Avigilon NVR5 PRM FIPS User manual

Avigilon NVR5 PRM FIPS
User GuideNVR5-PRM-FIPS-96TB-NA
NVR5-PRM-FIPS-128TB-NA
NVR5-PRM-FIPS-160TB-NA

©2023,Avigilon Corporation. All rights reserved. AVIGILON, the AVIGILON logo, AVIGILON CONTROL CENTER,
and ACC are trademarks of Avigilon Corporation. Microsoft and Windows are trademarks of the Microsoft group of
companies. Dell is a trademark of Dell Inc. Other names or logos mentioned herein may be the trademarks of their
respective owners. The absence of the symbols ™ and ® in proximity to each trademark in this document or at all is
not a disclaimer of ownership of the related trademark.
This document has been compiled and published using product descriptions and specifications available at the time
of publication. The contents of this document and the specifications of the products discussed herein are subject to
change without notice. Avigilon Corporation reserves the right to make any such changes without notice. Neither
Avigilon Corporation nor any of its affiliated companies: (1) guarantees the completeness or accuracy of the
information contained in this document; or (2) is responsible for your use of, or reliance on, the information. Avigilon
Corporation shall not be responsible for any losses or damages (including consequential damages) caused by
reliance on the information presented herein.
Avigilon Corporation
avigilon.com
20230727
2

Contents
Introduction 1
Before YouStart 1
Overview 1
Front View 1
Back View 3
Package Contents 4
Installation 5
Connect Cables 5
Install the Sliding Rack Rails and Cable Management Arm 5
Install the Bezel 5
Logging into Windows Server for the First Time 7
Connecting to ACC Software 8
Activating and Configuring ACC Software 8
Troubleshooting 9
Network Configuration 9
Checking System Health 9
Operating System Recovery by External USB 9
Unlocking the Storage Volume 10
Re-installing the ACC Software 10
Replacing the Motherboard 10
Maintenance 11
Checking System Health 11
ACC Client Site Health 11
Server Administrator Software System Health 11
Replacing Hard Drives 12
Guidelines 12
Replacing a Hard Drive Blank 13
Replacing Front or Back Hard Drives 15
LED Indicators 16
Diagnostic Indicators 16
iDRAC Direct LED Indicators 17
Power Status Indicators 17
Network Link Status Indicators 18
Hard Drive RAID Status Indicators 19
System Health and Identification Modes 20
Resetting the iDRAC System 20
3

For More Information 21
Product User Guides 21
4

Introduction 1
Introduction
The Avigilon Network Video Recorder (NVR5 Premium FIPS Series) is preloaded with Avigilon Control Center (ACC)
software and is configured for exceptional performance and reliability. The Network Video Recorder offered in
higher data storage capacities can be easily integrated into any existing Avigilon surveillance system or act as the
base of a new site.
Before YouStart
Avigilon recommends the use of an uninterruptible power supply (UPS) system to protect your video surveillance
system hardware. A UPS system is used to protect critical equipment from mains supply problems, including spikes,
voltage dips, fluctuations and complete power failures using a dedicated battery. It can also be used to power
equipment during the time it takes for a standby generator to be started and synchronized.
Any UPS connection must include configuration to shut down the operating system on the appliance when battery
power is low or there is 15 minutes of power remaining.
It is recommended that cameras not be connected to the appliance until after the appropriate network configuration
has been set up.
Overview
Front View
Figure 1: Front view of NVR5 Premium FIPS Series recorder with front bezel installed

Front View 2
Figure 2: Front view of NVR5 Premium FIPS Series recorder with front bezel removed
1. BezelProtects against unauthorized physical access to the hard drives.
For more information, see Install the Bezel on page5.
2. Power buttonControls the power supply to the recorder.
3. Video connectorAccepts a VGA monitor connection.
4. USB 2.0 portAccepts USB connectors to external devices.
5. iDRAC Direct micro USB port and iDRAC Direct LED indicatorConnects a laptop or desktop computer on the same network as the Integrated Dell™ Remote Access
Controller (iDRAC) version 9.
For more information about the iDRAC web interface, see the information tag on your recorder and the
Enabling iDRAC Enterprise Features Setup Guide.
Also indicates when the iDRAC port is connected. For more information about the LED indicator, see LED Indicators on page16.
6. Diagnostic indicatorsProvides information about system operations.
For more information about the above LED indicators, see LED Indicators on page16.
7. System health and system identification buttonDisplays the system health. Also identifies a recorder deployed in a rack with other equipment.
For more information, see System Health and Identification Modes on page20.
8. Twelve (12) Hard drivesProvides access to hot-swappable hard drives. There are LED indicators on each hard drive.
Some drives may contain an empty hard drive tray.

Back View 3
9. Information tag (top and bottom views are not shown)
Slides out to provide the serial number, system information, and iDRAC account credentials for initial login to
the iDRAC web interface.
Back View
Figure 3: Back view of NVR5 Premium FIPS Series recorder
1. Two (2) 1 Gbps Ethernet portsAccepts Ethernet connections to multiple networks and includes LEDindicators of the connections.
2. Out-of-Band Management (OOBM) portAccepts an OOBM RJ-45 connection and includes an LEDindicator of the connection.
3. Keyboard port and mouse portAccepts connectors to a keyboard and mouse.
4. Two (2) 10Gbps SFP+ Ethernet portsAccepts Ethernet connections to multiple networks and includes LEDindicators of the connections.
5. Video connectorAccepts connections to serial devices.
6. Two (2) Power supply connectorsAccepts a power supply connection.
7. Four (4) 1 Gbps Ethernet portsAccepts Ethernet connections to multiple networks and includes LEDindicators of the connections.
8. System identification buttonIdentifies a recorder deployed in a rack with other equipment. Also resets the iDRAC web interface without
rebooting the operating system.
For more information about the iDRAC reset, see the
Enabling iDRAC Enterprise Features Setup Guide.
For more information about the above LED indicators, see LED Indicators on page16.

Package Contents 4
Package Contents
Ensure the package contains the following:
lAvigilon NVR5 Premium Recorder
lRack sliding rail assembly kit
lCable management arm assembly kit
lBezel and key
lBlank USB key for OS recovery image
lPower cables
o2 x C13 / C14
o2 x region specific
NA: NEMA 5-15P / C13
UK: BS 1363 / C13
EU: SCHUKO / C13
AU: AS3112 / C13

Installation 5
Installation
Connect Cables
Refer to the diagrams in the Overview section for the location of the different connectors. Make the following
connections as required:
1. Connect a KVM switch or separate keyboard, mouse and monitor to the recorder.
lThe keyboard and mouse can be connected to any USB port on the recorder.
lThe monitor can be connected to any video connector at the front or back of the recorder.
2. Connect the recorder to your network by plugging an Ethernet cable into one of the Ethernet ports.
3. For out-of-band management access and functionality, connect Ethernet cable to the OOBM connector.
4. Connect a power cable to each power supply at the back of the recorder.
5. Press the power button on the front of the recorder. Check that the recorder LED indicators display the
correct status. For more information on the different LED status indicators, see LED Indicators on page16.
Install the Sliding Rack Rails and Cable Management Arm
If the recorder will be mounted in a server rack, install the Sliding Rack Rails and the Cable Management Arm (CMA)
provided in the recorder package. Follow the procedures outlined in the Rack Installation Instructions and the CMA Installation Instructions provided in the assembly kits.
NOTE
When rack-mounting the recorder, ensure no interference occurs from the sliding arms of adjacent
equipment in the rack. Every sliding rack rail on the server rack must be aligned before you insert the
recorder into the rail for a smooth installation. For more information, refer to the dimensions in your
server rack design documentation.
Install the Bezel
The bezel can be installed on the front of the recorder to help protect the hard drives against unauthorized access.

Install the Bezel 6
1. Align and insert the right end of the bezel until it clicks into place.
2. Push the left end of the bezel into the front of the unit until it clicks into place.

Logging into Windows Server for the First Time 7
Logging into Windows Server for the First Time
After the recorder powers up, you will need to configure the Windows operating system for the first time:
1. On the first screen, scroll through the list and select your preferred language.
Figure 4: The language selection screen during initial Windows software set up. (Used with permission from Microsoft.)
2. Select the country/region, preferred app language and keyboard layout, and then click Next.
NOTE: If a language other than English is selected, the server will restart. This is normal Windows behavior.
Proceed with step 3 once the server has finished restarting.
3. The End User License agreements are displayed. Review the terms then click Accept.
4. On the Customize settings screen, set a password for the local administrator account.
The password must meet the following complexity and policy requirements:
lHave a minimum length of 14 characters.
lHave at least one of each of the following: lowercase character, uppercase character, symbol, and
number.
lYou cannot reuse your last 24 passwords.
lThe password will expire in 60 days.
lThe password must be a minimum age of 1 day before it can be changed.
5. Press Ctrl+Alt+Delete to unlock and log in:
lUser name: AdministratorlPassword: created in the previous step.
6. Once logged in, the recorder will go through initial system setup, and then start BitLocker encryption, some
configuration and applying of hardening policies.
7. The Setup dialog will start configuring the system storage. This process may take up to 5- 20 minutes
depending upon the size of the storage volume.

Connecting to ACC Software 8
8. The AvigilonControl Center Software will start running automatically and the NVR Analytics Kit will be
configured.
9. Once the setup procedure is complete, the system will restart.
IMPORTANT
After this reboot, as part of the applied hardening policies, your Administrator account user
name will have been automatically changed to MotoSec.
10. Log in with the MotoSec user name and the password you created previously. The user name is not case
sensitive.
Once logged in, proceed to deploying the recorder using an active directory or standalone. For more
information, see the ACC Initial System Setup and Workflow Guide.
To continue protecting your system, you will need to create a backup BitLocker recovery key, create a USB
recovery stick, and disable USB ports. For more information on these security procedures, see the Avigilon
System Hardening Guide.
Connecting to ACC Software
Once you have deployed your Network Video Recorder, you should activate your ACC software.
Activating and Configuring ACC Software
lInitial ACC™ System Setup and Workflow Guide
lACC 7 Help Center
Printable versions of these guides are available on the Avigilon website: avigilon.com/support/software/.

Troubleshooting 9
Troubleshooting
Network Configuration
By default, the Remote Monitoring Workstation acquires an IP address on the network through DHCP. If you need to
set up the workstation to use a static IP address or any specific network configuration, see the Windows Help and Support files for more information.
By default, the NVR5 Workstation acquires an IP address on the network through DHCP. If you need to set up the
workstation to use a static IP address or any specific network configuration, see the Windows Help and Support files
for more information.
By default, the NVR5 Premium acquires an IP address on the network through DHCP. If you need to set up the
workstation to use a static IP address or any specific network configuration, see the Windows Help and Support files
for more information.
Checking System Health
You can check on the health of the system components in the Site Health in the ACC Client software. See Site Health
in the ACC Client User Guide for more information.
Operating System Recovery by External USB
If you need to recover the Windows operating system on the Network Video Recorder you will need to have created
a USB Recovery Image during recorder setup. For more information, see Hardening the Avigilon NVR5 Premium -
FIPS Series.
The general steps are:
1. Plug the USBrecovery device into the recorder.
NOTE
USB ports must be enabled to complete the OS recovery. See Hardening the Avigilon NVR5
Premium - FIPS Series for more information on enabling USB ports.
2. Reboot the NVR.
3. Press the F11 key while the server is booting up to open the Boot Manager.
4. Select One-shot UEFI Boot Menu from the Boot Manager Main Menu.
5. On the UEFI Boot menu, select to boot from the USB recovery device.
6. Click Recover on the Recovery window.
7. Wait for the recovery process to complete. This may take 20-30 minutes. Once the recovery process is
complete, it will ask you to remove the USB and reboot the NVR.
8. Go through the initial setup process. For more information, see Logging into Windows Server for the First Time on page7.

Unlocking the Storage Volume 10
Unlocking the Storage Volume
After the OS recovery is complete, you will need to unlock the storage volume that has been encrypted with
BitLocker.
1. Plug the USBrecovery device into the recorder.
IMPORTANT
The BitLocker recovery key files (BEK files) should have been backed up to your USB device
as part of completing the NVR setup. For more information, see Hardening the Avigilon NVR5
Premium - FIPS Series.
2. Open Windows Explorer and locate the storage volume with the locked icon.
3. Click the storage volume. Windows will ask you for a Recovery Key. Click to Load Key From USB Drive. The
storage volume should now be unlocked.
4. Click on the Windows Start button and type Manage BitLocker. Open the Manage BitLocker application.
5. Click on Storage and select Turn on auto-unlock.
Re-installing the ACC Software
Download and install your version of the ACC software on the NVR. After installing, the system will start configuring
system storage and hardening of the recorder.
Replacing the Motherboard
Your recorder uses a Trusted Platform Module (TPM) to secure your hardware with integrated cryptographic keys. To
maintain security, the TPM cannot be reused with a new motherboard if the motherboard needs to be replaced. If the
motherboard needs to be replaced, this will require a new TPM.
You will be required to enter your BitLocker recovery key when booting to the Operating system after replacing the
motherboard. As part of the initial setup, administrators should backup their BitLocker recovery key. This key can
then be used to restore BitLocker on a new TPM if the motherboard is replaced.
IMPORTANT
Make sure you have the BitLocker recovery key prior to replacing the motherboard. It is also advised
that you decrypt the hard drive prior to replacing the motherboard.
1. After replacing the motherboard and signing in with the BitLocker recovery key, navigate to Control Panel >
System and Security > BitLocker Drive Encryption.
2. Choose to Suspend protection from the Manage BitLocker window. A message should appear stating that
BitLocker protection has been suspended.
3. Reboot the system and go into the BIOS to enable and activate the TPM.
4. Click Apply and Exit.
5. Boot back into Windows and ensure that BitLocker is turned back on in the BitLocker manager console.

Maintenance 11
Maintenance
Checking System Health
You can check your system health through the ACC Client Site Health or with the Server Administrator software.
ACC Client Site Health
You can check on the health of the system components in the Site Health in the ACC Client software. See Site Health
in the ACC Client User Guide for more information.
Server Administrator Software System Health
The Server Administrator software is pre-installed on the recorder. The software provides information about the
recorder’s system operation status, and gives you remote access to the recorder for recovery operations.
IMPORTANT
To comply with hardening policies, the FIPS Series NVR will not allow the Server Administrator
software to open with its default self-signed certificate. To use the Server Administrator software, you
have two options:
lTo fix the self-signed certificate: generate a certificate signing request, get it signed by a
trusted certificate authority, and upload the CA-signed certificate to the Server Administrator.
For more information, see the Server Administrator Software Certificate Management section
of the System Hardening Guide.
lTo workaround the self-signed certificate: use the Windows Registry Editor to edit the key to
temporarily allow self-signed certificates. Using this method will leave your system exposed
until you change the registry key back to its previous state. For more information, see the
Server Administrator Software Registry Key section of the System Hardening Guide.
If one of the LED indicators on the recorder is flashing an error warning, the Server Administrator will display details
about the problem. For more information about the LED indicators, see LED Indicators on page16.
1. Open the Server Administrator.
lTo open the Server Administrator locally, double-click the Server Administrator shortcut icon on the
desktop.
lTo open the Server Administrator remotely, open a web browser and enter this address:
https://<recorder IP Address>:1311/.
For example: https://192.168.1.32:1311/ or https://localhost:1311/.
If you are using an intranet connection, your browser may display an error message. Allow the browser to
ignore the certificate warnings.
2. If asked to log in, enter the Windows software administrator username and password that was configured for
the recorder.

Replacing Hard Drives 12
3. On the Server Administrator home page, the health of the system components are displayed in the
workspace on the right.
lTo see the health of other system components, expand and select a different component from the
System Tree on the left.
lThe table displayed in the workspace lists system components and their status:
The system component is running normally.
The system component has a non-critical warning.
The system component has a critical failure.
The system component status is unknown.
lTo see the details of a system component, select the system component from the workspace.
The Server Administrator is also used to customize the Redundant Array of Independent Disks (RAID) settings,
assign a hot spare and remotely monitor the system health. For more information about the features in the Server
Administrator, see the Help system provided in the software.
Replacing Hard Drives
NOTE
Before powering down the recorder for any upgrade, recovery or maintenance, back up critical
recorder data and programs. For more information, see the Windows™ Upgrade and Recovery Guide for Avigilon Systems (link).
The operating system and the Avigilon Control Center software are mirrored on two hard drives at the back of the
recorder. If one of the hard drives fail, you can replace the failed drive while the recorder continues to run from the
other.
If your recorder is still under warranty, contact Avigilon Technical Support to replace the failed hard drive.
If more than two hard drives fail at the same time, contact Avigilon Technical Support immediately for recovery
instructions.
Only replace a hard drive if the hard drive LED indicator and the Server Administrator displays an error.
1. Open the Server Administrator.
2. Check which hard drive has failed, then disconnect the drive through the Server Administrator software.
Hard drives are installed at the front and back of the recorder. Be sure you can identify which hard drive
needs to be replaced.
3. Remove the bezel.
4. Depending on where the hard drive is located, perform one of the following procedures:
Guidelines
When replacing hard drives, observe the following general guidelines:

Replacing a Hard Drive Blank 13
lIf only one drive is used, install the drive in the drive bay with the lowest device number. For example:
WARNING
Opening or removing the system cover while the system is powered on may expose you to a risk of
electric shock.
CAUTION
Do not operate the system without the cover for a duration exceeding five minutes. Operating the
system without the system cover can result in component damage.
CAUTION
To ensure proper operation and cooling, all bays in the system and system fans must be always
populated with a component or a blank.
Replacing a Hard Drive Blank
The hard drives on the Network Video Recorder are set up in a RAID configuration. This allows information to be
recorded across several hard drives.
If one hard drive fails, there is enough information on the other hard drives for the recorder to continue recording
video.
Depending on the recorder model, there may be hard drive blanks at the front of the recorder. You can replace the
blanks with hard drives as required.

Replacing a Hard Drive Blank 14
1. Remove the bezel.
a. Unlock the bezel.
b. Push the release button next to the lock.
c. Pull the left end of the bezel then unhook the right end to remove the bezel.
2. Press the release button and slide the blank out of the hard drive slot.
3. Insert the hard drive all the way into the recorder then push the handle against the hard drive to lock it into
place.
4. Open the Server Administrator application and expand the System Tree.
The new hard drive should be automatically added to the Physical Disks list. The list is typically available
here:System > Storage > PERC H740P Mini (Embedded) > Connector 0 (RAID) > Enclosure (Backplane) > Physical Disks.

Replacing Front or Back Hard Drives 15
5. Assign a task to the new hard drive or allow it to exist as an extra storage drive.
It is recommended to use the new hard drive as a hot spare. Hot spares are hard drives that are available on
standby in the event of a hard drive failure in the RAID. If that occurs, you can configure the system to
automatically redirect recording to the unused hard drive.
To assign the new hard drive as a hot spare:
a. In the Task list, select Assign and Unassign Global Hot Spare.
b. Click Execute.
If the new hard drive is not displayed in the Server Administrator, try one of the following:
lRefresh the browser.
lReboot the recorder.
Replacing Front or Back Hard Drives
1. Locate the failed hard drive at the front or back of the recorder, depending on the model.
2. Press the release button on the front left of the hard drive.
3. When the handle is released, pull the hard drive out of the recorder.
4. Remove the four screws from the side of the hard drive carrier.
5. Lift the failed hard drive out of the carrier.
6. Insert the replacement hard drive into the carrier and screw it into place. The hard drive connectors should
face the back.
7. When the hard drive is secured in the carrier, insert the hard drive back into the recorder.
8. Once the hard drive is inserted all the way in, push the handle against the hard drive to lock it into place.
The recorder immediately starts rebuilding the hard drive. The progress of the rebuilding is displayed in the Physical
Disks panel or Server Administrator. This may take several hours.

LED Indicators 16
LED Indicators
The following tables describe what the LEDs on the Network Video Recorder indicate.
Diagnostic Indicators
The diagnostic indicators on the front panel highlight system issues during system startup.
NOTE
The diagnostic indicators only light-up when the recorder is powered.
LED IndicatorDescription System health and System IDlSteady blue — The system is powered on and healthy. System health mode is active.
lBlinking blue — System identification mode is active.
lSteady amber — The system is in fail-safe mode.
NOTE
If the system health indicates a degraded or critical state, contact Avigilon
Technical Support for assistance.
lBlinking amber — The system is experiencing a fault. Check the System Event Log.
For more information, see System Health and Identification Modes on page20.
Hard drivelSteady amber — The hard drive is experiencing an error. Check the System Event Log.
TemperaturelSteady amber — A thermal error has occurred.
Possible errors include:
oTemperature out of range
oFan failure
Check that the fans are functioning correctly and the air vents are not blocked.
ElectricallSteady amber — An electrical error has occurred.
Possible errors include:
oVoltage out of range
oFailed power supply
oVoltage regulator
Check the power status indicator to confirm if it is an issue with the power supply, and
reseat the power supply unit, if the error persists.