On-Prem Maintenance¶
Operational runbooks for organizations running a self-hosted (on-premise) GRC-ITSM deployment. GRC-ITSM runs on a Halo core (the Halo WebApp plus its supporting database and integrator), so keeping the underlying Windows hosts patched and the Halo application current is a routine part of operating your own instance.
These runbooks are written for the operators and platform engineers responsible for a self-hosted deployment. They assume familiarity with Windows Server, IIS, SQL Server Management Studio (SSMS), and Task Scheduler.
What these pages cover
This section documents two recurring maintenance procedures: patching/rebooting the Windows hosts and upgrading the Halo application version. Both procedures share the same shutdown choreography (stop the IIS site, disable the integrator task), so the two pages cross-reference each other.
Production change control
Both procedures take your GRC-ITSM platform offline for the duration of the maintenance window. Schedule them inside an approved change window and confirm a rollback point (snapshot or backup) exists before you begin.
Deployment topology¶
A self-hosted deployment runs Halo on two Windows Servers. Knowing which component lives where is the foundation for both runbooks.
| Server | Hosts | Notes |
|---|---|---|
| Application Server | IIS-hosted Halo WebApp (an ASP.NET application) and the DB Integrator | The integrator runs here as a Windows Scheduled Task, not as a service |
| SQL Server | The Halo database | MSSQL 2016 minimum, 2022 recommended, 2025 supported. Compatibility level >= 130 (>= 140 for Halo v2.220+) |
Host OS on both servers is Windows Server 2016 / 2019 / 2022 / 2025.
There is no 'Halo' Windows service
The Halo WebApp is an IIS site backed by an application pool. When a procedure says "stop Halo" or "start Halo," it means stop or start the IIS site (and app pool) -- there is no entry in services.msc named Halo.
Likewise, the Backend Services (Event, Incoming, Outgoing, Scheduling -- the NHServerless services that replaced NHServer) are application toggles under Configuration > Advanced Settings > Backend Services, not services.msc entries. Do not go looking for them in the Windows Services console.
How the components connect:
- The Application Server runs two things: the IIS site + app pool (the Halo WebApp, an ASP.NET application) and the DB Integrator (a scheduled-task executable that can also be run interactively as a GUI).
- Both of those connect to the Halo database (MSSQL) on the SQL Server.
- There is no direct dependency between the WebApp and the DB Integrator -- they are independent processes on the same host that both talk to the database.
Environment values specific to your deployment¶
These runbooks are deliberately generic. Before running either procedure, gather the values specific to your environment and have them on hand. Each appears as a «CONFIRM: ... » placeholder in the procedures below -- substitute your own value wherever you see one.
| Value | Why it matters |
|---|---|
| WebApp folder path | The IIS site's physical path where upgrade files are dropped. Halo deployments use either C:\Halo\Production or C:\Halo\WebApp -- confirm yours. Referred to throughout as "the WebApp folder" |
| IIS site name + app pool name | The exact names you stop and start in IIS Manager |
| Integrator Scheduled Task name(s) + exe folder | There may be more than one task (e.g. a default task plus a 5-minute sync task). The executable is often relocated, so locate it via the task's Actions tab |
| Task / app pool service account | The Windows account the scheduled task and app pool run under |
| API certificate status | Whether the API certificate is installed on the Application Server (affects whether the integrator must stay running across a reboot) |
| Backup / snapshot location + owner | Where the rollback point lives and who owns it |
| Maintenance window + change-approval owner | The approved window and who signs off |
Substitute your own values
The «CONFIRM: ... » markers are placeholders for values specific to your environment -- fill in your own server names, paths, task names, and accounts as you follow the steps. Keep that filled-in copy in your own internal runbook or secrets store rather than anywhere public.
Runbooks¶
-
Safely apply Windows Server updates and reboot the Application Server (and SQL Server) without data loss or a broken Halo instance.
-
Upgrade the Halo application version on the Application Server, including version-gated installer steps and post-upgrade verification.
The two procedures share the same shutdown choreography (stop the IIS site, disable the integrator task). The host-OS runbook is the canonical reference for those shared steps; the Halo upgrade runbook links back to it.
Source guides¶
These runbooks derive from the HaloITSM On-Prem guide set. Cited inline by their short references:
| Ref | Guide |
|---|---|
| s1 | On-Prem -- Pre-requisites |
| s2 | On-Prem Upgrade |
| s3 | On-Prem Upgrade -- Troubleshooting |
| s4 | DB Integrator -- Troubleshooting |
| s5 | Checking your DB Integrator Version |