Access Reader Credential Loading in Houston, TX 77095

You took over the building and nobody has the cardholder list

A 1980s and 1990s suburb like Copperfield has aged into second and third owners. Offices in the older strip centres off Highway 6 have changed tenants repeatedly, HOA boards have rotated, and somewhere in that history the installing company stopped answering the phone. What gets handed over is a panel in a closet, an unlabelled bundle of cable, a software licence on a computer that has since been retired, and a drawer of cards.

Six questions decide everything that follows. Which platform and controller is this? Is the software licensed, and is it still reachable? Does anyone hold an administrator login? How many cardholder records exist? When was the last change made? And is there a backup of the database anywhere at all?

Two warnings worth stating plainly before anybody touches anything. If the administrator password is genuinely lost, some platforms allow a documented recovery through the manufacturer with proof of ownership and some flatly do not — in which case the honest answer is replacing the controller while reusing the readers and the wiring, not a miracle. And whatever the temptation, do not factory-reset a panel to start clean. That takes the cardholder list and the event history with it, which is precisely the evidence you were hired to recover.

Working out what the cards actually are before ordering more

Ordering replacements requires three facts: the technology, the bit format and the facility code. The card face volunteers almost none of them.

• Start with the printing. A part number and any hot-stamped digits narrow the field considerably, and the slot punch and thickness hint at the era.
• Use a diagnostic reader to separate 125 kHz proximity from 13.56 MHz contactless. They look identical and behave nothing alike.
• Present a sample at a live reader and read the resulting entry in the software. Most platforms record an unrecognised credential along with the raw data the panel received, which is the fastest legitimate route to the format.
• Expect more than one answer. A site that bought cards in three separate years may be carrying three facility codes. That is perfectly workable if all three are configured in the panel, and genuinely painful if two of them collide.

The badges that still open doors and should not

This is the finding in almost every audit we run in 77095, and it is rarely dramatic. It is simply accumulation.

The method is reconciliation. Export the active cardholder list, line it up against the current payroll or tenant roster, and treat every unmatched record as a question to be answered rather than a row to be deleted. What typically surfaces: contractor badges issued during a build-out years ago, entries named only temp or spare 3, a master credential whose holder nobody can name, and in multi-tenant corridors a former tenant who still carries a working common-area card long after the suite was re-let.

Disable those records, do not erase them. A disabled record stops working instantly while the history attached to it survives, and that history is frequently the only way to reconstruct who was in a space on a particular evening. Deleting the row destroys the answer and keeps none of the security benefit.

It is worth noting what this exercise buys you. The advantage of credentials over keys is that access can be withdrawn without touching a single door — but that advantage only exists while somebody knows who holds what. An unreconciled system has quietly given up the one thing it was bought for.

A diagnostic order that finds the fault quickly

Work down this list rather than across it. Each step eliminates a whole class of cause, and it is much faster than swapping parts.

1. Does the reader react at all? No change in the indicator or tone on presentation points at reader power or the reader itself, not at the credential.
2. Does the software log anything? An event showing an unrecognised number means the credential and the wiring are fine and the problem is enrolment or format configuration.
3. A reaction at the door but no event? Look at the data conductors and the port’s format configuration on the panel.
4. Only certain cards fail? That is a format or facility-code mismatch affecting one batch, not a hardware fault.
5. Only one door fails? That reader, its cabling, or the access level attached to it.
6. Failures only at certain hours? A schedule or holiday table, not the credential.
7. Intermittent across the whole site? Look at supply voltage and panel communications before anything else.

Then the physical checks that catch the stubborn ones. Measure supply voltage at the reader under load rather than at the panel, because a twelve-volt reader at the end of a long run of thin conductor browns out only when it draws current. Bond the cable shield at the panel end only, never both. Confirm two readers are not mounted too close together, including back to back through a partition, which detunes both. And a proximity reader fixed to a steel frame needs the model intended for that mounting or it will read at half the distance it should.

The security issue hiding behind an outdoor reader

Older installations almost universally use a one-way, unencrypted protocol between the reader and the panel, carried in the clear on a pair of data conductors. It has been the industry default for decades and it works reliably. It also means that anything spliced into that pair behind the reader can capture every badge presented at the door and replay one later, without ever touching the software.

That matters most on an exterior door in a strip centre, where the reader is reachable from a public parking lot and nobody is watching the back of it. Three practical mitigations, in order of what they cost:

• Check that the reader reports tamper, and that the reader’s own fasteners are the security type rather than a common driver bit.
• Move the field termination inside the secure side of the opening so there is no accessible splice point outdoors.
• Where both the reader and the panel support it, move that link to the supervised, encrypted protocol built for this purpose. A tap then reads ciphertext and a cut line raises an alarm instead of passing unnoticed.

Be aware that the last option is a capability of the hardware at both ends, not a setting that can be switched on over old equipment. And remember the parallel exposure: unencrypted proximity credentials can themselves be copied at conversational distance, so on a perimeter door the card technology deserves the same scrutiny as the wire.

Choosing between cleaning up the old credentials and starting fresh

After the audit there is a genuine decision, and it is not always the expensive one.

Keep the existing credentials when the technology suits the doors it protects, the format and facility code are now documented, the unknown records are a manageable handful, and the controller still has capacity and manufacturer support.

Re-badge when the facility code cannot be established, when unencrypted proximity is protecting a perimeter entrance, when unknown records outnumber known ones, or when the property itself has changed hands and the previous population is simply unaccountable.

Where re-badging is right, it is phased rather than abrupt: the new credentials are loaded alongside the old, issued area by area with a published cut-off, and the old range is voided on an announced date. Nobody arrives on a Monday to find their badge dead.

How we run the audit

1. Inventory the readers, doors and controllers, and back up the database before a single change is made.
2. Establish the credential technology, format and facility code, and document all three.
3. Export the cardholder list and reconcile it against your roster.
4. Rebuild the level and schedule structure around roles, then remediate the orphaned records.
5. Hand over a runbook with the format, the codes, the structure, the backup location and a named owner.

What changes the scope

Door and reader count; how many cardholder records exist; whether the database is reachable and backed up; the controller’s age and support status; whether readers are being carried forward or replaced; whether a phased cut-over is needed; and whether the work has to happen outside business hours in an occupied suite. EVOTECH IT LLC is a licensed and insured low-voltage contractor serving Houston and the surrounding area for more than twenty years, and every audit begins with a free on-site estimate and an itemised written quote — never a figure over the phone.

Mistakes that make an audit worse

• Deleting records instead of disabling them, taking the history along with them.
• Resetting the controller to defaults in order to tidy it up.
• Ordering credentials against an assumed facility code.
• Leaving the administrator password written inside the panel door.
• Making changes before anybody took a backup.

If you have inherited a system nobody documented, do not start by pressing buttons on the panel. Call a licensed contractor and start with a backup and an inventory. EVOTECH is on (832) 359-2425.

Related services

Frequently asked questions