Connection to the Enterprise Server fails (Socket Error 10060/10061/11001) – checklist

When connecting the Windows client or the Server Manager to the Enterprise Server, three typical socket errors can occur. The error code already narrows down the cause:

• #10061 "Connection Refused" – the target machine is reachable, but no service is accepting connections on the addressed port: the server service is not running, or you are using a wrong port.

• #10060 "Connection Timed Out" – the request remains unanswered: almost always a firewall, proxy, or routing issue (packets are being dropped).

• #11001 "Host not found" – the server name cannot be resolved to an IP address: name resolution (DNS).

Work through the following checklist in order:

1. Is the service running? On the server, check the entry Password Depot Enterprise Server 19 (service name PD_Service_19) in the Windows services and start it if necessary. Cross-check: log on directly on the server using the address 127.0.0.1 or localhost – these addresses always work. If the local logon succeeds, the cause lies in the network or the firewall.

2. Does the port match the main version? Each main version of the Enterprise Server uses its own default port – version 19: 25019, version 18: 25018. Check the port number in the client's login dialog, especially after a migration. Note that the Windows client and the Enterprise Server must be the same main version. (REST server/Web Client: default port 8714.)

3. Check the firewall on both sides: Allow inbound and outbound rules for TCP and UDP – on the server for pd_service.exe and pd_admin.exe as well as explicitly for port 25019, on the client for PasswordDepot.exe and pdUpdater.exe. For error 10060, additionally check proxies, VPN routes, and port forwarding between client and server. Step-by-step instructions are provided in the firewall article (see "Related topics").

4. Check DNS (especially for 11001): As a test, connect using the server's IP address instead of its name (e.g. 192.168.1.10 instead of server.company.local). If that works, fix the name resolution. In addition, in the client under Edit → Options → Network, set the Internet Protocol version to a fixed value – IPv4 or IPv6 instead of "Auto".

5. Timed out or refused? Use the code to narrow things down: "Connection Refused" (10061) → back to steps 1–2 (service/port). "Timed Out" (10060) → step 3 (firewall/network path).

Note: Certificate or TLS warnings at logon are not socket errors and are covered in a separate article (see "Related topics"). As of version 18, SSL/TLS encryption is permanently enabled; divergent "SSL settings" on the client or server – as in older versions – are therefore no longer a possible cause.

Related topics:

• Which firewall settings are required on the Enterprise Server & Windows client?

• Certificate warning when logging on to the Enterprise Server

• How do I migrate the Enterprise Server to version 19?