Add installer log guidance — PingCastle Enterprise 4.0

[JoeDibley]

Summary

• Add "Collecting Installer Logs" subsection to enterprisetroubleshooting.md (4.0) covering the /l*v verbose installer log flag
• Add :::note deep links to the new section in both install tabs (Production and Test/POC) in enterpriseinstall.md (4.0)
• Document a known upgrade issue in enterpriseupgrade.md (4.0): the installer sometimes fails to detect the existing installation directory during an in-place upgrade, with the INSTALLFOLDER command-line workaround

Scope: 4.0 only — 3.5 has no troubleshooting page to link to.

Test plan

• Anchor link validated by pre-commit hook
• Dale lint pass on new content — no violations
• Confirm note renders correctly in both tabs and deep link scrolls to section (DOCS_PRODUCT=pingcastle npm run start)

🤖 Generated with Claude Code

[github-actions]

Auto-Fix Summary

7 issues fixed, 6 skipped across 3 files

Category	Fixes
Dale: misplaced-modifiers	2
Dale: passive-voice	2
Dale: wordiness	3

Skipped (needs manual review)	Reason
docs/pingcastle/4.0/enterprisetroubleshooting.md:189 — Netwrix.OxfordComma	False positive. The sentence 'If Entra ID scanning isn't available, Enterprise and CloudAPI aren't integrated correctly.' is not a series of three or more items — it is a subordinate clause followed by a main clause with a compound subject ('Enterprise and CloudAPI'). The rule regex '\w+,\s+\w+\s+and\b' matches the clause boundary comma. Adding an Oxford comma would be grammatically incorrect, and rewording solely to evade the regex would change the author's phrasing without improving clarity.
docs/pingcastle/4.0/enterprisetroubleshooting.md:99 — Dale: positional-references	"The last error relates to the missing update KB2533623" points at the preceding screenshot; no anchor or caption exists to reference instead, and naming a specific error could misidentify which image is meant
docs/pingcastle/4.0/enterprisetroubleshooting.md:155 — Dale: passive-voice	"TCP/IP connectivity enabled on SQL Server" and "Firewall configured to allow remote connections" are requirement fragments describing required states, not passive clauses; rewriting them would change the list's established form
docs/pingcastle/4.0/enterprisetroubleshooting.md:158 — Dale: xy-slop	"The application pool identity needs these permissions, not your user account" is positive-then-negative contrast that carries the actual warning; the rule targets the "x is not y, x is z" order
docs/pingcastle/4.0/enterpriseupgrade.md:27 — Dale: idioms	"run the new installer on top of your existing 3.5.1 installation" is established technical phrasing for in-place upgrades; literal alternatives read less clearly
docs/pingcastle/4.0/enterpriseinstall.md:41 — Dale: idioms	"The installer wizard walks you through..." is standard, widely understood documentation phrasing rather than a culturally specific expression

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

15 issues fixed, 16 skipped across 7 files

Category	Fixes
Dale: passive-voice	6
Dale: positional-references	2
Dale: wordiness	6
Dale: xy-slop	1

Skipped (needs manual review)	Reason
docs/pingcastle/4.0/enterprisetroubleshooting.md:173 — Netwrix.OxfordComma	False positive. The sentence is "If Entra ID scanning isn't available, Enterprise and CloudAPI aren't integrated correctly." The comma marks the end of a subordinate clause, and "Enterprise and CloudAPI" is a two-item subject — not a series of three or more items. The rule is a bare regex (\w+,\s+\w+\s+and\b) with no list detection. Adding a comma before "and" would be grammatically incorrect.
docs/pingcastle/4.0/enterprisesilentinstall.md:53 — Dale: passive-voice	Passive fragments in the MSI property reference tables ("Only used when...", "Required when...", "Auto-generated if empty", "Appended to the built connection string", and similar cells throughout the file) are conventional terse reference-table descriptors. Rewriting every cell to active voice would churn the whole reference section for no clarity gain and risk changing property semantics.
docs/pingcastle/4.0/enterprisesilentinstall.md:14 — Dale: undefined-acronyms	UAC is standard Windows administration terminology for this sysadmin audience; the rule excludes well-known IT industry acronyms.
docs/pingcastle/4.0/enterpriseinstall.md:122 — Dale: undefined-acronyms	"proof-of-concept" is already spelled out in prose earlier in the same tab (line 102), so the later POC usage follows define-on-first-use; POC is also general business terminology, not product-specific.
docs/pingcastle/4.0/enterpriseinstall.md:94 — Dale: idioms	"free up ports 80 and 443" is standard technical usage rather than a culturally specific idiom.
docs/pingcastle/4.0/enterprisetroubleshooting.md:142 — Dale: xy-slop	"The application pool identity needs these permissions, not your user account" corrects a specific and common misconception; removing the contrast would drop information the reader needs.
docs/pingcastle/4.0/enterprisetroubleshooting.md:83 — Dale: positional-references	"The last error" refers to the last screenshot in the preceding image sequence, which has no heading or anchor to link to; no rewrite preserves the reference unambiguously.
docs/pingcastle/4.0/enterprisetroubleshooting.md:178 — Dale: idioms	"out of sync" is established technical jargon for service state mismatch, not a culturally specific expression.
docs/pingcastle/4.0/enterprisetroubleshooting.md:208 — Dale: wordiness	"at the time of the failure" is mildly wordy, but the sentence also carries the distinction between a message box and a log file; a tightening rewrite risked blurring that and the gain was marginal.
docs/pingcastle/4.0/enterpriseupgrade.md:27 — Dale: idioms	"run the new installer on top of your existing 3.5.1 installation" is conventional phrasing for an in-place upgrade; a literal replacement would read less clearly.
docs/pingcastle/4.0/enterpriseupgrade.md:13 — Dale: wordiness	"Check the installed version by clicking..." is a mildly indirect procedure phrasing, but it is already concise and rewriting it as an imperative step would restructure content outside the scope of a style fix.
docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:20 — Dale: positional-references	"Everything to the right" describes the spatial layout of the chart in the screenshot, not a cross-reference to other page content, so the spatial word is accurate and necessary.
docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:38 — Dale: wordiness	"The same holds for the opposite case" is vague, but the intended symmetric case (end date with no start date) is not stated anywhere, so spelling it out would mean inventing behavior rather than editing for style.
docs/pingcastle/4.0/enterpriseuser-entities.md:28 — Dale: wordiness	"provides an ergonomic view to reorganize the various entities that may compose your company" is wordy and marketing-flavored, but condensing it risks changing what the view actually does; needs an author with product knowledge.
docs/pingcastle/4.0/enterpriseuser-entities.md:6 — Dale: wordiness	"lets you set up the tool completely" is imprecise, but any tightening changes the claimed scope of the Configuration view.
docs/pingcastle/4.0/enterpriseuser-entities.md:30 — Dale: wordiness	"Example to show how to reorganize entities:" is awkward, but it serves as a caption for the following screenshot and shorter rewrites read as an instruction instead of a caption.

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

22 issues fixed, 13 skipped across 8 files

Category	Fixes
Dale: passive-voice	16
Dale: undefined-acronyms	1
Dale: wordiness	5

Skipped (needs manual review)	Reason
docs/pingcastle/4.0/enterprisetroubleshooting.md:173 — Netwrix.OxfordComma	False positive. The sentence is 'If Entra ID scanning isn't available, Enterprise and CloudAPI aren't integrated correctly.' The comma marks the end of a subordinate clause, and 'Enterprise and CloudAPI' is a two-item compound subject — not a series of three or more items. The rule is a crude regex (\w+,\s+\w+\s+and\b) that matches any comma followed by 'X and'. Adding a comma before 'and' would be grammatically incorrect, and rewording only to evade the regex would weaken the symptom-first troubleshooting phrasing.
docs/pingcastle/4.0/enterpriseauthsetup.md:232 — Dale: wordiness	'Failure to properly secure this configuration allows authentication bypass' — nominalized, but every concise rewrite changes who can bypass authentication; security meaning too easy to alter
docs/pingcastle/4.0/enterpriseauthsetup.md:359 — Dale: undefined-acronyms	CRL and OCSP are standard PKI acronyms the sysadmin audience knows; the rule's exclusion list covers well-known IT standards
docs/pingcastle/4.0/enterprisesilentinstall.md:14 — Dale: undefined-acronyms	UAC is a well-known Windows platform acronym, excluded by the rule
docs/pingcastle/4.0/enterprisesilentinstall.md:54 — Dale: passive-voice	'Appended to the built connection string' — terse Purpose-column fragment; an active rewrite with an explicit actor breaks the column's phrase style without clarifying
docs/pingcastle/4.0/enterprisesilentinstall.md:76 — Dale: passive-voice	'SID of the Windows group granted general access' — 'granted' reads as an adjectival modifier inside a noun phrase, not a passive clause
docs/pingcastle/4.0/enterprisesilentinstall.md:183 — Dale: positional-references	'Edit the variables at the top' refers to position within the adjacent code snippet, not to other page content
docs/pingcastle/4.0/enterprisesupportlogs.md:31 — Dale: undefined-acronyms	MSI is a well-known Windows Installer acronym for this audience, and it's spelled out on the linked silent-install page
docs/pingcastle/4.0/enterprisesupportlogs.md:38 — Dale: xy-slop	'needs write access to the path, not just the account that launched ...' — both clauses carry distinct technical information rather than a rhetorical negative-positive flourish
docs/pingcastle/4.0/enterprisetroubleshooting.md:83 — Dale: positional-references	'The last error' refers to the final screenshot in the preceding image sequence; no heading anchor exists to link to instead
docs/pingcastle/4.0/enterprisetroubleshooting.md:142 — Dale: xy-slop	'The application pool identity needs these permissions, not your user account' — a genuine, load-bearing contrast readers act on
docs/pingcastle/4.0/enterprisetroubleshooting.md:173 — Dale: passive-voice	'aren't integrated correctly' is a stative/adjectival use describing a condition, and no agent is knowable at that point in the diagnosis
docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:20 — Dale: positional-references	'Everything to the right' describes a region of the chart image, not a cross-reference to other content

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

16 issues fixed, 20 skipped across 8 files

Category	Fixes
Dale: idioms	1
Dale: misplaced-modifiers	2
Dale: passive-voice	11
Dale: positional-references	1
Dale: wordiness	1

Skipped (needs manual review)	Reason
docs/pingcastle/4.0/enterprisetroubleshooting.md:173 — Netwrix.OxfordComma	False positive. The sentence is 'If Entra ID scanning isn't available, Enterprise and CloudAPI aren't integrated correctly.' — a conditional clause followed by a main clause with a two-item compound subject, not a series of three or more items. The rule's regex ('\w+,\s+\w+\s+and\b') matches the comma that separates the clauses. Adding a comma before 'and' would be grammatically incorrect, and rewording correct prose solely to dodge a misfiring warning-level rule would add noise without improving the text.
docs/pingcastle/4.0/enterpriseauthsetup.md:359 — Dale: undefined-acronyms	CRL and OCSP are well-known PKI industry standards that the sysadmin audience knows; the rule explicitly excludes standard industry acronyms
docs/pingcastle/4.0/enterpriseauthsetup.md:367 — Dale: undefined-acronyms	UPN is a standard Active Directory term in the rule's excluded well-known set
docs/pingcastle/4.0/enterpriseauthsetup.md:316 — Dale: undefined-acronyms	'IdP Metadata' is a literal UI field label on the SAML settings screen, not body-prose use of an acronym
docs/pingcastle/4.0/enterpriseauthsetup.md:28 — Dale: passive-voice	'a username and password stored in the PingCastle Enterprise database' is a noun-phrase modifier; rewriting to active would add words without improving clarity
docs/pingcastle/4.0/enterpriseinstall.md:44 — Dale: idioms	'walks you through' is standard, widely understood documentation phrasing; every literal replacement is equally figurative
docs/pingcastle/4.0/enterpriseinstall.md:122 — Dale: undefined-acronyms	POC is a common business abbreviation, not product-specific, and 'proof-of-concept' already appears in full earlier on the page
docs/pingcastle/4.0/enterpriseinstall.md:94 — Dale: idioms	'free up ports 80 and 443' is standard technical phrasing rather than a culturally specific expression
docs/pingcastle/4.0/enterprisesilentinstall.md:183 — Dale: positional-references	'the variables at the top' refers to a position inside the adjacent code block, not to other page content, so 'the following' or an anchor doesn't apply
docs/pingcastle/4.0/enterprisesilentinstall.md:86 — Dale: passive-voice	'Label shown on the sign-in page' is a noun-phrase table fragment; multiple valid rewrites and no clear improvement in meaning
docs/pingcastle/4.0/enterprisesupportlogs.md:39 — Dale: undefined-acronyms	MSI is a well-known Windows administration acronym for the sysadmin audience and is not product-specific
docs/pingcastle/4.0/enterprisesupportlogs.md:46 — Dale: xy-slop	'needs write access to the path, not just the account that launched...' is a substantive technical contrast, not the negative-positive rhetorical pattern the rule targets
docs/pingcastle/4.0/enterprisetroubleshooting.md:83 — Dale: positional-references	'The last error' is an ordinal reference to the final screenshot in the preceding list; there is no heading to anchor to and no unambiguous rewrite
docs/pingcastle/4.0/enterprisetroubleshooting.md:142 — Dale: xy-slop	'The application pool identity needs these permissions, not your user account' contrasts the correct identity with a common misconfiguration; the contrast carries real information
docs/pingcastle/4.0/enterprisetroubleshooting.md:140 — Dale: passive-voice	'Firewall configured to allow remote connections' is a requirements-list fragment; an active rewrite would require restructuring the whole list
docs/pingcastle/4.0/enterprisetroubleshooting.md:43 — Dale: misplaced-modifiers	'to diagnose the issue or attach to a support case' has a parallelism problem, but it is a grammar slip no Dale rule covers cleanly
docs/pingcastle/4.0/enterprisetroubleshooting.md:178 — Dale: idioms	'out of sync' is established technical vocabulary rather than a culturally specific idiom
docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:26 — Dale: wordiness	Sentence mixes third person ('an administrator') and second person ('your perimeter'); a concise rewrite would require choosing one, which changes meaning
docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:38 — Dale: wordiness	'The same holds for the opposite case' is vague, but the intended case is ambiguous and any expansion would assert behavior not stated in the source
docs/pingcastle/4.0/enterpriseuser-entities.md:18 — Dale: misplaced-modifiers	'meaning these administrators operate on defined domains' is a loose sentence-level modifier whose intended scope is clear enough; rewrites risk changing meaning

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/pingcastle/4.0/enterpriseauthsetup.md

• Completeness — Line 16: the note was trimmed to "Most changes on these screens take effect within about 30 seconds, without a restart." "Most" tells the reader that exceptions exist, but the page no longer says which settings are exceptions or where to find them, and no other 4.0 page carries that list (enterprisesettings-logging.md line 10 states the opposite — that logging settings need no restart). Suggested fix: either keep a short pointer — "Most changes on these screens take effect within about 30 seconds. A few settings require a restart; the setting's description on the Settings screen notes when one is needed." — or move the removed restart list to enterprisesettings.md and link to it from here.
• Clarity — Line 378: "Ensure the user account login matches one of the certificate mapping identifiers." "Certificate mapping identifiers" isn't a term used anywhere else; the reader has to guess it means the numbered list under Certificate Mapping at line 363. Suggested fix: "Ensure the user account login matches one of the identifiers listed under Certificate Mapping."

docs/pingcastle/4.0/enterpriseinstall.md

• Structure — Lines 40–42 and 135–137: the "Having trouble installing? See [Installer Logs]..." note appears immediately before the procedure, so the reader meets a troubleshooting pointer before trying anything. The question-and-answer phrasing also reads conversationally against the neutral tone used elsewhere on the page. Suggested fix: move the note to the end of each Step 2 procedure and reword as a conditional statement — "If the installation fails, capture a verbose install log. See Installer Logs."

docs/pingcastle/4.0/enterprisesilentinstall.md

• Clarity — Line 6: this page calls the installer PingCastle-Enterprise-Installer-<version>.exe, but enterpriseinstall.md calls it PingCastleEnterpriseInstaller.exe throughout (prerequisites, Step 2 headings, and the SQL section), and enterpriseupgrade.md uses a third form, pingcastle-enterprise-installer.exe. A reader who downloads the file named on the installation page won't be sure this page describes the same binary. Suggested fix: pick one form for 4.0 and use it in all three files; if the shipped filename really does include the version, update enterpriseinstall.md and enterpriseupgrade.md to match rather than leaving three spellings.
• Clarity — Lines 54–55: USE_ENCRYPTION and TRUST_SERVER_CERTIFICATE say "Default Encrypt=True;" and then "Omit this property to set it to False." A default is what you get when you omit the property, so the two sentences contradict each other, and it's unclear what value to pass to turn encryption off. Suggested fix: state the behavior explicitly — "Pass USE_ENCRYPTION=Encrypt=True; to append encryption to the connection string. Omit the property to connect without it." — and say what the installer does when the property is absent.
• Clarity — Lines 47–56, 74–77, 112–118: the Purpose column holds allowed values for several rows (CONNECTIONSTRINGWAY | AUTO | MANUAL) and a description for others (DATABASE_SERVER | SQL Server instance). Scanning the table, the reader can't tell which column to read for valid input. Suggested fix: add a Values column, or move the value list into Notes and keep Purpose descriptive for every row.
• Completeness — Lines 114 and 163: SCHEDULER_ACCOUNT_CHOICE is documented as "SAME_AS_APPPOOL | CUSTOM | ..." and GRAPH_CERT_STORE_LOCATION as "CurrentUser | ...". The ellipsis tells the reader values exist that the page won't name, which is a dead end in a scripted install where the value must be exact. Suggested fix: list the remaining accepted values, or drop the ellipsis and state that these are the only values supported for silent installs.
• Completeness — Line 41: SKIP_PREREQUISITE_CHECK is the only entry with no value syntax, while every other property in the table shows one (SERIALNUMBERPROPERTY="<key>"). The reader can't tell whether to pass SKIP_PREREQUISITE_CHECK, =1, or =True. Suggested fix: show the exact form, for example SKIP_PREREQUISITE_CHECK=1, and note what the installer does if a prerequisite is actually missing.
• Completeness — Lines 6 and 187: the page has no prerequisites, and the Basic Installation example says the installer "creates the database locally," which conflicts with enterpriseinstall.md, where installing SQL Server is Step 1 and a prerequisite. A reader scripting a fresh server will run the basic example and fail with no local SQL instance. Suggested fix: add a short "Before you begin" section after the intro that points to Requirements and states that SQL Server (or SQL Express) must already be present when DB_SERVER_TYPE=LOCAL.
• Structure — Lines 12–14: items 1 and 2 describe what the wrapper does in sequence, but item 3, "Requires elevation," is a condition that applies before step 1, not a third step. Suggested fix: move the elevation requirement into the sentence introducing the list, or into a :::note after it.

docs/pingcastle/4.0/enterprisesupportlogs.md

• Clarity — Line 46: "msiexec forwards the log path unchanged from the wrapper" reverses the actors — the wrapper forwards the path to msiexec. As written, the reader has to re-parse the sentence to work out which process needs write access. Suggested fix: "The wrapper passes the log path to msiexec unchanged, so the elevated process running the install needs write access to that path — not just the account that launched PingCastle-Enterprise-Installer-<version>.exe."
• Completeness — Line 9: the page opens with "Use this page to gather logs before opening a support ticket," but never says where to send the collected logs or how to open the ticket. Suggested fix: close the page with a link to Netwrix support, so the reader can finish the task the introduction set up.

docs/pingcastle/4.0/enterprisetroubleshooting.md

• Structure — Lines 200–228: "Diagnosing a Failed Installation with Verbose Logging" sits in Common Errors and Solutions, which line 43 introduces as "common errors, their causes, and how to fix them." This entry is a diagnostic procedure with no error or symptom, so a reader scanning the collapsed summaries for their symptom will skip past it. Suggested fix: promote it to its own ### section after Common Errors and Solutions, or move the custom-action list to enterprisesupportlogs.md under Installer Logs and leave a link here.
• Clarity — Line 224: "See Installer Fails Before Setup Runs." points to another collapsed <details> block, which is bold text rather than a link and is hidden until the reader expands it. Suggested fix: "See the Installer Fails Before Setup Runs entry earlier in this section, and expand it for the list of symptoms."
• Structure — Lines 10–14: after the move, Viewing Application Logs and Errors is one sentence plus a tip that redirects elsewhere, so the heading promises content the section no longer has. Suggested fix: fold the pointer into the Troubleshooting intro, or retitle the section — "Where to find logs" — so the heading matches what's there.

docs/pingcastle/4.0/enterpriseupgrade.md

• Completeness — Line 30: the known issue tells the reader to use INSTALLFOLDER, but the new silent installation page documents CUSTOM_INSTALL_PATH="<dir>" as the property that sets the install directory and never mentions INSTALLFOLDER. A reader who checks both pages can't tell whether these are two names for one thing or two different properties. Suggested fix: confirm which property the 4.0 installer honors for an upgrade, use that name in both places, and add INSTALLFOLDER to the Core Install Switches table in enterprisesilentinstall.md if it's separate from CUSTOM_INSTALL_PATH.
• Clarity — Line 33: the command uses pingcastle-enterprise-installer.exe, while lines 27, 41, and 42 of this same page use PingCastleEnterpriseInstaller.exe. The reader can't tell whether the lowercase form is a different file. Suggested fix: use the same filename as the surrounding steps, and quote the log path — PingCastleEnterpriseInstaller.exe INSTALLFOLDER="D:\PingCastleEnterprise\" /l*v "C:\Temp\upgrade.log" — since upgrade.log writes to the elevated process's working directory, which is the pitfall enterprisesupportlogs.md line 46 warns about.

docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md

• Structure — Lines 4–6: the H1 is followed immediately by ## Action plans management with no overview. On the old page this content had the Configuration-view introduction above it; as a standalone page, the reader arrives with no statement of what action plans and exceptions are or when to use them. Suggested fix: add one or two sentences under the H1 explaining that action plans schedule remediation work and exceptions suppress rules that don't apply to your environment.
• Clarity — Lines 8 and 26: "This part lets an administrator..." referred to a section of the entities page; on a standalone page "this part" has nothing to point back to. Suggested fix: name the subject — "Action plans let an administrator configure a remediation schedule that reports then display." and "Exceptions let an administrator adapt PingCastle Enterprise to the company's specific context."
• Clarity — Line 16: "You can act on it directly in the domain details where the rules appear" — "it" has no antecedent; the nearest candidates are "a remediation schedule" and "reports." Suggested fix: "You can create an action plan directly from the domain details page, where the rules appear."
• Completeness — Lines 6–22: the action plans section describes what an action plan is and what the chart shows, but never gives the steps to create one, so a reader on this page can't complete the task the heading names. Suggested fix: add a short numbered procedure for creating an action plan from the domain details page, or link to the page that has it.
• Structure — Lines 30, 40, 63, 67: Rule exceptions, Excluding specific findings with wildcards, Migration, and Bulk actions are bold pseudo-headings rather than ### headings, so they don't appear in the page TOC and can't be linked to. The wildcard block in particular is substantial new guidance that other pages will want to reference. Suggested fix: convert these four to ### headings under Exceptions management.
• Clarity — Lines 14, 18, 22, 28, 75, 81: the images carry machine-generated French alt text ("Une image contenant texte Description générée automatiquement") or empty alt text. A screen reader user gets nothing usable, and the French string is visible if an image fails to load. Suggested fix: replace each with a short English description of what the screenshot shows, for example "The action plan configuration screen with a due date set."
• Completeness — Line 40: the new wildcard guidance is Enterprise-only, but prouser.md line 139 has an equivalent Exceptions management section with no wildcard coverage. Suggested fix: confirm whether the Rule Item to Handle wildcard behavior applies to PingCastle Pro, and if it does, add the same guidance there.

docs/pingcastle/4.0/enterpriseuser-entities.md

• Completeness — Line 4: the title and sidebar label narrowed to "Entities" and the action plans content moved out, but the page has no pointer to where it went. A reader who bookmarked this page for exceptions or action plans now finds them gone with no forwarding link. Suggested fix: add a line at the end of the page — "To manage action plans and exceptions for a domain or entity, see Action plans and exceptions."

Summary

24 editorial suggestions across 8 files. The highest-impact items are the three different spellings of the installer filename across enterprisesilentinstall.md, enterpriseinstall.md, and enterpriseupgrade.md; the INSTALLFOLDER vs. CUSTOM_INSTALL_PATH conflict between the upgrade and silent installation pages; and the contradictory USE_ENCRYPTION/TRUST_SERVER_CERTIFICATE defaults. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

2 issues fixed, 9 skipped across 8 files

Category	Fixes
OxfordComma (rewrite)	1
Dale: idioms	1

Skipped (needs manual review)	Reason

| docs/pingcastle/4.0/enterpriseauthsetup.md:59 — Dale: passive-voice | "should already be enabled" is passive, but every active rewrite either turns the author's hedge into an assertion about IIS defaults or abandons the Enabled/Disabled UI terminology — meaning would change. |
| docs/pingcastle/4.0/enterpriseauthsetup.md:28 — Dale: passive-voice | "a username and password stored in the PingCastle Enterprise database" is a reduced relative clause, not a full passive sentence; expanding it to active adds words without improving clarity. |
| docs/pingcastle/4.0/enterpriseauthsetup.md:232 — Dale: wordiness | "Failure to properly secure this configuration allows authentication bypass" could be tightened, but any rewrite risks weakening a security-critical danger callout. |
| docs/pingcastle/4.0/enterprisesilentinstall.md:14 — Dale: undefined-acronyms | UAC is a well-known Windows term for the Windows Server sysadmin audience this page targets; the rule excludes well-known industry standards. |
| docs/pingcastle/4.0/enterprisesilentinstall.md:183 — Dale: positional-references | "the variables at the top" locates a line within the PowerShell snippet itself, not a cross-reference to other page content. |
| docs/pingcastle/4.0/enterprisetroubleshooting.md:71 — Dale: positional-references | "The last error" refers to one of several preceding screenshots; without seeing the images there is no way to name the specific error, so an explicit reference can't be written. |
| docs/pingcastle/4.0/enterprisetroubleshooting.md:161 — Dale: passive-voice | "aren't integrated correctly" is a stative passive describing a condition with no identifiable actor; an active rewrite would invent a cause. |
| docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:20 — Dale: positional-references | "Everything to the right" describes the layout inside the chart image, not a spatial reference to other page content. |
| docs/pingcastle/4.0/enterpriseuser-actionplans-exceptions.md:26 — Dale: wordiness | "the company's specific context ... exceptions specific to your perimeter" is repetitive, but dropping either "specific" loses a distinction the author appears to intend. |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Code Review

No build-, routing-, or config-breaking problems in this PR. Verified:

• Sidebar (sidebars/pingcastle/4.0.js) — all doc IDs resolve to real files (enterprisesilentinstall, enterprisesupportlogs, enterpriseuser-actionplans-exceptions); no duplicate entries; the new Troubleshooting category's link: {type: 'doc', id: 'enterprisetroubleshooting'} is valid and the doc isn't double-listed as an item.
• Links and anchors — every relative link and fragment added in this PR resolves against a real heading (enterprisesupportlogs.md#installer-logs, enterprisetroubleshooting.md#common-errors-and-solutions, enterpriseinstall.md#remote-database-configuration, enterpriseauthsetup.md#authentication/#openid-connect, enterprisesettings-logging.md#downloading-logs, enterprisehttpssetup.md#configuring-https, enterpriseemailsetup.md#email, and the in-page #windows-authentication-properties / #saml-properties / #openid-connect-properties). Since onBrokenLinks/onBrokenAnchors throw, this matters — it's clean.
• Removed anchors — enterprisetroubleshooting.md#log-files and the enterpriseuser-entities.md action-plans/exceptions sections were deleted; no remaining inbound links to #log-files, #action-plans-management, or #exceptions-management anywhere in the repo. enterprisepostinstall.md's link to enterpriseuser-entities.md#entities still resolves.
• MDX safety — every <version>, <key>, <dir>, <poolname>, <path>, and <pwd> placeholder is inside inline code or a fenced block, so MDX won't parse them as JSX. Images image50–image56.webp moved to the new page all exist under static/images/pingcastle/enterpriseuser/.
• No workflow, products.js, docusaurus.config.js, or KB-script changes in this PR.

Issues in documented commands

These are command/technical correctness, not prose style:

1. enterpriseupgrade.md:33 — trailing backslash inside the quoted path will break argument parsing

pingcastle-enterprise-installer.exe INSTALLFOLDER="D:\PingCastleEnterprise\" /l*v upgrade.log

\" is an escaped quote under standard Windows CRT/CommandLineToArgvW parsing, so the value becomes D:\PingCastleEnterprise" /l*v upgrade.log rather than the intended path — and this page's own silent-install sibling says the wrapper "preserves quoting verbatim." The path has no spaces, so the quotes aren't needed at all. Suggest INSTALLFOLDER=D:\PingCastleEnterprise (no quotes, no trailing slash), and adjust the "Replace D:\PingCastleEnterprise\" line to match.

Also on that line: upgrade.log is a relative path. Per enterprisesupportlogs.md:44, the log is written by the elevated msiexec process, so a relative path resolves against that process's working directory rather than the user's — an absolute path (e.g. "C:\Temp\upgrade.log") is safer.

2. Three different names for the same installer binary across the PR

• enterpriseinstall.md / enterpriseupgrade.md body: PingCastleEnterpriseInstaller.exe
• enterpriseupgrade.md:33 (new): pingcastle-enterprise-installer.exe
• enterprisesilentinstall.md / enterprisesupportlogs.md (new): PingCastle-Enterprise-Installer-<version>.exe

At most one of these is the shipped filename. Readers copy-paste these, so they should be reconciled to whatever the 4.0 build actually produces.

3. enterprisesilentinstall.md:47-48 — self-contradictory default

USE_ENCRYPTION … Default Encrypt=True;. Omit this property to set it to False.

If omitting the property yields False, then False is the default. Same wording on TRUST_SERVER_CERTIFICATE. Presumably the intent is "the installer appends this when set; pass USE_ENCRYPTION=0 (or an empty value) to get Encrypt=False" — worth stating the concrete value to pass. Related: SKIP_PREREQUISITE_CHECK, SCHEDULER_ADD_TO_LOCAL_ADMINS, and SSL_FORCE_REBIND are listed without the value to assign (=1?), which a reader can't act on.

4. INSTALLFOLDER vs CUSTOM_INSTALL_PATH

enterprisesilentinstall.md:40 documents CUSTOM_INSTALL_PATH="<dir>" as the custom install directory property, while the new enterpriseupgrade.md workaround uses INSTALLFOLDER. Both may be real (INSTALLFOLDER is the stock WiX directory property), but if so the silent-install table should mention INSTALLFOLDER too; if not, one of the two commands is wrong.

5. Security nit — blanket "the log is scrubbed" claim (enterprisesupportlogs.md:51, repeated at enterprisetroubleshooting.md:219)

PingCastle Enterprise scrubs sensitive values, such as connection strings and keys, before writing them to the log.

A /l*v MSI log records public property values unless they're listed in MsiHiddenProperties, and the silent-install page only claims masking for OIDC_CLIENT_SECRET specifically. If the scrubbing isn't comprehensive, this sentence encourages users to ship logs containing SQL_PASSWORD, SMTPPASSWORD, GRAPH_CLIENT_SECRET, SSL_CERT_PASSWORD, and SERIALNUMBERPROPERTY to support. Worth confirming the MsiHiddenProperties coverage, and otherwise narrowing the claim to the properties that are actually masked (the "review the log before sharing it" advice that follows is good either way).

Content and style are out of scope here — the doc-review workflows cover those.

[HerbieSmith-Netwrix]

Wrong way around? Wrapper passes all log path details unchanged to the msiexec

[RichardHNetwrix]

I think this should be "PingCastleEnterpriseInstaller.exe CUSTOM_INSTALL_PATH="D:\PingCastleEnterprise" /l*v upgrade.log"