The proper way to run a iFix server? Console RDP?

I've had a lot of experience working with iFix on Windows machines but not a whole bunch setting up the iFix server (where the IGS or other gateway is running). Also, this may be more of a Windows question than an iFix one.

Previously what I've worked with (at a client site) is whenever I needed to do something to the Fix database or modify the IGS, I'd hop on a client machine and remote desktop (via MS Terminal Services).

Now, if I accessed the server as a regular user, I would never see the iFix application running. I always needed to specify the /console parameter (or /admin on later machines, /console was replaced by /admin):

ie - mstsc /v: iFIXSERVER /f /console

This would enabled me to see the iFix application.

We had to be sure to NEVER LOG OUT via the "Log Off" button (but just close the remote session) when we were in a console session, otherwise the iFix server would shutdown and render the clients helpless.

1) How did they get the iFix server to run only as a console application (or why am I only able to see it when logged into a console session and not when I log in as a remote client)?

2) Is this the preferred method to running a remote iFix server? If not, can anyone recommend a setup? I was always worried someone who didn't know what they were doing would log in and "log out" the console rather than "X-out" the RDP session.

Thanks.


PS: Reason I am asking is I am setting up an iFix server and the only account that should be logging in for the most part is the Administrator account. The example I mentioned above had multiple users logging in (with Admin privileges), so I'm not sure if that changes anything.

Hi,
I believe the key to answering your question is some explanation about what the console is.
The console is the session that is opened locally on the pc, and that is connected to the screen and keyboard/mouse that are physically attached to a computer. There is only one console session on each pc (workstations only have this one session, servers can have multiple sessions).
If you would open a non-console session and start iFix, you might be running iFix multiple times on the same computer, which can lead to serious problemns in communication towards the PLC. Therefore, if you logon to a SCADA server using RDP, you should always use the /CONSOLE argument.
Answering your question how this is opened is really simple: most probably the server is setup to automatically login as a certain user when starting, without asking the password for that user. Also iFix is automatically started (most commonly with a shortcut in Start > All Programs > Startup). The machine may then be locked after some time using the screen saver. You can unlock the pc when you physically access it, or start an RDP console session to control the running programs.

In recent iFix version, there is an option to leave the iFix service running when you log out. This might be a better option for you. I don't have an iFix system here so i can't check the exact location of the settings, but if you need it I can check later.

I hope this helps.
budtse

budtse said:

The console is the session that is opened locally on the pc, and that is connected to the screen and keyboard/mouse that are physically attached to a computer.

Click to expand...

So if the server boots and does not automatically log in then there is no console session active?

budtse said:

If you would open a non-console session and start iFix, you might be running iFix multiple times on the same computer, which can lead to serious problemns in communication towards the PLC. Therefore, if you logon to a SCADA server using RDP, you should always use the /CONSOLE argument.

Click to expand...

I believe in the versions of iFix I am working with (4.0 + ), if you log in and try to start another instance of iFix, it will prompt and error saying "iFix is already running" and will not start.

budtse said:

Answering your question how this is opened is really simple: most probably the server is setup to automatically login as a certain user when starting, without asking the password for that user. Also iFix is automatically started (most commonly with a shortcut in Start > All Programs > Startup).

Click to expand...

We edited the registry to automatically have the server log in with an administrator account. However if I log in remotely with /console as a different user (not the one that is automatically logged in), does the original admin session lock out?

budtse said:

The machine may then be locked after some time using the screen saver. You can unlock the pc when you physically access it, or start an RDP console session to control the running programs.

Click to expand...

The servers don't run a screen saver as they are house in a server room, only way to connect to them is via a ethernet KVM or RDP connection (however the clients do).

On the server the iFix service, IGS Server, and the iFix background server were running never the Workspace.

budtse said:

In recent iFix version, there is an option to leave the iFix service running when you log out. This might be a better option for you. I don't have an iFix system here so i can't check the exact location of the settings, but if you need it I can check later.

Click to expand...

I'm doing an upgrade with 5.0 so I will check this option. Thanks for the info.

kdcui said:

So if the server boots and does not automatically log in then there is no console session active?

Click to expand...

It will start the console session automatically when you open a rdp with /console. If you'd log out of the rdp instead of disconnect, the console user would also log out.

kdcui said:

We edited the registry to automatically have the server log in with an administrator account. However if I log in remotely with /console as a different user (not the one that is automatically logged in), does the original admin session lock out?

Click to expand...

Not sure about how Windows handles that. We always log in with the same account. It probably has to be either the same account, or someone with administrative rights (to prevent a lower-privileged user to hijack the console).

Also, with the default settings (there might be policy settings to change this), the console is always locked locally, even if you use the same account for the remote connection.