AECOtools for IT departments

Jump to: Installation & file locations · Updates · Network endpoints · Microsoft authentication · Licensing & grace periods · Security & signing · Data & privacy · Troubleshooting · Report Issue

Installation and file locations

AECOtools installs from a single signed MSI (per-machine scope, admin rights required once). Everything after that — tool packages, updates, settings, logs — lives per user under the user profile and needs no admin rights.

Silent install for deployment tooling (Intune, SCCM, PDQ):

msiexec /i "AECOtools.msi" /qn /norestart

Installed by the MSI (per machine)

Add-in identifiers, if you inventory them: AddInId D8A36CC4-0C84-4D99-A1F0-2BF0F2D4A7A1, VendorId AECO.

Written per user at runtime

How updates work

• At every Revit start the loader checks a version manifest at https://aecotechcontent01.blob.core.windows.net/aecotools-public/stable/manifest.json and downloads any changed files. Downloads are verified against SHA-256 hashes in the manifest, and cached files are re-verified at startup.
• Offline or blocked? The cached package is used and Revit starts normally — the check has a 15-second stall timeout and the shipped default is continue with cached package on update failure. The very first start after install works offline from the ProgramData seed.
• Updates are per user and need no admin rights. The MSI never needs re-running for tool updates — only for onboarding a new machine.
• The loader keeps the active and previous package versions, never downgrades on its own, and loader self-updates are staged in the background and applied at the next start.
• If AECOtech ever needs to roll the fleet back, the rollback ships as a new higher version — so it flows through the same mechanism with nothing required from users or IT.

Network endpoints to allow

All HTTPS on port 443. The clients use the Windows default proxy settings; there is no custom proxy configuration.

Microsoft authentication

• Sign-in happens in the user's default browser, not inside Revit: AECOtools opens licence.aecotech.com.au, which runs a standard OIDC authorisation-code + PKCE flow against Microsoft Entra. Revit polls the licensing API until sign-in completes.
• The requested scopes are openid profile email only — basic identity. No Microsoft Graph scopes, no mailbox, files or directory access, nothing application-level in your tenant.
• Works with your existing conditional access and MFA policies, because it's an ordinary browser sign-in.
• If your tenant requires admin consent for third-party apps, a tenant admin can pre-approve AECOtools for the whole organisation in one click:
  https://login.microsoftonline.com/organizations/adminconsent?client_id=4fb93193-4741-4db5-8a95-9cbdff14f328
• Licensing is domain-based: the signed-in email's domain maps to your company's licence tenant, and seats assign automatically up to your seat count.

Licensing and grace periods

Security and code signing

• Everything we ship is Authenticode-signed — the MSI and every AECOtech binary — with a Certum (Asseco) certificate: CN=Joseph Banks, O=AECOtech pty ltd, SHA-256 file digests, timestamped against DigiCert so signatures outlive certificate renewal.
• Application control (ThreatLocker, AppLocker, WDAC, Airlock): tool packages and AECOWebHost.exe run from %LOCALAPPDATA%\AECOtools\, so hash-based or path-based rules will fight the update mechanism. Allow by publisher certificate instead — one rule covers every release. File hashes change with every update by design.
• Browser components: embedded panels use Microsoft Edge WebView2. Revit 2027 uses Revit's own WebView2; Revit 2024 ships its own; Revit 2025 hosts it in a separate signed process (AECOWebHost.exe) to avoid a known Revit 2025 conflict.
• Runtimes: Revit 2024 runs on .NET Framework 4.8, 2025–2026 on .NET 8, 2027 on .NET 10 — matching each Revit version's own runtime. The standalone AECOTransmit app needs the .NET 8 Desktop Runtime; AECOtools offers the official Microsoft download if it's missing.
• No telemetry. There is no analytics or telemetry SDK in the product. The only traffic is the endpoints listed above: licence checks, update downloads, and the cloud features your users invoke.

Data and privacy

• Sent to the licensing service: the signed-in name and work email, Windows user and machine name, and an install identifier. The machine fingerprint is a SHA-256 hash — raw hardware identifiers never leave the machine. This is what powers seat and device management in your portal.
• Stored locally: the licence session cache (tokens and lease dates) in the user's profile, protected by the user's NTFS permissions; logs under %LOCALAPPDATA%\AECOtools\logs\, auto-pruned after 30 days or 200 MB.
• Nothing is uploaded automatically — including crash and issue reports (see below).
• Model data stays in your models: AECOtools tools operate inside Revit on documents your users already have open. Cloud features (AECOtrack, ACC tools) only move data when a user explicitly invokes them.

Troubleshooting for helpdesk

A user can't sign in

1. Sign-in opens in the default browser — check the browser actually opened and can reach licence.aecotech.com.au and login.microsoftonline.com (proxy and web-filter rules are the usual culprit).
2. If Microsoft shows "Approval required", your tenant requires admin consent — use the one-click admin consent link in Microsoft authentication above.
3. Conditional access blocks show Microsoft's own error page with a correlation ID — treat like any other app sign-in block in your tenant.
4. To force a completely fresh sign-in, close Revit and delete %LOCALAPPDATA%\AECOtools\runtime\license\license-session.json, then start Revit and sign in again.
5. Device-limit errors no longer happen — a third device automatically signs out the oldest one.

AECOtools doesn't load / no ribbon tab

1. Check your endpoint security first: if DLLs under %LOCALAPPDATA%\AECOtools\ are being blocked, add a publisher-certificate allow rule (see Security). This is the single most common cause in managed environments.
2. Check the loader log: %LOCALAPPDATA%\AECOtools\logs\loader-<year>.log (and bootstrap-<year>.log). The last lines name the failure.
3. Confirm the .addin file exists for that Revit year (locations in Installation — note 2027's different path).
4. Holding Shift during Revit startup offers to start without AECOtools — useful to prove whether an issue is AECOtools-related at all, and users can disable it for a session themselves, no admin needed.

A tool button says it isn't initialised / does nothing

1. This means the ribbon stub is present but its tool package didn't load — usually an interrupted first download on a filtered network.
2. On the AECOtools ribbon: Support panel ▸ Licensing ▸ Update to Latest, then Reload Runtime (or just restart Revit).
3. Still failing: check the session log (newest file in %LOCALAPPDATA%\AECOtools\logs\sessions\) and the blob endpoint in Network endpoints is reachable.

Revit starts slowly since installing

The update check runs at startup with a 15-second stall timeout. On a healthy network it's sub-second; if startup gained ~15 seconds, something is black-holing aecotechcontent01.blob.core.windows.net (dropping packets rather than refusing). Allow the host or let it fail fast, and startup returns to normal — the cached package is used either way.

The Report Issue button

On the AECOtools ribbon: Support panel ▸ Licensing pulldown ▸ Report Issue. It's designed so your users can hand AECOtech a complete diagnostic without IT having to gather anything:

• It builds a zip (capped at 10 MB) in Documents\AECOtools Issue Reports containing the AECOtools session logs and relevant Revit journals, plus a readable BlackBox-diagnosis.html summary of what the journal shows.
• Credentials and secrets are scrubbed from the logs, and the licence cache folder is excluded entirely.
• Nothing is uploaded. It opens a pre-addressed email to info@aecotech.com.au (Outlook, an .eml draft, or mailto) with the zip attached — the user sees exactly what's being sent and sends it themselves. If attachments are policy- restricted, the zip is sitting in their Documents folder for whatever channel you prefer.