--- manual: IM 36K01C10-01EN title: CI Server Setup edition: 3rd Edition, Sep. 2023 version: R1.03 status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1) --- # CI Server Setup (R1.03) New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network tools. Section numbers refer to the manual. ## 1. Before you start - Needed: the CI Server software medium (or its ISO) and one **Activated License File per server** (an upgrade needs one that includes the Upgrade License). - Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT Security Tool are not supported**. VMs run Windows Server 2019. - Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365 (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server. ## 2. New setup ### Order of work (§2.1, physical machine) 1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702). 2. Configure Windows settings (below). 3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set Windows network settings. 4. Install CI Server (with or without the IT Security Tool). 5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain). 6. Apply the CI Server licence. On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package** instead of drivers/card, VM network settings, install, IT security, licence, then VM settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30. ### Windows settings (§2.1.2) | Setting | Required value | |---|---| | Security patches | Apply per company policy before going live; patch promptly later | | Visual effects | *Let Windows choose what's best* | | Processor scheduling | *Programs* | | Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart | | Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down | | Fast startup | Off: run `\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 | | Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) | | Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS | | Drive optimization | Scheduled optimization off | | Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled | | Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong | | .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source::\sources\sxs /limitaccess`, or Server Manager feature) | | DCOM | Default Authentication Level = *Connect*; restart | | Display | Scale 100 % | | 8dot3 names | `fsutil behavior set disable8dot3 2`; restart | ### Vnet/IP (§2.1.1, §2.1.3, §2.1.4) - Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd parity; action-mode switch all OFF. One card per computer; card before drivers. - Drivers from `\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` → `installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off. - Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*, *RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4. - Default addresses: Ethernet `172.17..`/16; control bus `172.16..`/16; Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18..`/16. - Computer name = station name. Check `sc query VLTDI` = RUNNING. - Never use Internet Connection Sharing, bridge connections or Homegroup. - Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8). ### Installing CI Server (§2.1.5) - Run as a local administrator (domain types: domain admin or local admin + domain credentials); join the domain first for domain/combination management. - Close applications, disable antivirus, never run two installers, never install where CI Server Remote Connect is installed. - `\Windows\CIServer\ciserver-R-rM-setup.exe` = CI Server only; `…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type *CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default, see known issues), reboot. - **Change the initial passwords of the predefined CI Server user accounts** (Engineering Module manual). ### IT security (§2.1.6) and licence (§2.1.7) - IT Security Tool: select *Standard Model* and the user management type; keep default items; restart. The model must be the same across the system. Save/export settings if you change defaults. Running the tool (also during upgrade) overwrites manual security changes. - Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence file › Finish. ### CI Server Remote Connect (§2.4) On a CI View PC (never on a Portal or Core): browse to `http(s)://:` (defaults 8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup` (Setup File Editor › *Client communication* tab); open them in the firewalls. ### Virtualization extras (§2.5) RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1; allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task for sound over RDP. ## 3. Maintenance **Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the *CI Service* Windows service (set startup type *Automatic* for automatic start). An expired licence gives an error at start. **Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance Licence): 1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only). 2. Stop CI Server; set the CI Service startup type to *Manual*. 3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` (plus project files). 4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*` (`.sav/.d01/.k01`) and `*.sqlite`. 5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy `tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`. 6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings. 7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again. 8. IT security, licence. 9. Restore: **compare and merge** changes into the new files (never copy old files over new ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security. 10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`, restore the startup type. - ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client; on R1.02 or older with the Simba server, uninstall the server before upgrading. - Passwords of predefined CI Server accounts are reset to the initial ones: change them again. **HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes). **Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must match; takes effect within an hour. New features need CI Server stopped first. **Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features › CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security definitions), then run `\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`. **TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`: `TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC IPv4 settings: note them first, re-enter after restart). ## Troubleshooting (Appendix 1) | Problem | Workaround | |---|---| | Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart | | Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups | | Installed updates not listed | `wmic qfe list full` | | Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |