---
manual: IM 36K01C30-01EN
title: CI Server Security Guide
edition: 3rd Edition, Sep. 2023
version: R1.03
status: from docs (users/groups and firewall checked read-only on the test system)
---

# CI Server Security Guide (R1.03)

What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
needs, and the related utilities. Section numbers refer to the manual.

## 1. Threats and measures

- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
  firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
  group policies (password/lockout, security options, software restriction, audit policies,
  administrative templates, safe DLL search order).
- IT security settings **must** be applied at the area and process levels; business and
  corporate levels follow the site's own policy.

## 2. Security model and user management

- CI Server supports only the **Standard model**: protects against network and terminal
  attacks, **not** against theft. Password and lockout policies are *not* set by it (use
  domain policy).
- User management types:

| Type | Accounts kept on | Notes |
|---|---|---|
| Standalone | Each computer | Small systems; admin and product maintenance rights not separable |
| Domain | Domain controller | Central; rights separable |
| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies |
| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |

- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
  domain controller, with `_LCL` local helper groups):

| Name | Kind | Purpose |
|---|---|---|
| `CIX_OPERATOR` | Group | Operators |
| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) |
| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance |
| `CIX_OPC` | Group | OPC configuration and communication |
| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers |
| `CTM_PROCESS` | User | Runs VAGW services |
| `RDC_PROCESS` | User | Dual-redundant platform only |
| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) |

Use these accounts only for CI Server. Changing the security model may delete or rename groups.

## 3. Firewall (§3.2)

Windows Firewall on; block everything except what CI Server needs:

| Use | Port |
|---|---|
| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
| DURM between nodes | UDP 17001, 17101 (one per DURM line) |
| SMDMON (system log collection) | UDP 18002 |
| Remote desktop (only if needed, restrict users) | TCP 3389 |
| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 |
| ODBC (SimbaServer, Core only) | TCP 1583 |
| Alarm e-mail | TCP 25 |
| NTP/SNTP (not needed with Vnet/IP) | 123 |
| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 |
| OPC UA | UDP 4840 discovery; communication port configurable |
| Vnet equipment (`odeq.exe`) | TCP 44818 |
| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 |
| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 |
| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 |

ICMP echo (ping) is allowed by the Standard model.

## 4. Other settings (§3.3–§3.6)

- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
  Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
  Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
  Notifications, and others. DHCP Client must stay running.
- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
  network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
  also prints "2500–20550", taken as a typo).
- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
  configure HOSTS/DNS for name resolution.
- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
  allow writing temporarily.

## 5. Tools (§4)

| Tool | Use |
|---|---|
| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
| `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
| `ITSecuritySettingItemExport.exe` | Export applied settings |
| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |

**Changing the account that runs CI Server (§4.9)**: create the user, add it to
Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config.

## 6. Optional hardening (§5)

Extra settings the site may add: audit policies and event log sizes, disable recovery
console and Guest account, restrict audit log and removable media access, immediate
screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
protocols, block malicious DLL loading.