ci-server-engineer/.claude/skills/installation-security/tasks/setup-check.md

task	version	source	status
Check a machine against the CI Server setup and security requirements	R1.03	IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30	verified (2026-09-30)

Setup check (read-only)

powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1

Run from the repo root, preferably elevated. Changes nothing. One line per check: [OK] matches the manual, [DIFF] differs, [CHECK] needs a human decision.

What it checks

Area	Checks
CI Server	Installed version (1.03.00), CI Service state, startup type and account (.\CIX_PROCESS), VAGW service
Windows	Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings
IT security	CIX_OPERATOR, CIX_ENGINEER, CIX_MAINTENANCE, CIX_OPC groups, CIX_PROCESS / CTM_PROCESS users, IT Security Tool installed
Firewall	Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002

Reading the result

• [DIFF] on a development PC is normal; for a production server, fix each item with the Setup summary's Windows settings table (knowledge/manuals/IM36K01C10-01EN.md §2) or by running the IT Security Tool.
• The script finds the firewall rules only as "some rule allows this port"; check the rule scope separately for production.
• Also read %TLS_LOG_PATH%\ci_start.log after a start: every service should report … started and the log ends with CI Server started; look for -E- and failed lines. The first lines show the version and build (e.g. R1.03.00 … (r10200M)).
• The web ports actually used are SECURE_PORT_NUMBER / NON_SECURE_PORT_NUMBER in %TLS_ROOT_PATH%\tls\sup\jwuiisg.sup (8443 / 8080 by default).
• Folder rights (not in the script): setup files can hold passwords (e.g. dbc.sup). Check who can read and change them: foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }. Under Program Files, Users can read; an install outside Program Files (e.g. C:\Yokogawa\CIServer, seen on an R1.05 system) can inherit Authenticated Users: Modify, so any signed-in user can change setup files (ISS-061). Fixing it is a site decision (IT Security Tool).

Test system result (2026-09-30)

Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF. Differences: firewall domain/private profiles off; no CIX_ groups or CTM_PROCESS (IT Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not disabled. Web ports 8443/8080. ci_start.log: all services started, one SSL certificate error (InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed): the ODBC server odbsrv has USESSL = YES but no certificate in %TLS_ROOT_PATH%\tls\pki\odbsrv, so it exits at start (harmless unless ODBC is used; fix in skill data-access, task access-checks.md; knowledge/issues.md ISS-008).