Why Windows Asks to Let ElderSuite Through the Firewall When You Scan

📝 Overview

The first time the ElderSuite Scan Manager opens on a computer, Windows may show a Windows Security Alert asking whether to allow ElderSuite to communicate on the network. That prompt is ElderSuite searching the office network for network scanners.

Click Allow access. If the prompt was declined, Windows will not ask again, and ElderSuite needs to be allowed through the firewall by hand.

ElderSuite serves adult day care centers nationwide. Choosing a scanner once the list fills is covered in How to Choose a Scanner in ElderSuite. Scanning into Client, Employee, or Provider Documents is covered in How to Scan Documents into ElderSuite.

⚙ How It Works

1. Understand What the Prompt Is For

ElderSuite finds scanners three ways at once: through the scanner's installed Windows software, through its TWAIN driver, and directly over the network for scanners and multifunction printers that support driverless scanning.

That third search is the only part of ElderSuite that listens on the local network, so Windows Defender Firewall asks for permission once, the same way it does for other programs that look for devices on the network.

Nothing else in ElderSuite depends on this permission. Signing in, saving records, reports, and documents keep working whether or not it is granted.

2. Click Allow Access When the Prompt Appears

When the Windows Security Alert appears:

• Check Private networks, such as my home or work network.
• Leave Public networks unchecked.
• Click Allow access.

Allowing needs an administrator. If Windows asks for an administrator user name and password, the person who manages the computers will need to enter it.

3. Know What Happens If the Prompt Was Declined

Windows remembers a declined prompt silently and permanently. There is no second prompt, and ElderSuite shows no error.

USB scanners and scanners whose software is installed still appear and scan normally. Network scanners that ElderSuite finds without installed software stop appearing in the scanner list on that computer. A network multifunction printer whose software is installed usually still appears, because ElderSuite reaches it through that software instead.

4. Allow ElderSuite Through the Firewall by Hand

These steps need an administrator on the computer.

1. Open Windows Security (search for it from the Start menu).
2. Click Firewall & network protection.
3. Click Allow an app through firewall.
4. Click Change settings.
5. Find ElderSuite in the list and check the box in the Private column.
6. Click OK.
7. Close and reopen the ElderSuite Scan Manager. The scanner search runs again when the window opens.

If ElderSuite is not in the list, click Allow another app..., then Browse, paste this path into the file name box, press Enter, and click Add:

%APPDATA%\MicroSolutions\ElderSuite\ElderSuite.exe

5. If the Scanner Still Is Not Listed

Make sure the scanner is turned on and connected to the same network as the computer.

In Windows, confirm the office network is set to Private, not Public. Windows blocks device discovery on Public networks regardless of the firewall setting for ElderSuite.

Install the scanner's own software from the manufacturer. Once its driver is installed, ElderSuite lists the scanner through the driver and no longer depends on the network search.

A quick test: if the built-in Windows Scan app can see the scanner, ElderSuite can scan from it.

6. Notes for IT Administrators

Only one thing needs to be allowed. ElderSuite discovers driverless network scanners with multicast DNS, the same mechanism Windows and printers use to find each other on a local network.

• Program:%APPDATA%\MicroSolutions\ElderSuite\ElderSuite.exe, allowed inbound on the Private profile.
• Traffic: UDP port 5353 (mDNS, multicast address 224.0.0.251).
• Scope: local network only. Discovery does not cross subnets, so the scanner and the computer must be on the same network segment.

ElderSuite installs per Windows user, inside that user's profile folder, and does not require administrator rights to install or update. Each Windows account that uses ElderSuite on a shared computer sees its own prompt and needs its own rule, because the program path differs per account. Updates keep the same path, so a rule created once stays valid after ElderSuite updates itself.

✅ Important Limitations

Declining the firewall prompt does not break signing in, saving records, reports, or documents. Those connections are outbound to ElderSuite servers, which the firewall already allows.

The firewall rule belongs to the Windows account, not the computer. Each account that opens the Scan Manager is asked once.

ElderSuite cannot create the firewall rule during installation. Creating a firewall rule requires administrator rights, and ElderSuite installs without them so it can be installed and updated on locked-down office computers. Windows asks once instead.

A scanner that is listed but returns nothing when scanned is a different problem. Some scanner software registers a name whether or not the device is attached. Choose the entry that appears only when the scanner is present, or install the scanner's current software. See How to Choose a Scanner in ElderSuite.

⚠ A Declined Prompt Is Permanent Until You Fix It

Windows remembers a declined Windows Security Alert silently. There is no second prompt and no ElderSuite error message.

Allow ElderSuite through the firewall by hand under Windows Security → Firewall & network protection → Allow an app through firewall, then reopen the ElderSuite Scan Manager.

💡 Need More Help?

For step-by-step assistance, click Ask Eddie from within ElderSuite.

If the scanner still does not appear after the firewall is allowed and the network is Private, open a ticket at eldersuite.com/support.