Installing and Commissioning Metasys Web Access

Transcription

1 Technical Bulletin Issue Date March 4, 2003 Installing and Commissioning Metasys Web Access Installing and Commissioning Metasys Web Access (MWA)...3 Introduction... 3 Key Concepts... 4 MWA... 4 Microsoft Terminal Services... 4 Microsoft Windows License Requirements... 5 Hardware and Software Requirements... 6 Installation Order... 6 Commissioning MWA... 8 Authentication Options... 9 Metasys Person-Machine Interface (PMI) on the MWA Computer Metasys PMI on a Separate Computer Special MWA Configuration for Tenant Use Automatic Log On to Windows Operating System (OS) M-Web Migration Detailed Procedures Configuring Windows 2000 Server/Advanced Server for MWA Installing MWA Configuring the Automatic Log Off Feature Setting Up Remote Users Changing the Authentication Option Changing the Picture on the MWA Logon Page Generating the Object List Configuring N1 Schedule Restricting Remote User Access to an Application Enabling Automatic Log On to Windows OS Migrating Existing M-Web Release 2.0 or Later Installations to MWA Johnson Controls, Inc. Code No. LIT Software Release 5.1

2 2 Installing and Commissioning Metasys Web Access Technical Bulletin Internet Access to MWA Troubleshooting Possible Installation Problem Using the M-Password Autologin Feature with MWA... 40

3 Installing and Commissioning Metasys Web Access Technical Bulletin 3 Installing and Commissioning Metasys Web Access (MWA) Introduction Metasys Web Access (MWA) allows any authorized building operator to control all day-to-day activities of the Building Automation System (BAS) from anywhere using intranet or Internet communication infrastructure and Microsoft Internet Explorer Web browser. This document describes how to: configure Windows 2000 Server/Advanced Server for MWA install MWA configure the automatic log off feature set up remote users change the authentication option change the picture on the MWA logon page generate the object list configure N1 Schedule restrict remote user access to an application enable automatic log on to Windows OS migrate existing M-Web Release 2.0 or later installations to MWA This document also describes Internet access to MWA and troubleshooting procedures.

4 4 Installing and Commissioning Metasys Web Access Technical Bulletin Key Concepts MWA MWA provides Web access to M-Series component features from a Windows 2000 Server/Windows 2000 Advanced Server computer to multiple remote users via Microsoft Internet Explorer Web browser. When you access the MWA computer remotely through a Web browser, MWA uses the same user interface presentation as an M5 Workstation and uses the screen manager to organize the screen space layout. By using Microsoft Terminal Services, each user connected to the MWA computer essentially acts as a separate M5 Workstation and can use the M-Series applications to access data on integrated N1 and N30 networks. Microsoft Terminal Services Terminal Services is a technology available with Microsoft Windows 2000 Server and Microsoft Windows 2000 Advanced Server that allows remote users to create a Windows 2000 client session through Microsoft Internet Explorer Web browser. The Windows 2000 client session allows the user to access the applications and resources of the MWA/Windows 2000 Terminal Services computer. Microsoft Terminal Services requires that you download an ActiveX control. The ActiveX control is available from the Microsoft Corporation. Navigate to AC/default.asp Download and install the most recent version of the Remote Desktop Web Connection ActiveX control into the TSWeb directory (default) before you install MWA. Depending on the MWA product option installed, Terminal Services can host up to 10 MWA client sessions. When a remote user is connecting for the first time, the MWA computer automatically verifies that the remote computer has the correct Remote Desktop Web Connection ActiveX control. If not found, the remote user s computer automatically downloads the ActiveX control from the MWA computer. On the client computer, the control is called Microsoft RDP Client Control (redist) and exists in the following directory: C:\[Windows Directory]\Downloaded Program Files\

5 Installing and Commissioning Metasys Web Access Technical Bulletin 5 Note: The Netscape Navigator browser does not support the ActiveX control plug-in used with Microsoft Terminal Services. MWA client sessions are not available through Netscape Navigator Web browser. Microsoft Windows License Requirements There are two types of licenses needed: the Windows 2000 Server Client Access License (CAL) and the Windows 2000 Terminal Services Client Access License (TS CAL). The MWA computer must have Per Server Windows 2000 Server CALs for the number of concurrently connected users. CALs are loaded with the Windows 2000 server OS. The number of CALs controls the number of users allowed to connect concurrently. Remote users can connect from any device, but only up to the number of Windows 2000 Server standard CALs. For example, assume that you have installed the Windows 2000 Server Operating System (OS) with 5 Windows 2000 Server CALs but you have 12 users that may need to access the MWA. All 12 users can access the MWA server, but only 5 can connect concurrently. Note: If the MWA computer was not properly configured for Per Server configuration during Windows 2000 OS installation, you can change it using Windows Licensing (Start > Programs > Administrative Tools > Licensing). In addition to the standard CALs for the Windows 2000 Server OS, each client device (computer) that connects to the MWA server is required to have a TS CAL. TS CALs are loaded onto the Windows 2000 Server Terminal Services machine (MWA server). When a new device connects to this server, one of these TS CALs is issued. Accounting for issued TS CALs differs with the operating system of the connecting device: Every device with a Windows 98 OS, Windows NT OS, or Windows XP Home Edition OS uses one of the allocated TS CALs. Devices with a Windows 2000 Professional OS or Windows XP Professional OS do not get counted as using a TS CAL. Terminal Services License Server The appropriate number of CAL and TS CAL licenses for the customer s site must be purchased from the Microsoft Corporation. Once you have purchased the Terminal Server License from the Microsoft Corporation, refer to Microsoft Knowledge Base Article number to activate the Terminal Services License Server and Install CALs over the Internet.

6 6 Installing and Commissioning Metasys Web Access Technical Bulletin Note: There are four ways to Activate the Terminal Services License Server. Please refer to the Microsoft Knowledge Base or to the Microsoft Windows Server OS documentation for other methods. Hardware and Software Requirements For hardware and software requirements, please see Metasys Installation and Platform Requirements Technical Bulletin (LIT-12012). Installation Order Depending upon whether an N1 network or an N30 network needs to be integrated, the order in which you install the software components may be slightly different. Figure 1 shows the order in which you install the software components on a Windows 2000 Server/Advanced Server computer. Note: Do not install M3 or M5 Workstation software separately on the hardware platform that runs MWA software. M3 and M5 Workstation software do not support the Windows 2000 Server/Advanced Server operating system. Make sure that you have a separate M3 Workstation connected to the N30 network, or a separate M5 Workstation connected to the N1 or N30 network for performing any network configuration activities.

7 Installing and Commissioning Metasys Web Access Technical Bulletin 7 Windows 2000 Server/Advanced Server with Per Server Windows CAL configuration Install Internet Information Server (IIS) Install Microsoft Terminal Services Download Remote Desktop Web Connection ActiveX Control from Microsoft Web site (1) Install Microsoft Terminal Services Licensing N1 Network Install Metasys PMI (2) BACnet TM Network Install Metasys Web Access Activate Terminal Services Licenses (3) (1) Refer to Microsoft Terminal Services in this document. (2) If Metasys PMI is installed on a separate computer, do not install Metasys PMI on the MWA computer. (3) Refer to Microsoft Windows License Requirements in this document. MWA-install Figure 1: Metasys Web Access Installation Procedure For any application installed (except MWA) after Microsoft Terminal Services, you must start the installations from the Windows OS Start menu at Settings > Control Panel > Add/Remove programs.

8 8 Installing and Commissioning Metasys Web Access Technical Bulletin Commissioning MWA Once MWA is installed on the computer, complete the activities listed in Table 1 before a remote user logs on. Table 1: Commissioning MWA Activity Description Refer To Configure the Automatic Log Off Feature Set Up Remote Users Authorize MWA Software Set Up M-Password Configure Trend Collectors Configure OLE for Process Control (OPC) Servers Generate the Object List Configure M-Alarm Logger Configure N1 Schedule Configure Metasys Operator Workstation (OWS) Configure M-Graphics Configure M-Trend Change Default MWA Page Restrict Remote User Access to Applications Allows MWA to automatically terminate connections if the user does not log off correctly. Create all remote users and set user permissions. Use M-Authorize to authorize all M-Series software on the computer. Create M-Password profiles for all MWA users. Open and Save the M-Password database file to the local drive. Limit M-Password configuration to one administrator (recommendation). Configure N1 Trend Collector and M-Collector. Configure BACnet OPC Data Access Server, BACnet OPC Alarm and Event Server, N1 OPC Data Access Server, and the N1 OPC Alarm and Event Server. Use the N1 OPC DA Configurator to generate the Metasys N1 object list. Use the Logger Configurator to configure the M-Alarm Logger. Use the N1 Schedule Configurator to configure N1 Schedule. Create and compile Data Definition Languages (DDLs) and download them to the N1 network. Configure M-Graphics on the MWA computer. Configure M-Trend on the MWA computer. Change the picture on the MWA logon page (optional). Restrict remote user access to the Metasys Historical Data Visualization (MHDV) Configurator and any other applications installed after MWA software. Configuring the Automatic Log Off Feature in this document Setting Up Remote Users in this document Using M-Authorize Technical Bulletin (LIT ) M-Password Technical Bulletin (LIT ) and M-Password Application Actions Technical Bulletin (LIT ) M5 Workstation User s Guide and Using M-Collector Technical Bulletin (LIT ) Using M-Alarm with the BACnet OPC AE Server (LIT ), Appendix A: N1 OPC Data Access Server Technical Bulletin (LIT ), and Using M-Alarm with the N1 OPC AE Server (LIT ) Generating the Object List in this document Configuring the Logger (LIT ) chapter of the M-Alarm User s Guide Configuring N1 Schedule in this document Operator Workstation Technical Bulletin (LIT ) M-Graphics User s Manual M-Trend User s Manual Changing the Picture on the MWA Logon Page in this document Restricting Remote User Access to an Application in this document

9 Installing and Commissioning Metasys Web Access Technical Bulletin 9 Authentication Options MWA provides remote users with two types of Windows 2000 OS authentication: with and without Windows 2000 User Authentication. The authentication type you select applies to all users. Connection with Windows 2000 User Authentication (Recommended, Default with MWA Installation) A remote user connecting to MWA needs to log on to a Windows 2000 Server. This connection type sets up individual remote user names for each remote user accessing MWA. Use M-Password as an additional level of security to control access to M-Series components. Connection without Windows 2000 User Authentication A remote user with preexisting authentication (for example, Novell NetWare Services) does not need to log on to Windows 2000 Server/Advanced Server when connecting to the MWA computer. This connection type sets up a single user name and all remote users use that name to log on to MWA. Use M-Password as an additional level of security to control access to M-Series components. M-Password supports auto logon to M-Password from the Windows 2000 Server/Advanced Server logon. Refer to Auto Logon to Security Server from Windows NT Logon in the M-Password Technical Bulletin (LIT ). Note: Auto Logon to security server requires a Windows 2000 domain controller User ID. The MWA server cannot be used as a Windows 2000 domain controller. The MWA server should be a part of another domain to get Auto Logon implemented. To use the auto logon feature with the Metasys Operator Workstation (OWS), refer to Appendix C: Metasys OWS AutoLogin (LIT ).

10 10 Installing and Commissioning Metasys Web Access Technical Bulletin Metasys Person-Machine Interface (PMI) on the MWA Computer Metasys PMI is not available for MWA remote users and is only available for MWA local users if it is installed on the same computer as MWA. Windows 2000 Server/Advanced Server with Terminal Services installed only allows a user to run one instance of a 16-bit application, and thus Metasys PMI is limited to the local user. Metasys PMI requires a user to be logged on to the Windows OS for proper data exchange with MWA. If Metasys PMI software and MWA reside on the same computer, a Windows OS local user must be logged on to the MWA computer to provide Metasys N1 network data to remote MWA users. To avoid keeping a local Windows OS user logged on to the MWA computer, MWA can be set up to communicate with a separate computer on the network that is running Metasys OWS. Note: To get data from the N1 Trend Collector to the Point History tab of M-Explorer, you must set the Enable Point History and Save Point History flags in PMI software. Metasys PMI on a Separate Computer A user must be logged on to the Windows OS where the Metasys OWS is installed for MWA to get data from the Metasys N1 network. If Metasys PMI and MWA reside on the same computer, a Windows OS local user must be logged on to the MWA computer to provide Metasys N1 network data to remote MWA users. To avoid keeping a local Windows OS user logged on to the MWA computer, MWA can be set up to communicate with a separate computer on the network that is running Metasys OWS. To communicate with the Metasys OWS on a separate computer, use the network address of the Metasys OWS to reconfigure the following applications: N1 OPC Data Access Server (DAS) N1 OPC Alarm and Event (AE) server N1 Schedule The Metasys OWS must be running the application called Metahost. Metahost.exe should be configured to run on startup when the Metasys OWS starts on a separate computer. With this configuration, Metasys PMI is unavailable to the local MWA user since Metasys PMI is not operating on the same computer as MWA. The Metasys OWS computer s Internet Protocol (IP) address must be used to configure the OPC servers for the N1 network.

11 Installing and Commissioning Metasys Web Access Technical Bulletin 11 For trend collection with Metasys PMI on a separate computer, the N1 Trend Collector runs on the same computer as Metasys PMI. Note: To get data from the N1 Trend Collector to the Point History tab of M-Explorer, you must set the Enable Point History and Save Point History flags in PMI software. Use the MWA Installation CD-ROM to install N1 Trend Collector on this computer. From Windows Add/Remove Programs, choose Add New Programs and navigate to M5 > M5 Workstation > setup.exe on the MWA CD-ROM. Perform a custom M5 installation and select the following components: Johnson Controls Access Historian Johnson Controls M-Authorize Johnson Controls M-Password Johnson Controls N1 Trend Collector Release Refer to the M5 Workstation Installation Technical Bulletin (LIT ) for details. Note: You do not need to activate temporary authorization for this computer with M-Authorize. If the temporary authorization is already activated, you can ignore it until it expires or remove the temporary license using M-Authorize. When N1 Trend Collector is running on the separate computer with Metasys PMI, you need to configure N1 Trend Collector to write the database file (Trenddb.mdb) to the MWA computer. On the MWA computer, create a folder to share (for example, AccessHistorianData) and set the folder file sharing properties to allow the MWA Terminal Server Group access to the folder. On the computer running Metasys PMI, map the folder (in this case, AccessHistorianData) as a network drive. Use the Data Sources Open Database Connectivity (ODBC) administrative tool to select the drive (mapped folder) and set the database file (Trenddb.mdb) as an Access Historian Data Source. N1 Trend Collector now writes to the folder on the MWA computer. Note: This N1 Trend Collector configuration on a firewall requires Port 445 to be open. Consult with the customer s Information Technology (IT) staff before configuring N1 Trend Collector on a Metasys PMI computer.

12 12 Installing and Commissioning Metasys Web Access Technical Bulletin Special MWA Configuration for Tenant Use You can also configure MWA for an occupant/tenant user application that allows an occupant to control his or her own environment. This special configuration allows the user to access one single M-Graphics display that shows his or her personal environment. To configure MWA for this tenant user application (only if MWA software is installed on the same computer as PMI software), follow these guidelines: 1. Remove the M5 startup shortcut from the all-users startup menu on the MWA server computer. 2. On the MWA server computer, create one local user account and activate auto logon for this user so that the computer starts up automatically after a reboot. Note: This user must have Power User or Administrator privileges. 3. Insert an M5 shortcut into the Start menu for the local auto login user created in Step 2. This step allows the MWA server to start automatically in the local session. Note: You do not have to insert an M5 shortcut for all tenant users. This only needs to be done for the auto logon user created in Step 2. The reason for creating this local user is to make sure that PMI software starts automatically after a reboot and provides data to the OPC DA Server, at the time when M-Graphics starts the OPC DA Server. 4. Create all of the terminal MWA users. 5. Place a shortcut in the Start menu of all the terminal server users which points to the graphic for that particular user (for example, C:\Documents and Settings\All Users\Application Data\Johnson Controls\M-Data\M-Graphics\room101.gdf). Note: To ensure that M-Graphics starts automatically in runtime mode, either select Start in Runtime Mode from the application preferences of M-Graphics, or configure the shortcut so that it starts the application in runtime mode (for example, C:\Program Files\Johnson Controls\M-Graphics\gwx32.exe" - runtime "C:\Documents and Settings\All Users\Application Data\Johnson-Controls\M-Data\M-Graphics\room101.gdf") 6. Limit each users access to the Windows desktop using the Windows policy editor.

13 Installing and Commissioning Metasys Web Access Technical Bulletin 13 Note: If a large number of users is going to access the server (expected in a tenant application), it is also a good idea to limit the connection time of each terminal server user to 3 to 5 minutes. Other users cannot access the server if multiple users have not logged off after accessing the server. Automatic Log On to Windows Operating System (OS) When MWA and Metasys PMI software reside on the same computer, you can configure a user to log on to the Windows 2000 Server/Advanced Server OS automatically by editing the registry database. With this configuration, Windows OS starts and does not prompt you for the password. This configuration allows the server to reboot without anyone being present (for example, after a power failure during the night) and is important in situations where trend data is critical. Refer to Enabling Automatic Log On to Windows OS in this document. IMPORTANT: The Automatic Log On feature may pose a security risk. If you set a computer for automatic log on, anyone who can physically obtain access to the computer can gain access to all of the computer contents, including any network or networks to which it is connected. In addition, when automatic log on is enabled, the password is stored in the registry in plain text. The specific registry key that stores this value is remotely readable by the Authenticated Users group. This setting is only recommended for cases where the computer is physically secured and steps have been taken to ensure that unauthorized users cannot remotely access the registry. M-Web Migration MWA provides a functional replacement for M-Web. MWA may be able to reuse existing graphics (.gdf) and trend (.htv) files. The M-Graphics animation limitations imposed by M-Web are removed by MWA. You can now enhance the existing M-Web based M-Graphics files to use the full functionality of M-Graphics. With MWA: M-Explorer provides navigation and object level summary similar to the M-Web summary features. M-Web customized summary feature is not supported by MWA. M-Password replaces the M-Web password feature. Screen manager replaces M-Web graphics links. Migrating existing M-Web installations to MWA is a manual process that you do before you install MWA. Refer to the procedure Migrating Existing M-Web Release 2.0 or Later Installations to MWA in this document.

14 14 Installing and Commissioning Metasys Web Access Technical Bulletin Detailed Procedures Configuring Windows 2000 Server/Advanced Server for MWA To configure Windows 2000 Server/Advanced Server for MWA: Information Technology (IT) Requirements Before installing Windows 2000 OS, get the information listed in Table 2 from your IT department. Table 2: IT Requirements Requirement Static Internet Provider (IP) Address* Subnet Mask* Default Gateway* Domain or Workgroup Name* Description The network location of the computer you are setting up The name of the workgroup or domain where you are installing the new computer Place Server on Domain Only the Network Administrator can add a server to a domain (domain users only). * Required during Windows 2000 Server/Advanced Server installation Set Up Windows Install Windows 2000 Server or Windows 2000 Advanced Server with the components listed in Table 3. During Windows 2000 Server/Advanced Server installation, set the licensing mode to Per Server and set the minimum number of Windows Client Access Licenses equal to the number of MWA remote users. For an example of a typical installation procedure, refer to Appendix A: Metasys Web Access (MWA) Server Installation Guidelines (LIT ).

15 Installing and Commissioning Metasys Web Access Technical Bulletin 15 Table 3: Windows 2000 Server/Advanced Server Components Component Description MWA Must Have: NTFS File System Allows MWA to control user access to directories, applications, and individual files. MWA installation requires that the C: drive has NTFS. Service Pack 2 Provides bug fixes and security updates for the OS. Available from Microsoft Corporation. Application Server* Set at the Terminal Services Setup screen during the installation. Allows multiple connections to Windows 2000 Terminal Services. Networking Services* Installs Networking Services. IIS* Terminal Services* Terminal Services Licensing* MWA Cannot Have Certificate Services* Installs IIS. Installs Windows 2000 Terminal Services technology. Installs the Windows 2000 Terminal Services Licensing program. Does not allow necessary Application Server mode. Cluster Services* Does not allow more than three remote connections to Terminal Services. * Indicates the components can be added or changed after Windows 2000 Server/Advanced Server installation. IMPORTANT: The Microsoft Corporation has issued two security patches, MS02-46 and MS02-47, that affect MWA. MWA users should download and install these two patches. MWA users should download and install the MS02-46 and MS02-47 Microsoft Security patch immediately from the following addresses: et/security/bulletin/ms asp net/security/bulletin/ms asp

16 16 Installing and Commissioning Metasys Web Access Technical Bulletin Installing MWA Table 4: Terminal Services Setup Option Application Server Permissions Compatible with Terminal Server 4.0 Users Your domain or workgroup Description Do not select the default remote Administration setting. Select Permissions Compatible with Terminal Server 4.0 Users instead of Permissions compatible with Windows 2000 Users, recommended. Keep the default location. Notes: Install Internet Information Server (IIS) and Microsoft Windows 2000 Terminal Server software before installing MWA. Download and install the most recent version of the Remote Desktop Web Connection ActiveX control from the Microsoft Web site before you install MWA ( TSAC/default.asp). To install MWA: 1. Insert the MWA CD-ROM. Note: If autorun is disabled, browse to MWA_Setup.exe and double-click it. The Welcome dialog box appears. The install verifies that M-Series software components are installed. The install then launches the M5 Workstation installation included with MWA. Refer to M5 Workstation Installation Technical Bulletin (LIT ) for details. Table 5 lists the M5 Install types and components required for MWA. Continue to Step 2 when the M5 installation is complete. Table 5: M5 Install Types Install Type Typical (recommended) Custom N1 Network Custom N30 Network Available Components No manual selections M5 Master, screen manager, M-Authorize, M-Password, Metasys PMI, N1 OPC DA and Alarm and Event (AE) servers M5 Master, screen manager, M-Authorize, M-Password, BN OPC DA and AE servers IMPORTANT: Do not install M5 Workstation software directly from the MWA CD. The MWA installation sequence installs the necessary M-Series software. If, for any reason, you install M5 Workstation on the MWA Server computer after the MWA software, re-install MWA after the M5 Workstation installation for MWA to configure the system correctly. 2. Click Next. The Software License Agreement dialog box appears.

17 Installing and Commissioning Metasys Web Access Technical Bulletin Click Yes to accept the terms of the License Agreement. The Choose Destination Location dialog box appears (Figure 2). Figure 2: Choose Destination Location Dialog Box 4. Verify that the destination is in C:\Inetpub\wwwroot and click Next. The Configure Virtual Directory dialog box appears (Figure 3).

18 18 Installing and Commissioning Metasys Web Access Technical Bulletin Figure 3: Configure Virtual Directory Dialog Box 5. Specify the name of the virtual directory in the Directory Name field (for example, type MWA) and click Next. The Select Domain User dialog box appears (Figure 4). Note: The virtual directory is the name that remote users use to connect to the MWA.

19 Installing and Commissioning Metasys Web Access Technical Bulletin 19 Figure 4: Select Domain User Dialog Box 6. Enter an existing Username, Password, and Confirm Password. If the user you entered already exists, the Start Copying Files dialog box appears (Figure 6). If you enter a name that does not exist, the Create User Account dialog box appears (Figure 5) to create the administrator you entered. Click Yes. The Start Copying Files dialog box appears (Figure 6). Note: Windows 2000 Server policies introduced by your IT department may not allow you to create the user here. If not, the MWA installation displays an error code for your IT department to see the policy that is not allowing MWA to create the user. Work with your IT department to resolve policy issues. Figure 5: Create User Account Dialog Box

20 20 Installing and Commissioning Metasys Web Access Technical Bulletin Figure 6: Start Copying Files Dialog Box 7. Confirm the current settings and click Next to begin installation or click Back to change any of the selected settings. When the installation finishes, the Terminal Services Client dialog box appears and asks if you want to read the Release Notes. 8. Click Yes or No. The Setup Complete dialog box appears and asks if you want to restart the computer.

21 Installing and Commissioning Metasys Web Access Technical Bulletin 21 Figure 7: Setup Complete Dialog Box 9. Select Yes, I want to restart my computer now and click Finish. Configuring the Automatic Log Off Feature Note: If a remote user does not log off correctly (for example, if the user closes their Web browser before logging off), the session stays active on the MWA computer. The automatic log off feature ends the session if the user does not log off correctly. To configure the automatic log off feature: 1. On the task bar, click the Start button and select Programs > Administrative Tools > Terminal Services Configuration. The Terminal Services Configuration explorer window appears (Figure 8).

22 22 Installing and Commissioning Metasys Web Access Technical Bulletin Figure 8: Terminal Services Configuration Explorer Window 2. Select Connections in the left pane. 3. Double-click RDP-Tcp in the right pane. The RDP-Tcp Properties dialog box appears. 4. Click the Sessions tab (Figure 9).

23 Installing and Commissioning Metasys Web Access Technical Bulletin 23 Figure 9: RDP-Tcp Properties Dialog Box Sessions Tab 5. Select the first Override user settings and set options according to Table 6. Table 6: Session Dialog Box Options Field Description End a Disconnected Session Terminates a session if the user closes the Web browser. Active Session Limit Sets a time limit that a user can stay connected and terminates the session after that time. Idle Session Limit Terminates a session if the user is inactive for a certain amount of time. 6. Select the second Override user settings and select End session. 7. Click OK.

24 24 Installing and Commissioning Metasys Web Access Technical Bulletin Setting Up Remote Users Notes: Repeat Creating a New User and Setting User Permissions Sections for each MWA remote user. The MWA computer cannot be used as a domain controller. Creating a New User To create a new user: 1. On the Windows Start menu, click Programs > Administrative Tools > Computer Management. The Computer Management explorer window appears (Figure 10). Figure 10: Computer Management Explorer Window 2. Click Local Users and Groups in the left pane of the Computer Management explorer window. 3. Double-click Users in the right pane. 4. Click Action > New User... The New User dialog box appears (Figure 11).

25 Installing and Commissioning Metasys Web Access Technical Bulletin 25 Figure 11: New User Dialog Box 5. Fill in the fields with the new user information and password settings. 6. Click Create. The dialog box resets for another new user. 7. Click Close or return to Step 5. Setting User Permissions To set user permissions: 1. In the right pane of the Computer Management dialog box (Figure 10), select a user. 2. Right-click on the User and select Properties from the pop-up menu. The User Properties dialog box appears with the user name in the upper left hand corner (Figure 12).

26 26 Installing and Commissioning Metasys Web Access Technical Bulletin Figure 12: User Properties Dialog Box 3. On the Member Of tab, click Add... The Select Groups dialog box appears (Figure 13).

27 Installing and Commissioning Metasys Web Access Technical Bulletin 27 Figure 13: Select Groups Dialog Box 4. Select MWA Terminal Server Group and click Add. 5. Select Power Users and click Add. 6. Click OK.

28 28 Installing and Commissioning Metasys Web Access Technical Bulletin Changing the Authentication Option To change the authentication option: 1. On the task bar, click the Start button and select Programs > Administrative Tools > Terminal Services Configuration. The Terminal Services Connection explorer window appears. 2. Select Connections in the left pane. 3. Double-click RDP-Tcp in the right pane. The RDP-Tcp Properties dialog box appears. 4. Click the Logon Settings tab (Figure 14). Figure 14: RDP-Tcp Properties Logon Settings Tab 5. Set RDP-Tcp options depending on your connection type according to Table 7.

29 Installing and Commissioning Metasys Web Access Technical Bulletin 29 Table 7: Connection Type Settings Connection Type Setting With Windows 2000 User Authentication* Without Windows 2000 User Authentication * Default and recommended ** Every user must log on using this name. Select Use client-provided logon information. Select Always Prompt for Password. Select Always use the following logon information: Complete the User name and Domain fields.** Select Always prompt for password. 6. Click OK. 7. Close the Terminal Services Connection explorer window. Changing the Picture on the MWA Logon Page To change the picture on the MWA logon page: 1. Create a 4 in. x 4 in. picture. 2. Save the picture with the name customer.jpg 3. Move the file to the MWA virtual directory (for example c:\inetpub\wwwroot\mwa). The picture file appears on the MWA logon page (Figure 15). Figure 15: Location of customer.jpg Picture

30 30 Installing and Commissioning Metasys Web Access Technical Bulletin Generating the Object List Note: Before you can use the N1 OPC Configurator to generate the object list, the Global and NC DDL files must already exist. MWA uses the files from the configured Metasys PMI software. Before you can use these DDL files, you must compile them first without errors. To generate the object list: 1. Close all programs, including the M5 screen manager. 2. On the Start menu, select Programs > Johnson Controls > N1 OPC DA Server > N1 OPC DA Configurator. The N1 OPC Configurator program appears (Figure 16). Figure 16: N1 OPC Configurator Program 3. On the Tools menu, select Generate Object list. The Generate Object List dialog box appears (Figure 17).

31 Installing and Commissioning Metasys Web Access Technical Bulletin 31 Figure 17: Generate Object List Dialog Box 4. Click Browse. The Open dialog box appears (Figure 18). Note: If MWA accesses Metasys PMI on a remote machine, you need to copy all the DDL files to MWA local drive to generate object list.

32 32 Installing and Commissioning Metasys Web Access Technical Bulletin Figure 18: Open Dialog Box 5. Navigate to and select the Global DDL file and click Open. The path appears in the Select DDL File field (Figure 19). Figure 19: Generate Object List Dialog Box Showing Global DDL File

33 Installing and Commissioning Metasys Web Access Technical Bulletin Click Add. The path appears in the Global File Name section. 7. In the NC File Name section, click Browse. The Open dialog box appears. 8. Navigate to and select the NC DDL file(s) and click Open. Note: Select all NC DDL files associated with the global DDL file. 9. Click Add and the file names appear in the NC File Name section. 10. Click OK. If a database already exists, the N1OPCConfigurator dialog box appears (Figure 20). If not, skip Step 11 and the N1OPCConfigurator program appears. Figure 20: N1OPCConfigurator Dialog Box Note: When configuring multiple networks, click No for the first network to start a new object list. For all subsequent networks, click Yes to add all of the networks together into the same object list. The N1 OPC Configurator program appears. Configuring N1 Schedule To configure N1 Schedule: Note: The N1 Schedule OCX provides access to N1 Schedules residing in NCMs. 1. On the Windows Start menu, click Programs > Johnson Controls > N1 Schedule > N1 Schedule Configurator. The N1 Schedule Configurator appears (Figure 21). Figure 21: N1 Schedule Configurator 2. Complete the IP Address and Timeout fields.

34 34 Installing and Commissioning Metasys Web Access Technical Bulletin 3. Click OK. Restricting Remote User Access to an Application Note: Use this procedure to limit remote user access to any application installed on the MWA computer after the MWA software is installed (for example, MHDV configurator). To restrict remote user access to an application: 1. Use Windows Explorer and browse to the executable file (.exe) of the application. 2. Right-click and select Properties from the pop-up menu. 3. On the Security tab, remove MWA Terminal Server Group, Terminal Server User, and Users groups from the list of allowed groups. 4. Click OK. Enabling Automatic Log On to Windows OS IMPORTANT: The registry contains system configuration information. Use extreme caution when using the registry editor. IMPORTANT: This setting is only recommended for cases where the computer is physically secured, and steps have been taken to ensure that unauthorized users cannot remotely access the registry. To enable automatic log on to Windows OS: 1. Start Regedt32.exe, and then locate the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 2. Using your account name and password, double-click the DefaultUserName entry, type your user name, and then click OK. 3. Double-click the DefaultPassword entry, type your password, and then click OK. Note: If the DefaultPassword value does not exist, perform the following steps: a. On the Edit menu, click Add Value. b. In the Value Name box, type DefaultPassword, and select REG_SZ for the Data Type.

35 Installing and Commissioning Metasys Web Access Technical Bulletin 35 c. Type your password in the String box. Save your changes. d. Also, if no DefaultPassword string is specified, Windows OS automatically changes the value of the AutoAdminLogon key from 1 (true) to 0 (false), which disables the AutoAdminLogon feature. 4. On the Edit menu, click Add Value, enter AutoAdminLogon in the Value Name box, and select REG_SZ for the Data Type. 5. Type 1 in the String box. Save your changes. 6. Quit Regedt Click Start, click Shutdown, and then click OK to turn off your computer. When you restart the computer, it logs on to the Windows OS automatically. Note: To bypass the AutoAdminLogon process and to log on as a different user, hold down the SHIFT key after you log off or after Windows OS restarts. Migrating Existing M-Web Release 2.0 or Later Installations to MWA To migrate existing M-Web Release 2.0 or later installations to MWA: 1. Copy the files and folders listed in Table 8 onto a network drive or a CD-ROM. Table 8: M-Web Files and Directories Files or Folders Default Location Contents M-Graphics Folder C:\Documents and Settings\All Users\ Application Data\Johnson Controls\M-Data Copy all.gdf files. Copy any saved/edited files in subfolders. Do not include subfolders - MWA installs the latest sample files. Any customer created subfolders should be copied. M-Trend Folder Access Historian Database M-Web Sample Graphics Folder Continued on next page... C:\Documents and Settings\All Users\ Application Data\Johnson Controls\M-Data C:\Documents and Settings\All Users\ Application Data\Johnson Controls\M-Data\ Access Historian\Active Database C:\Documents and Settings\All Users\ Application Data\Johnson Controls\M-Data Copy all.htv files. Copy any saved/edited files in subfolders. Do not include subfolders - MWA installs the latest sample files. Any customer created subfolders should be copied. Copy all.mdb files. Copy any saved/edited.gdf files.

36 36 Installing and Commissioning Metasys Web Access Technical Bulletin Files or Folders (Cont.) Default Location Contents N1 OPC DA Server gdf files C:\Documents and Settings\All Users\ Application Data\Johnson Controls\M-Data C:\program files\johnson Controls\ N1OPC (M-Web Release 2.0) N1 OPC DA Server folder All customer created M-Graphics files in other locations htv files All customer created M-Trend files in other locations M-Web Folder* C:\Inetpub\wwwroot\M-Webx.x M-Web database files * Copy for your reference. Do not restore to the MWA computer. 2. Install MWA. 3. Restore the files and folders onto the computer running Windows 2000 Server/Advanced Server with MWA. 4. Navigate through all M-Graphics displays to confirm that they work correctly. Note: Refer to the M-Graphics User s Manual. 5. Verify that archived trend is properly restored on the MWA computer. If M-Web used AspenTech InfoPlus.21 Historian, reconfigure M-Trend to connect to Access Historian. Notes: Refer to Appendix A: Adding Database Connections (LIT ). M-Trend in MWA does not retrieve existing data from AspenTech InfoPlus.21 Historian. If M-Web used Access Historian, open the M-Trend database files (.htv) to confirm that M-Trend is retrieving data. Internet Access to MWA Network security issues make connecting to MWA over the Internet a special concern. This section is used to convey possible security risks to the IT department. This section only applies to situations where remote users are connecting to the MWA computer from somewhere on the Internet. There are two recommended approaches to connect to MWA from the Internet: use a Virtual Private Network (VPN) or use a firewall.

37 Installing and Commissioning Metasys Web Access Technical Bulletin 37! CAUTION: Risk of Equipment Damage or Data Loss. Network Security is an important issue. Configurations that expose the customer networks to the Internet need to be approved by your customer s IT department. Internet Access to MWA using a VPN The simplest method of connecting to MWA from the Internet is to use a VPN (Figure 22). If a VPN already exists, the risks and security concerns have already been established. The system would act as though the remote users were on the company intranet. MWA Remote User 1 VPN Tunnel Internet VPN Router MWA Remote User 2 intranet MWA Computer MWA Remote User 10 BAS Network mwa-vpn Figure 22: MWA Internet Communication via VPN Internet Access to MWA using a Firewall You can connect to MWA from the Internet using a firewall (Figure 23). A firewall is a combination of hardware and software that provides a security system to prevent unauthorized access from the Internet to the intranet. Demilitarized Zone (DMZ) is a term referring to the portion of a network located between the Internet and the intranet. It is a buffered area that is usually protected by one or more firewalls. Because a local user cannot stay logged on, M-Trend is not available with this configuration.

38 38 Installing and Commissioning Metasys Web Access Technical Bulletin MWA Remote User 1 Firewall DMZ MWA Remote User 2 Internet MWA Computer Inbound ports 80 and 3389 from Internet and Local Area Network (LAN) to MWA MWA Remote User 10 Inbound Port from MWA server to OWS Metasys OWS N1 Network MWA-firewall Figure 23: MWA Internet Communication via Firewall Network Security Risks MWA communicates with the Metasys OWS using Port 24688, leaving your network exposed to the Internet on this port. Mitigating Factors Consider the following: Use firewalls to isolate MWA from the intranet. Close inbound Ports 3389 and 445 to the intranet. Set up two firewalls to semi-separate the Metasys OWS from the intranet. A semi-separate Metasys OWS provides another set of log files and controls traffic better. Set up an Intrusion Detection System (IDS) to monitor the servers and detect changes to the system. Restrict the IP addresses that can access the MWA system. Use strong encryption for the terminal session when connecting to the MWA server. Do not use the administrative ID (or any ID with administrative rights) to access the system from the Internet.

39 Installing and Commissioning Metasys Web Access Technical Bulletin 39 Troubleshooting Possible Installation Problem Problem New installation of MWA software installs incorrect OPC Server Subscription information. Symptom After performing a new install of an M5 Workstation, or MWA software, and running the Alarm Logger Configurator, click the Edit Subscription button. If Iconics servers are shown rather than Johnson Controls servers (Figure 24), then the wrong OPC Server Subscription information has been installed. Figure 24: Subscription Properties Showing Iconics Servers Solution The default logger configuration file (awxlog32.mdb) needs to be replaced.

40 40 Installing and Commissioning Metasys Web Access Technical Bulletin To replace the Default Logger Configuration file: Note: The following operation needs to be performed in both the Empty Database folder and the Active Database folder. Both folders are in the c:\documents and Settings\All Users\Application Data\Johnson Controls\M-Data\M-Alarm\ folder. 1. Open Windows Explorer. 2. Navigate to and open the Empty Database folder in the C:\Documents and Settings\All Users\Application Data\Johnson Controls\M-Data\M-Alarm\ folder. 3. Right-click the awxlog32.mdb file and select Rename. 4. Rename the file oldawxlog32.mdb. 5. Press the Enter key. 6. Right-click the n1aegeneventlog.mdb file and select Rename. 7. Rename the file awxlog32.mdb. 8. Press the Enter key. 9. While still in the c:\documents and Settings\All Users\Application Data\Johnson Controls\M-Data\M-Alarm\ folder, navigate to and open the Active Database folder. 10. Repeat Steps 3 through Restart the MWA software. Using the M-Password Autologin Feature with MWA Problem The MWA Autologin feature for M-Password requires the login User ID from a Windows NT/Windows 2000 Domain Controller. When Windows 2000 Server/Advance Server OS is converted to a domain controller, it removes the Power User group from Computer Management/Local Users and Groups to increase the security of the domain controller. However, since the MWA application requires the remote user to have Power User group privileges, this issue impacts the MWA system security design and the use of the M-Password Autologin feature for MWA. Solution The power users group only exists on computers in a workgroup and M-Password Autologin only works using a domain controller. Use the following solution to restore the M-Password Autologin feature capability for MWA:

41 Installing and Commissioning Metasys Web Access Technical Bulletin 41 Add the MWA-based Windows 2000 Server to another domain controller. This action allows the MWA-based Windows 2000 Server to log on to another domain controller and keep the Power User group privileges available on the local machine for MWA components. When defining MWA remote users on the domain controller, add the local Power Users group and MWA Terminal Server Group to the Domain Users group. Note: This solution may introduce Domain Name System (DNS) and machine name resolution error messages. Contact IT support of the site for assistance or if you are unfamiliar with domain controllers. Controls Group 507 E. Michigan Street P.O. Box 423 Milwaukee, WI Published in U.S.A.