ci-server-engineer/knowledge/manuals/IM36K01C30-01EN.md

manual	title	edition	version	status
IM 36K01C30-01EN	CI Server Security Guide	5th Edition, Feb. 2026	R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)	from docs (users/groups and firewall checked read-only on the R1.03 test system; listening ports, users and firewall checked read-only on the R1.05 test server, 2026-10-08; the IT Security Tool is not installed there and not supported on its Windows Server 2025, so IT security itself is not verified on R1.05)

CI Server Security Guide (R1.05)

What the IT Security Tool changes, which Windows accounts and firewall openings CI Server needs, and the related utilities. Section numbers refer to the 5th edition. Since R1.04 the manual covers Windows Server 2022 instead of 2016; R1.05 adds Windows 11 Enterprise LTSC 2024 and IT security version 3.0 (§7 below).

1. Threats and measures

• Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
• Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal firewall, stopping unused services, IT environment settings (NetBIOS, disk password, Delivery Optimization, Defender), and group policies (password/lockout, security options, software restriction, audit policies, administrative templates, safe DLL search order).
• IT security settings must be applied at the area and process levels; business and corporate levels follow the site's own policy.

2. Security model and user management

• CI Server supports only the Standard model: protects against network and terminal attacks, not against theft.
• Password and lockout (§2.1, §3.6.1–3.6.2): in IT security 2.0 the password policy is not applied (use domain policy), but the account lockout policy is applied (10 failed sign-ins, counter reset after 15 min, locked for 15 min). In 3.0 both are settings of the tool; for domain accounts set them on the domain controller or in the Default Domain Policy. (The R1.03 version of this summary said lockout was not set; that was wrong in R1.03 too.)
• Upgrading from R1.03 or earlier with changed IT security defaults: a dialog asks to reset the lockout values; answer Yes, then set custom values again (IM 36K01A50 §1.3).
• User management types:

Type	Accounts kept on	Notes
Standalone	Each computer	Small systems; admin and product maintenance rights not separable
Domain	Domain controller	Central; rights separable
Combination	Domain, plus local fallback	Local _LCL groups for emergencies
Linked domain (recommended for new systems)	Domain, linked to local groups	Apply Standalone first, join domain, then link with Domain Link Management Tool

• Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the domain controller, with _LCL local helper groups). With IT security 3.0 only the Standalone and Linked domain sets are created (§2.2.1).

Name	Kind	Purpose
CIX_OPERATOR	Group	Operators
CIX_ENGINEER	Group	Engineering (Engineering / Edit Module)
CIX_MAINTENANCE	Group (also Administrators)	Installation and maintenance
CIX_OPC	Group	OPC configuration and communication
CIX_PROCESS	User	Runs CI Server services and CI OPC servers
CTM_PROCESS	User	Runs VAGW services
RDC_PROCESS	User	Dual-redundant platform only
VNT_*	Groups/users	Vnet/IP Interface Package (no sign-in rights)

Use these accounts only for CI Server. Changing the security model may delete or rename groups.

Verified (R1.05 test server, 2026-10-08): without the IT Security Tool, CI Server still creates the local user CIX_PROCESS (member of Administrators) and runs CI Service with it; there are no CIX_ groups and no CTM_PROCESS. A local group RDC_GA_CLIENT with member CIX_PROCESS also exists although the server is not a dual-redundant platform (ISS-089, no action needed).

3. Firewall (§3.2)

Windows Firewall on; block everything except what CI Server needs. IT security 3.0 uses the same exception list (§3.7.2).

Use	Port
Web / secure web (CI View, CI Portal)	TCP 8080 / 80, TCP 8443 / 443
RESTful API web server (jrstsrv, new in R1.04/R1.05)	TCP 34597 (JRST_NETWORK_PORT in jrstsrv.sup)
DURM between nodes	UDP 17001, 17101 (one per DURM line)
SMDMON (system log collection)	UDP 18002
Remote desktop (only if needed, restrict users)	TCP 3389
HAC	UDP 16000–16006 (hac.sup, jhacProperties\application.properties); HACW_HMI UDP 16010–16041
ODBC (SimbaServer, Core only)	TCP 1583
Alarm e-mail	TCP 25
NTP/SNTP (not needed with Vnet/IP)	123
OPC classic	TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138
OPC UA	UDP 4840 discovery; communication port configurable
Vnet equipment (odeq.exe)	TCP 44818
Equipment drivers	Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090
Windows domain	DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389
Dual-redundant platform (PRC)	TCP 34480, 34483–34486; UDP 1311

ICMP echo (ping) is allowed by the Standard model.

Verified (R1.05 test server, 2026-10-08): listening are TCP 8080/8443 (web), 34597 (RESTful API), 34493 (OPC UA server opxuas), UDP 17001/17101 (DURM) and 18002 (SMDMON). The RESTful API server also listens on TCP 7073 on all interfaces; no manual mentions this port and jrstsrv.sup has no keyword for it (ISS-087). Do not open it in the firewall.

4. Other settings (§3.3–§3.6)

• Unused services disabled by the tool (OS columns now Win10 LTSC, Win11 LTSC 2024, Server 2019, Server 2022): Diagnostic Policy, Connected User Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push Notifications, and others. Delivery Optimization is no longer stopped; WinHTTP Web Proxy Auto-Discovery left the list. DHCP Client must stay running.
• Delivery Optimization (§3.5.3): limited by policy (Server 2022: HTTP only; other listed OSs: bypass) so updates do not spread between plant PCs.
• Defender (§3.5.4): the "turn off" policy is set on OSs older than Windows 11 and left unconfigured on Windows 11; it has no effect on Win10 LTSC 2021 / Win11 LTSC 2024.
• OPC: Create permanent shared objects right for CIX_OPC, CIX_PROCESS, CTM_PROCESS; network access sharing model Classic; DCOM port range 20500–20550 (the manual's table still prints "2500–20550" in R1.05, taken as a typo).
• NetBIOS over TCP/IP can be disabled (default with domain/combination management); then configure HOSTS/DNS for name resolution.
• USB storage disabled; use the StorageDeviceCTL utility (members of CIX_MAINTENANCE) to allow writing temporarily.

5. Tools (§4)

Tool	Use
IT Security Tool (Start › YOKOGAWA Security)	Setup (version 2.0/3.0, model, management type), Save/Restore (with a default password for recreated accounts), Change Password of the saved file, Import/Export, Information (summary)
Domain Link Management Tool	Link/unlink the domain (linked domain management); sign in as local admin + CIX_MAINTENANCE
PrepareReconstruction.cmd then ciserver-…-ITSecurity.exe › Apply IT Security only	Re-apply with different target components (CI Mobile View, General PC, domain controller)
Reapply on Remote Connect after an upgrade to R1.05	Run the R1.05 -ITSecurity.exe installer again to reinstall the IT Security Tool (overwrite install), then apply (§4.8.1)
ResetITSecCondition.cmd (<ISO drive>\Windows\CIServer\ITSecurity)	First step when switching CI Mobile View, General PC or a domain controller between IT security 2.0 and 3.0 (§4.8.3–4.8.4)
Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>] (<ISO drive>\Windows\CIServer\ITSecurity)	Create CIX_PROCESS or set its password; same password on all collaborating computers; restart
…CreateCTMProcess.exe [-p <password>]	Same for CTM_PROCESS
ITSecuritySettingItemExport.exe	Export applied settings
YWVNETCreateVNTUser	Change passwords of the Vnet/IP Interface Package users (VM)

Installer options (App. 2.5): CI Server and IT Security Tool for CI Core / CI Portal; IT Security for multi-product environment for CI View / CI Mobile View on a PC where another Yokogawa product's IT security is applied; Apply IT Security only for CI Mobile View, General PC and domain controller (avoid it where other products are installed). Applying the wrong station type means reinstalling Windows. Version 3.0 always needs a licence number.

Changing the account that runs CI Server (§4.9): create the user, add it to Administrators (and RDC_GA_CLIENT on a dual-redundant platform; CIX_OPC or CIX_OPC_LCL when IT security is applied), set it on the CI Service Log On tab and on the Identity tab of CI OPC AE Server and CI OPC DA Server in Component Services › DCOM Config.

6. Optional hardening (§5)

Extra settings the site may add: audit policies and event log sizes, disable recovery console and Guest account, restrict audit log and removable media access, immediate screen-saver password, SNMP, SSL/TLS registry settings, secure startup and AllowedPaths registry keys, remove Everyone for anonymous users, remove unused protocols, block malicious DLL loading, show a notice on entry to a security zone (§5.26).

Safe API use (§5.27, new): give each client application of the APIs (ODBC, OPC UA, web, RESTful API, …) its own DSS user or authorization group with only the datasets and the read/insert/update/delete rights it needs and a unique password; never run it as SYSTEM or with an administrator account. The RESTful API is HTTPS only; use the newest TLS version (§5.14). Treat exported data as sensitive and delete what is not needed.

7. IT security version 3.0 (new in R1.05)

From docs, not tested (IT Security Tool not available on the R1.05 test server) (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.

• Chosen in the IT Security Tool next to 2.0; needs a licence number per computer. The full setting list is a PDF installed with the tool. Settings are grouped in categories (Access Control, Firewall per profile, System Services, Password Policy, Account Lockout Policy, Security Options, Administrative Templates, Removable Storage Access, …); access control, firewall exceptions, OPC, HDD password and software restriction work as in 2.0.
• Defaults worth knowing:
  • Unticked by default (tick them on Select Setting Items if wanted): screen lock after inactivity, 15-minute limit for idle RDP sessions, password-protected screen saver, SMB signing (Windows 11 signs by default; switch it off on both sides if a product cannot cope).
  • Ticked by default: Kerberos limited to AES (a domain user may get a "current credentials" prompt; reset that user's password or untick the item), Internet Explorer 11 disabled, network level authentication and a single session per RDP user, Print Spooler refuses client connections, no PnP redirection over RDP, auto logon disabled.
  • PowerShell script-block logging and transcription are on, so a password typed in PowerShell ends up in the log: run security utilities that take passwords in cmd.
  • CD/DVD access can be denied only with the Group Policy Editor, not with the tool.
• Built-in accounts (§3.7.18, §3.7.22): disable or rename the built-in Administrator and Guest; avoid names containing admin, root or su; on the dual-redundant platform rename ADMINISTRATOR / PATCHUSER with the Redundancy Management Tool.
• LAPS (§3.7.23): only with linked domain management and 3.0. After installing it (Setup summary §2.1.6), enable Enable Local Admin Password Management in the GPO of the OU of the target computers. The built-in Administrator then gets a different, rotating password on each computer (read it with LAPS UI on the domain controller), so do not use that account for CI Server.
• Switching CI Mobile View, General PC or a domain controller between 2.0 and 3.0 (§4.8.3–4.8.4): sign in as a CIX_MAINTENANCE administrator, run ResetITSecCondition.cmd, start the tool and choose the version. Back to 2.0: first Restore the file PrepareToChangeITSecVer.hed under C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\System\Extension\3.0. For linked domain management, leave the domain, reapply, rejoin and relink.
• Central management with Active Directory (ch. 6): on the domain controller create a GPO, Import Settings from CIX_Standard_2.0.zip or CIX_Standard_3.0.zip (from …\ITSecurity\GPOFiles\<version>; 3.0 comes from the IT security 3.0 medium), and link it to the OU of the CI Server computers. Apply IT security on every client first; change settings only in the GPO on the domain controller.