Proficy* HMI/SCADA - ifix U SING T ERMINAL S ERVER

Transcription

1 Proficy* HMI/SCADA - ifix U SING T ERMINAL S ERVER Version 5.1 May 2010

2 All rights reserved. No part of this publication may be reproduced in any form or by any electronic or mechanical means, including photocopying and recording, without permission in writing from GE Intelligent Platforms, Inc. Disclaimer of Warranties and Liability The information contained in this manual is believed to be accurate and reliable. However, GE Intelligent Platforms, Inc. assumes no responsibilities for any errors, omissions or inaccuracies whatsoever. Without limiting the foregoing, GE Intelligent Platforms, Inc. disclaims any and all warranties, expressed or implied, including the warranty of merchantability and fitness for a particular purpose, with respect to the information contained in this manual and the equipment or software described herein. The entire risk as to the quality and performance of such information, equipment and software, is upon the buyer or user. GE Intelligent Platforms, Inc. shall not be liable for any damages, including special or consequential damages, arising out of the user of such information, equipment and software, even if GE Intelligent Platforms, Inc. has been advised in advance of the possibility of such damages. The user of the information contained in the manual and the software described herein is subject to the GE Intelligent Platforms, Inc. standard license agreement, which must be executed by the buyer or user before the use of such information, equipment or software. Notice 2010 GE Intelligent Platforms, Inc. All rights reserved. *Trademark of GE Intelligent Platforms, Inc. Microsoft is a registered trademark of Microsoft Corporation, in the United States and/or other countries. All other brands or names are property of their respective holders. We want to hear from you. If you have comments, questions, or suggestions about our documentation, send them to the following address: doc@ge.com

3 Table of Contents About this Guide... 1 Reference Documents... 1 Introduction to Terminal Services... 1 Using iclientts... 2 Understanding the ifix Terminal Server Environment... 4 File System Support... 5 Where to Find More Terminal Server Information... 6 Getting Started... 6 ifix Terminal Server Limitations... 6 Scalability... 7 Software Requirements... 7 Licensing Requirements... 8 Hardware Key Licensing Considerations... 9 Setting up Windows Server 2003 for Terminal Services... 9 Enabling Windows Server 2003 Terminal Services... 9 Enabling Terminal Server Licensing in Windows Server Activating a License Server in Windows Server 2003 Through the Internet Setting Up Windows Server 2008 for Terminal Services Enabling Windows Server 2008 Terminal Services Enabling Terminal Server Licensing in Windows Server Activating a License Server in Windows Server 2008 Through the Internet Configuring Terminal Server Users to Use Remote Desktop Protocol Using ifix Terminal Server Clients with FIX32 and Pre-iFIX 3.5 SCADA Nodes Setting IP Addresses for Each Client i

4 Editing a User's SCU File Installing and Configuring ifix with Windows Terminal Server Before You Begin with ifix on Your Terminal Server Overview of the Terminal Server Setup Steps Step 1: Determining User Types and Directories Planning User Types Planning SCU Directories for ifix Planning Shared Directories Understanding Project Directory Paths Step 2: Installing ifix Installing ifix over an Uninstall Running ifix as a Service on the Terminal Server Step 3: Installing the Virtual Keyboard on Terminal Server and Clients Step 4: Configuring the SCU Defining Project Directory Paths Notes on Project Paths Disabling SCADA Support for Client SCUs Defining ifix Global Security Paths Upgrading SCU Files from a Previous ifix Release Configuring User Accounts to Use a Unique Set of Schedules Step 5: Creating Startup Profiles Configuring the Options for the Startup Profile Manager Configuring the Default Profile Adding Startup Profiles More on Startup Profiles TIP: Creating User Defined Desktop Shortcuts to Start ifix TIP: Using the Application Validator to Take a Snapshot of Your Project Folders EXAMPLE: Configuring Terminal Server with ifix Running As a Service ii

5 Table Of Contents ifix WorkSpace Toolbars and Terminal Server Historical Collect and Terminal Server Securing the Terminal Server Environment Installing and Configuring Terminal Server Clients Configuring a Remote Desktop Connection to Connect to a Terminal Server Configuring Screen Savers for Windows Server 2003 and Windows Server Logging on to a Remote Terminal Server Using Internet Explorer Optimizing ifix Terminal Server Optimizing ifix Using Screen Regions Using Deadband Values Using Refresh Rates Designing in 256 Colors with RDP Disabling Picture Caching Using Bitmaps Using Traditional Clients Disabling Smooth Scrolling Using Auto Scale Optimizing the Terminal Server Machine Modifying the Encryption Rate Disabling Client Wallpaper Deleting Temporary Folders Disabling Active Desktop Third-party Thin Client Software and Hardware Citrix Presentation Server Automation Control Products (ACP) ThinManager Optimizing New ifix Pictures for Use with Terminal Service Capable Devices Troubleshooting Your ifix Terminal Server Environment iii

6 Isolating Your ifix Terminal Server Problem Troubleshooting Specific Terminal Server Problems Troubleshooting Known Terminal Server Problems Frequently Asked Questions on Using ifix with Terminal Server Index... 1 iv

7 About this Guide Using Terminal Server is intended for system integrators, IT administrators, and process control engineers responsible for setting up and optimizing an ifix Terminal Server environment. This help assumes familiarity with Microsoft Windows Server 2003, Microsoft Windows Server 2008, Microsoft Windows Licensing, Microsoft Windows Terminal Services and/or Citrix technologies including licensing, and your network environment. Reference Documents For more information on ifix, the System Configuration Utility (SCU), ifix Security, and the ifix Environment, refer to the following: Optimizing Your ifix System Mastering ifix Implementing Security Setting up the Environment For more information on installing and configuring Microsoft Terminal Services, refer to the Microsoft Terminal Server online documentation and the Microsoft Windows Server 2003 or Microsoft Windows Server 2008 Help. To access the Microsoft Windows Help, position your cursor over any empty space on the Windows desktop and press F1. Introduction to Terminal Services Terminal Services for Microsoft Windows Server 2003 and Microsoft Windows Server 2008 allow you to centrally manage and execute ifix. The Terminal Server environment is a thin-client architecture where all application processing occurs centrally on the Server. By installing a small piece of thin-client software from Microsoft or connecting through an Internet Explorer 5.5 (or higher) browser, thin clients are able to initiate and run individual instances of ifix on the Server. Only graphic, keyboard, and mouse instructions are sent back and forth between the client and the Server, minimizing network traffic. Using Terminal Services with ifix provides: Ease of maintenance You can install one copy of ifix onto the Server, allowing multiple users to run clients from the Server. Upgrades and SIMs only need to be installed on the Server. Shared pictures Each user accesses the same set of pictures. When one picture is changed, all users get the changes. Remote access Using the Terminal Services Advanced Client (TSAC) or Remote Desktop 1

8 Communication (RDC), clients can connect to the ifix Terminal Server and access ifix through Internet Explorer 5.5 or higher. Built-in RDC in Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008 Clients from Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008 can connect to the ifix Terminal Server using Remote Desktop Communication (RDC) and access ifix through Internet Explorer 5.5 or higher. Security Data between the ifix Terminal Server and the client session is encrypted. There is also additional security between the client machines and the ifix Terminal Server. Lightweight client machines The ifix Terminal Server locally processes the software that the clients execute. Clients connecting to the Server do not need the processing power usually required to run ifix. This allows clients running platforms from Windows 95 to Windows Server 2008 to execute ifix through Terminal Server. Specialized environments Terminal Services allows you to tightly control user accounts. For example, you can configure a user account to start and execute a single program (ifix). ifix automatically starts at log in, and the user does not have access to the Windows desktop. When the user exits ifix, he logs out of the Terminal Server account. Handheld environments Terminal Services gives you the ability to use wireless handhelds to display ifix screens. Controlled access to files Using the Windows file protection, you can limit the directories users are allowed to access and modify. File protection also allows you to create safe and separate environments for developing and testing new pictures. Using iclientts iclientts provides a multi-session version of ifix client software (iclient) that runs on a Terminal Server enabled machine. The multi-session environment allows multiple thin clients to log on to the Server and initiate individual sessions of ifix. ifix is not installed on the individual client machines, only on the Terminal Server. The user's experience is nearly identical to running ifix on their local node. From the client, it is not obvious that a user is in a Terminal Server session. Virtually all ifix client functions work including scripts, trending, alarms, and security. iclientts also allows you to remotely support ifix from any computer on your network or anywhere in the world. The following table compares iclient and iclientts features. Comparison of iclient and iclientts Feature Standard iclient iclientts Requires software on client Yes No ifix compatibility (Pictures/Schedules) 100% 100% 2

9 Comparison of iclient and iclientts Feature Standard iclient iclientts Picture navigation Yes Yes Tag Group support Yes Yes Write Access/Alarm ACK Yes Yes Historical charts and Historical datalinks Yes Yes VBA scripting Yes Yes ActiveX support Yes Yes Development/run time support Yes Yes Color support Unlimited Unlimited for Windows Server 2003 with RDP 5.1 Client, or Windows Server 2008 with RDP 6.0 Client For more information about additional color support, refer to the Designing in 256 Colors with RDP 5.0 section. Runs in browser No Yes (IE) Security ifix, Windows Server 2003, Windows Server 2008 ifix, Windows Server 2003, Windows Server 2008 ifix Environment protection Yes No Runs applications requiring services in Windows Yes Yes (if ifix is configured to run as a service) Server platforms supported Yes Yes Number of clients talking to a SCADA node Each client = 1 connection Each client = 1 connection 3

10 Comparison of iclient and iclientts Feature Standard iclient iclientts ifix SCADA Yes Yes Proficy Change Management Yes Not supported Understanding the ifix Terminal Server Environment ifix Terminal Server allows multiple clients to run individual instances of ifix from one Server. A sample ifix Terminal Server environment, illustrated in the following figure, includes a Server, one or more ifix SCADA nodes, and multiple clients. Sample 1: ifix Terminal Server Environment 4

11 Thin clients access the Terminal Server through Microsoft Remote Desktop Protocol (RDP) or Citrix Independent Computing Architecture (ICA) protocol. Each thin client accesses applications on the Server by connecting to the Terminal Server machine either through an RDP client or ICA. No ifix software is installed or runs on the thin client machine. A separate session of ifix runs on the Terminal Server for each thin client. This allows very thin clients with minimal client-side resources to execute an individual instance of ifix. The user's experience is nearly identical to running ifix on their local machine. If you have clients and SCADAs in your ifix Terminal Server environment, you can access and manage any of the SCADAs from a thin client. For example, from a thin client machine, you can build graphics, add tags, and change setpoints on a networked SCADA. Another sample ifix Terminal Server environment, illustrated in the following figure, includes a Terminal Server that runs the ifix SCADA server as a service on the same computer, and includes multiple Terminal Server clients. Sample 2: ifix Terminal Server Environment For more information on the Terminal Server environment, refer to the Terminal Services Configuration Overview section of the Microsoft Windows operating system Help. File System Support Windows provides three types of file systems for disk partitioning: NTFS, FAT, and FAT32. It is recommended that you use NTFS with ifix Terminal Server. NTFS provides greater file-level security for users in a multi-session environment. For more information on file systems and configuring file system security, refer to the Choosing a File System section of the Microsoft Windows operating system Help. 5

12 IMPORTANT: Be aware that you can configure directory level security in NTFS and the Windows operating system. Use caution when doing so. Any enhancement to security that you make at the folder or directory level is not managed within ifix. You must manage these security settings outside of ifix. Where to Find More Terminal Server Information For the most up to date Terminal Server information for Windows Server 2003 or Windows Server 2008, visit Microsoft's web site: Getting Started Before installing ifix on a Windows Server 2003 or a Windows Server 2008 computer, you must enable and set up the Windows Terminal Server. However, before you get started you should be aware of the ifix Terminal Server limitations and software and licensing requirements. You should also spend some time planning a sound network and security strategy, and user and machine naming conventions. This chapter describes the information that you need to know before installing and running ifix with Terminal Server. It includes the following topics: ifix Terminal Server Limitations Software Requirements Licensing Requirements Setting up Windows Server 2003 for Terminal Services Setting Up Windows Server 2008 for Terminal Services Configuring Terminal Server Users to Use Remote Desktop Protocol Using ifix Terminal Server Clients with FIX 32 and Pre-iFIX 3.5 SCADA Nodes ifix Terminal Server Limitations The following is a list of ifix Terminal Server limitations and assumptions: The Terminal Server computer must have Windows Server 2003 or Windows Server 2008 installed. ifix does not support running a Terminal Server on Windows Vista. However, Windows Vista users can connect to a Terminal Server node running Windows Server 2003, or Windows 2008 with RDP 6.0. Proficy Change Management is not supported from a Terminal Server client session. Running ifix on Windows NT 4.0 Terminal Server Edition or Windows 2000 is not supported. 6

13 Remote Desktop Protocol (RDP) 5.0 in Windows Server 2003 Terminal Services imposes a limit of 256 colors. For more information on color support, refer to Designing in 256 Colors with RDP 5.0. Terminal Server does not solve the ifix limitation of 200 iclients connecting to a single SCADA node. Running FIX32 and ifix on the same computer is not supported within Terminal Server. However, you can run ifix with the FIX Desktop option on the Terminal Server. Although Windows allows machine names of up to 15 characters, ifix node names are limited to eight characters. NETBIOS is not supported for connecting View (Terminal Server computer) to SCADA. Depending on your settings, some keyboard shortcuts (such as Ctrl+ALT+DEL) may be disabled or remapped. Alarm printing at the client side is not supported. User accounts must be created and accessed after installing ifix. The ifix Sample System is not supported on the Terminal Server, when running ifix as a service. When using ifix with Terminal Services and all clients share the same ifix folders, toolbars can be configured separately on each client. Refer to the ifix WorkSpace Toolbars and Terminal Server section for more details. Scalability The number of clients allowed per Server varies according to the Server's processing power and memory. iclientts performance depends on the design of the application. If you use good optimization techniques and avoid unnecessary animations when developing your application, you should be able to run more clients with better performance per Server. The Microsoft Performance Monitor can help you to determine the optimal number of iclientts sessions your Server can handle. For more information on optimizing your iclientts performance, refer to the Optimizing ifix Terminal Server chapter. TIP: Be aware that if your SCADA Server runs as a service on your Terminal Server, your processor speed and optimization routines become even more important. Be sure to read the Optimizing ifix Terminal Server section. Software Requirements ifix Terminal Server requires ifix and the following operating system: Windows Server 2003, Standard or Enterprise Edition, or Windows Server 2008, Standard or Enterprise Edition NOTE: It is highly recommended that you install the latest Service Pack and Windows Updates. 7

14 Licensing Requirements It is recommended that you install your Terminal Server on a computer that is not a domain controller. Make sure that you back up the terminal server licenses regularly, so as not to lose data. For the most up to date Terminal Server license information on Windows Server 2003, visit Microsoft's web site: For the most up to date Terminal Server license information on Windows Server 2008, visit Microsoft's web site: ifix Terminal Server Clients for Windows Server 2003 or Windows Server 2008 When a Windows Server 2003 or Windows Server 2008 client connects to the Terminal Server with External Connector Licensing disabled, the license from the client is used. The first time that you connect to the Server, that license is activated. External Connector Licensing was formerly known as Internet Connector Licensing. External Connector Licensing is not supported with ifix. By default, External Connector Licensing is disabled on the Terminal Server. If you are running a non-windows Server 2003 or Windows Server 2008 client computer, you need to purchase Windows Terminal Services Client Access Licenses (TSCALs) from Microsoft. When you first set up the ifix Terminal Server, you have a 120 day temporary license to run a maximum of 10 client machines from the Server. The first 10 Windows 9x and NT client machines that connect to the Server will reserve the licenses. NOTE: Terminal Services Client Access Licenses (TSCALs) are counted per device and are not concurrent. WARNING: Once you activate a TSCAL, it is permanently associated with that machine. You cannot reboot the machine to clear your license use. If you reformat the machine, you must contact Microsoft to obtain a replacement license. iclientts Licensing and Keys An iclientts Hardware Key is required on the Terminal Server PC to enable ifix to run in Terminal Server mode. No hardware keys are required on the thin client machines. If you purchased iclientts, you are responsible for ensuring that your licenses are used correctly. Using Terminal Server capability, you can limit the number of incoming client connections to the number of iclientts licenses that you have purchased. You can also use Terminal Server Security and ifix Security to limit the users who can initiate iclientts sessions on the Terminal Server. If you have iclientts licenses that enable a mixed environment of Developer, Run Time, and Read- Only users, your Hardware Key will be enabled for Developer use. To limit users to: Run Time only Implement ifix security and authorize only the ability to use the WorkSpace Run-Time application. 8

15 Read-only Select a single security area and apply this security area to all tags. Configure ifix security so that read-only users are not authorized for this security area. You can also limit your users to Read-Only capability by providing a user environment that does not provide any opportunity to change values. For example, you could use Data Entry Type = None for all data links when creating displays. Or when using Alarm Summaries, clear all of the items on the Operator tab in the Alarm Summary Configuration dialog box. If you have iclientts licenses that enable a mixed environment of Run Time and Read-Only uses, your Hardware Key will be enabled for Run Time use. To limit users to Read-Only, use the methods described above. For more information on setting up your licensing system and ifix Security, refer to the Implementing Security manual. Hardware Key Licensing Considerations All hardware keys distributed to run ifix contain software to enable licensing for Terminal Server client computers. For example, if you purchase a ten-client license, software embedded in the key enables ten concurrent client users, and prevents an eleventh client access to ifix. When a client disconnects from Terminal Server, the eleventh client can then access it. NOTE: You still need enough TSCALs to license all the devices that will connect to the server. Be aware that even though you may have the appropriate number of iclientts licenses enabled, if performance issues exist, you may not be able to connect. Setting up Windows Server 2003 for Terminal Services This section describes the configuration steps you need to enable and set up Microsoft Terminal Server. These steps must be performed before you install the ifix product. The Terminal Server configuration steps in Windows Server 2003 include: Enabling Windows Server 2003 Terminal Services Enabling Terminal Server Licensing in Windows Server 2003 Activating a License Server in Windows Server 2003 Through the Internet For more information about Terminal Server, refer to the Terminal Services section of the Windows Server 2003 Help. Enabling Windows Server 2003 Terminal Services It is recommended that you use the Control Panel's Add or Remove Programs dialog box to enable Terminal Services. When you enable Terminal Services in this manner, you are prompted to select Full or Relaxed Security. Otherwise, if you use the Configure Your Server Wizard, you are not prompted, and the security is set to Full, by default. On Windows Server 2003, ifix needs to use Terminal Services with Relaxed Security so that clients can load the correct SCU to start ifix. The steps that follow explain how to enable Terminal Services on a Windows Server 2003 computer, 9

16 with Relaxed security. To enable Terminal Services on a Windows Server 2003 computer: 1. Click the Start button and point to the Control Panel, and then click Add or Remove Programs. The Add or Remove Programs dialog box appears. 2. Click Add/Remove Windows components. The Windows Components Wizard opens. 3. Select the Terminal Services check box. A warning message appears explaining Internet Explorer Enhanced Security Configuration. 4. Click Yes to continue. 5. Click Next. The Terminal Server installation and licensing information appears in the next screen of the wizard. 6. Click Next to continue. The wizard requests that you set the default security permissions for application compatibility. 7. Select the Relaxed Security option and click Next. A status bar appears in the wizard showing the progress of the component configuration. When complete, the wizard displays a final screen. 8. Click Finish to close the Windows Components Wizard. A dialog box appears requesting that you restart your computer. 9. Click Yes to restart your computer. If for some reason you did not use the Control Panel's Add or Remove Programs dialog box to enable Terminal Services, you can use the steps below to change the security setting to Relaxed. To change the security setting to Relaxed: NOTE: You must be in Terminal Server mode to make these changes. Otherwise, you cannot open the Permission Compatibility setting. 1. From the Control Panel, open the Administrative Tools folder, then the Terminal Service Configuration item. The Terminal Services Configuration window appears. 2. Select the Server Settings folder. 3. Double-click the Permission Compatibility item. 4. Change the setting to Relaxed Security, and click OK. Enabling Terminal Server Licensing in Windows Server 2003 Windows Server 2003 provides the Terminal Services Licensing administrative tool to enable you to activate license servers, install key packs, and track client license use. You must be a Windows Administrator on the computer to enable Terminal Server licenses. For more information on Terminal Server licensing, refer to the Managing Terminal Services section of the Windows Server 2003 Help. To enable Terminal Server Licensing: 1. Click the Start button and point to the Control Panel, and then click Add or Remove Programs. The Add or Remove Programs dialog box appears. 10

17 2. Click Add/Remove Windows components. The Windows Components Wizard opens. Using Terminal Server 3. Select Terminal Server Licensing option in the Windows Components and click Next. The Terminal Services Licensing Setup dialog box appears. 4. If your network includes several domains, select Your Entire Enterprise. 5. Otherwise, if your network includes Windows NT 4.0 domains, or if you want to maintain a separate license server for each domain, select the Your Domain or Workgroup option. 6. Enter or browse for a path in the Install License Server Database at this Location field. 7. Click Next to continue. A message box appears requesting that you insert the Windows Server 2003 product CD-ROM. 8. Insert the CD-ROM and enter the path to the disk. 9. Click OK to continue. A status bar appears in the wizard displaying the progress of the license install. When complete, a message appears in the wizard. 10. Click Finish. Activating a License Server in Windows Server 2003 Through the Internet A license server stores all client licenses installed on a Terminal Server and provides a secure way of tracking the licenses that have been issued to Terminal Server clients. You need to install the license server, activate it through the Microsoft Clearinghouse, and install license key packs onto the license server before issuing Terminal Server client licenses. For more information on the license server, refer to the Client Services section of the Windows Server 2003 Help. The following instructions allow you to activate the license server through the Internet. If you want to activate your server through telephone, fax, or World Wide Web, refer to the Windows Server 2003 Help. To activate the license server through the Internet: 1. From Administrative Tools, open Terminal Services Licensing. 2. Right-click the license server you want to activate in the console tree. 3. Select Activate Server from the right-click menu. The Licensing wizard starts. 4. For the Activation Method, select Automatic from the drop-down list and click next. 5. Enter the required location information and click Next. Microsoft sends you an containing your server activation PIN. 6. From the Completing the Process dialog box, select one of the following: Complete the process immediately. Postpone until your PIN arrives. Restart the activation process in the Completing the Process dialog box. 7. Click Next. 8. In the Activation PIN field, enter the Microsoft supplied PIN and click Next. 9. Click Next to install client license key packs for your license server, or Click Clear Install licenses Now, then click Finish to install key packs at a later time. 11

18 Setting Up Windows Server 2008 for Terminal Services This section describes the configuration steps you need to enable and set up Microsoft Terminal Server. These steps must be performed before you install the ifix product. The Terminal Server configuration steps in Windows Server 2008 include: Enabling Windows Server 2008 Terminal Services Enabling Terminal Server Licensing in Windows Server 2008 Activating a License Server in Windows Server 2008 Through the Internet For more information about Terminal Server, refer to the Terminal Services section of the Windows Server 2008 Help. Enabling Windows Server 2008 Terminal Services It is recommended that you use Server Manager to enable Terminal Services. You must be logged in as an administrator to install Terminal Services. The steps that follow explain how to enable Terminal Services on a Windows Server 2008 computer. To enable Terminal Services on a Windows Server 2008 computer: 1. Click the Start button and point to Administrative Tools, and then Server Manager. 2. From the tree, select Roles, and then Add Roles. 3. Select the Terminal Services check box, and then click Next. 4. From Role Services list select the Terminal Server check box. A warning box appears. NOTE: If you want to enable and allow Internet Explorer connections, select TS Web Access. 5. Click Next to continue. 6. Click Next. The Authentication Selection dialog box appears. 7. Select the network level authentication to use and click Next. The Specify Licensing Mode dialog box appears. 8. Select the licensing mode to use and click Next. The Confirmation dialog box appears. 9. Click Install. A dialog box appears requesting that you restart your computer. 10. Click Yes to restart your computer. 11. Click Start, the Administrative Tools, then Server Manager. Enabling Terminal Server Licensing in Windows Server 2008 It is recommended that you use Server Manager to enable Terminal Services licensing. You must be a Windows Administrator on the computer to enable Terminal Server licenses. For more information on Terminal Server licensing, refer to the Managing Terminal Services section of the Windows Server 2008 Help. 12

19 To enable Terminal Server Licensing: 1. Click the Start button, and then click Administrative Tools, and then click Server Manager. 2. From the tree, select Roles. 3. In the Terminal Services section, select Add Roles Services. 4. Select TS Licensing and click Next. 5. Choose the discovery scope for this license server. 6. In the Location field, enter a location for the TS Licensing database, and click Next. 7. Click Install to continue. A status bar appears in the wizard displaying the progress of the license install. When complete, a message appears in the wizard. 8. Click Close. Activating a License Server in Windows Server 2008 Through the Internet A license server stores all client licenses installed on a Terminal Server and provides a secure way of tracking the licenses that have been issued to Terminal Server clients. You need to install the license server, activate it through the Microsoft Clearinghouse, and install license key packs onto the license server before issuing Terminal Server client licenses. For more information on the license server, refer to the Client Services section of the Windows Server 2008 Help. The following instructions allow you to activate the license server through the Internet. If you want to activate your server through telephone, fax, or World Wide Web, refer to the Windows Server 2008 Help. To activate the license server through the Internet: 1. Click Start, select Administrative Tools, then Terminal Services, and then click Terminal Server Licensing Manager. 2. Right-click the server you want to activate in the console tree and then click Activate Server. The Activate Server wizard starts. 3. On the Connection Method page, in the Connection method list, select Web Browser, and then click next. 4. On the License Server Activation page, click the hyperlink to connect to the Terminal Server Licensing web site. NOTE: If you are running Terminal Server Licensing Manager on a computer that does not have Internet connectivity, note the address for the Terminal Server Licensing Web site, and then connect to the Web site from a computer that has Internet connectivity. 5. Under Select Option, click Activate a license server, and then click Next. 6. In the Product ID boxes, enter your Product ID. Your Product ID is displayed on the License Server Activation page of the Activate Server Wizard. Complete the name, company, and country/region fields. Specify any other information that you want to provide, such as and company address, and then click Next. 7. Confirm your entries, and then click Next. Your license server ID is displayed. 8. On the License Server Activation page in the Activate Server Wizard, enter the license server ID that you received in the previous step, and then click Next. Your license server is 13

20 activated. 9. On the Completing the Activate Server Wizard page, do one of the following: To install Terminal Services client access licenses (TS CALs) onto your license server, select the Start Install Licenses Wizard check box, click Next, and then follow the instructions. To install TS CALs later, clear the Start Install Licenses Wizard now check box, and then click Finish. Configuring Terminal Server Users to Use Remote Desktop Protocol After adding users to Windows, you must grant them access rights to terminal server. You can use the Computer Management Console in the Administrative Tools menu to provide users with access to the Terminal Server. To grant access to users on Windows Server 2003 or Windows Server 2008 Terminal Server: 1. Click the Start button, select Programs, then Administrative Tools, and then click Computer Management. 2. Expand the Local Users and Groups options and from the System Tools tree, click the Users folder. 3. Double-click the user you want to enable to log on as a Terminal Server client in Windows. 4. On the Terminal Services Profile tab, ensure that the Deny this user permission to log on to Terminal Server is unchecked. 5. On the Member Of tab, add the group Remote Desktop users. 6. Click OK out of all dialogs. CAUTION: The Windows Logon Locally User Right introduces a degree of risk to your Server. To minimize the risk of unintentional or malicious modification to the Server, refer to the Security and Policies topics in the Microsoft Windows Help. If you configured a user to automatically start a specific iclientts session, you must prevent that user from starting a second terminal server session. Multiple sessions running the same node name or running multiple node names on the same network can cause connection not established errors. Refer to the Microsoft Knowledge Base Article Q Limiting a User's Concurrent Connections in Windows 2003 for information on limiting concurrent users. Using ifix Terminal Server Clients with FIX32 and Pre-iFIX 3.5 SCADA Nodes If you are upgrading from a previous ifix release, take the following information into consideration: Previously released ifix clients, such as ifix 3.0 and earlier (including FIX32), can take advantage of IP enhancements in ifix 3.5 and higher SCADAs, but you must provide a unique node name for the client, along with the unique IP address. 14

21 The following sections describe how to perform these tasks: Setting IP Addresses for Each Client Editing a User's SCU File Setting IP Addresses for Each Client When connecting an ifix 5.1 Terminal Server client to a ifix 3.0 (or earlier ifix version) or a FIX32 SCADA node, perform the following steps in this section to set IP addresses for each client on the Terminal Server. NOTE: Before you begin, check with your Network Administrator, so that you assign the correct IP addresses. To set up IP addresses for each client in Windows XP: 1. Right-click My Network Places and select Properties. The Network Connections dialog box appears. 2. Right-click Local Area Connection and select Properties. The Local Area Connection Properties dialog box appears. 3. On the General tab, click the Internet Protocol TCP/IP connection. 4. Click Properties. The Internet Protocol (TCP/IP) Properties dialog box appears. 5. Select to Use the Following IP Address. 6. Enter the static IP address for the Terminal Server. 7. Click Advanced. The Advanced TCP/IP Settings dialog box appears. 8. In the IP Addresses area, click Add. 9. Add an IP address for each client you want to connect. 10. Click OK to close the Advanced window. 11. Click OK to close the Internet Protocol (TCP/IP) window. 12. Click OK to close the Local Area Connection window. To set up IP addresses for each client in Windows Vista: 1. Right-click My Network and select Properties. The Network and Sharing Centre appears. 2. In the Task list on the left, click Manage network connections. 3. Right-click the Local Area Connection and select Properties. The Local Area Connection Properties dialog box appears. 4. On the Networking tab, click the Internet Protocol TCP/IP connection. 5. Click Properties. The Internet Protocol (TCP/IP) Properties dialog box appears. 6. Select to Use the Following IP Address. 7. Enter the static IP address for the Terminal Server. 8. Click Advanced. The Advanced TCP/IP Settings dialog box appears. 15

22 9. In the IP Addresses area, click Add. 10. Add an IP address for each client you want to connect. 11. Click OK to close the Advanced window. 12. Click OK to close the Internet Protocol (TCP/IP) window. 13. Click OK to close the Local Area Connection window. To set up IP addresses for each client on Windows 2003 Terminal Server: 1. From the Control Panel, open Network Connections. 2. Right-click Local Area Connection and then select Properties. 3. On the General tab, select the Internet Protocol (TCP/IP) connection, and then click Properties. The Internet Protocol (TCP/IP) Properties dialog box appears. 4. Select Use the Following IP Address. 5. Enter the static IP address, Subnet Mask and Default Gateway for the Terminal Server. 6. Click Advanced. The Advanced TCP/IP Settings dialog box appears. 7. In the IP Addresses area, click Add. 8. Add an IP address for each client you want to connect. 9. Click OK to close the Advanced dialog box. 10. Click OK to close the Internet Protocol (TCP/IP) dialog box. 11. Click OK to close the Local Area Connection dialog box.. To set up IP addresses for each client on Windows 2008 Terminal Server: 1. From the Control Panel, open Network and Sharing Center. 2. Under Task, select the Manage Network Connections link. 3. Right-click Local Area Connection and then select Properties. 4. On the Networking tab, select the Internet Protocol Version 4 (TCP/IPv4) connection, and then click Properties. The Internet Protocol Version 4 (TCP/IPv4) Properties dialog box appears. 5. Select Use the Following IP Address. 6. Enter the static IP address, Subnet Mask and Default Gateway for the Terminal Server. 7. Click Advanced. The Advanced TCP/IP Settings dialog box appears. 8. In the IP Addresses area, click Add. 9. Add an IP address for each client you want to connect. 10. Click OK to close the Advanced dialog box. 11. Click OK to close the Internet Protocol (TCP/IP) dialog box. 12. Click OK to close the Local Area Connection dialog box. 16

23 Editing a User's SCU File When using an ifix 5.1 Terminal Server client to connect to an ifix 3.0 (or earlier) or FIX 32 SCADA node, use the following steps to edit a user's SCU file to use a specific and unique IP address. NOTE: The following procedure can be done on the Terminal Server console machine. The procedure needs to be performed for each SCU configuration file that Terminal Server clients will use. To edit the SCU file: 1. From the File menu of the SCU, select Open to open the desired.scu file that the Terminal Server client will use. 2. From the Configure menu, open the Network Configuration dialog box. 3. Verify that TCP/IP is selected under Network. 4. Verify that the remote node name in the Remote Node Name edit field is correct. If the name of the remote node to which this user's node will connect is not correct, enter it in the Remote Node Name edit field and click Add. 5. Click the Advanced button to open the Advanced Network Configuration dialog box. The SCU cautions you not to modify these values unless you are familiar with the system. Click Yes to continue. 6. Enable the path (IP address) under LAN Redundancy that this user will use and disable all other paths. NOTE: Do not select the Enable LAN Redundancy check box. The IP addresses displayed in this list box are those that were set up previously by the Terminal Server Administrator. Verify that only the user's assigned unique IP address is enabled. 7. When finished, click OK to close the Advanced Network Configuration dialog. 8. Click OK to close the Network Configuration dialog. 9. On the File menu, click Save to save the SCU file. Installing and Configuring ifix with Windows Terminal Server The following sections describe the steps you need to follow after enabling Terminal Services and its licensing. Before you install and configure ifix, make sure you follow the steps outlined in the Before You Begin with ifix on Your Terminal Server section. For a description of the overview steps, refer to the Overview of the Terminal Server Setup Steps section. Refer to the Setting Up the Environment manual for more general details on ifix setup information. 17

24 Before You Begin with ifix on Your Terminal Server TIP: Prior to installing any applications for use with Terminal Server clients, refer to the Microsoft Terminal Server documentation regarding concept, configuration, and use of ROOTDRIVE. If you do not follow the recommended steps for the correct Windows Terminal Server Configuration, your applications may not function correctly. Before you begin installing and configuring ifix on a Terminal Server, it is recommended that you complete the following Windows administrative tasks: Run chkroot.cmd from the C:\Windows\Application Compatibility Script folder. This creates the RootDrv2.cmd file. In Notepad or another text editor, open the RootDrv2.cmd file from the C:\Windows\Application Compatibility Script folder. At the end of the file, on the Set RootDrive= line, add a driver letter. For example: Set RootDrive=W:. Then, save the RootDrv2.cmd file. This creates the chkroot.key file. Overview of the Terminal Server Setup Steps Once you have set up your Terminal Server, perform the following steps described in the following figure. Click a block in the diagram to jump to that section. Overview of ifix Configuration for Terminal Services 18

25 Step 1: Determining User Types and Directories This section describes actions you should consider when determining user types and directories for your ifix application. These actions include: Planning User Types Planning SCU Directories for ifix Planning Shared Directories Understanding Project Directory Paths Planning User Types Before defining your user types, determine what types of users you need. Which of your users will: Share the same preferences? Be able to configure their own historical collection settings (HTA)? Work with recipes? Develop pictures? Have development rights? Have run-time rights? Work with one or more ifix projects? Require additional directory permissions to be set outside of ifix? Anticipating the needs of your users allows you to successfully determine the configuration of your user types. For each user type, you will then create a project. You define projects paths in the ifix System Configuration Utility (SCU). Each project can have multiple users. To define a profile for each user, use the Startup Profile Manager. Planning SCU Directories for ifix Planning the directory paths for specific SCUs to provide enhanced or unique functionality per user type, thin client, or group, should be well planned. The design scheme for this type of implementation is similar to implementing the same scenario in a traditional environment (non TS) where SCU paths are using a mapped network drive on a file server. Careful planning is needed to prevent multiple users from performing conflicting actions, such as downloading recipes or modifying database values. Incorporating ifix security to limit applications and area access in the Terminal Server environment is highly recommended. For more information on setting security options in ifix, refer to the Implementing Security manual. IMPORTANT: Be aware that if you configure directory level security in NTFS and the Windows operating system, to something other than the default, use caution when doing so. Any enhancement to security that you make at the folder or directory level is not managed within ifix. You must manage these security settings outside of ifix. For each new project, by default, ifix creates the following directory structure, unless you specify that the project use one or more shared folders instead: 19

26 Directory ALM Description Stores the Alarm file and event log. Share this directory. This allows events from different sessions to be logged to the same.evt files for simpler troubleshooting of ifix under Terminal Server. Do not allow more than one ifix client to use Alarm File Services while sharing the ALM directory. APP Share or do not share this directory depending on user types and rights. HTR Stores Historical collection preferences. If more than one client will collect historical data, give each user a separate directory. HTRDATA Stores collected historical data. If clients view the same historical data charts, share the directory. LOCAL Stores the user-specific files including Toolbars, User preferences,.ini files, and the.scu file. If your users are restricted to run mode, they can share the same directories. If your users require special user preferences or configure rights, create unique directories. PDB Stores the Database files. Schedules are also saved in this directory. If schedules are shared by clients, share this directory. PIC Stores pictures (.GRF), dynamo sets (.FDS), Global color tables (.FTB), and other files (.FXG). Generally, share this directory. RCC RCM Stores recipe files. For run-time users, share the directories. Create unique directories for developers or restricted nodes. You can share directories outside the project, instead of creating each of these directories within the same project path. For instance, you may want all projects to share the C:\Program Files\Proficy\Proficy ifix\pic path, so that all users share the same pictures, but have different project paths for the other folders. For instance, you may create projects for ifix operators (C:\Program Files\Proficy\Proficy ifix\operators) and supervisors (C:\Program Files\Proficy\Proficy ifix\supervisors) that share the PIC path in C:\Program Files\Proficy\Proficy ifix\pic, but retain separate folders for all other settings. Planning Shared Directories For each project, it is recommended that certain types of users only share specific directories. The following table outlines these recommendations. 20

27 User Types and Directories to Share Project Project-Specific (Unshared) Directories Shared Directories Example User Type Run Time Only LOCAL PDB, PIC, APP, HTR, HTRDATA, ALM, RCM, and RCC Operator Run Time with Historical Collection LOCAL, HTR PDB, PIC, APP, HTRDATA, ALM, RCM, and RCC Supervisor Special Alarming Run Time LOCAL, ALM PDB, PIC, APP, HTR, HTRDATA, RCM, and RCC Supervisor Development LOCAL, PDB, PIC, APP, HTR, HTRDATA, ALM, RCM, and RCC None. Developers should have all unique directories except for NLS and the BASE path, which should always be shared. Developer Refer to the Planning SCU Directories for ifix section for descriptions of the different ifix directories. Understanding Project Directory Paths If you are using ifix Project Configuration with Terminal Services, make sure that the Base and Language Paths are the same for each project. The locations of the project paths can differ, depending upon the user type. However, the Base and Language Paths should be the same for each project. For instance, if you leave the Base and Language set to the defaults, the Base is set to C:\Program Files\Proficy\Proficy ifix and the Language is set to C:\Program Files\Proficy\Proficy ifix\nls for each project. Step 2: Installing ifix To set up Windows XP or Windows Vista to install ifix: 1. Log on to the Terminal Server as a member of the local machine's Admin group. 2. Insert the ifix installation DVD. 3. Click Next in the Install Program from DVD dialog box. 4. Use the Browse button to find Setup.exe on the ifix installation DVD. 5. Double-click Setup.exe. The installation program begins. 21

28 6. Click Next. 7. When the product install prompts you to choose an install type, select Complete. 8. Continue through the installation. 9. Restart Windows. To set up Windows Server 2003 to install ifix: NOTE: At the end of the ifix product install, do not select any options to restart your computer automatically. If you do so, the ifix product does not completely install. Instead, choose to restart the computer manually (if requested), click Finish, and then restart the computer. 1. Log on to the Terminal Server as a member of the local machine's Admin group. 2. Insert the ifix installation DVD. 3. Click Next in the Install Program from DVD dialog box. 4. Use the Browse button to find Setup.exe on the ifix installation DVD. 5. Double-click Setup.exe. The installation program begins. 6. Click Next. 7. When the product install prompts you to choose an install type, select Complete. 8. Continue through the installation. If prompted, do not select to restart computer. 9. Restart Windows. To set up Windows Server 2008 to install ifix: NOTE: At the end of the ifix product install, do not select any options to restart your computer automatically. If you do so, the ifix product does not completely install. Instead, choose to restart the computer manually (if requested), click Finish, and then restart the computer. 1. Log on to the Terminal Server as a member of the local machine's Admin group. 2. Insert the ifix installation DVD. 3. Click Next in the Install Program from DVD dialog box. 4. Use the Browse button to find Setup.exe on the ifix installation DVD. 5. Double-click Setup.exe. The installation program begins. 6. Click Next. 7. When the product install prompts you to choose an install type, select Complete. 8. Continue through the installation. If prompted, do not select to restart computer. 9. Restart Windows. Installing ifix over an Uninstall If you used Uninstall to uninstall a previous version of ifix, note that Uninstall does not delete all of the shipped toolbar files. For example, Uninstall does not remove any files from the LOCAL directories created for Terminal Server clients. 22