Access Reader Credential Loading in The Woodlands, TX 77381

One badge, two databases: the multi-tenant problem

In most multi-tenant office buildings and medical towers, the readers on the entrances, the garage gate, and the after-hours elevator belong to the landlord’s base-building system. The readers on your suite doors belong to you. The two systems share nothing.

That has practical consequences. Loading a card into your suite software does nothing at the lobby door, and only property management can add someone to the base-building system. After-hours elevator access, where readers in the cab limit which floors a badge can select, sits on management’s side as well.

Tenants are often handed building cards by management and then want the same card to open the suite. That works when two conditions hold: your suite reader reads the same card technology and data format, and your system is given the number each card carries. Management will usually share the card numbers of the badges they issued to your staff, or we read them ourselves with an enrollment reader. If the technologies do not match, the choice is between a second card and replacing the suite readers with models that read the building’s credential.

Prox, smart card, or both: finding out what the reader actually reads

125 kHz proximity

The older technology still common in campus buildings from the 1990s and 2000s. A prox card transmits a fixed number with no encryption, and it can be copied with inexpensive hardware. Loading is simple; security is weak.

13.56 MHz smart credentials

Encrypted cards such as the secure families sold by the major reader manufacturers. The reader must hold the keys for the credential’s configuration, so a secure card from another site or another vendor’s program will not read, even though it runs on the same frequency.

Multi-technology cards

These carry a prox chip and a smart chip in one card. Here is the trap: a reader that understands both usually reports the smart-chip number when both are present. If your database holds the prox number, the card is denied even though staff insist it is the same card. The two numbers match only if the cards were ordered that way.

Mobile credentials

Many current platforms can put a badge on a phone, read over Bluetooth or NFC. Loading one means sending the person an invitation from the system; each usually consumes a license, and the phone needs the app or wallet pass set up and the relevant radio turned on.

To identify what you have, we read the reader’s model label, watch its light and beep behavior, present a sample card to an enrollment reader, and check the controller’s event log, which on most systems records the raw bit length of each read.

How we load a credential so it works the first time

1. Confirm the person record: name, employee or badge ID, department, start date, and an end date for contractors and temporary staff, so their access lapses automatically.
2. Capture the card number. For a sequential box of cards we use the range from the order paperwork and verify one sample at a reader. For loose or inherited cards we present each one to an enrollment reader.
3. Confirm the format and facility code the controller accepts, whether that is the standard 26-bit layout or one of the longer corporate formats.
4. Assign an access level built from doors and a schedule. We assign by group rather than door by door, so the next hire in that department gets identical access in one step.
5. Push the change to the controllers and confirm each controller is online and has taken the update.
6. Test at every door the person should use, and at one door they should not. A clean denial proves the schedule is working, not only the card.
7. Record the issue: card number, date, and who issued it, so an audit months later has a trail.

Moving an office from prox cards to secure credentials without a lockout day

Plenty of offices in 77381 still run on prox cards installed when the building opened. A migration does not require a weekend of locked doors if it is sequenced.

1. Install readers that accept both the old prox cards and the new secure credential.
2. Load each person’s new credential while the old card stays active, so nobody is stranded mid-transition.
3. Set a firm cutover date after which prox numbers are disabled in the database.
4. Reconfigure the readers to accept only the secure credential. Skip this step and the prox side keeps reading, and the security gain is lost.

The connection between reader and controller matters too. Traditional Wiegand wiring sends card data unencrypted and cannot report a tampered or disconnected reader. OSDP, with Secure Channel enabled, encrypts that link and supervises the reader. When readers are being replaced anyway, it is the moment to decide.

During the overlap every person holds two credentials, so we confirm the controller’s credential capacity before loading, and we label records clearly so the old cards can be removed in one clean pass.

Taking access away is half the job

• Disable rather than delete. A disabled record keeps the audit history tied to the person’s name.
• Disable at the end of the last day, and collect the card. With prox cards, a returned card does not rule out a copy, which is one more argument for secure credentials.
• Disable a lost card immediately, before the replacement is issued, not after.
• Review quarterly. Export the active user list and compare it with the HR roster. Former staff, vendors who finished their project, and cards labeled only with a role are the usual findings.
• Replace shared cards. A card named for a cleaning crew or a front-desk role, passed between people, makes the log meaningless. Individual credentials fix that.

Where this work comes up in 77381

The ZIP mixes office and research buildings off Research Forest Drive with medical practices, private schools, churches, and the amenity buildings of residential associations. Each creates its own kind of loading work. Offices bring the landlord and suite split described above. Medical practices tend to separate clinical, records, and medication rooms into different access levels, so a single wrong group assignment is noticed quickly. Associations issuing resident fobs for pools and fitness rooms manage hundreds of credentials that change hands whenever a house sells, which makes naming each fob by address rather than by person the difference between a clean list and a mystery.

EVOTECH is based in Katy and Houston; we do not keep an office in The Woodlands. Ring (832) 359-2425 and we will confirm when a technician can reach your building.

What changes the scope and the price

• How many credentials are involved, and whether their numbers are already known.
• Access to the platform: working admin credentials, a cloud service or an on-premises server, and whether old server software needs an update before new card types can be added.
• Coordination with property management for base-building access.
• For migrations, reader replacement and card ordering. Secure cards with a site-specific configuration can take time to arrive.
• After-hours testing in occupied buildings.

We quote after reviewing the system on site, with each part itemized.

What brings the call back a week later

• A prox number loaded for a multi-technology card whose reader reports the smart-chip number.
• Changes saved on the server while a controller was offline, so that door never received them.
• An activation date set in the future, or a controller clock that drifted, often around daylight saving changes.
• Everyone given an all-doors level to save time, which becomes a security finding at the next audit.
• No holiday schedule defined, so doors on an unlock schedule sit open on a day the office is closed.
• Anti-passback rules that flag a freshly issued card as already inside.

Related services

Frequently asked questions