ci-server-engineer/knowledge/manuals/IM36K01C10-01EN.md

manual	title	edition	version	status
IM 36K01C10-01EN	CI Server Setup	3rd Edition, Sep. 2023	R1.03	from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)

CI Server Setup (R1.03)

New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network tools. Section numbers refer to the manual.

1. Before you start

• Needed: the CI Server software medium (or its ISO) and one Activated License File per server (an upgrade needs one that includes the Upgrade License).
• Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server IoT 2019. On Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT Security Tool are not supported. VMs run Windows Server 2019.
• Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365 (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.

2. New setup

Order of work (§2.1, physical machine)

1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702).
2. Configure Windows settings (below).
3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set Windows network settings.
4. Install CI Server (with or without the IT Security Tool).
5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
6. Apply the CI Server licence.

On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) Vnet/IP Interface Package instead of drivers/card, VM network settings, install, IT security, licence, then VM settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.

Windows settings (§2.1.2)

Setting	Required value
Security patches	Apply per company policy before going live; patch promptly later
Visual effects	Let Windows choose what's best
Processor scheduling	Programs
Virtual memory	Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart
Power	High performance; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down
Fast startup	Off: run <DVD>\Windows\Tool\HiberbootDisabled.bat as administrator (HiberbootEnabled = 0); required before Vnet/IP drivers on Win10
Windows Defender	Turned off by group policy (Server 2016: Turn off Windows Defender; 2019: Turn off Windows Defender Antivirus)
Automatic Windows updates	Disabled by group policy (Configure Automatic Updates = Disabled). With WSUS: install CI Server first, then disable from WSUS
Drive optimization	Scheduled optimization off
Automatic cleanup	Task Scheduler › Microsoft › Windows › Servicing › StartComponentCleanup disabled
Windows updates	KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong
.NET Framework 3.5.1	Installed (dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess, or Server Manager feature)
DCOM	Default Authentication Level = Connect; restart
Display	Scale 100 %
8dot3 names	fsutil behavior set disable8dot3 2; restart

Vnet/IP (§2.1.1, §2.1.3, §2.1.4)

• Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd parity; action-mode switch all OFF. One card per computer; card before drivers.
• Drivers from <DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip → installVirtProd.cmd (VM: installVirtProdVPF.cmd), as administrator, antivirus off.
• Rename connections: Ethernet, Vnet, VnetIPOpen (VM: VnetIPBUS1, VnetIPBUS2, RemoteUINetwork). Disable IPv6; Vnet uses only Yokogawa Vnet Protocol + IPv4.
• Default addresses: Ethernet 172.17.<domain>.<station>/16; control bus 172.16.<domain>.<station>/16; Vnet/IP open 192.168.<128+domain>.<129+station>/24; VM remote UI 172.18.<domain>.<station>/16.
• Computer name = station name. Check sc query VLTDI = RUNNING.
• Never use Internet Connection Sharing, bridge connections or Homegroup.
• Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).

Installing CI Server (§2.1.5)

• Run as a local administrator (domain types: domain admin or local admin + domain credentials); join the domain first for domain/combination management.
• Close applications, disable antivirus, never run two installers, never install where CI Server Remote Connect is installed.
• <DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe = CI Server only; …-ITSecurity.exe = CI Server + IT Security Tool (also installs VAGW modules; install type CI Server and IT Security Tool). Choose the install folder (no spaces if non-default, see known issues), reboot.
• Change the initial passwords of the predefined CI Server user accounts (Engineering Module manual).

IT security (§2.1.6) and licence (§2.1.7)

• IT Security Tool: select Standard Model and the user management type; keep default items; restart. The model must be the same across the system. Save/export settings if you change defaults. Running the tool (also during upgrade) overwrites manual security changes.
• Licence: Start menu › License Authorization Wizard (admin) › select the activated licence file › Finish.

CI Server Remote Connect (§2.4)

On a CI View PC (never on a Portal or Core): browse to http(s)://<portal>:<port> (defaults 8080 / 8443), Download (Windows), run CI-rc-setup.exe. Portal ports are in jwuiisg.sup (Setup File Editor › Client communication tab); open them in the firewalls.

Virtualization extras (§2.5)

RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1; allow multiple sessions per user; enable Windows Audio and the System Sound Service task for sound over RDP.

3. Maintenance

Start/stop (§3.1): Start menu › CI Server › Start CI Server / Stop CI Server, or the CI Service Windows service (set startup type Automatic for automatic start). An expired licence gives an error at start.

Reinstall / upgrade (§3.2), upgrades from R1.02 or earlier (needs a Product Maintenance Licence):

1. Database consistency: dsschk, dsschk -r, dsschk -e, dsschk -e -r (upgrade only).
2. Stop CI Server; set the CI Service startup type to Manual.
3. Stop the VAGW Bossd service, then back up %TLS_ALLUSERS_PATH% and %TLS_ROOT_PATH%\tls (plus project files).
4. On the Core (upgrade): delete in %TLS_SAV_PATH% eqp*_main.*, eqp*_item.*, opx*.* (.sav/.d01/.k01) and *.sqlite.
5. Note changed setup files (Setup File Editor, Status = Changed) and copy tls\com, sup, tpl, src and %TLS_ALLUSERS_PATH%\wap.
6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
8. IT security, licence.
9. Restore: compare and merge changes into the new files (never copy old files over new ones), including wap\cfg\operatorInterfaces\DEPLOY\layouts\; re-apply IT security.
10. Verify: start, dsschk -e -r three times, restart, check %TLS_LOG_PATH%\ci_start.log, restore the startup type.

• ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client; on R1.02 or older with the Simba server, uninstall the server before upgrading.
• Passwords of predefined CI Server accounts are reset to the initial ones: change them again.

HAC upgrade (§3.3): stop standby, disconnect its network, upgrade and test offline, stop standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).

Extend licence (§3.4): License Authorization Wizard while running; node name/number must match; takes effect within an hour. New features need CI Server stopped first.

Uninstall (§3.5, §3.6): back up, stop CI Server and VAGW Bossd, Programs and Features › CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security definitions), then run <DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd.

TCP/IP tools (§3.8): from the VirtualProduct package XCM3003\Module\Tool: TcpipInconsistencyDetector.cmd (check) and TcpipInconsistencyRepair.cmd (resets all NIC IPv4 settings: note them first, re-enter after restart).

Troubleshooting (Appendix 1)

Problem	Workaround
Server Manager error, Microsoft updates fail (80070543), .NET install fails	Temporarily set DCOM Default Authentication Level to Connect (revert to None afterwards where the manual says so), restart
Cannot manage users in Control Panel	Use Computer Management › Local Users and Groups
Installed updates not listed	wmic qfe list full
Cannot change time zone (Server 2019 with UAC)	Run timedate.cpl as administrator