# Installing and Registering IQService

> [!WARNING]
>
> To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

You can download IQService from the configuration page of a source that requires it.

- **Alternative Names:** Look for "**IQService**," "**Integration Service**," or "**Server Host**".
- **Network Protocol:** IQService is compatible with both IPv4 and IPv6.

## Download the Integration Service

Install this service only if you use one of the following sources:

- Azure Active Directory
- Active Directory
- HCL Domino (IBM Lotus Domino)
- Microsoft SharePoint Online
- Microsoft SharePoint Server
- Windows Local

> [!NOTE]
>
> No need to install IQService if you do not already have one of these sources configured.

**To download the service:**

1. Go to **Connections \> Sources**.
2. Select one of the sources that needs IQService.
3. On the source configuration page, find the panel labeled **IQService** or **Integration Service**.

   [![Integration Service panel on the source configuration page.](<https://documentation.sailpoint.com/connectors/iqservice/help/img/integration.png>)](<https://documentation.sailpoint.com/connectors/iqservice/help/img/integration.png>)
4. Select **Download**.

## Installation and Service Start-Up

1. **Prepare the Installation Files**

   Before you start, use the downloaded components in compliance with the active SailPoint license. Use the files only for their intended purpose and do not share or redistribute them. If you have questions about usage rights, contact your Account Representative or CSM.

   1. **Unzip the archive** - Extract the downloaded `IQService.zip` archive into your desired location. For example:

      ```text
      C:\SailPoint\IQService\
      ```
   2. **Verify DLLs** - After extracting, right-click the DLL files and check the properties to confirm they are from a trusted source.
2. **Install the Windows Service**

   To improve security, the IQService installation enforces a TLS configuration by default. Complete the necessary TLS prerequisites before running the installation command. For detailed requirements and setup procedures, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/security/secure_communication.html>).

   When you are ready, open a command prompt and run one of the following commands:

   **Option A - Default installation:**

   This command installs the service as `IQService-Instance1` on the default port 5050, if available.

   ```text
   IQService.exe -i
   ```

   **Option B - TLS-only installation:**

   This command installs the service as `IQService-Instance1` on the TLS port number that you provide.

   ```text
   IQService.exe -i -o <TLS Port Number>
   ```

   ### Security Notice During a Fresh Install

   When you run a fresh install of IQService, the installer displays a security notice in the command prompt. The notice states that selected services are disabled by default and must be explicitly enabled after TLS is configured.

   The notice is similar to the following:

   ```text
   ╔══════════════════════════════════════════════════════════════════════════════╗
   ║  SECURITY NOTICE - Services Disabled by Default                              ║
   ╠══════════════════════════════════════════════════════════════════════════════╣
   ║  Starting this release, the following services are DISABLED                  ║
   ║  by default and must be explicitly enabled before use:                       ║
   ║                                                                              ║
   ║      GMSAPassword  - Using gMSA as a Service Account                         ║
   ║      ScriptExecutor - Script execution (before and after script)             ║
   ║                                                                              ║
   ║  To enable a service, run (TLS must be configured first):                    ║
   ║    IQService.exe -g --enable <ServiceName>                                   ║
   ║                                                                              ║
   ║  Example:  IQService.exe -g --enable GMSAPassword                            ║
   ╚══════════════════════════════════════════════════════════════════════════════╝
   ```

   > **Note**
   >
   > Use the exact service name shown by `IQService.exe -g` when you run `--enable`. The gMSA service is called `GMSAPasswordData`. Confirm the name in your build before you enable the service. Refer to [Option to Enable/Disable Services](<https://documentation.sailpoint.com/connectors/iqservice/help/option_to_disable.html>).

   ### Service and Port Details

   - **Service name:** The service is installed with the name `IQService-Instance1`. In the Windows Services console, its display name begins with `SailPoint`.
   - **Default port:** By default, IQService uses port 5050 for the primary instance and 5051 for the secondary instance.

   ### For Existing Installations (If Updating)

   Disable the old non-TLS port if you are updating an existing IQService instance to use a TLS port. This is crucial to close security gaps and maintain a secure connection.

   - For detailed instructions, refer to [Disabling Non-TLS Communication for an Existing IQService Instance](<https://documentation.sailpoint.com/connectors/iqservice/help/recent_updates.html#disabling-non-tls-communication-for-an-existing-iqservice-instance>).
   - For complete details on the requirements and procedures for a secure setup, refer to the [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/iqservice/help/security/secure_communication.html>) guide.

   ### Start the Service

   Select one of the following methods to start the service:

   1. **From the Windows Services console** - Open the **Services** console, locate the service name beginning with `SailPoint`, and select **Start**.
   2. **From the command line** - Run the following command:

      ```text
      IQService.exe -s
      ```

   ### Grant Service Account Access to the Certificate Private Key

   > **Note**
   >
   > If you run IQService under a service account context, that service account must be granted access to the private key of the valid certificate on your VA machine.

   **To grant access to the certificate private key:**

   1. Go to Certificate Manager on your VA.

      [![Certificate Manager showing Personal Certificates store on the local computer.](<https://documentation.sailpoint.com/connectors/iqservice/help/img/certificate_manager_personal_store.png>)](<https://documentation.sailpoint.com/connectors/iqservice/help/img/certificate_manager_personal_store.png>)
   2. Right-click the valid certificate and select **All tasks \> Manage private keys**.

      [![Certificate context menu with All tasks and Manage private keys selected.](<https://documentation.sailpoint.com/connectors/iqservice/help/img/manage_private_keys_menu.png>)](<https://documentation.sailpoint.com/connectors/iqservice/help/img/manage_private_keys_menu.png>)
   3. Add the service account user that is used when configuring IQService.

      [![Permissions dialog for certificate private keys with Add selected.](<https://documentation.sailpoint.com/connectors/iqservice/help/img/private_key_permissions.png>)](<https://documentation.sailpoint.com/connectors/iqservice/help/img/private_key_permissions.png>)
   4. Select **Apply**.
   5. Restart IQService.