Create and configure groups

Use the Group Account dialog box to create and delete user groups, as well as to configure the security rights for a selected group.

Assuming the project security system has already been enabled (that is, you have used the Security System configuration wizard at least once, most likely when you created your project), you can access the Group Account dialog box by doing one of the following:

• Go to the Project tab of the ribbon, click Configure to open the Security System dialog box, and then click Groups; or

• Go to the Global tab of the Project Explorer, right-click the Security folder to open its shortcut menu, select Settings to open the Security System dialog box, and then click Groups.

Please note that if a user is assigned to more than one group (see Creating and configuring users), those groups' settings might conflict with each other. How the settings are resolved depends on which settings they are:

• The settings in the Group Account dialog box are permissive, which means the most permissive setting from all of a user's groups applies to the user. For example, if any of the groups can create and modify tags, the user can create and modify tags.

• The settings in the Group Account Advanced dialog box (both tabs) are restrictive, which means the most restrictive setting from all of a user's groups applies to the user. For example, if one group has a minimum password size of 8 and another group has a minimum password size of 12, the user's minimum password size is 12. (For Auto Log Off in particular, Counting from logon overrides Counting from user's last action.)

Group Account

Group Account

The user group that you are currently configuring.

There are two default groups for all projects: Guest and (Default Rights).

If the security mode is set to Local Plus Domain (LDAP), the built-in groups in Microsoft Active Directory will not appear in this list of groups and cannot be added to the project.

New

Creates a new group. In the New Group Account dialog box, type the name of the new group and then click OK.

Delete

Deletes the currently selected group.

Reset

Resets the rights of the currently selected group to match the (Default Rights) group.

This does not lock the group to the default; you can make further changes. To lock the group, see Use Default Rights below.

Advanced

Opens the Group Account Advanced dialog box, which you can use to configure the Password and Auto LogOff settings (see below).

Runtime Access

The specific rights that a member of the group has when they use a thin client to access your project during run time:

Security Rights

Locks the rights of the currently selected group to those configured for the (Default Rights) group. If changes are made to the (Default Rights) group, they also apply to this group.

Security Level

The range of access levels that this group may access in the project.

Start Project

Members of the group may run the project.

Close Project

Members of the group may stop the project.

Watch Window (write)

Members of the group may use the Watch window to write values to the project database.

This only applies to projects running locally. For projects running remotely, see Enable Remote Debugging Tools below.

Task switch enabled

Members of the group may switch away from the project runtime client to another Windows task.

This option does not apply to Secure Viewer thin clients running on some versions of Windows Embedded; the user may always switch away from the client.

Edit Security System

Members of the group may make changes to the project security system during run time.

Be careful not to clear this option for your own group, or you may not be able to undo your own changes.

Windows Task Manager

Members of the group may press Ctrl+Alt+Del on the keyboard to open the Windows Security screen, which they can use to access Task Manager and other features.

If this option is cleared — in other words, if members of the group are not allowed to open the Windows Security screen — you will need to run the thin client program as an administrator. If you are concerned that doing so might cause other issues, just make sure the Windows user who runs the thin client program is different from the users who will use the thin client to log on to the project.

This option does not apply to Secure Viewer running on some versions of Windows Embedded.

Enable Remote Security System and Remote Debugging Tools

Members of the group may:

• Configure the security system in another project (running in Distributed - Client mode) in order to use the settings in the current project (running in Distributed - Server mode);

• Configure a TCP/IP Client worksheet in another project in order to connect it to the current project; and

• Use Watch and LogWin tools to debug the project while it is running on remote station.

  Runtime group

  If this option is selected, the group will be available for new users created during run time. For example, if the CreateUser function is called during run time in order to create a new user, the new user can be assigned only to groups that have this option selected. This can prevent an existing user with limited rights from creating a new user and then assigning it to a group with more rights.

  Web Thin Client Access

  Members of the group may use Web Thin Client to connect to the project runtime server.

  This option does not affect the user's ability to use Mobile Access.

  Secure Viewer Access

  Members of the group may use Secure Viewer to connect to the project runtime server.

  This option does not affect the user's ability to use Mobile Access.

  Engineering Access

  The specific rights that a member of the group has when they use the project development software to open and edit your project:

  Security Rights

  Locks the rights of the currently selected group to those configured for the (Default Rights) group. If changes are made to the (Default Rights) group, they also apply to this group.

  Security Level

  The range of access levels that this group may access in the development application.

  Project Settings

  Members of the group may modify the project settings and the Mobile Access configuration.

  Drivers, Data Sources

  Members of the group may create, modify device drivers and external data sources.

  Network Configuration

  Members of the group may create, modify TCP/IP Client worksheets.

  Create, modify tags

  Members of the group may create, modify project tags.

  Create, modify screens

  Members of the group may create, modify project screens.

  Create, modify task sheets

  Members of the group may create, modify task worksheets.

Group Account Advanced

Min password size, Min number of special characters, Min number of numeric characters, Min number of alpha characters

To make user passwords more complex and therefore more secure, you can require that they contain a certain number of alpha (A-Z, a-z), numeric (0-9), and special (punctuation) characters. When the user is prompted to change their password — for example, when their old password expires (see Password aging below) — the new password will not be accepted unless it meets these requirements.

Case-sensitive

If this option is selected, passwords are case sensitive — that is, passwords created with both upper and lowercase characters must be entered the same way by the user.

Password aging

The number of days that a password can be used before it expires. When a user's password expires, that user will be forced to change it: when they try to log on to the project, the Change Password dialog box will be automatically displayed and the user cannot complete the logon process until they provide a new password.

This setting applies to all users in the group, although the actual aging is counted separately for each user. The aging is restarted after the password is changed, either by the Change Password dialog box as described above or by the SetPassword function.

By default, the user must choose a new password that is different from the old password. To disable this requirement, so that users can re-use the same passwords, use a text editor to manually edit your project file (<project name>.app) to include the following setting:

[Security]

ChangePasswordMode=1

To make passwords never expire, set Password aging to 0.

E-signature time-out

Timeout period (in minutes) of the E-Sign dialog box for all users in this group. The user must enter their user name and password before the specified timeout to use project features that require an e-signature.

Disable e-signature

When the value in this box is TRUE (non-zero), users in this group can ignore the e-signature requirement on any screen objects that have the E-Sign option selected and on any scripts that call the CheckESign function. Using the object or triggering the script still sends an event to the Event Log, but it is automatically signed on behalf of the user.

To change this setting during run time, type the name of a project tag (for example, DisableESign). The value of the tag will be used.

Auto Log Off

Log Off after

Number of minutes after which the current user must be logged off automatically. If this field is left in blank (or with the value 0), the current user is never logged off automatically.

Counting from logon

When this option is selected, the current user is automatically logged off after the period of time configured in the Log Off after field elapsed since when the current user was logged on the system.

Counting from user's last action

When this option is selected, the current user is automatically logged off after the period of time configured in the Log Off after field elapsed since the last action (mouse, touchscreen, or keyboard action) was performed by the current user.

Disconnect Web Thin Client on auto logoff

If the user logged on through a Web Thin Client, then when the user is logged off, the client is automatically disconnected from the data server.

This option does not affect the user's ability to use the Mobile Access thin client.

Auto Lock-up

Enable

Enables the auto lock-up features described below.

Lock up account after

Maximum number of times a user can try to log on to an account. If the user exceeds the specified maximum number of attempts (provides an invalid password) within the period of time specified in the Reset counter after field, the project will automatically block the user.

Reset counter after

Defines how long after an invalid log-on attempt the project will wait (in minutes) until it resets the log-on attempts counter.

If VBScript debugging is enabled, the Auto Log Off feature cannot be used; the normal execution cycle is suspended during debugging, so it is not possible to accurately measure the time elapsed without user input. For more information, see Debugging VBScript.