How to Fix Hikvision iVMS-4200 Employee Enrollment and Sync Failures

You added the employees in iVMS-4200 and they still cannot get through the door, or the client refuses to take them at all. The cause is usually in one of eight places, and you can check them in order in well under an hour. This guide covers the iVMS-4200 access control client (the AC client) with Hikvision's DS-K1T range of terminals and similar devices: what the errors say, what causes each one, and how to fix it.

It is written for whoever has been handed the system: an IT admin, a facilities manager or an HR administrator, not only an installer.

Symptoms: what you are seeing

Match your screen to the table. Each row points to the step that fixes it.

The client reports connection problems as an SDK error code. The wording below is the vendor's own and varies slightly between client versions, so search on the number in brackets:

HCNetSDK.dll[7]   Failed to connect to the device. The device is off-line, or connection timeout caused by network.
HCNetSDK.dll[1]   User name or password error.
HCNetSDK.dll[13]  Not authorized for this operation.
HCNetSDK.dll[10]  Timeout when receiving data from the device.
HCNetSDK.dll[5]   The number of connection with the device has exceeded the max limit.
HCNetSDK.dll[6]   Version mismatch. SDK version is not matching with the device.

HCNetSDK.dll[153] is the code for a locked-out user. If you see something that is not in this list, the number is still the part to search for.

How an employee gets from iVMS-4200 onto a terminal

It helps to know the route, because most "enrollment not working" calls stop at step 3 or step 4 below. Four things have to be true, in this order:

1. The terminal is added and online. Device Management, Device, Add, by IP address, with port 8000 (the default), the user name and the password.
2. The person exists with a credential. In the Person module the Person ID is the Employee ID the terminal will use. Add at least one credential: card, fingerprint, face or PIN.
3. The person is in an access group. Under Access Control → Authorization → Access Group, a group ties three things together: the people, the doors (access points) and a schedule template.
4. The group has been applied to the device. Select the group, click Apply All to Devices or Apply Changes to Devices, and read the Status column.

When you edit a person, for example a new card, fingerprint or face photo, iVMS-4200 shows an Access Group to Be Applied prompt in the corner of the client with Apply Now and Apply Later. If someone clicks Apply Later, the terminal keeps the old data until the group is applied. That is a common reason an updated employee still cannot get in.

Step 1: Confirm the terminal is online

1. Ping it. ping 192.168.1.64 with your terminal's address. No reply means look at power, the network cable, an IP conflict or a VLAN before touching software.

2. Check it has been activated. A new or factory-reset terminal answers on 192.0.0.64, user admin, port 8000, and must be activated (a password set) before anything else works. Do it with Hikvision's SADP tool or from the client's online device list, then move it to an address on your network.

3. Test port 8000 from the PC that runs iVMS-4200. In PowerShell:

   Test-NetConnection 192.168.1.64 -Port 8000
   

   TcpTestSucceeded : True means the path is open. False while the ping works points to a firewall or antivirus on the PC, a managed-switch or VLAN rule, or a terminal whose port was changed (the DS-K1T802 manual gives 2000 to 65535 as the valid range). iVMS-4200 must use the same number the terminal does.

4. Check the login. HCNetSDK.dll[1] is a wrong password. After several wrong attempts the terminal locks that user for about 30 minutes (HCNetSDK.dll[153]), and a reboot also clears it. Fix the saved password in Device Management before the client retries.

5. Look for too many connections. HCNetSDK.dll[5] means the terminal is already serving its maximum number of clients: another PC running iVMS-4200, HikCentral or a third-party integration.

6. Try without TLS. If adding fails only when Transmission Encryption (TLS) is ticked, untick it to test. The terminal has to support it, and with Certificate Verification on, the terminal's certificate must be copied into the client's certificate folder.

7. Arm the device. Under Tool → Device Arming Control, switch on Auto-Arming. Without it the client does not receive the terminal's events, and reading a card through the terminal's reader from the client needs an armed device.

For a branch or site on another network, do not port-forward 8000 to the internet. Use a VPN between the sites, or add the terminal by ISUP (formerly EHome, default port 7660) so the terminal connects out to your server.

Step 2: Read the apply status and find who failed

Do not guess which employees are missing. The client tells you.

1. Go to Access Control → Authorization → Access Group, select the group and look at the Status column. Click Applying Status and tick Display Failure Only to list just the failures.
2. Go to Person Management → Resource Statistics. In Overview on Device, choose the terminal and click Counting. Compare persons, faces, cards and fingerprints with the client's own numbers. A gap means those people are not on the terminal.
3. For one employee, use Access Control → Authorization → Search. Pick the device, add the person's name or the applying status, and you see which group the person belongs to and the state of each credential.

If a person shows as applied but still cannot pass, check the four usual suspects:

• The template. The group's schedule template must cover today's hours. The built-in All-Day Denied template never lets anyone through, and All-Day Authorized always does.
• The door. The group must list the terminal's door under Select Access Point.
• The validity period. Once a person's validity period ends, their credentials stop working. Use Extend on the person.
• A pending apply. Someone clicked Apply Later, or applied from another PC with Apply All to Devices and replaced your groups.

Re-apply only what failed: select the group and use Apply Changes to Devices.

Step 3: Fix duplicate employee IDs, cards and PINs

The client enforces uniqueness, and the rules from Hikvision's manual explain many "person skipped" surprises:

• The Person ID is the Employee ID on the terminal. It must be unique. Letters and numbers are supported.
• A card number can belong to only one person, and one person can hold up to five cards.
• PIN codes are 4 to 8 digits and cannot repeat. Generate creates a unique six-digit PIN.
• Import takes a CSV or Excel template, up to 2,000 persons at a time. Fields marked with an asterisk are required, and multiple cards are separated by a semicolon. If a person number already exists in the client, delete that record before importing it again.
• Get from Device skips any person whose card number or employee ID already exists in the client. It brings in up to 2,000 persons and 5,000 cards.

Two mistakes are worth ruling out first:

• Excel drops leading zeros. Employee ID 00417 becomes 417, which no longer matches the terminal. Format the column as text before you paste anything in.
• The printed card number is not always the number the reader sends. Cards often print one format and the reader outputs another. Read the number from the reader or the enrollment station instead of typing what is printed, and check that the Card No. Type in the enrollment station settings matches how your cards are numbered.

In Excel, Conditional Formatting → Highlight Cells Rules → Duplicate Values on the ID, card and PIN columns finds clashes in seconds.

Step 4: Enroll faces, fingerprints and cards correctly

Face photos

For photos you upload, Hikvision's manual says JPG or JPEG, smaller than 200 KB. Hikvision's how-to for its face terminals adds a resolution of at least 640 by 480 pixels, at least 60 pixels between the eyes, and a file of about 60 KB or more. Limits differ by model, so check your terminal's manual.

• Use Verify by Device. When you add or import a photo, tick it and the client checks whether a face terminal in the system can recognise the face before you apply it. The option appears only when the device supports it.
• Bulk import needs the person records first. Then import a ZIP of JPG files named Person ID_Name, with the ID exactly matching the imported record.
• Photo quality matters more than size. Use a front-facing, evenly lit head-and-shoulders shot with a plain background and no glasses glare. A cropped passport scan or a photo of a photo is a common cause of "accepted but never recognised".
• The photo may disappear after applying. With Save Pictures in Structure Data Format enabled, the client deletes the registered picture once the person is applied. That is expected.
• Collecting at the terminal (Add Face → Remote Collection) captures the face with the terminal's own camera, which is the camera that will recognise it later. If you collect through an enrollment station with Face Anti-Spoofing ticked, the liveness level (Low, Medium, High) can reject genuine faces in poor light. Drop a level to test.

Fingerprints

There are two collection modes. Local uses a USB recorder or enrollment station plugged into the PC. Remote uses the fingerprint sensor on the terminal itself.

• Prefer remote collection on the terminal that will read the finger later. A print taken on the door's own sensor usually matches better than one from a different USB recorder.
• For a DS-K1F800-F recorder, click Settings and pick the COM port the recorder shows under Windows Device Manager. If no COM port appears there, the driver is probably missing. Try another USB port or another PC.
• Enroll at least two fingers per person, so a cut or a plaster on one does not lock someone out.

Cards

• Enrollment stations such as the DS-K1F100-D8E and DS-K1F180-D8E ask for the Card Type: EM or Mifare. Pick the type you actually issue.
• A terminal reads only the frequency it was built for. Most Hikvision terminals come in EM and Mifare versions, so a Mifare card held to an EM-only terminal will never register.
• Reading a card through the terminal from the client (remote mode) needs an armed device, as in Step 1.

Step 5: Check terminal capacity

Every terminal has a hard ceiling for fingerprints, cards and faces, and a full terminal does not make room for the next person. The first symptom is usually that the last people you added never arrive. Manufacturer datasheet figures for a few DS-K1T models:

Check the datasheet for your exact model, because variants differ. To see where you stand, use Resource Statistics → Counting as in Step 2. Some terminals also show registered, remaining and total users on their own system-information screen.

If you are at the limit:

• Remove leavers. Delete the person in the client and check that the device count falls. If it does not, apply again.
• Do not put everyone on every terminal. An access group applies only the people it lists to the doors it lists, so a group per door or per department keeps each terminal within its limit.
• Move to a larger model where the site has simply outgrown the terminal. See the Hikvision range and tell us your headcount.

Step 6: Match the client and terminal firmware

HCNetSDK.dll[6] says the client's SDK version does not match the device. It typically follows a client update, or a newer terminal being added to an old client. Credential formats can also change between firmware generations, so an old terminal with a new client can fail to take faces or fingerprints.

• In Device Management, the Firmware Upgrade column shows Upgradeable when the client knows of a newer version for that device.
• Export before you upgrade. Under Person → Export, back up persons and photos. The Export button appears only if Export Person Information is enabled in the general parameters, and the exported photo file is encrypted with a key you set, so keep that key.
• Upgrade out of hours, on a stable network and power. Use firmware for your exact model and region from your supplier, not a file downloaded at random.

Step 7: Check the clock and the attendance rules

If people can open the door but never appear in attendance reports, the fault is not in enrollment.

• Clock. Tick Synchronize Time when you add a device, and use Tool → Batch Time Sync to set every terminal to the PC's time. Confirm the PC itself is on UAE time (GST, UTC+4).
• Attendance rules. In the Time and Attendance module, each person needs a shift schedule (department, person or temporary), and the client has to calculate the data, automatically or manually. Per Hikvision's manual, only access records made after the rules are configured are calculated, so earlier punches will not appear in the results.

Step 8: Isolate the fault and reset cleanly

If Steps 1 to 7 have not found it, isolate the fault:

• Add one test person on the terminal's own web page, if your model has one. If the terminal accepts a person there but not from iVMS-4200, the fault is in the client, the network path or a version mismatch. If it fails there too, the terminal is the problem: storage, firmware or hardware.
• Try another PC. Install the client, add the same terminal and apply one person. If it works, the fault is local to the first PC: firewall, antivirus or a USB driver.
• Then reset in this order: export your persons, apply again with Apply All to Devices out of hours, and only then take the terminal back to factory defaults (it returns to 192.0.0.64 and needs activating again), re-add it and re-apply.

Before you call anyone: what to collect

Five things let an engineer diagnose most of these remotely:

1. The exact error text, or a screenshot of the Status column with Display Failure Only ticked.
2. The terminal model and firmware version.
3. The iVMS-4200 version.
4. How many persons the client holds, and the terminal's count from Resource Statistics.
5. What changed just before it stopped: a new PC, a firmware update, a password change, a network or VLAN change, or an import.

If the person shows as applied and the terminal accepts them, but the door still does not open, the fault is downstream of the terminal. See access control door won't unlock. For a turnstile or barrier, see access control gate not working. If you are comparing platforms before you standardise, our ZKTeco vs. Suprema vs. Hikvision comparison covers where each one fits.

The menu paths, limits and file rules above come from Hikvision's iVMS-4200 AC Client User Manual and the terminal manuals. Menus differ slightly between client versions, so if a label is missing on your screen, look one level up.