0

Background

We have been supplying rack mount servers running a desktop Windows OS for some time. We are currently using the Dell R330 hardware platform and have recently moved to Server 2016 Essentials.

From time to time we encounter issues where the end users insist on installing Anti-Virus software on the flow computers, which we do not want as we cannot be certain that there will be no adverse effects on the software packages we use. Even if we test here at the factory with the version and definitions at that time, we cannot guarantee continued operation.

Additionally, we are looking at making the Flow Computer application more protected (from tampering, IP etc) and resilient (through hardening, no uncontrolled applications etc).

Key applications

1/. Kepware Modbus Suite

OPC server

Manages all Modbus communications over RS485/Ethernet

2/. Atvise

Presents HMI via a built-in web-server

OPC Client getting/sending data via Kepware

Approach being considered

To resolve this, we are considering the following solution:

  1. Install Windows Hyper-V server 2016 (command line only, no GUI) which is FOC from Microsoft

  2. Install Server 2016 Essentials as a ‘hidden’ VM – this will run all our software and will not be exposed to the customer

a. ‘CORE’ VM

b. Runs both Kepware and Atvise

c. We use a Moxa PCIe serial card for RS485 IO – this will need to be available exclusively to this VM

d. It will need an external ethernet connection allowing the web-based HMI to be run externally

e. This VM needs to be managed by using Server Manager on Windows 10 (installed on Solartron Laptops for setup and commissioning purposes)

  1. Install Windows 10 (for example) as an exposed VM

a. ‘GUEST’ VM

b. This VM has control over the video and so will be the OS seen when powering on

c. It will run the web-based HMI presented by the hidden VM

d. Client can install anti-virus software without impacting the core VM

What has been done so far?

  1. Installed Hyper-V Server 2016 on test PC

  2. Administrator password is set

  3. Followed the instructions on this link to setup remove server admin tools: a. https://docs.microsoft.com/en-us/windows-server/remote/remote-server-administration-tools

  4. Downloaded “WindowsTH-RSAT_WS_1803-x64.msu”

  5. Had trouble connecting using Server Manager – was OK with RDP but kept giving Kerberos error message when trying to connect to the server.

  6. Tried following steps in the following link: a. How do I remotely manage Hyper-V 2016 standalone via Windows 10?

  7. … this seems to be all the right steps but couldn’t get it to work.

Tasks needed

  1. Review whether this is the correct approach

  2. Get remote administration working with Server Manager on Windows 10

  3. Install 2 VMs

  4. Configure GUEST VM so it has ownership of the video/keyboard/mouse

  5. Configure CORE VM so it has ownership of the PCIe slot with drivers installed

  6. Configure CORE VM with RDP connection (perhaps on a non-standard port) so it can be administered by Solartron

  7. Possibly restrict browse support on the CORE VM so it won’t been seen on the client LAN, only visible through port 80 (HTTP) and 502 (Modbus) and RDP

  8. Configure TCP so that:

a. GUEST VM can access the web-browser in the CORE VM (for local display support)

b. Any other networked system can access the web-server installed on the CORE VM

  1. Help with ‘hardening’ of the CORE VM
Bijoykrishna Das
  • 1

1 Answers1

0

The hyper-v manager remote administration might not be working because there is a mismatch with the account you're launching the MMC console and the one that has rights on the server. So I'd say that the both local administrator account and remote administrator account must be identical (user and password). If you want to take a step further, run the mmm.exe using the /netonly /runas command from the cmd, it's a useful tool (https://ss64.com/nt/runas.html).

Humberto Castellon
  • 849
  • 1
  • 7
  • 17