cliu
5e58499fe5
Summarize CI Server Setup and Security Guide, add the draft installation-security skill and tools/setup_check.ps1 (read-only check practiced on the test system), and log ISS-008/009. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
159 lines
9.2 KiB
Markdown
159 lines
9.2 KiB
Markdown
---
|
||
manual: IM 36K01C10-01EN
|
||
title: CI Server Setup
|
||
edition: 3rd Edition, Sep. 2023
|
||
version: R1.03
|
||
status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)
|
||
---
|
||
|
||
# CI Server Setup (R1.03)
|
||
|
||
New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network
|
||
tools. Section numbers refer to the manual.
|
||
|
||
## 1. Before you start
|
||
|
||
- Needed: the CI Server software medium (or its ISO) and one **Activated License File per
|
||
server** (an upgrade needs one that includes the Upgrade License).
|
||
- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT
|
||
Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server
|
||
IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT
|
||
Security Tool are not supported**. VMs run Windows Server 2019.
|
||
- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365
|
||
(Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard
|
||
antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.
|
||
|
||
## 2. New setup
|
||
|
||
### Order of work (§2.1, physical machine)
|
||
|
||
1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702).
|
||
2. Configure Windows settings (below).
|
||
3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set
|
||
Windows network settings.
|
||
4. Install CI Server (with or without the IT Security Tool).
|
||
5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
|
||
6. Apply the CI Server licence.
|
||
|
||
On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
|
||
instead of drivers/card, VM network settings, install, IT security, licence, then VM
|
||
settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
|
||
TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
|
||
must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
|
||
|
||
### Windows settings (§2.1.2)
|
||
|
||
| Setting | Required value |
|
||
|---|---|
|
||
| Security patches | Apply per company policy before going live; patch promptly later |
|
||
| Visual effects | *Let Windows choose what's best* |
|
||
| Processor scheduling | *Programs* |
|
||
| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
|
||
| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down |
|
||
| Fast startup | Off: run `<DVD>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
|
||
| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) |
|
||
| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
|
||
| Drive optimization | Scheduled optimization off |
|
||
| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
|
||
| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong |
|
||
| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess`, or Server Manager feature) |
|
||
| DCOM | Default Authentication Level = *Connect*; restart |
|
||
| Display | Scale 100 % |
|
||
| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
|
||
|
||
### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
|
||
|
||
- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
|
||
parity; action-mode switch all OFF. One card per computer; card before drivers.
|
||
- Drivers from `<DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
|
||
`installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
|
||
- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
|
||
*RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
|
||
- Default addresses: Ethernet `172.17.<domain>.<station>`/16; control bus `172.16.<domain>.<station>`/16;
|
||
Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
|
||
- Computer name = station name. Check `sc query VLTDI` = RUNNING.
|
||
- Never use Internet Connection Sharing, bridge connections or Homegroup.
|
||
- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).
|
||
|
||
### Installing CI Server (§2.1.5)
|
||
|
||
- Run as a local administrator (domain types: domain admin or local admin + domain credentials);
|
||
join the domain first for domain/combination management.
|
||
- Close applications, disable antivirus, never run two installers, never install where CI
|
||
Server Remote Connect is installed.
|
||
- `<DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
|
||
`…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
|
||
*CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
|
||
see known issues), reboot.
|
||
- **Change the initial passwords of the predefined CI Server user accounts** (Engineering
|
||
Module manual).
|
||
|
||
### IT security (§2.1.6) and licence (§2.1.7)
|
||
|
||
- IT Security Tool: select *Standard Model* and the user management type; keep default items;
|
||
restart. The model must be the same across the system. Save/export settings if you change
|
||
defaults. Running the tool (also during upgrade) overwrites manual security changes.
|
||
- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence
|
||
file › Finish.
|
||
|
||
### CI Server Remote Connect (§2.4)
|
||
|
||
On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
|
||
8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
|
||
(Setup File Editor › *Client communication* tab); open them in the firewalls.
|
||
|
||
### Virtualization extras (§2.5)
|
||
|
||
RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
|
||
allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
|
||
for sound over RDP.
|
||
|
||
## 3. Maintenance
|
||
|
||
**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the
|
||
*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired
|
||
licence gives an error at start.
|
||
|
||
**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance
|
||
Licence):
|
||
1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
|
||
2. Stop CI Server; set the CI Service startup type to *Manual*.
|
||
3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls`
|
||
(plus project files).
|
||
4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
|
||
(`.sav/.d01/.k01`) and `*.sqlite`.
|
||
5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
|
||
`tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`.
|
||
6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
|
||
7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
|
||
8. IT security, licence.
|
||
9. Restore: **compare and merge** changes into the new files (never copy old files over new
|
||
ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security.
|
||
10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`,
|
||
restore the startup type.
|
||
- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client;
|
||
on R1.02 or older with the Simba server, uninstall the server before upgrading.
|
||
- Passwords of predefined CI Server accounts are reset to the initial ones: change them again.
|
||
|
||
**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop
|
||
standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).
|
||
|
||
**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must
|
||
match; takes effect within an hour. New features need CI Server stopped first.
|
||
|
||
**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
|
||
CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
|
||
definitions), then run `<DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
|
||
|
||
**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`:
|
||
`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
|
||
IPv4 settings: note them first, re-enter after restart).
|
||
|
||
## Troubleshooting (Appendix 1)
|
||
|
||
| Problem | Workaround |
|
||
|---|---|
|
||
| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
|
||
| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
|
||
| Installed updates not listed | `wmic qfe list full` |
|
||
| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
|