plug the pad in. Done. The first time the user opens Signature Pad Test, the tool will confirm the service is reachable and capture a test signature.

One Firefox-specific wrinkle: SigWeb signs its localhost certificate with the Topaz CA, which Chrome, Edge, and IE pick up from the Windows trust store automatically. Firefox uses its own trust store and will not see it. On Firefox-only fleets, import C:\Program Files (x86)\Topaz\Tablet\TopazCA.cer into the user's Firefox Authorities store. There is no clean GPO automation for the Firefox cert store, so the common approach is the Firefox Enterprise Policy Certificates.Install directive in policies.json, or a one-time deploy script that calls certutil against the user's Firefox profile. If your front-desk staff are all on Chrome or Edge, skip this entirely.

Pushing bookmarks and shortcuts

Make desktest.net findable. The cleanest method on managed Windows is Chrome and Edge managed bookmark policy, set via Group Policy or directly in the registry under HKLM\Software\Policies\Google\Chrome\ManagedBookmarks (Chrome) and HKLM\Software\Policies\Microsoft\Edge\ManagedBookmarks (Edge). The value is a single JSON string listing each tool URL.

[
  {"name": "desktest.net (Diagnostics)", "children": [
    {"name": "Scanner Test", "url": "https://desktest.net/scanner-test/"},
    {"name": "Signature Pad Test", "url": "https://desktest.net/sigpad-test/"},
    {"name": "PDF Test", "url": "https://desktest.net/pdf-test/"},
    {"name": "Printer Test", "url": "https://desktest.net/printer-test/"},
    {"name": "SiteLink Test", "url": "https://desktest.net/sitelink-test/"},
    {"name": "Microphone Test", "url": "https://desktest.net/mic-test/"},
    {"name": "Webcam Test", "url": "https://desktest.net/webcam-test/"},
    {"name": "Speaker Test", "url": "https://desktest.net/speaker-test/"},
    {"name": "Keyboard Test", "url": "https://desktest.net/keyboard-test/"},
    {"name": "Display Test", "url": "https://desktest.net/display-test/"},
    {"name": "Browser Test", "url": "https://desktest.net/browser-test/"},
    {"name": "Network Test", "url": "https://desktest.net/network-test/"},
    {"name": "USB Device Test", "url": "https://desktest.net/usb-test/"},
    {"name": "Mouse Test", "url": "https://desktest.net/mouse-test/"},
    {"name": "WebRTC Test", "url": "https://desktest.net/webrtc-test/"}
  ]}
]

For Firefox, use the Enterprise Policy JSON (policies.json) Bookmarks array, or an autoconfig.js shipped with the install. For Edge or Internet Explorer Favorites on older Windows images, use Group Policy Preferences (User Configuration, Preferences, Windows Settings, Internet Settings, Favorites). Whatever you pick, the goal is that a front-desk user can open their browser's bookmark bar and click the tool name without typing. Many shops push a single bookmark to the hub https://desktest.net/ and let users pick the tool from the homepage; either approach works.

Pre-rollout smoke test

Before pushing to the fleet, validate on one reference workstation that has the same image and the same peripheral models. Plan on 20 minutes.

1. Install FIS WebScan with the seeded WebScanCapture_Setup.xml next to the MSI.
2. Install Topaz SigWeb with msiexec /i SigWeb.msi /qn.
3. Plug in a check scanner and a signature pad.
4. Apply your bookmark policy and reboot.
5. Open https://desktest.net/. Confirm all fifteen tool tiles render.
6. Run Scanner Test, feed a check, confirm PASS with MICR decoded.
7. Run Signature Pad Test, sign on the pad, confirm PASS.
8. Run PDF Test, Printer Test, and SiteLink Test. Confirm each produces a reasonable result for your environment.
9. Run the browser-only peripheral tools you actually care about (Microphone, Webcam, Speaker, Keyboard, Display, Mouse) on at least one machine to validate the standard image. Most of these need user gestures or visual confirmation, so this is a per-image check rather than per-workstation.
10. If you support video calling at the front desk, run WebRTC Test from inside the corporate network to confirm STUN reachability (UDP 3478/19302 outbound). If you support self-storage SiteLink, run SiteLink Test from a typical user account.

If Scanner Test passes here, your seed XML is correct and the rest of the fleet will work. If it reports a whitelist failure on the reference machine, fix the XML before going further.

Tier-1 support workflow

The point of all this is that a user reporting "my scanner stopped working" never needs a screen-share. The workflow your tier-1 staff should follow:

1. Send the user the direct link to the relevant tool (Scanner Test for check scanners, Signature Pad Test for signature pads, and so on).
2. Ask them to click Run.
3. When the verdict appears, ask them to click Copy Diagnostic Report and paste the result into the ticket.

The report includes the workstation OS, the exact browser version, every check that ran with pass or fail, the diagnosed cause, the recommended next step, and the raw driver response where applicable. Tier-1 can triage from the report text alone in 95% of cases. The remaining 5% (genuine hardware failure or a weird vendor bug) get escalated with the report attached, which saves tier-2 the same investigation step.

Troubleshooting common false negatives

Scanner Test reports whitelist failure on machines you thought were seeded. Confirm the XML actually got distributed: on a target workstation, open %ProgramData%\FIS\WebScan\config\domain.xml and look for https://desktest.net in the origin list. If it is missing, your install package did not pick up the seed file. Check the MSI base name matched the XML base name and re-run the install.

Signature Pad Test passes in Chrome and Edge but fails reach in Firefox. The Topaz CA cert was not imported into Firefox's trust store. Either import it on the affected profile, push it via Firefox Enterprise Policy, or move the user to Chrome or Edge.

SiteLink Test fails the passive ping but staff confirm SiteLink Web Edition works fine in the browser. Expected. The passive ping is a no-cors request and is intentionally lenient (it cannot read the response body for privacy reasons). Trust the visual confirmation step.

Scanner Test reaches WebScan but the WebSocket fails on Edge UWP. Loopback isolation. Run CheckNetIsolation LoopbackExempt -a -n="Microsoft.MicrosoftEdge_8wekyb3d8bbwe" in an admin command prompt. This is rare on modern Edge (Chromium) but still hits the old UWP build.

Related

• Scanner Test guide - what each check verifies and how to read the verdict.
• Signature Pad Test guide - the same, for SigWeb.
• About desktest.net - what this site is and the three rules every page follows.
• desktest.net - the tool hub.