250 Scala Installation Manual For Windows Operating Systems PDF Free
250 Scala Installation Manual For Windows Operating Systems PDF Free
Installation Manual
for Windows Operating Systems
Version.Revision 2.79
TABLE OF CONTENTS
1 HI NT S O N U SI NG T H I S DO CU M ENT 7
3 IN ST A LL AT IO N 2 50 S CA L A 39
4 IN ST A LL AT IO N O F O PT I O N A L CO M PO N E N T S 53
5 UP D AT E 2 5 0 S CA L A 63
6 UP D AT E O F T O O L BO X II 65
7 S EC UR IT Y 73
8 UN IN ST A LL AT IO N 2 5 0 S C AL A 75
9 25 0 S C A L A DAT A ST O R A G E 77
10 25 0 S C A L A S ET T ING S 79
11 P AG EC O NT RO L F O R S EN D M ES S AG E I N D ET A IL 95
12 W INDOW S AUT O LO G O N 10 9
13 NT P- C LI E NT 11 3
13.1 Tip regarding 250 SCALA settings when using NTP................................................... 113
14 O N- SC R E EN K E YB O A RD 11 5
15 T IP S & T R IC K S 11 7
16 CO NF IG UR AT IO N SH E ET FO R 25 0 S C A LA CO M P O N ENT S 12 5
17 FUN CT IO N AN D T A S K O F D E ACT I V AT E D S ER V IC E S 13 1
This document describes the procedure for installing the standard 250 SCALA package on an IBM-
compatible system platform for the revision specified on Page ii.
In addition to this document, other 250 SCALA Installation Manuals are available, e.g. for other system
platforms.
The 250 SCALA Installation Manuals were written for persons who are familiar with the initial
installation and technical maintenance tasks for the purpose of acquainting them with 250 SCALA's
system technique as an essential preparation or valuable aid in performance of their tasks. This
includes both customers and ANDRITZ HYDRO employees.
1.3 HANDLING
The 250 SCALA Installation Manuals were written for all kinds of users and are therefore useful as
both an introduction and a reference. It is recommended that new users read this document from start
to finish.
The 250 SCALA Installation Manuals should be available at each 250 SCALA plant.
Since 250 SCALA Installation Manuals were not written for a specific project, synonyms are used in
certain passages rather than project-specific terms. For example, the designations in italics and
set off by angle brackets are different for each 250 SCALA process computer system:
The following chapter should provide support for the installation of the operating system. It is not to be
regarded as a complete guide for the installation of the operating system, but provides a few important
hints in order to set up the operating system correctly for 250 SCALA.
Overview tables with the operating systems and Microsoft Office versions supported by each
250 SCALA version can be found in the document "Operating Systems and Microsoft Office
Compatibility Sheet".
To be found
• in the 250 SCALA Help in the section "Installation" or
• in the ISI-Web under ISI Item Number D74-143.
The installation of the operating system on "pre-installed" PCs that are supplied by Dell corresponds to
the greatest possible extend to that of PCs without a pre-installed operating system (see chapter
2.3, "Operating system installation for computers not pre-installed").
The only difference is merely that on a pre-installed PC from Dell the installation media for the
operating system is already available on the hard disk while on a PC without pre-installation the
Windows DVD with the operating system has to be present and to be inserted in the DVD-drive.
For computers that are not pre-installed, the operating system installation is to be carried out
completely new with the operating system installation DVD.
In general the following rough steps for the operating system installation are necessary (the sequence
can vary depending on the type of computer or operating system and should serve as support).
• "Make it yours"
Regarding the usage of a Microsoft account proceed according to your company's guidelines.
In case of doubt this step should be skipped ("Skip this step") as the sign in to a Microsoft
account is also possible at a later time.
At this point, one should again refer to the more detailed manufacturer documents
available.
The following option must be activated in Windows Explorer: "File name extension"
2.6 PARTITIONING
With the following partitioning, it has to do with recommendations that have been prepared in co-
operation with the ANDRITZ HYDRO Hardware-, Product- and Development sectors.
Each project can determine the ideal partitioning for itself, but care must be taken that there is
sufficient free hard-disk storage space available on each drive after the installation.
In the following chapters the drives are specified with the names used in the above table (e.g.
<SYSTEM>).
The existing drive "C" has to be downsized to the a. m. value (e.g.: 160 GB).
• (Shrink Volume...)
• The amount of space to shrink has to be specified. "Enter the amount of space in
MB:"
• After this, the area that has been freed up can be set up for drive "E”. Right-click the
unallocated space; select "New Simple Volume…".
2.7 MULTILINGUALISM
To display menus, dialog fields and other elements of the user interface in further languages language
packs can be downloaded from Microsoft.
For this purpose the Windows Settings have to be opened and Time & language is to be
selected.
Attention!
Due to the change of the language also the keyboard layout might change. This might lead to
the fact that characters (especially special characters) are now located on other keys of the
keyboard.
Following the installation of the Language Pack and the switch over to a new language are described
for Office 2016.
OK
• Close Excel
2.8 NETWORK
Each 250 SCALA control centre system has at least one physical network.
This Ethernet network is used for combining the distributed systems (Process computer components,
Visualization components) and is also normally used for coupling the automation system to the control
centre system.
For 250 SCALA projects, so-called free or private network addresses are assigned by
ANDRITZ HYDRO as network addresses in the range of 172.16.1.0 to 172.20.253.0.
According to a definition (RFC 1918) these network addresses are not used in the Internet.
An important reason is to be seen in the possibility of world-wide remote maintenance of 250 SCALA
control centre systems with TCP/IP via public networks.
Furthermore, as standard the project abbreviation is used to form the Host name and the network
addresses are used for forming the IP-addresses.
Naturally, Host names and IP-addresses assigned by the user can still also be taken into account.
For details see chapter 15.6, "Suggestion for network addressing, network mask and host name
assignment".
2.9 WINDOWS-USER
It is strongly recommended to create further Windows-Users besides the User "LocalAdmin", that
should not have administrator-rights for the operation of 250 SCALA.
To operate 250 SCALA, the user has to be a member of the group "Users", only for the FDA Editor
("LogiCAD") he has to be a member of the group "Power Users".
For security reasons, we recommended that a separate administrator password is used for each PC.
A user with administrator-authorization is for example necessary for the following operations:
• Installation
• Deinstallation
• Update
• Repair
• Add / Remove Components
This user has already been created during the installation process. As for the installation of
250 SCALA administrator-rights are necessary, this user has to be used.
The user "scala250” is used for local operation of the system with 250 SCALA.
The user "scala250” only requires user rights for the "Users” group. Administrator rights are not
necessary and should be avoided for reasons of security.
• Right-click on Users
Select New User...
• Create the user "scala250" with password and settings according to your company's
guidelines
MS-Office 2010 must be installed in order to use Excel-Reports or the archive editor.
All of the Office editions listed in chapter Error! Reference source not found., "Error! Reference so
urce not found." are supported - but only the 32-Bit versions.
It may be necessary to perform an update for individual operating system components if the
requirements for the new version of 250 SCALA have changed compared with requirements for the old
(currently installed) version.
The update procedure checks the requirements and outputs signals accordingly if any of the
requirements for the new version of 250 SCALA have not been met.
N.B.:
As part of an update of 250 SCALA, individual dll files may be updated too. The next time Microsoft
Office programs are started up, the MS Office Installer may become active and an Office update may
be requested. These Office applications cannot be used until this happens. It is therefore necessary
to have the appropriate Office CD for the relevant project to hand.
• Microsoft Excel (or Microsoft Office), if you want to use Excel Reports or the Archive Editor
Please note:
• The entire 250 SCALA installation procedure must be carried out by a User that
has Administrator-authorizations.
• For all Windows installations only the operating system languages English and
German are supported.
• Another codepage than the standard-codepage may only be used on an English
Windows installation.
• The NDM (Network device monitor) feature requires an installed SNMP service.
• It is strongly recommended to perform a backup of the entire computer (e.g.
image backup with Acronis TrueImage) before the installation.
For the installation of 250 SCALA the following installation media and literature are required:
If the 250 SCALA Installation-DVD is not in the DVD-drive <DVD>, insert this now.
Remark:
If the operating system feature "Autorun" should be deactivated on your computer you can open the
setup menu manually: double-click the file <DVD>\autorun.bat.
You can start 250 SCALA also directly – without the setup menu – as follows: <DVD>\setup250.exe
Click [Next].
It is recommended that the 250 SCALA product is installed on the suggested drive <SYSTEM>, e.g.:
"C"
Change the folder name for the project data to the drive letter of the data partition, e.g.: "E"
It is possible to carry out preliminary selection when it comes to selecting the components to be
installed.
You now have the possibility of excluding individual components of 250 SCALA from the installation.
It is possible to select the language for the menu entries in the start menu:
If there are other 250 SCALA SCADA systems in another subnetwork, the For the entire network
firewall setting needs to be selected.
Chapter 17 contains details of the services deactivated as a result and which tasks they perform.
If certain items are not available, this means the tasks have been performed already. For example, the
Adobe Reader may have been installed before the 250 SCALA set-up was started.
If you select the Configure Autologon task, a dialog for easy configuration of automatic logging on to
Windows will be launched once installation is complete.
For details on configuring automatic logging on to Windows, please see Section 12 – "Windows
Autologon".
At the end of the installation the 250 SCALA settings are called up automatically.
Details for the 250 SCALA settings can be found in the section 12, "Windows Autologon".
The 250 SCALA settings can be called up again at any time later and changes
carried out.
If you have altered all settings in all tabs to your requirements, then click the button [OK].
At the end of the installation click [Finish] to close the InstallShield Wizard.
An installation of the TOOLBOX II with CAEXplus and FDA Editor (logiCAD) for
250 SCALA on the same computer is not possible! It can only either the one or the other
be installed. An installation of both applications on the same computer results with high
probability into a fail of the installation and can make a new installation of the PC
necessary.
If FDA Editor is being used, first install the software and only afterwards connect the USB
dongle.
In the event that any prerequisite for installation of the individual components is not met, a message
indicating this will be displayed.
If you have successfully concluded the installation of 250 SCALA, then the components that have
been selected under "Startup" in the 250 SCALA settings start automatically. These components
normally disappear after a short time from the Taskbar, because they are also activated under "Hide".
Then start the other 250 SCALA components in the sequence specified.
If the SCADA-Server has successfully started up, the message: 250 SCALA STARTUP END …
appears in the startup window.
In the Login-window that appears click <Return> or the button [OK] without inputting a user name or
password to login as Default-User.
The consistency check and the subsequent loading is successfully concluded if the message "All data
have been successfully loaded" is displayed in the notification display of the consistency check
window.
Then close the consistency check window with the button [Cancel].
After the first successful, complete loading it is recommended to restart the SCADA-Server (after each
further loading a restart of the SCADA-Server is not necessary).
To do this, click the close-window button of the SCADA-Server window. As a result the SCADA-Server
is shut down.
An End-Task window thereby appears. Here, do not click any button, instead wait
for until the SCADA Server terminates itself!
If the SCADA-Server is completely shut down and the SCADA-Server window has disappeared, start
the SCADA-Server again via the Windows-Start menu
START | PROGRAMS | 250 SCALA | SCADA SERVER.
With a redundant system, when shutting down and restarting the entire system, it
must be ensured that the Server which was ultimately active is started up as the
first Server. If this sequence is not adhered to, then the Standby-Server can no
longer be started up without manual intervention.
The initial start of the SCADA Client is first possible after a complete consistency check and loading,
because with this the user authorizations for the SCADA Client are also loaded to the SCADA Server.
In the Login-window that appears click <> or the button [OK] without inputting a user name or
password, to login as Default-User.
Afterwards the interface of the SCADA Client appears as configured by the standard configuration.
Important system settings are defined via the CAE-Client and can be checked or modified there.
In the Login-window that appears, click <> or the button [OK] without inputting a user name or
password, to login as Default-User.
Further settings for the system are defined In SCADA-Server configuration files.
Configuration files become active when the SCADA-Server is started up, i.e. if you
carry out changes here, a restart of the SCADA-Server is necessary to activate the
changes.
Comments are to be found in the individual configuration files, carefully read through these before you
carry out any changes in the configuration file.
All configurations are already preset with sensible defaults after the installation of 250 SCALA, i.e.
normally no changes must be made in the configuration file, and the system can be started without
intervention in the configuration file.
3.4 TOOLBOX II
From Version 6.50, TOOLBOX II is only relevant for use of the OPM within 250 SCALA. The CAE
server no longer requires TOOLBOX II.
4.1 PAGECONTROL
For the use of "SendMessage" the installation of the software "PageControl" is required.
As soon as the component "SendMessage” is selected in the 250 SCALA installation dialog,
PageControl is automatically installed along with it.
Please refer to the section 11 – "PageControl for SendMessage” for further details.
The PageControl-license that was installed with the SCALA-CD is a demo license (validity 59 min).
The full license must be activated now.
For the activation of the PageControl-License the following installation media is required:
• Informel-CD
Activation Process
• Insert the Informel-CD. (If "Autorun" is activated, the installation menu is started automatically.
Closing this installation window.)
• Start PageControl. (A dialog for PageControl configuration is started automatically; this should
be ended by [Cancel]).
Click [Open].
Click [Close].
The installation of the OPC server is a separate item within the installation of 250 SCALA. It makes no
difference at all whether the SCADA server is installed on the same PC or not.
The OPC server is installed together with the common components of 250 SCALA. These ensure the
dialogues for "Settings" and the RSI parameters are available on the PC.
The "OPC Core Components" of the OPC Foundation are also installed on the installation of the OPC
server. These provide, for example, the OpcEnum service, and are a prerequisite for the use of a OPC
server. This is automatic on installing 250 SCALA (as soon as the OPC server is installed.
The OPC server from 250 SCALA can be installed on several PCs if so required. The data capacity
offered by these OPC servers can vary.
Installation of the OPC server is independent of the existing OPC client from 250 SCALA (available for
some time) and can hence be performed on computers on which the OPC client is installed.
A detailed description of the installation process can be found in the document "Installation Manual
SQL Interface".
4.5 RDS-SERVER
A detailed description of the installation process can be found in the document "250 SCALA
Installation Manual RDS Server”.
With the installation of FDA editor (logiCAD) through 250 SCALA, an empty project is created, which
already contains the module libraries well known from CAEXplus. This project is proposed
automatically during the first start of FDA editor (logiCAD).
The module libraries contain CAEXplus specific components. These can be used also in the FDA 250-
project by what a large supply of prefabricated elements is available.
These modules however are only available in the project which has been created by the installation
process. Projects which are created further in FDA editor (logiCAD) do not provide these modules.
The creation of further projects in FDA editor (logiCAD) is not recommended furthermore for reasons
of the data backup. Only the data of the pre-designed project will be backed up.
Moreover only the libraries of this sample project are updated in case of updates in future releases -
not those in individually created projects.
Click [Next].
▪ Now the sample project is proposed in the path-line. Leave this entry unchanged.
Click [Finish].
Thus the sample project has been created successfully and is ready for further adaptations.
An installation of the TOOLBOX II with CAEXplus and FDA Editor (logiCAD) for
250 SCALA on the same computer is not possible! It can only either the one or the
other be installed. An installation of both applications on the same computer leads
with high probability to a fail of the installation and can make necessary a new
installation of the PC.
Replaces the previous used application "keyblock.exe" (or "KeyblockTrialversion.exe) which will be
uninstalled automatically.
• no Windows-Autologon required
• no license necessary
• typically runs hidden as SCALA daemon (but has an application window which can be made
visible)
• typical Windows key combinations will be blocked if one or more SCADA Clients run
After an update to version 6.70.00 or newer the key combination [Ctrl]+[Alt]+[Del] is no longer
suppressed
A workaround is the suppression of this key combination using the Windows group policies. In
difference to the Windows Standard Operation parameters group policies are applied to all Windows
users and are independent of the current SCADA Client user.
Only users with administrative permissions are allowed to change group policies.
Use Windows-Start / Execute and input of "gpedit.msc" to invoke the editor for group policies.
The configuration for the behavior of user switching can be changed in Local Computer Policy /
Computer Configuration / Administrative Templates / System / Logon:
The behaviour for Ctrl+Alt+Del may be configured in Local Computer Policy / User Configuration /
Administrative Templates / System / Ctrl+Alt+Del Options:
Please make certain that theses configurations will not be overwritten, e.g. by a corporate policy.
An update of 250 SCALA can be carried out if an older or the same version of 250 SCALA is already
installed on the computer.
If your 250 SCALA control system consists of a number of systems, the 250 SCALA product release
for the CAE server must not be older than those of the other systems.
The update requires on singular systems an operational interruption. Plan this impending operational
interruption (that can take several hours) carefully. Inform the necessary stations and choose a
favorable time.
On a redundant system the update has to be executed first on the standby system. If this has booted
completely a redundancy switch has to be carried out in order to update the other system.
The following steps are necessary for the update of 250 SCALA and are described in detail in the
following chapters:
• Data backup of the project data of the old (currently installed) version
• Update of the operating system (if necessary)
• Update of TOOLBOX II (if necessary)
• Update of the Program Package 250 SCALA
• Data backup of the project data of the new version (after the update)
The entire 250 SCALA Update procedure must be carried out by a user who has
Administrator-Authorizations.
The update supports all official versions since 6.00. For beta- and RC-versions an update is supported
only within the same version.
Example:
The update from 6.42 beta 8 to the final version 6.42 is supported.
The update from 6.41.01 beta 1 to the final version 6.42 is not supported.
6 UPDATE OF TOOLBOX II
For the new version of 250 SCALA it may be necessary to install a new Service pack for the
TOOLBOX II or even a new version of TOOLBOX II.
The update procedure checks the demands and gives corresponding messages if any demand of the
new version of 250 SCALA is not fulfilled.
Before each update, it is absolutely essential to back up data for TOOLBOX II via the Data Distribution
Center so this can be accessed again at any time in the event of an emergency.
A guide for updating the TOOLBOX II can be found in the TOOLBOX II-Documentation.
If TOOLBOX II needs to be deinstalled for the update and a version older than 6.50 is still installed on
the 250 SCALA CAE server, please note the following vitally important information:
When uninstalling TOOLBOX II the project data of the 250 SCALA CAE-Server are
also uninstalled, since both use the same database. It is therefore absolutely
necessary to also carry out a backup of your 250 SCALA project data via SCALA
Data Storage before uninstalling the TOOLBOX II, and to restore the backup of the
CAE-Server again after a new installation of TOOLBOX II !
If Version 6.50 or higher is installed on the 250 SCALA CAE, this will not be affected if TOOLBOX II is
deinstalled.
If the TOOLBOX-requirements of 250 SCALA have not changed, then it is not necessary to update
TOOLBOX II.
For updating 250 SCALA the following installation media are required:
Before each update of the product 250 SCALA you should definitely create a
backup by using the program package 250 SCALA Data Storage in order to
thereby secure your project data!
It is recommended that all 250 SCALA applications running (that are not hidden) are closed.
During the update process 250 SCALA components still running are automatically terminated.
The installation-DVD starts automatically and opens a window with the setup menu.
Remark:
If the operating system feature "Autorun" should be activated on your computer you can open the
setup menu manually by opening the file <DVD>\autorun.bat..
You can start 250 SCALA also directly – without the setup menu – as follows: <DVD>\setup250.exe
The following step confirms that the installed version should be replaced.
Confirm the replacement of the old version by the new version of 250 SCALA by clicking [OK].
An automatic updating of all installed program packages of 250 SCALA now takes place.
If some 250 SCALA program components are still running, these are now closed automatically.
New functions which are available after the update are now displayed.
Click [OK].
At the end of the update, the 250 SCALA settings are automatically called up.
During an update, all settings of the previously installed version are adopted. It can however occur,
that additional features in the 250 SCALA settings are available in the new version.
Details about this can be found in the section 10, "250 SCALA Settings".
The 250 SCALA settings can be called up and modified again later at any time.
If you have checked all settings in all tabs, then to complete the update of 250 SCALA click the button
[OK].
After the update, you should create a backup of your available project data with the
new version.
Click [Yes].
If the new version of 250 SCALA contains new components and you wish to use these features, you
must add these after the update.
Select the component(s) that you wish to add (or remove) and click on [Next >].
The rest of the installation process then takes place as described from section 4, "Installation of
Optional Components".
7 SECURITY
A security package for 250 SCALA will be available in 2011. This package contains measures to take
into consideration increased security requirements for PC systems, with regard to virus scanners, virus
signatures and patches for Windows and MS Office.
Although the manufacturers of anti-virus software use all imaginable test mechanisms to avoid false
positives, an element of risk always remains. This is due to the fact that no manufacturer of anti-virus
software has access to all applications, files, in-house developments and functions that may occur
within a company.
ANDRITZ HYDRO has therefore set itself the goal of introducing a system for checking virus
signatures (patterns) so that 250 SCALA is not negatively affected by false positives.
Using a high-quality automated test environment, it should be possible to supply 250 SCALA
customers with anti-virus patterns promptly.
Starting with 250 SCALA version 6.50, ANDRITZ HYDRO will supply a system that is free of viruses at
the point of acceptance/hand-over, as well as information on the current version of the virus scanner,
checked on our test system.
All future updates of the virus scanner will be checked in a test system, with a view to interplay with
our software, and once they have passed the tests, they will be available to the customer for download
via an interface, in so far as a service contract covering these services exists between ourselves
and the customer.
Prompt download by the customer is necessary for reliable virus protection, and the customer holds
sole responsibility for this. Any liability on the part of ANDRITZ HYDRO for complete protection against
viruses or other attacks, as well as for false positives, shall be excluded, as shall compensation for
subsequent damage, on whatever grounds. The customer shall remain responsible for protecting its
entire system against viruses.
With regard to operating system and office updates, from version 6.60, 250 SCALA will introduce a
mechanism similar to that used for verification of the virus patterns. The aim is to carry out this test
within approximately 8 weeks of the date on which a defined status of operating system update
becomes available, and to authorize the update accordingly.
The note regarding the service contract and liability also applies accordingly to the operating system
updates.
It may be necessary to uninstall 250 SCALA if e.g. the 250 SCALA update process has not functioned
correctly, and therefore the update cannot be carried out the normal way. Then in this case, after the
uninstallation of 250 SCALA described here, a renewed installation must be carried out as described
in chapter 3, "Installation 250 SCALA".
The entire 250 SCALA uninstallation process must be carried out by a user who
has Administrator-Authorizations.
Before uninstalling 250 SCALA a data backup of all relevant project data should
definitely be made, in order to access this again at any time in the event of an
emergency.
Be sure before the next step, that you have made a data backup (or
Acronis Image) of 250 SCALA.
Following confirmation by the user, 250 SCALA is removed from the computer.
To be able to bring your project data up-to-date at any time due to an emergency, you should carry out
regular data backups.
You can make these data backups on the hard drive (e.g. in the directory <DATA>\250 Backup\ )
and then e.g. burn onto CD or backup onto a network drive.
Please note that the data storage directory must not be in the project- or data-directory.
In particular before an update you should always make a data backup (or Acronis
Image) of your project data.
A detailed description of backup and restore is to be found in the 250 SCALA Help, chapter Parameter
Setting | Data Storage.
In the 250 SCALA settings, different important settings for 250 SCALA can be carried out.
They are automatically called up at the end of the initial installation or an update of 250 SCALA, or can
be called up via the Windows Start menu via
10.1 PROJECT
Projectname
This must be identical on CAE-Server and SCADA-Server (if CAE-Server and SCADA-Server are on
the same computer, it is the case anyway) and is checked during loading from CAE-Server to the
SCADA-Server. Exception is the "Multi-hierarchy".
If "Multiple SCADA Systems" is activated (in other words "Multi-hierarchy" is used), it is important
that the individual SCADA Systems in the "Multi-hierarchy" have different projectnames, since e.g. the
"System identification constant" is derived from the projectname.
The multi project handling provides to the user the possibility to administrate multiple 250 SCALA
projects in a single CAE database. Up to 100 projects can be administrated. Up to 10 of these projects
can be administrated at the same time.
This option is meant especially as support to the efficient development of customer projects. This
function is of less importance for an installed SCALA-system as usually not more than one project is in
use.
Language settings
Here the "Project language" and the "Default language" can be selected.
This setting refers to the corresponding language-column in the MLS-file.
If no appropriate text is found in the MLS-file for the project language, then the text of the default
language is used.
Consequently, e.g. with only partial translation in the project language, the corresponding text of the
standard language can always still be displayed. If the text is also not found in the default language,
then it is displayed in the English language.
Redundancy
If the machine is a redundant system, either "Server A" or "Server B" has to be selected (depending
on which server this machine is). As soon as a SCADA Server has been selected, the until then
grayed-out field "SCADA Server B" in "Server Network Names" becomes active.
If no server is installed on this machine then it is not possible to select a server. Then it only has to be
decided between "not redundant" and "redundant". (If "redundant" fill in the name of the server in
"Server Network Names".)
Here the IP-address, the Host name or the Alias name of "SCADA Server A", "SCADA Server B" and
"CAE Server" must be specified.
When using the Software package "Schedule Manager", the Alias name may not
be used.
"SCADA Server B" is only active if redundancy has been selected and "CAE Server" is only active if it
is required for a component that is installed on the machine (e.g. CAE-Client).
With "RSI connection timeout" activated, the "Connection Timeout" can be selected in seconds.
This parameter specifies whether the SCADA-Server is to terminate the connection to a component
coupled via RSI (e.g. SCADA-Client, RSI-SQL, VBSE, RAS, Program-Manager) after a preset time if a
failure is detected.
If "RSI connection timeout" is not selected, then the connection is terminated according to the TCP/IP
Timeout (normally 3 Minutes).
Normally, the default setting "RSI connection timeout" activated and the monitoring time of 30 seconds
remain unchanged.
A change to "SCALA Computer Name" is not adopted in the Windows Computer Name.
The SCALA Computer Name is required e.g. when using the component "Remote Application Starter
Daemon (RAS Daemon)".
Provides that all running SCALA applications will be closed before shutdown, reboot or log off.
If this option is not selected, all SCALA applications (SCADA-client, SCADA-server etc.) have to be
closed manually before shutdown.
Removing the network plug was till now the reason that also purely local connections (e.g. SCADA
client to SCADA server at a compact configuration) were interrupted. If this checkbox is selected, then
this does not happen any more.
ATTENTION: If using DHCP ("obtain an IP-address automatically") after the change of the network
the new IP-address must be requested manually with "ipconfig /renew".
If this option is selected, SCALA behaves as an embedded system. By than the behavior of the
parameterization of an embedded system can be emulated on a development PC. On an embedded
system this option is not available.
If "Emulate Embedded System" is selected, in addition the option "Harddisk available" is accessible.
Parameter Set
Here further parameter-sets can be created or selected for the SCADA-Client in addition to the default-
parameter-set. All the parameters in this tab (and the advanced settings) are valid for the selected
parameter set.
For every new created parameter-set an additional SCADA-Client shortcut is created in the Windows-
Menu (after pressing the button [OK] or [Apply] ). With this shortcut the SCADA-Client can be
started easily with the predefined parameters.
By pressing the button [New ...] a new parameter-set is created as a copy from an existing
parameter-set.
If the button [Remove] is pressed, the selected parameter-set is removed (the default-parameter-set
cannot be removed).
If this option is selected, the settings from "250 SCALA Settings" are taken over from the CAE.
Excluded are only "Horn Sounds" and "Custom Graphic Acceleration". The values in the "250 SCALA
Settings" then are grayed-out and instead the CAE defaults are used. Therefore this is reasonable
only after the "250 SCALA Settings" are taken over into the "CAE Defaults" and in the CAE the
SCADA Client has been updated. Details are to be found in the 250 SCALA Help: Installation |
Overview | Instructions for CAE Upgrade to Version 6.42.
Automatic assignment: This is the default setting. The number of the SCADA Client is assigned
dynamically by the server (from 250 down to 128).
Client number (1-100): If this option is selected, a number from 1 to 100 can be assigned to the
installed SCADA Client.
Client number range (1-100): If this option is selected, a certain number range can be assigned to
the SCADA Client Number. Within this range the number is assigned dynamically by the server.
Startup
Under "Scheme" a scheme for the startup of the SCADA-Client can be selected, where e.g. special
positions can be used (schemes can be defined in the CAE-Client).
Via the parameter "Startup Script" a startup-script can be selected, that is activated automatically
when the SCADA-Client starts up (Startup-Scripts can be defined via Dynadraw).
Horn Sounds
Here Wave-Files can be selected as horn sounds for the individual Software-Horns (1-16).
If the checkbox next to "Horn Sounds" is deselected, all horn sounds are inactive ("Mute"; does not
affect a possibly existing Hardware-Horn).
In the dropdown-box a horn is selected; in the description field next to it the sound file for the
respective horn sound is shown. The selection of the checkbox between these two fields causes that
the respective horn will be regarded as non-existent.
Here you can switch the use of the graphic acceleration of the graphics-card for the SCADA-Client on
or off, which can be useful if there are problems with the graphics.
Via the button [Advanced Settings ...] in the tab "SCADA Client" the advanced settings for the
SCADA-Client can be reached.
Redundancy
This parameter is only changeable in an additional created parameter-set (is taken from tab "Project"
in the default-parameter-set).
If the machine, where the SCADA-Client connects to, is a non-redundant system, then
"Not redundant" is to be selected, otherwise if the system is redundant select "Redundant".
This parameter is only changeable in an additional created parameter-set (is taken from tab "Project"
in the default-parameter-set).
Here the IP-address, the Host name or the Alias name of "SCADA Server A" and "SCADA Server B"
of the system where the SCADA-Client connects to must be specified.
"SCADA Server B" is only active if redundancy has been selected.
This parameter is only changeable in an additional created parameter-set (is taken from tab "Project"
in the default-parameter-set).
This parameter specifies whether the SCADA-Server is to terminate the connection to the
SCADA-Client after a preset time if a failure is detected.
If "RSI connection timeout" is not selected, then the connection is terminated according to the TCP/IP
Timeout (normally 3 Minutes).
Here, a "Custom SCADA Client Window Size " for the SCADA-Client can be determined.
Is used e.g. to use only two monitors to display the SCADA-Client on a system with 3 monitors.
After activating "Custom Monitor Usage" the "Number of monitors used by the SCADA Client" can be
determined.
In addition, via "First monitor used by the SCADA Client" it can be determined, on which monitor (from
left) the SCADA-Client is to be activated first.
Auto Login
Here a "Username" and "Password" for auto-login on startup of the SCADA-Client can be defined.
Security
If "Hide Desktop during SCALA Login" is activated, then while the Login-window of the SCADA-Client
is visible, in the background a window is laid over the desktop, which prevents operation of the
desktop.
If "Allow 'Retain windows and current view' on logout/login": is selected, at Switch User the possibility
to retain the current configuration of active displays (picture, curves, lists, …) in the SCADA Client is
available.
Miscellaneous
If "Touchscreen Mode" is activated the context-menus on selectable objects in pictures can also be
opened via left-click.
That makes it possible to operate e.g. on a touchpanel (without the right mouse-button).
The parameter "Show as bottommost application" is used to show the SCADA-Client always as
bottommost window, even if it is active. The advantage is that windows of applications that are started
via the SCADA-Client cannot be hidden behind the SCADA-Client window.
If this parameter is not selected the SCADA-Client comes to the front if it is activated.
By activating "Use Watchdog" a message can be generated, if on the SCADA-Client for a selected
time no input is given via keyboard or mouse.
The tool bars of the SCADA-Client could not be covered already previously by pictures, lists or curves.
The option "Toolbar Overlay Protection" prevents now also the covering of the tool bars by dialogues
and applications. (See also references in the chapter "Tips & Tricks.)
"Disable Splash Screen ": this option suspends the display of the Splash-Screen of the SCADA Client.
This is useful e.g. when working via remote desktop, VNC, etc.
"Hide cursor ": if selected, the mouse cursor is not displayed within the SCADA Client. This is useful
on touch panels without a connected mouse.
"Open virtual keyboard automatically ": if this option is selected, a virtual keyboard ("On-Screen
Keyboard") is displayed automatically whenever a text box becomes active.
Resource Level
This setting determines up to which hierarchy level (starting with Basics) the resources will be used for
display in the CAE-Client. Usually "Project" will be selected.
Hint:
The levels from Basics to Project are strictly hierarchical. I.e., Temp overwrites Basics and Project
overwrites Temp. The behavior of the variants is slightly different. All variants are directly based on
Project, i.e., changes in one variant do not affect the other variants.
Menu Transparency
With a slider the transparency of the context menu can be set from 0 – 75 %. In pictures the context
menus of selectable objects (and only those menus) will be displayed transparent.
To prevent that dialogues or applications can cover the toolbar, the option "Toolbar Overlay
Protection" is available. (See chapter "Advanced Settings".) In this context the following references are
to be considered:
• For using the Toolbar Overlay Protection, no user defined monitor assignment must be
configured.
• Certain applications (e.g. Windows Task Manager) can overlay the toolbar.
• In rare cases certain graphic cards can cause that a window comes to lie behind the toolbar.
As it is then covered by the toolbar, it cannot be selected with the mouse. With the following
procedure such a covered window can be recovered:
− select the window with the Windows-Taskbar, Task Manager or <Alt><Tab>
− press <Alt><Space> to make the window system menu visible
− click "move"
− move the window back to the visible area by using the cursor keys.
Nethorns
For "Hardware (MAC) address" the MAC-address of the nethorn has to be specified (can be found on
the nethorn device).
The IP-address the nethorn should get, has to be defined under "IP address of the nethorn device".
After powering off and on the nethorn device, it will get this IP address.
The "Subnetmask of the nethorn device" normally is the subnetmask of the project-network.
The "IP address of the gateway" only has to be specified if the nethorn device is reachable via a
router, otherwise it can be left blank.
SCA
One can select between "Hardware solution" and "Software solution" for the SCA. This function is
required for the correct mode selection and redundancy switchover.
Under "Connection to the other server" the serial interface can be selected to which the Hardware-
SCA or (when using Software-SCA) the serial connection cable (between the two redundant
SCADA-Servers) is connected.
Under "Mode selection" when using Software-SCA one can set the desired mode, normally
"Automatic".
This parameter is only necessary if a redundant connection between SCADA-Server and RTU exists,
and the RTU only has one IP address.
In that case the SCADA-Server has to get more than one IP address.
To do that the parameter "RTU send address mapping" has to be activated. Then the parameters
"RTU send address 1" to "RTU send address 4" can be assigned to the different IP addresses of the
SCADA-Server. These RTU send addresses can then be assigned to the connections as "#1" to "#4"
in the CAE-Client under "LAN Components".
Time Synchronization
When "SCALA should synchronize the computers system clock" is activated, the system time of the
computer is set by 250 SCALA.
If an NTP-service is used to synchronize the system time of the computer, then "SCALA should
synchronize the computers system clock" should be deactivated, since otherwise the computer clock
would be synchronized from two places.
Status TA
Here the text address of a binary information for the state monitoring can be entered. If nothing or a
wrong text address has been entered, the state of the OPC server cannot be displayed.
Here can be set to which process variables released for OPC data exchange this OPC server grants
access. To each data point up to 8 numeric OPC ranges can be assigned. A single OPC server then
allows the access to those ranges released with this parameter.
XML Portnumber
The OPC server can be addressed via COM, DCOM und XML. In order that the access via OPC-XML
works, here a TCP portnumber must be entered. It has to be paid attention that this number is not
used by another application on this computer. If the portnumber is set to 0 then the XML functionality
of the OPC servers is deactivated.
10.5 AUTOSTART
Here, you can determine, which applications are started automatically after the login of a user.
With the 250 SCALA settings activated, all the active applications and the standard settings for the
250 SCALA components are available.
By clicking [Restore Defaults] one can restore the default settings at any time.
10.6 HIDE
These programs are then, if they are started, neither displayed in the Taskbar nor in the Task Manager
and run hidden in the background.
By clicking [Restore Defaults] one can restore the default settings at any time.
10.7 LICENSES
Here, the valid licenses for the displayed MAC-address for the (license-obligated) installed 250 SCALA
components must be entered.
The displayed MAC-address under the "Serial number" is the MAC-address contained in the license
file.
It is possible to store and administrate more than one serial number and the corresponding licenses. In
the drop-down-menu "Serialnumber" the serial number with the desired licenses can be selected (e.g.
mobile dongle with picture editor license).
With the button [New...] a dialog window for entering the data for a further serial number will be
opened.
After entering this data the licenses for this serialnumber have to be selected in the drop-down-boxes
"Item number (Product)" and next to it the license key as per license sheet has to be entered.
By clicking [Licence Wizard ...] a Wizard is activated, which simplifies the input of the
licenses.
With [View Licence file ...] the license file of 250 SCALA is displayed.
10.8 INFORMATION
Here, you see the most important information about your system and your 250 SCALA Installation.
PageControl is used to control the modem/e-mail dispatch when messages from SendMessage are
pending.
11.1 MODEM
With a GSM modem 250 SCALA supports the dispatch of SMS messages and the receipt of SMS
receipts. As a default type the Siemens TC 35 is provided.
11.1.1.1 Wiring
All necessary wirings have to be carried out at the top side of the modem. The data cable should be
attached to the next free serial port of the PC. In this document it is assumed that this is the first serial
port, that means COM1:. The used serial cable must be wired 1:1.
Number Description
1 Plug-in power
2 RS232 interface (9-pin D-Sub)
3 Antenna connector
At the lower side of the modem is the holder for the SIM card and a diagnosis LED.
Number Description
1 LED display
2 Handset connector
3 Mini-SIM card holder
Caution: The SIM card should be deleted completely - if it is not new - or it should be made sure
absolutely that it contains no more SMS.
For inserting the SIM card the SIM card holder should be opened with a pointed, stable object (at the
best with a ballpoint pen). The SIM card holder should not be pulled out completely.
Caution: If the holder was pulled out completely, caution when re-inserting! The holder could also be
inserted slightly above the track - then it does not come out any more when pushing the button.
With an analogue modem 250 SCALA supports the functions language notification and paging. The
devolo MicroLink 56k i is offered as a default type.
Please gather information about the wiring from the online documentation which can be found on the
CD-ROM enclosed to the modem.
For a correct function the Windows drivers must be installed with the hardware assistants. If Windows
does not recognize the modem automatically, please choose dvl1813.inf from the CD-ROM enclosed
to the modem.
Note: With analog modems, it is vital that the tool "mdmprep.exe” is installed. The program can be
found on the 250 SCALA Installations DVD in the directory "\3rdParty\AnalogModem\”.
11.2 CONFIGURATION
If SendMessage is used only to send eMails, this configuration procedure can be skipped.
Configurations Procedure
• After selection of the serial port (standard is COM1:) click [SETTINGS...] for the configuration
menu. All other parameters are controlled by SendMessage.
• Via the button [MODEM...] settings for all known modem types can be made.
If it is a GSM modem the correct PIN must be entered afterwards.
• The selection of the modem (default is "Siemens TC35" or "Devolo MicroLink 56k i") must be
confirmed with [OK].
The program mdmprep.exe provided in the directory PageControl of the 250 SCALA Product
CD-ROM can be used to switch off the redialing-lock of analogue modems.
With private branch exchanges it can be necessary to deactivate the setting Wait for dial tone.
• For the correct function of SendMessage the desired services provider must be selected.
• As default all licensed service providers (in demo mode all providers) are selected. Via the button
[Deactivate All] this selection should be removed.
• Settings for SMS via ISDN. The desired provider must be selected.
• Settings for Paging via ISDN. The desired service provider must be selected.
• Settings for Paging via analogue phone. The desired service provider has to be selected.
12 WINDOWS AUTOLOGON
Windows-Autologon is used for automatic logon with a predefined user after power on or the reboot of
the computer, without a keystroke necessary.
For the case of Windows logout or change user, the Autologon has NO EFFECT – you must fill in the
Windows logon dialog nevertheless.
An appropriate tool for activating Autologon is provided in the 250 SCALA product path
(e.g.:\Programs\SAT\SCALA).
Steps to go ahead:
After the installation of 250 SCALA, in the directory <SYSTEM>\Program Files\SAT\SCALA\ there
is the file ScalaAutologon.exe.
This program needs the Windows-Admin-user right in order to read and write the settings.
(In contrast, that user, who should be set by the Autologon, does not need the Admin-user
right. Therefore it might happen, that the Autologon user, later on when being the Windows
user too, cannot read or can only partly read his own settings and cannot write any new
settings at all.)
After switching on the computer, the user scala250 should automatically be logged on.
The option Save password as encrypted text is available under Windows XP+newer, it is
checked by default and the user should only uncheck it on special wish.
NOTE: When saving plain text, the password will be un-encrypted in the Windows-Registry!
Do click on Enable. This button is only available, if the Username field contains 1 character at least
and if both Password fields have the same contents (here even an empty string is possible):
Restart the PC, Windows should then start up automatically with the user "scala250”.
If Autologon is already configured (only then the button is available), simply click on Disable:
Notice
If the Shift key is pressed during startup before the system executes the logon, then Autologon is
disabled for this one logon procedure.
13 NTP-CLIENT
With Version V6.50 and higher of 250 SCALA, there is the option to install the TARDIS NTP client
when installing 250 SCALA.
With 64-bit Windows systems, a TARDIS cannot be configured via the control panel
in the usual way once installed. For this reason, the Tardis Console feature is made
available in the Tardis 2000 start menu during 250 SCALA installation. When user
account control is active, this application must be specifically started with
administrator rights.
If NTP is used in the network, then in the tab "SCADA Server" under "Time synchronization" the
setting "SCALA should synchronize the computers system clock" should be deactivated, since
otherwise the computer clock would be time synchronized from two places.
14 ON-SCREEN KEYBOARD
• After the first successful load from the CAE client: restart the SCADA server.
• For editing the configuration files (*.str) it is recommended to use WordPad; if not, line feeds
are probably not recognized correctly.
Comprehensive documentation of the TCP ports required can be found in the document "TCP/UDP
Portlist for 250 SCALA, SICAM 1703.
For encryption of data on the hard drive, 250 SCALA supports the "Bitlocker” program (manufactured
by Microsoft).
Encryption can be carried out subsequently at any point, however we recommend that all 250 SCALA
applications are closed for the duration of first encryption.
15.6 SUGGESTION FOR NETWORK ADDRESSING, NETWORK MASK AND HOST NAME
ASSIGNMENT
A computer incorporated in a TCP/IP-network has at least one network interface (mostly for Ethernet).
This network interface has an IP-address.
Each additional network interface over which the TCP/IP is operated requires a further, different IP-
address.
Two devices that wish to communicate directly in a TCP/IP-network must each have IP-addresses
within the same network address. If they do not have that, they can only communicate via a "Router".
Physically separated networks each have their own network addresses. The network address is
produced by logically linking the IP-address with the network mask (viewed binary) with AND.
In the following descriptions, synonyms are used for the project-specific determinations:
Ethernet-Network <ET-IP-Addr.>
address
With 250 SCALA, for each suggestion (no compulsory determination) due to the network mask
255.255.255.224 (hex: 0xffffffe0) a Class-C network address (<ET-IP-Addr.>) assigned
for a 250 SCALA project is separated into 8 further subnetworks (Subnetting, Subnetwork 0 to 7).
With that 30 IP-addresses are available in each subnetwork.
Within the local Ethernet-Network (Subnetwork 0) there are therefore 30 IP-addresses available for up
to 30 computers.
Since there are no compulsory determinations for the assignment of network addresses in a
250 SCALA project, suggestions are made in the following table, how the address assignment in a
project could meaningfully appear, this should be discussed with those responsible for the network
before beginning the project and if necessary altered.
prk1, prkb,
redundant SCADA Server B
<proj>pb, <ET-IP-Addr.>.4
(with "All-In-One": SCADA-Client 2)
(vis2, <proj>v2)
SCADA-Client 1
vis1, <proj>v1 <ET-IP-Addr.>.6
(if own machine)
SCADA-Client 2
vis2, <proj>v2 <ET-IP-Addr.>.7
(if own machine)
The hosts-File, in which the Host-names and Alias-names of the computers in the project can be
defined, is located in
<SYSTEM>\WINNT\system32\drivers\etc\hosts .
The hosts-File for the project network <ET-IP-Addr.> with two redundant All-In-One computers,
two visualization workplaces, one protocol printer and one hardcopy-printer could e.g. appear as
follows:
127.0.0.1 localhost
<ET-IP-Addr.>.13 npr0
<ET-IP-Addr.>.16 nhc0
The host-names used, in other words e.g. <proj>pa, are also meaningful as computer name for the
computer.
15.6.2 HOSTS-FILE
Netmask: 255.255.255.224
Default Gateway: xxx.xxx.xxx.001 (e.g.: 172.17.99.1)
# Router
172.17.99.1 projr0
172.17.99.2 projr1
#
# SAT 250, AllInOne
172.17.99.3 projpa prka
172.17.99.4 projpb prkb
#
# Netprinter
172.17.99.13 projs0 npr0
172.17.99.14 projs1 npr1
172.17.99.15 projs2 npr2
#
# Hardcopy
172.17.99.16 projy0 nhc0
#
# Toolbox
172.17.99.17 projt0
#
# Router
172.17.99.1 projr0
172.17.99.2 projr1
#
# SAT 250, SCADA Server
172.17.99.3 projpa prka
172.17.99.4 projpb prkb
#
# Netprinter
172.17.99.13 projs0 npr0
172.17.99.14 projs1 npr1
172.17.99.15 projs2 npr2
#
# Hardcopy
172.17.99.16 projy0 nhc0
#
# Toolbox
172.17.99.17 projt0
#
# SAT 250, SCADA Clients
172.17.99.5 projv1 vis1
172.17.99.6 projv2 vis2
172.17.99.7 projv3 vis3
172.17.99.8 projv4 vis4
172.17.99.9 projv5 vis5
172.17.99.10 projv6 vis6
172.17.99.11 projv7 vis7
172.17.99.12 projv8 vis8
Analysis Tool Includes the Analysis Tool for analyzing and License-free
searching for errors in the system.
Should normally also be installed on a computer
on which a SCADA-Server is installed.
Is required on every computer in the system from
where analyses of the system are to be carried
out.
CAE Client Includes the Client for the CAE Server. License-free
Should be required on at least one computer of
the project.
Is needed on each computer in the system on
which the data of the CAE-Server is to be
managed.
Data Storage Client Includes the Client for the Data Storage-Server. License-free
Should be required on at least one computer of
the project.
Is needed on each computer in the system from
which a data backup is to be carried out.
SCADA Client Includes the SCADA Client and the Picture Editor, Subject to
as well as the Archive Editor. license
Requires Dynavis 2 to be installed on the
machine.
Must be installed on all computers in the project
on which the Visualization is to run.
OPC Client Includes the client for "OLE for Process Control". Subject to
Sub-item of "SCADA Is required if 250 SCALA has to connect to an license
Server" OPC Server.
Visual Basic Script Includes the Visual Basic Script Engine. License-free
Engine Used to be able to carry out calculations via
Visual Basic scripts by using 250 SCALA-
Expansion routines.
Net Calculation Includes Net Calculation from PSI. Subject to
license
Current distribution Calculates the distribution of currents in power Subject to
calculation lines and feeders for a given load, infeed and license
Sub-item of "Net impedance situation and warns against overloads.
Calculation"
Networkmanager Includes the network manager for devices that are Subject to
SNMP capable. license
FDA for the Active This feature usually has to be installed together License-free
Process and with FDA. If it is not installed, FDA only work a
Simulation without special test system for the simulation mode of the
Online-Test SCADA servers.
Sub-item of "FDA"
OPC Server To be used for the supply of data via the OPC- Subject to
protocol. license
The connection to the OPC Server is made with
RSI. It is only available at Windows platforms.
Supported are the protocol versions OPC-DA
1.0/2.0/3.0 and XML-DA (from V6.40).
The following configuration sheet lists all important information for the installation of 250 SCALA on the
project computer.
It should be filled out by project-managers, serves the installation-technician as support, and should
also be used for the documentation of the 250 SCALA installation.
It is recommended to copy and fill out the following configuration sheet for each
project computer and to file with the project documentation after completing the
250 SCALA installation.
The fields marked with "" are to be filled out by project-managers before the 250 SCALA installation.
Installation-Technician: ..........................................................
Date: ..........................................................
The ActiveX Installer (AxInstSV) service provides user account control validation for the installation of
ActiveX controls from the Internet and enables management of ActiveX control installation based on
Group Policy settings. This service’s startup type is Manual, so it will start when requested by an
application. If this service is disabled the installation of ActiveX controls will behave according to the
default browser settings. By default it logs on using the Local System account.
The ActiveX Installer service is dependent upon the following system components:
The Adaptive Brightness (SensrSvc) service monitors ambient light sensors to detect changes in
ambient light and adjust the display brightness. If this services is stopped or disabled the display
brightness will not adapt to lighting conditions. This service is configured for a manual start by default.
When started it will log on using the Local Service account by default. This service is not dependent on
any other system service, nor is any service dependent on it.
This service is supported in all versions of Windows 7except Windows 7 Starter operating system.
The Application Layer Gateway Service (ALG) is a subcomponent of the Windows networking
subsystem. It provides support for third-party plug-ins to allow network protocols to pass through the
firewall and work behind Internet Connection Sharing. This service is installed by default and its
startup type is Manual.
When started in the default configuration it will log on using the Local Service account.
This service is not dependent on any other system service, nor is any service dependent on it.
The following table identifies the application protocol, network protocol, and ports used by the
Application Layer Gateway Service:
The Application Management service (AppMgmt) provides software installation services such as
Assign, Publish, and Remove. It processes requests to enumerate, install, and remove applications
that are deployed through an organization's network by using Group Policy. When you use Get
Programs from the Windows Control Panel to install programs from the network on a domain-joined
computer, Windows calls this service to retrieve the list of deployed applications on your network. The
service is also called when you use Control Panel to remove an application, or when a component
(such as the shell) makes an installation request for an application to handle a file name extension,
Component Object Model (COM) class, or ProgID that is not present on the computer. The service is
started by the first call that is made to it, and it does not stop after it is started.
If the Application Management service stops or if you disable it, users cannot install, remove, or
enumerate applications that are deployed in AD DS. This service is installed by default but is not
started unless an application requests it.
When started in the default configuration it will log on using the Local System account.
This service is available on Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise
as well as all versions of Windows Server 2008 R2. It is not available on Windows 7 Starter, Windows
7 Home Basic, or Windows 7 Home Premium.
This service is not dependent on any other system service, nor is any service dependent on it.
The Block Level Backup Engine Service (wbengine) performs block level backup and recovery of data.
This service is used by the Backup and Restore feature in the Control Panel of Windows 7 and by the
Windows Server Backup feature of Windows Server 2008 R2. It allows for backups to occur at the
hard disk level, instead of just file by file, in a process similar to disk imaging.
This service is installed by default and its startup type is Manual. When started in the default
configuration it will log on using the Local System account.
This service is not dependent on any other system service, nor is any service dependent on it.
The Bluetooth Support Service (bthserv) supports discovery and association of remote Bluetooth
devices. Stopping or disabling this service may cause already installed Bluetooth devices to fail to
operate properly and prevent new devices from being discovered or associated. If you do not use
Bluetooth devices with your computer, this service can be disabled.
This service is installed by default and its startup type is Manual. When started in the default
configuration it will log on using the Local Service account.
The Bluetooth Support Service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The BranchCache (PeerDistSvc) service caches network content from peers on the local subnet. This
enables clients in a branch office to securely retrieve files that are cached locally instead of having to
retrieve files from a home office server. If this service is stopped or disabled remote computers will
need to be able to connect directly to host servers in order to retrieve data.
The Branch Cache service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Certificate Propagation service (CertPropSvc) propagates certificates from smart cards to
resources that request them. The Certification Propagation service applies when a logged-on user
inserts a smart card into a reader that is attached to the computer. This action causes the certificates
to be read from the smart card. The certificates are then added to the user's personal store.
If the Group Policy "CertPropRootEnabledString" is set, Root Certificates are also propagated to the
machine root trust store. Root certificate propagation is responsible for the following specific smart
card deployment scenarios, where public key infrastructure (PKI) trust has not yet been established:
• Joining the domain
• Accessing a network remotely
In both cases, the computer is not joined to a domain, and, therefore, trust is not being managed by
Group Policy. However, the objective is to authenticate to a remote server (the domain controller or
the RADIUS server). Root certificate propagation provides the ability to use the smart card to include
the missing trust chain.
On smart card insertion, the Certificate Propagation service propagates any root certificates on the
card to the Smart Card Trusted Roots certificate stores on the local computer. This process
establishes a trust relationship with the organization
This service startup type is by default Manual. However, if you have deployed smart cards as part of
your authentication policy, we recommend that you configure this setting with the Automatic startup
type. When started in the default configuration it will log on using the Local System account.
The Certification Propagation service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Certificate Services service supports the Active Directory Certificate Services (AD CS) server role
as part of Windows Server 2008 R2 to enable a business to act as its own certification authority (CA).
It issues and manages digital certificates for applications such as Secure/Multipurpose Internet Mail
Extensions (S/MIME), Secure Sockets Layer (SSL), Encrypting File System (EFS), IPsec, and smart
card logon. Windows Server 2003 supports multiple levels of a CA hierarchy and cross-certified trust
network, including offline and online CAs.
The AD CS server role is not installed by default. Administrators must install it through Server
Manager, at which time the role service Certificate Services is also installed. If Certificate Services
stops or if you disable it after installation, certificate requests are not accepted and certificate
revocation lists (CRLs) and delta CRLs are not published. If the service stops long enough for CRLs to
expire, existing certificates fail to validate.
Certificate services can be used to issue and manage digital certificates for programs and protocols
such as Secure/Multipurpose Internet Mail Extensions (S/MIME), Secure Sockets Layer (SSL),
Encrypting File System (EFS), IPsec, and smart card logon. Certificate Services relies on RPC and on
DCOM to communicate with clients by using random TCP ports that are higher than port 1024.
Certificate Services is not supported on a Server Core installation of Windows Server 2008, but it is
supported on a Server Core installation of as well as the Standard, Enterprise, and Datacenter
versions of Windows Server 2008 and Windows Server 2008 R2.
The following table identifies the application protocol, network protocol, and ports used by Certificate
Services:
The Distributed Link Tracking Client (TrkWks) service maintains links between the NTFS file system
files within your computer or across computers in your network domain. This service ensures that
shortcuts and Object Linking and Embedding (OLE) links continue to work after the target file is
renamed or moved.
When you create a shortcut to a file on an NTFS volume, distributed link tracking stamps a unique
object identifier (ID) into the target file, which is known as the link source. The file that refers to the
target file (known as the link client) also stores information about the object ID internally. Distributed
link tracking can use this object ID to locate the link source file in the following scenarios:
Note
Unless the computer is in a domain where the Distributed Link Tracking Server service is
available, this form of link tracking is less reliable over time.
• When the shared network folder that contains the link source file is renamed.
• When the computer that contains the link source file is renamed.
For all of the preceding scenarios, the link source file must be on a fixed NTFS volume. The NTFS
volumes cannot be on removable media.
Note
The Distributed Link Tracking Client service monitors activity on NTFS volumes and stores
maintenance information in a file called Tracking.log, which is located in a hidden folder
called System Volume Information at the root of each volume. This folder is protected by
permissions that allow only the computer to have access to it. The folder is also used by other
Windows services, such as the Indexing Service.
If the Distributed Link Tracking Client service stops, any links to content on that computer are not
maintained or tracked.
By default this service is installed and starts automatically and logs on under the Local System
account.
The Distributed Link Tracking Client service is dependent upon the following system components:
• Remote Procedure Call
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Fax service, a Telephony API (TAPI)-compliant service, provides fax capabilities from users'
computers. The Fax service allows users to send and receive faxes from their desktop applications
through either a local fax device or a shared network fax device. The service offers the following
features:
• Fax distribution and receipt
• Fax activity tracking and monitoring
• Inbound fax routing
• Server and device configuration management
• Archiving of sent faxes
If you disable the print spooler or telephony service, the Fax service does not start successfully. If this
service stops, users cannot send or receive faxes. The Fax service startup type is Manual; it stops
when there is no fax activity and restarts on an as-needed basis. On server operating systems, the
Fax service is installed with the Fax Server role (http://technet.microsoft.com/en-
us/library/cc771198.aspx).
This service is available on a Server Core installation of as well as the Standard, Enterprise, and
Datacenter versions of Windows Server 2008 and Windows Server 2008 R2.
The following table identifies the application protocols, network protocols, and ports used by the Fax
Service:
The Function Discovery Provider Host (fdPHost) service provides the host process for Function
Discovery providers. Function Discovery provides a uniform programmatic interface for enumerating
system resources, such as hardware devices, whether they are local or connected through a network.
It enables applications to discover and manage lists of devices or objects sorted by functionality or
class. Users benefit from this categorized view of devices on their system. Both applications and users
can use Function Discovery to discover what functions their system can perform, regardless of the
underlying device or software architecture.
Function Discovery supports an extensible discovery provider model. The providers included in the
system provide an abstraction layer over existing standards such as Plug and Play, Simple Service
Discovery Protocol (SSDP), Web Services Dynamic Discovery (WS-Discovery), and the registry.
Custom providers can be created to expose your organization's resources through Function
Discovery.
The service startup type is Manual. When started in the default configuration the service will log on
using the Local Service account.
The Function Discovery Provider Host service is dependent upon the following system components:
• HTTP
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The following system components depend on the Function Discovery Provider Host service:
• HomeGroup Provider
• Media Center Extender Service
• PnP-X IP Bus Enumerator
The Health Key and Certificate Management (hkmsvc) service provides X.509 certificate and key
management services for the Network Access Protection Agent service as part of the Network Access
Protection (NAP) platform. Enforcement technologies that use X.509 certificates may not function
properly if this service is not installed or is disabled.
The NAP platform helps administrators validate and enforce compliance with system health policies for
network access and communication. Administrators can create solutions for validating computers that
connect to or communicate on their networks, provide needed updates or access to needed
resources, and limit the network access of computers that are noncompliant.
The service startup type is Manual. When started in the default configuration it will log on using the
Local System account.
The Health Key and Certificate Management service is dependent upon the following system
components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Human Interface Device Access (hidserv) service enables generic input access to Universal
Serial Bus (USB) devices such as keyboards and mice. The service activates and maintains
predefined keyboard keys, remote controls, and other multimedia devices.
If the Human Interface Device Access service stops, keyboard keys that are controlled by this service
no longer function. For instance, the Back key, Forward key, and other keyboard keys on USB
keyboards and volume buttons on USB speakers do not function.
This service is installed by default and its startup type is Manual.When started in the default
configuration it will log on using the Local System account.
This service is not dependent on any other system service, nor is any service dependent on it.
The Interactive Services Detection (UI0Detect) service enables user notification of user input for
interactive services, which enables access to dialog boxes created by interactive services when they
appear. If this service is stopped, notifications of new interactive service dialog boxes no longer
function and there may no longer be access to interactive service dialog boxes. This service supports
the service isolation feature in Windows 7.
In Windows XP, Windows Server 2003, and earlier versions of the Windows operating system, all
services run in the same session as the first user who logs on to the console. This session is called
Session 0. Running services and user applications together in Session 0 poses a security risk
because services run at elevated privilege and, therefore, are targets for malicious users who are
looking for a way to elevate their own privilege level.
The Windows 7 and Windows Server 2008 R2 operating system mitigates this security risk by isolating
services in Session 0 and making Session 0 noninteractive. In these operating systems, only system
processes and services run in Session 0. The first user logs on to Session 1, and subsequent users
log on to subsequent sessions. This means that services never run in the same session as users'
applications and, therefore, are protected from attacks that originate in application code. Because
Session 0 is no longer a user session, services that are running in Session 0 do not have access to
the video driver. This means that any attempt that a service makes to render graphics fails. For
example, if a device installer runs in Session 0 and the installation program creates a dialog box in
Session 0 that requires user input to continue, the device installation never completes because the
user does not see the dialog box. From the user's perspective, the device installer has stopped
responding because it has stopped progressing and the user has no way to resume it. Basically, any
functionality in a service or a service-hosted driver that assumes the user is running in Session 0 does
not work correctly in Windows 7 and Windows Server 2008 R2.
As a result of this issue, the option of enabling the Interactive Service Detection Service is available for
customers who have services from earlier versions of Windows that send user interaction dialog boxes
to Session 0 instead of the corresponding user's session.
The service startup type is Manual by default. The service starts only when a visible dialog box that is
not a command window is detected. If the service is started, users are notified when a dialog box or
window (including a command window) appears in Session 0. Information about each of the last 10
dialog boxes appears in turn if more information is shown. This helps to ensure that deployment
testers are aware of services from earlier operating systems in their environment and have the
opportunity to contact the vendors for updated services.
The service detects these visible dialog boxes or windows and sends a notification to the user. Users
may choose to:
• Respond to the dialog box immediately by clicking a button to switch to Session 0, interact with
the task dialog box, and then switch back to their session.
• Be reminded again in five minutes. The reminders continue until the dialog box closes.
If this service is disabled, users do not receive notifications when the devices or services send dialog
boxes to Session 0. By default this service logs on using the Local System account and is allowed to
interact with the desktop.
This service is not dependent on any other system service, nor is any service dependent on it.
The Internet Connection Sharing (SharedAccess) service provides network address translation,
addressing, name resolution, and intrusion prevention services for a home or small office network.
This service is installed by default and its startup type is Disabled. If started in its default configuration
it will log on using the Local System account.
The Internet Connection Sharing service is dependent upon the following system components:
• Base Filtering Engine
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
• Network Connections
• Network Store Interface Service
• NSI proxy service drive
• Remote Access Connection Manager
• Secure Socket Tunneling Protocol Service
• Telephony
• Plug and Play
• Windows Management Instrumentation
The Link-Layer Topology Discovery Mapper (lltdsvc) service creates a network map, consisting of
computer and device topology (connectivity) information, and metadata describing each computer and
device. If this service is disabled, the network map does not function properly.
This service is installed by default and its startup type is Manual. When started in the default
configuration it will log on using the Local Service account.
The Link-Layer Topology Discovery Mapper service is dependent upon the following system
components:
• Link-Layer Topology Discovery Mapper I/O Driver
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Media Center Extender Service (Mcx2Svc) allows Media Center Extenders to locate and connect
to the computer. This service is available on Windows 7 Home Premium, Windows 7 Professional,
Windows 7 Ultimate, and Windows 7 Enterprise. It is not available on Windows 7 Starter or Windows 7
Home Basic.
This service is installed by default and its startup type is Disabled.When started in the default
configuration it will log on using the Local Service account.
The Media Center Extender Service is dependent upon the following system components:
• Function Discovery Provider Host
• HTTP
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
• PnP-X IP Bus Enumerator
• Remote Desktop Services
• Terminal Device Driver
• SSDP Discovery
The Net.Tcp Port Sharing Service (NetTcpPortSharing) provides the ability for multiple user processes
to share TCP ports over the net.tcp protocol. This service allows a net.tcp port to be shared and
secured in a similar fashion as port 80 is for HTTP traffic.
The Net.Tcp Port Sharing Service is available on all operating systems that support .NET Framework
3.0, but the service is not enabled by default. As a security precaution, an administrator must manually
enable the Net.Tcp Port Sharing Service prior to first use. Although the Net.Tcp Port Sharing Service
does provide a layer of processing between applications and the network, applications that use port
sharing should still be secured as if they were listening on the network directly. Specifically,
applications that use port sharing should evaluate the process privileges under which they run. When
possible, run your application using the built-in Network Service account, which runs with the minimal
set of process privileges required for network communication.
The Net.Tcp Port Sharing Service is included by default with Windows 7. It is available for installation
as role service for the Application Server role on Windows Server 2008 R2.
The Net.Tcp Port Sharing Service is not dependent upon any other system components.
The following system component is dependent upon the Net.Tcp Port Sharing Service:
• Net.Tcp Listener Adapter
The Netlogon service maintains an encrypted channel between your computer and the domain
controller that it uses to authenticate users and services. It passes user credentials through the
encrypted channel to a domain controller and returns the domain security identifiers and user rights for
the user, which is commonly referred to as pass-through authentication. The service is installed by
default and its startup type is Manual. After the computer joins a domain, the service starts
automatically. When started it logs on using the Local System account.
If the Netlogon service stops, the computer may not authenticate users and services and the domain
controller cannot register DNS records. If this happens, the domain controller may deny NTLM
authentication requests, and client computers cannot discover domain controllers.
The Network Access Protection Agent (napagent) service enables NAP functionality on client
computers. Enabling the NAP client agent makes it possible for clients that support NAP to evaluate
clients that connect to your network for compliance with organizational software security policies such
as mandatory updates, antivirus, signatures, and firewall configurations.
By default this service startup type is Manual. If you have a NAP infrastructure in place, this service
startup type is Automatic. When started it logs on using the Network Service account.
The Network Access Protection Agent service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Offline Files (CscService) service performs maintenance activities on the Offline Files cache,
responds to user logon and logoff events, implements the internals of the public API, and dispatches
events to accounts or logs configured for receiving events related to Offline Files activities and
changes in cache state.
The Offline Files service enables the user to designate particular network folders (and their subfolders)
to be available offline. When the user is connected to the network, Offline Files service automatically
synchronizes the folders to the local hard disk. When the computer disconnects from the network (in
other words, to go "offline"), Offline Files service provides access to the content from the locally
cached copy. When the computer reconnects to the network, the service automatically synchronizes
any changes made offline with the online version and updates the offline versions with more recently
made online versions.
We recommend that you use Encrypting File System (EFS) to encrypt the Offline Files cache so that
the files in the cache can only be accessed by the user on whose behalf it is cached.
The Offline Files service is not available on computers running Windows 7 Starter, Windows 7 Home
Basic, or Windows 7 Home Premium operating systems. It is installed by default and configured for an
automatic start on computers running Windows 7 Professional, Windows 7 Ultimate, or Windows 7
Enterprise operating systems. The Offline Files service logs on using the Local System account by
default.
The Offline Files service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Parental Controls (WPCSvc) service is provided for backwards compatibility with Vista parental
controls. If you did not use Vista parental controls this service is not used and can be disabled.
This service is installed by default and its startup type is Manual. When started in its default
configuration it will log on using the Local Service account.
The Parental Controls service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Peer Name Resolution Protocol (PNRPsvc) service enables serverless peer name resolution over
the Internet. If disabled, some peer-to-peer and collaborative applications may not function. This
protocol enables the naming of computers and services without reliance on a DNS server. This allows
for flexible, informal, temporary networks of nearby computers for collaboration, data sharing, and data
storage.
Security in peer-to-peer networks is difficult to establish. If computers in your organization are allowed
to connect to peer-to-peer networks, a security policy about the types of information shared and the
types of peer-to-peer networks that are compliant with your policy should be explicitly designed and
communicated to your users to enable them to make decisions about which peer-to-peer networks
they can trust.
A trusted peer-to-peer network should be one that meets the industry standard for establishing trust:
• The network uses a trusted authentication method to identify itself and its users. Your security
policy should identify which form of authentication is the minimally acceptable method.
• The network supports different authorization levels to allow for control over who you share
information with by using the network.
• The network supports encrypted data transmission so that when you collaborate by using this
network, your information is not as susceptible to capture by unauthorized users. It should also
provide some form of data-integrity checking such as digital signatures to ensure that the data
was not modified in transit.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local Service account.
The Peer Name Resolution Protocol service is dependent upon the following system component:
• Peer Networking Identity Manager
The following system components are dependent upon the Peer Name Resolution Protocol service:
• Peer Networking Grouping
• PNRP Machine Name Publication Service
The Peer Networking Grouping (p2psvc) service supports peer "grouping," which is a technology that
allows a developer to create a private peer-to-peer network. Administrators create the groups and
invite members to join after verifying their credentials. Each member has a specific certificate, which is
called a Group Member Certificate (GMC). The GMC ensures that all records exchanged between
peers are digitally signed. The public key of a peer is contained in the structures that are passed as
part of the communication between peers. The groups are opened and closed by the administrator as
needed. This service supports the HomeGroup feature in Windows 7.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local Service account
The Peer Networking Grouping service is dependent upon the following system components:
• Peer Name Resolution Protocol
• Peer Networking Identity Manager
The Peer Networking Identity Manager (p2pimsvc) service provides the identity service for Peer
Networking. It allows for the creation, enumeration, and manipulation of peer identities in a peer-to-
peer application. An individual user can have several different peer identities. This service supports
the HomeGroup feature in Windows 7.
This service is installed by default and its startup type is Manual. When started in its default
configuration it will log on using the Local Service account.
The Peer Networking Identity Manager service is not dependent upon any other system component.
The following system components are dependent upon the Peer Networking Identity Manager service:
• Peer Name Resolution Protocol
• Peer Networking Grouping
• PNRP Machine Name Publication Service
The PnP-X IP Bus Enumerator (IPBusEnum) service manages the virtual network bus. It discovers
network-connected devices by using SSDP or the WS-Discovery protocol and gives them presence in
Plug and Play. If this service is stopped or disabled, presence of network-connected devices is not
maintained in Plug and Play and all Plug and Play–based scenarios stop functioning.
The PnP-X IP Bus Enumerator service is installed, and the service startup type is Manual in
Windows 7. On Windows Server 2008 R2, the service is installed but disabled. When started in its
default configuration, it logs on using the Local System account.
The PnP-X IP Bus Enumerator service is dependent upon the following system components:
• Function Discovery Provider Host
• HTTP
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The following system component is dependent upon the PnP-X IP Bus Enumerator service:
• Media Center Extender Service
The PNRP Machine Name Publication Service (PNRPAutoReg) publishes a computer name by using
the Peer Name Resolution Protocol (PNRP). You can publish the computer name as a secured or
unsecured peer name. The peer name configuration is managed by means of the netsh command p2p
pnrp peer.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local Service account.
The PNRP Machine Name Publication Service is dependent upon the following system components:
• Peer Name Resolution Protocol
• Peer Networking Identity Manager
The Portable Device Enumerator Service (WPDBusEnum) enforces Group Policy settings for
removable mass-storage devices. It enables applications such as Windows Media Player and Image
Import Wizard to transfer and synchronize content by using removable mass-storage devices. This
service enables you to specify which portable storage devices are allowed to be connected to systems
that are managed with Group Policy.
This service startup type is Manual on Windows 7 and Manual on Windows Server 2008 R2. When
started in its default configuration it logs on using the Local System account.
The Portable Device Enumerator Service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Problem Reports and Solutions Control Panel Support (wercplsupport) service provides support
for viewing, sending, and deleting system-level problem reports for the Problem Reports and Solutions
control panel. This service is part of the Windows Diagnostic Infrastructure.
This service is installed by default and its startup type is Manual. When started it logs on using the
Local System account.
This service is not dependent on any other system service, nor is any service dependent on it.
The Program Compatibility Assistant Service (PcaSvc) provides support for the Program Compatibility
Assistant. If this service is stopped, the Program Compatibility Assistant does not function properly.
The Program Compatibility Assistant Service attempts to find software and driver updates that improve
the compatibility of applications with Windows 7 and make changes to the computer's configuration so
that the program runs better. The Program Compatibility Assistant runs automatically when it detects
that an older program is attempting to run in Windows 7 and is encountering problems.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local System account.
The Program Compatibility Assistant Service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
Quality Windows Audio Video Experience (qWave) is a networking platform for Audio Video (AV)
streaming applications on IP home networks. The qWave platform enhances AV streaming
performance and reliability by ensuring network Quality of Service (QoS) for AV applications. It
provides mechanisms for admission control, run-time monitoring and enforcement, application
feedback, and traffic prioritization. The qWave platform provides the functionality for socket-based
applications to gather in-depth, real-time information of a variable bandwidth network, allowing it to
dynamically adapt to changing network conditions. It also allows applications to prioritize packets in
order to make better use of the available bandwidth.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local Service account.
The Quality Windows Audio Video Experience service is dependent upon the following system
components:
• Link-Layer Topology Discovery Mapper I/O Driver
• QoS Packet Scheduler
• QWAVE driver
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Routing and Remote Access (RemoteAccess) service provides multiprotocol LAN-to-LAN, LAN-
to-WAN, VPN, and NAT routing services. This service also provides dial-up and VPN remote access
services. Your server can use this service to function as a remote access server, a VPN server, a
gateway, or a branch-office router.
From a routing perspective, the Routing and Remote Access service supports the Open Shortest Path
First (OSPF) and Routing Information Protocol (RIP) routing protocols, and controls the routing tables
for the TCP/IP stack-forwarding engine.
The Routing and Remote Access service is installed but disabled by default and must be explicitly
enabled to support remote access scenarios. If you support remote access and this service stops,
your computer cannot accept incoming RAS, VPN, or dial-on-demand connections, and routing
protocols are not received or transmitted.
The Routing and Remote Access service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Smart Card (SCardSvr) service manages and controls access to a smart card that is inserted into
a smart card reader, which is connected to your computer. The smart card subsystem is based on
Personal Computer/Smart Card (PC/SC) Workgroup consortium standards
(http://go.microsoft.com/fwlink/?LinkId=120309) and consists of the Resource Manager component,
which manages access to readers and smart cards. To manage these resources, the Resource
Manager performs the following functions:
• Identifies and tracks resources.
• Allocates readers and resources across multiple applications.
• Supports transaction primitives to access services that are available on a given card.
The Resource Manager also exposes the WinSCard subset of the Win32 API to provide applications
with access to a Card/Reader Selection user interface (UI). This component allows simple applications
that work with smart cards to access a card and reader with minimum coding.
The Smart Card service is automatically installed by default on computers running Windows 7 or
Windows Server 2008 R2. If this service stops, your computer is unable to read smart cards.
This service startup type is Manual on Windows 7 and Windows Server 2008 R2. When started in its
default configuration it logs on using the Local Service account.
The Smart Card service is dependent upon the following system component:
• Plug and Play
The Smart Card Removal Policy (SCPolicySvc) service allows the system to be configured to lock the
user desktop, disconnect from Remote Desktop sessions, or log off the user upon smart card removal.
Users who walk away from computers that are running an active logon session create a security risk.
To enforce the security of your system, it is best practice for users to disconnect from any remote
Remote Desktop sessions and either log off or lock their computers when they leave. The smart card
removal policy allows you to force users to comply with this practice when they remove their smart
cards.
Note
If you decide to use the force logoff policy, users must ensure that they have saved changes
to documents and other files before they remove their smart cards. Otherwise, they may lose
any changes they have made.
Whether or not you use the Smart Card Removal Policy service depends on how your users interact
with their computers. For example, this policy may be used for computers in an open floor or kiosk
environment. This policy may not be necessary when users have dedicated computers or exclusive
use of multiple computers. You can use a password-protected screensaver or other means to lock the
computers of these users.
This service is installed by default and its startup type is manual. When started in its default
configuration it logs on using the Local System account.
The Smart Card Removal Policy service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Storage Service (StorSvc) enforces group policy settings for storage devices. It is available for
computers running Windows 7 Professional or Windows 7 Enterprise only. Its startup type is Manual
and logs on using the Local System account by default.
The Tablet PC Input Service (TabletInputService) enables Tablet PC pen-and-ink functionality. This
allows any version of Windows 7 to be installed on a Tablet PC or to use a pen or touch input device.
If your computer does not have tablet functionality or an external pen or touch input device, you should
consider disabling this service.
This service is installed by default and configured for a manual start. When started in its default
configuration it logs on using the Local Service account.
The Tablet PC Input Service is dependent upon the following system components:
• Plug and Play
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The WMI Performance Adapter (wmiApSrv) service provides performance library information from
Windows Management Instrumentation (WMI) providers to clients on the network. This service only
runs when Performance Data Helper is activated.
This service is installed by default and its startup type is Manual. When started in the default
configuration it will log on using the Local System account.
The WWAN AutoConfig (WwanSvc) service manages mobile broadband (GSM & CDMA) data
card/embedded module adapters and connections by auto-configuring the networks. It is strongly
recommended that this service be kept running for best user experience of mobile broadband devices.
The WWAN Autoconfig service is configured to start manually and log on using the Local Service
account
The WWAN AutoConfig service is dependent upon the following system components:
• NDIS Usermode I/O Protocol
• Network Location Awareness
• Network Store Interface Service
• NSI proxy service driver
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
• TCP/IP Protocol Driver
• Plug and Play
The WebClient (WebClient) service enables Win32 applications to access documents on the Internet.
The service extends the network capability of Windows by allowing standard Win32 applications to
create, read, and write files on Internet file servers through the use of WebDAV, a file-access protocol
that is described in XML and uses HTTP for communication. Because it uses standard HTTP,
WebDAV communicates using existing Internet infrastructure, such as firewalls and routers.
The WebClient service is installed on Windows 7, and its startup type is Manual. When started in its
default configuration it logs on using the Local Service account
The Windows Backup (SDRSVC) service supports backup features provided by Windows 7 that allows
data files and system images to be stored separate from the computer in case of system failure or
data loss.
Having a regular backup policy is essential for disaster recovery scenarios, but backups are also a
security risk. Your security policy must address how data backups are going to be protected so that
they are not used to remove confidential information from your data center or your organization.
Backup copies that are on removable media should be placed in a secure storage area that only
trusted personnel have access to, and they should be encrypted. If possible, desktops and portable
computers should be backed up on network servers, which are in turn backed up into secure storage.
If that is not feasible, your users should be informed as to the best practices for backing up data
securely and be provided a secure location to store their backup copies.
This service is installed by default and its startup type is Manual. When started in its default
configuration it will log on using the Local System account.
The Windows Backup service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Windows Biometric Service (WbioSrvc) gives client applications the ability to capture, compare,
manipulate, and store biometric data without gaining direct access to any biometric hardware or
samples. The service is hosted in a privileged SVCHOST process.
The service is installed by default and its startup type is manual. When started in its default
configuration it will log on using the Local System account.
The Windows Biometric Service is dependent upon the following system components:
• Credential Manager
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
• Windows Driver Foundation – User-mode Driver Framework
• Plug and Play
• User Mode Driver Frameworks Platform Driver
The Windows CardSpace (idsvc) service enables the creation, management, and disclosure of digital
identities. Windows CardSpace is client software that enables users to provide their digital identity to
online services in a simple and trusted way. It is known as an identity selector: when a user must
authenticate to a Web site or a Web service, CardSpace presents a dialog box with a set of
"information cards" for the user to choose from. Each card has some identity data associated with it—
though this is not actually stored in the card—that has either been given to the user by an identity
provider such as their bank, employer, or government, or has been created by users themselves. The
CardSpace UI enables users to create Personal cards (also known as self-issued cards) and
associate a limited set of identity data. When the user chooses a card, a signed and encrypted
security token containing the required information (for example, name and address, employer's name
and address, or credit limit) is generated by the identity provider that created the card. The user, in
control at all times, then decides whether to release this information to the requesting online service. If
the user approves, the token is sent on to the requesting party where the token is processed and the
identity information is extracted.
This service is installed by default and its startup type is Manual. When started in the default
configuration, it logs on using the Local System account.
The Windows Color System service (WcsPlugInService) hosts non-Microsoft Windows Color System
color device model and gamut map model plug-in modules. These plug-in modules are vendor-specific
extensions to the Windows Color System baseline color device and gamut map models. Stopping or
disabling the WcsPlugInService service disables this extensibility feature, and the Windows Color
System uses its baseline model processing rather than the vendor's requested processing. This might
result in inaccurate color rendering. The Windows Color System provides for more precise color
mapping and gradation. Non-Microsoft vendors such as printer manufacturers and photo finishers can
use this feature in applications and drivers to explicitly call the color that they want rendered.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local Service account.
The Windows Color System service is dependent upon the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Windows Connect Now - Config Registrar (WCNCSVC) service acts as a registrar for the
Windows Connect Now service and issues network credentials to the enrollee in the service. Windows
Connect Now technology enables stream-lined configuration of secured wireless networks and easier
provisioning of wireless hardware and supports configuration of devices on out-of-band Ethernet and
in-band wireless networks. WCNCSVC hosts the Windows Connect Now Configuration which is
Microsoft's Implementation of Wi-Fi Protected Setup (WPS) protocol. This is used to configure
Wireless LAN settings for an Access Point (AP) or a Wi-Fi Device. The service is started
programmatically as needed.
Windows Connect Now-NET in Windows 7 communicates with access points and wireless stations by
using UPnP architecture, authenticates with them by using a personal identification number (PIN), and
provides wireless settings that are based on user selection.
This service is installed by default and its startup type is Manual. When started in its default
configuration it logs on using the Local Service account.
The Windows Connect Now - Config Registrar service is dependent upon the following system
components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Windows Error Reporting Service (WerSvc) reports errors when programs stop working or
responding and enables existing solutions to be delivered. It also generates logs for the Problem
Reports and Solutions diagnostic and repair service. If this service is stopped, programs and services
that rely on this service will not report errors correctly, and the results of diagnostic services and
repairs for those programs and services will not be displayed.
Windows Error Reporting is a feature that allows Microsoft to track and address errors relating to the
operating system, Windows features, and applications. Windows Error Reporting gives users the
opportunity to send data about errors to Microsoft and to receive information about solutions. Solution
information can include instructions for working around a problem, or a link to the Windows Update
Web site or another Web site for updated drivers, patches, or Microsoft Knowledge Base articles.
Microsoft developers can use Windows Error Reporting as a problem-solving tool to address customer
problems in a timely manner and to improve the quality of Microsoft products.
Windows Error Reporting has "consent levels" that an administrator can configure to control how
Windows Error Reporting sends data to Microsoft. These setting are configured in the Problem
Reporting settings page of the Action Center Control Panel. These settings can also be configured
through Group Policy under either Computer Configuration or User Configuration in Administrative
Templates\Windows Components\Windows Error Reporting\Consent.
User Account Control does affect how Windows Error Reporting works. A standard user does not have
the same ability to report errors as an administrator does. If a prompt appears when a user is logged
on as an administrator, the user can choose to report application and operating system errors. If a
prompt appears for a user who is not logged on as an administrator, the user can choose to report
application errors plus errors for operating system software that does not require administrative
credentials to run.
The administrator also has the option to specify a list of programs for which error reports should never
be sent. This service is installed by default, and the startup type is Automatic.
The Windows Media Center Receiver Service (ehRecvr) supports the Windows Media Center so that
you can receive TV and radio programs on your computer.
This service is not available in Windows 7 Starter or Windows 7 Home Basic. In Windows 7 Home
Premium, Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise it is installed by
default and configured for a Manual start. Once started, in a default configuration, it logs on using the
Network Service account.
The Windows Media Center Receiver Service is dependent on the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mappe
The Windows Media Center Scheduler Service (ehSched) supports the Windows Media Center so that
you can start and stop recording of TV programs on schedule.
This service is not available in Windows 7 Starter or Windows 7 Home Basic. In Windows 7 Home
Premium, Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise it is installed by
default and configured for a Manual start. Once started, in a default configuration, it logs on using the
Network Service account.
The Windows Media Center Scheduler Service is dependent on the following system components:
• Remote Procedure Call (RPC)
• DCOM Server Process Launcher
• RPC Endpoint Mapper
The Windows Media Player Network Sharing Service (WMPNetworkSvc) shares Windows Media
Player libraries to other networked players and media devices by using the UPnP architecture. By
default this service is installed on all versions of Windows 7, and its startup type is Automatic on
Windows 7 Home Premium and Windows 7 Professional. On all other versions of Windows 7 its
startup type is Manual. When started in its default configuration it logs on using the Network Service
account.
The Windows Media Player Network Sharing Service is dependent upon the HTTP system
component.
The Windows Remote Management (WinRM) service implements the WS-Management protocol for
remote management. WS-Management is a standard Web services protocol used for remote software
and hardware management. The WinRM service listens on the network for WS-Management requests
and processes them. The WinRM Service must be configured with a listener by using the Winrm
command-line tool or by using a Group Policy setting in order for it to listen over the network. The
WinRM service provides access to WMI data and enables event collection. Event collection and
subscription to events require that the service be running. WinRM messages use HTTP and HTTPS
as transports. The WinRM service does not depend on IIS but is preconfigured to share a port with IIS
on the same computer. The WinRM service reserves the /wsman URL prefix. To prevent conflicts with
IIS, administrators should verify that any Web sites hosted on IIS do not use the /wsman URL prefix.
Windows Remote Management (WinRM) is one component of the Windows Hardware Management
features introduced with Windows Server 2003 R2 that manage server hardware locally and remotely.
These features include a service that implements the WS-Management protocol, hardware diagnosis
and control through baseboard management controllers (BMCs), and a COM API and scripting objects
that allow you to write applications that communicate remotely through the WS-Management protocol.
WinRM provides an efficient way for management applications and scripts to communicate with local
and remote computers by using an encrypted channel. The Windows service that WinRM installs and
uses is also named WinRM.
When a server is connected to a BMC that supports the WS-Management standard, applications and
scripts can use WinRM to communicate directly with the BMC, even when the operating system is
offline (pre-boot or post-failure).
When a server is not connected to a BMC, WinRM can still be used to connect to WMI remotely in
situations where DCOM communication is impeded, for example, across a firewall. This usage is
possible because the WS-Management standard uses a single port that is configurable by the system
administrator.
WinRM exposes its own application programming interface (API) for scripting, which can be used by
scripts written in any Windows Script Host-compatible language. The scripting API communicates with
WMI by using syntax different from standard WMI scripts. WinRM syntax is documented in the WinRM
Software Development Kit. Hardware Management uses a WMI plug-in to expose WMI classes to
WinRM. To call these classes, the WMI namespace and class must be converted into a Uniform
Resource Identifier (URI).
As a security measure, if you use WinRM for remote management, you should configure the WinRM
service to use the HTTPS protocol.
This service is installed by default, and its startup type is Manual. When started in its default
configuration it will log on using the Network Service account.
The Windows Search (WSearch) service supports the Instant Search feature and provides content
indexing and property caching for file, e-mail, and other content (by means of extensibility APIs). The
service responds to file and e-mail notifications to index modified content. If the service is stopped or
disabled, Windows Explorer cannot display virtual folder views of items, and search in Windows
Explorer reverts to an item-by-item search.
The content indexed is based on the file and data types supported through add-ins included with
Windows Search and the default inclusion and exclusion rules for folders in the file system. For
example, the filters included in Windows Search support more than 200 common types of data,
including support for Microsoft® Office documents, Office Outlook e-mail (in conjunction with the MAPI
protocol handler), plaintext files, and HTML.
The main component of Windows Search is the indexer process, which is implemented as a Windows
service running in the Local System account. The process is always running for all users even if no
user is logged on, enabling Windows Search to maintain one index shared among all users with
security restrictions on content access and to process remote queries from client computers on the
network.
The Windows Search service includes a number of features to ensure that it protects the user
experience and system performance when indexing. A number of conditions cause the service to
throttle back or pause indexing:
• High CPU usage by processes that are not search-related
• High system I/O rate including file reads and writes, page file and file cache I/O, and mapped
file I/O
• Low memory availability
• Low battery life
• Low disk space on the drive storing the index
The Windows Time (W32Time) service maintains date and time synchronization on all computers on a
Windows network. It uses the Network Time Protocol (NTP) to synchronize computer clocks so that an
accurate clock value, or timestamp, can be assigned to network validation and resource access
requests. The implementation of NTP and the integration of time providers make Windows Time a
reliable and scalable time service for administrators. For computers that are not joined to a domain,
you can configure the Windows Time service to synchronize time with an external time source. If this
service is turned off, the time setting for local computers is not synchronized with any time service in
the Windows domain or external time service.
The Windows Time service is installed by default and configured for a manual start. When started in
the default configuration is will log on using the Local Service account.
If the Windows Time service stops or if you disable it, date and time synchronization is unavailable in
the network or from an external NTP server. There are two possible scenarios:
• If you stop the Windows Time service on a workstation, the workstation cannot synchronize its
time with another source, but no other external server is affected.
• If you stop the Windows Time service on a domain controller, the same effect as in the previous
scenario applies, but domain members are also unable to synchronize time with it. This inability
to synchronize may adversely affect time synchronization in the organization.
By default, the Windows Time service is installed and started automatically on computers running
Windows 7 or Windows Server 2008 R2.
The WLAN Autoconfig service enables automatic configuration for IEEE 802.11 wireless adapters for
wireless communications. Microsoft has worked with 802.11 network-adapter vendors to automate the
network adapter configuration process, which associates the network adapter with an available
network and improves the wireless roaming experience on Windows.
The wireless network adapter and its Network Driver Interface Specification (NDIS) driver must do little
more than provide support for a few new NDIS object identifiers (also known as OIDs) that query and
set device and driver behavior. The network adapter scans for available networks and passes the
information to Windows. The Wireless Configuration service configures the network adapter for an
available network. When two networks cover the same area, the user can configure a preferred
network order; the computer tries each network in order until it determines an active one. It is also
possible to limit association to only the configured, preferred networks.
On Windows Server 2008 R2 and Windows 7, the WLAN AutoConfig (WLANSVC) service enumerates
wireless adapters, and manages both wireless connections and the wireless profiles that contain the
settings required to configure a wireless client to connect to wireless networks. The WLAN AutoConfig
System Services Group Policy settings in Windows Server 2008 R2 enable administrators to specify
the service startup type of the WLAN AutoConfig service for domain member computers running with
Windows 7 and Windows Server 2008 R2 that have wireless network adapters and the associated
Windows 7 adapter drivers installed.
WLAN AutoConfig Group Policy settings enable administrators to prevent domain member users from
altering the startup mode of the WLAN AutoConfig service.