cliu
e90ad790a2
New knowledge/r105-verification.md lists the R1.05 functions not available on the test server (not tested) and the read-only steps prepared for the user to verify on the server or in the GUI (eqpdbg, setup_check.ps1, Engineering Module forms) plus the CI-Eng-Sample load decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
103 lines
7 KiB
Markdown
103 lines
7 KiB
Markdown
---
|
||
task: Check a machine against the CI Server setup and security requirements
|
||
version: R1.05 (first written for R1.03)
|
||
source: IM 36K01C10-01EN 5th ed. §1.3.2, §1.3.3, §2.1.2, §2.1.3, §3.3.15; IM 36K01C30-01EN 5th ed. §2.2.1, §3.2, §3.5.4, §3.7; practiced on the R1.03 test system 2026-09-30 and checked read-only on the R1.05 test server 2026-10-08
|
||
status: verified on R1.03 (2026-09-30); R1.05 checks verified one by one (R1.05 test server, 2026-10-08), script itself not yet run on R1.05
|
||
---
|
||
|
||
# Setup check (read-only)
|
||
|
||
```
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
|
||
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 -Version 1.03.00
|
||
```
|
||
|
||
Run from the repo root, preferably elevated. Changes nothing. The default target is R1.05
|
||
(`-Version 1.05.00`); use `-Version 1.03.00` for an R1.03 machine. One line per check:
|
||
`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
|
||
|
||
The script must be on the machine being checked. On a server you reach only remotely, the
|
||
user copies it there (or runs the checks below by hand); it writes nothing.
|
||
|
||
## What it checks
|
||
|
||
| Area | Checks |
|
||
|---|---|
|
||
| CI Server | Installed version (1.05.00 by default), CI Service (`StartCIServer`) state, startup type and account (`.\CIX_PROCESS`), VAGW service |
|
||
| Windows | Supported OS for the target version, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy (with the R1.05 exceptions), automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
|
||
| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed (program folder or the IT security 3.0 folder under ProgramData) |
|
||
| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002; on R1.05 also TCP 34597 (RESTful API) |
|
||
|
||
R1.05 supported OS (IM 36K01C10 5th ed. §1.3.2), all 64-bit: Windows 10 Enterprise / IoT
|
||
Enterprise LTSC 2019 and 2021, Windows 11 Pro and Enterprise, Windows 11 Enterprise / IoT
|
||
Enterprise LTSC 2024, Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025
|
||
(Standard). On Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT
|
||
Security Tool are not supported. Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016 and Server
|
||
2016 are no longer listed.
|
||
|
||
Defender (IM 36K01C10 5th ed. §2.1.2, IM 36K01C30 5th ed. §3.5.4): normally turned off by
|
||
group policy, but it must stay on with Windows 11 Pro 24H2, and it cannot be turned off on
|
||
Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for those.
|
||
|
||
## Reading the result
|
||
|
||
- `[DIFF]` on a development PC is normal; for a production server, fix each item with the
|
||
Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
|
||
running the IT Security Tool.
|
||
- The script finds the firewall rules only as "some rule allows this port"; check the rule
|
||
scope separately for production. If the active profile is switched off, no rule is needed
|
||
and every port is open: check which profile is active (`Get-NetConnectionProfile`).
|
||
- Listening ports (useful when there are no rules): `Get-NetTCPConnection -State Listen` and
|
||
`Get-NetUDPEndpoint` with the owning process. On R1.05 the RESTful API server (`jrstsrv`,
|
||
a `javaw` process) also listens on TCP 7073, which no manual mentions (ISS-087): do not open
|
||
it in the firewall.
|
||
- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
|
||
`… started` and there should be a `CI Server started` line; look for `-E-` and `failed`
|
||
lines. The log keeps growing after the start (equipment messages), so the `CI Server
|
||
started` line is not always last. The `UMHLOGTOO` line near the top shows the version and
|
||
build (R1.03: `R1.03.00 … (r10200M)`, R1.05: `R1.05.00 … (r11609M)`).
|
||
- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
|
||
`%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default); the RESTful API port is
|
||
`JRST_NETWORK_PORT` in `jrstsrv.sup` (34597 by default, R1.05).
|
||
- Installed updates: `Get-HotFix`. `wmic qfe list full` (Setup App. 1.3) fails on Windows
|
||
Server 2025 / 24H2, where WMIC is no longer installed (ISS-088).
|
||
- Folder rights (not in the script): setup files can hold passwords (e.g. `dbc.sup`). Check
|
||
who can read and change them:
|
||
`foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }`.
|
||
Under Program Files, Users can read; an install outside Program Files (e.g.
|
||
`C:\Yokogawa\CIServer`, as on the R1.05 test server) can inherit *Authenticated Users:
|
||
Modify*, so any signed-in user can change setup files (ISS-061). Fixing it is a site
|
||
decision (IT Security Tool).
|
||
- A local group `RDC_GA_CLIENT` with member `CIX_PROCESS` can exist on a machine that is not
|
||
a dual-redundant platform and has no IT security applied (seen on R1.05). It needs no
|
||
action (ISS-089).
|
||
|
||
## R1.05 test server result (2026-10-08)
|
||
|
||
Checks run one by one, read-only. The script itself is **awaiting user verification** (V2 in
|
||
`knowledge/r105-verification.md`). Windows Server 2025
|
||
Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in
|
||
`C:\Yokogawa\CIServer` without the IT Security Tool.
|
||
|
||
- Matched: CI Service running, automatic, account `.\CIX_PROCESS`; fast startup off; High
|
||
performance plan; processor scheduling Programs; 8dot3 names enabled; 100 % scale; web
|
||
ports 8443/8080; RESTful API on 34597; DURM UDP 17001/17101 and SMDMON UDP 18002 listening.
|
||
- Differed: Datacenter edition is not listed (only Standard); firewall profile for the
|
||
domain network off and no CI Server inbound rules; Defender on; automatic updates, defrag
|
||
and component cleanup not disabled; virtual memory not a custom size; .NET 3.5 not
|
||
installed; no `CIX_` groups, no `CTM_PROCESS`, no VAGW Bossd service (IT Security Tool not
|
||
installed and not supported on Server 2025, so IT security is **not tested** on this server).
|
||
- `ci_start.log`: all services started; the same odbsrv SSL certificate error as on R1.03
|
||
(ISS-008).
|
||
|
||
## R1.03 test system result (2026-09-30)
|
||
|
||
Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
|
||
Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
|
||
Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
|
||
plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
|
||
disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error
|
||
(`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
|
||
has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
|
||
start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
|
||
`knowledge/issues.md` ISS-008). Windows 10 Pro is no longer a supported OS for R1.05.
|