ci-server-engineer/.claude/skills/installation-security/tasks/setup-check.md

task	version	source	status
Check a machine against the CI Server setup and security requirements	R1.05 (first written for R1.03)	IM 36K01C10-01EN 5th ed. §1.3.2, §1.3.3, §2.1.2, §2.1.3, §3.3.15; IM 36K01C30-01EN 5th ed. §2.2.1, §3.2, §3.5.4, §3.7; practiced on the R1.03 test system 2026-09-30 and checked read-only on the R1.05 test server 2026-10-08	verified on R1.03 (2026-09-30); R1.05 checks verified one by one (R1.05 test server, 2026-10-08), script itself not yet run on R1.05

Setup check (read-only)

powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 -Version 1.03.00

Run from the repo root, preferably elevated. Changes nothing. The default target is R1.05 (-Version 1.05.00); use -Version 1.03.00 for an R1.03 machine. One line per check: [OK] matches the manual, [DIFF] differs, [CHECK] needs a human decision.

The script must be on the machine being checked. On a server you reach only remotely, the user copies it there (or runs the checks below by hand); it writes nothing.

What it checks

Area	Checks
CI Server	Installed version (1.05.00 by default), CI Service (StartCIServer) state, startup type and account (.\CIX_PROCESS), VAGW service
Windows	Supported OS for the target version, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy (with the R1.05 exceptions), automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings
IT security	CIX_OPERATOR, CIX_ENGINEER, CIX_MAINTENANCE, CIX_OPC groups, CIX_PROCESS / CTM_PROCESS users, IT Security Tool installed (program folder or the IT security 3.0 folder under ProgramData)
Firewall	Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002; on R1.05 also TCP 34597 (RESTful API)

R1.05 supported OS (IM 36K01C10 5th ed. §1.3.2), all 64-bit: Windows 10 Enterprise / IoT Enterprise LTSC 2019 and 2021, Windows 11 Pro and Enterprise, Windows 11 Enterprise / IoT Enterprise LTSC 2024, Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025 (Standard). On Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT Security Tool are not supported. Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016 and Server 2016 are no longer listed.

Defender (IM 36K01C10 5th ed. §2.1.2, IM 36K01C30 5th ed. §3.5.4): normally turned off by group policy, but it must stay on with Windows 11 Pro 24H2, and it cannot be turned off on Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports [CHECK] for those.

Reading the result

• [DIFF] on a development PC is normal; for a production server, fix each item with the Setup summary's Windows settings table (knowledge/manuals/IM36K01C10-01EN.md §2) or by running the IT Security Tool.
• The script finds the firewall rules only as "some rule allows this port"; check the rule scope separately for production. If the active profile is switched off, no rule is needed and every port is open: check which profile is active (Get-NetConnectionProfile).
• Listening ports (useful when there are no rules): Get-NetTCPConnection -State Listen and Get-NetUDPEndpoint with the owning process. On R1.05 the RESTful API server (jrstsrv, a javaw process) also listens on TCP 7073, which no manual mentions (ISS-087): do not open it in the firewall.
• Also read %TLS_LOG_PATH%\ci_start.log after a start: every service should report … started and there should be a CI Server started line; look for -E- and failed lines. The log keeps growing after the start (equipment messages), so the CI Server started line is not always last. The UMHLOGTOO line near the top shows the version and build (R1.03: R1.03.00 … (r10200M), R1.05: R1.05.00 … (r11609M)).
• The web ports actually used are SECURE_PORT_NUMBER / NON_SECURE_PORT_NUMBER in %TLS_ROOT_PATH%\tls\sup\jwuiisg.sup (8443 / 8080 by default); the RESTful API port is JRST_NETWORK_PORT in jrstsrv.sup (34597 by default, R1.05).
• Installed updates: Get-HotFix. wmic qfe list full (Setup App. 1.3) fails on Windows Server 2025 / 24H2, where WMIC is no longer installed (ISS-088).
• Folder rights (not in the script): setup files can hold passwords (e.g. dbc.sup). Check who can read and change them: foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }. Under Program Files, Users can read; an install outside Program Files (e.g. C:\Yokogawa\CIServer, as on the R1.05 test server) can inherit Authenticated Users: Modify, so any signed-in user can change setup files (ISS-061). Fixing it is a site decision (IT Security Tool).
• A local group RDC_GA_CLIENT with member CIX_PROCESS can exist on a machine that is not a dual-redundant platform and has no IT security applied (seen on R1.05). It needs no action (ISS-089).

R1.05 test server result (2026-10-08)

Checks run one by one, read-only, then the script itself (copied to a temporary folder, run from an elevated session, deleted again): 12 OK, 5 CHECK, 20 DIFF. The first run showed the CI Server ports as allowed: the script counted program-limited Windows rules with "any port" (e.g. Remote Desktop Shadow) as a match. Fixed 2026-10-08; such rules no longer count. Windows Server 2025 Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in C:\Yokogawa\CIServer without the IT Security Tool.

• Matched: CI Service running, automatic, account .\CIX_PROCESS; fast startup off; High performance plan; processor scheduling Programs; 8dot3 names enabled; 100 % scale; web ports 8443/8080; RESTful API on 34597; DURM UDP 17001/17101 and SMDMON UDP 18002 listening.
• Differed: Datacenter edition is not listed (only Standard); firewall profile for the domain network off and no CI Server inbound rules; Defender on; automatic updates, defrag and component cleanup not disabled; virtual memory not a custom size; .NET 3.5 not installed; no CIX_ groups, no CTM_PROCESS, no VAGW Bossd service (IT Security Tool not installed and not supported on Server 2025, so IT security is not tested on this server).
• ci_start.log: all services started; the same odbsrv SSL certificate error as on R1.03 (ISS-008).

R1.03 test system result (2026-09-30)

Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF. (Run before the firewall-check fix of 2026-10-08, so "inbound allowed" lines may have counted program-limited "any port" rules; re-run to confirm.) Differences: firewall domain/private profiles off; no CIX_ groups or CTM_PROCESS (IT Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not disabled. Web ports 8443/8080. ci_start.log: all services started, one SSL certificate error (InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed): the ODBC server odbsrv has USESSL = YES but no certificate in %TLS_ROOT_PATH%\tls\pki\odbsrv, so it exits at start (harmless unless ODBC is used; fix in skill data-access, task access-checks.md; knowledge/issues.md ISS-008). Windows 10 Pro is no longer a supported OS for R1.05.