Authorize computers for mode switches

Note: For information on overriding default configuration settings, refer to Modify configuration settings.

Follow the procedure below to prevent computers in less secure areas from performing mode switches.

To authorize computers for mode switches

1. In the %DNADataRoot%\RealTime\config\Settings directory, either create or open the RealTime_Security_Enhancement.json file.

2. In the following object, change the value of ENABLE_CHECK_MODE_SWITCH from false (default) to true:

   {

   "RealTime": {

   "ENABLE_CHECK_MODE_SWITCH": false,

   "COMPUTERS_ALLOWED_TO_ISSUE_MODESWITCH": null,

   "SYSTEMS_NOTALLOWED_TO_ISSUE_MODESWITCH": "DSS"

   }

   }

   When left as false, Controllers can perform mode switches on any computer provided they have at least one of the following permissions:

   • DNA Permission - Control_SCADA

   • DNA Permission - Supervise_SCADA

     Note: This field is case-insensitive.

3. In the following object, replaced the null value of COMPUTERS_ALLOWED_TO_ISSUE_MODESWITCH with the names of computers on which Controllers can perform mode switches:

   {

   "RealTime": {

   "ENABLE_CHECK_MODE_SWITCH": false,

   "COMPUTERS_ALLOWED_TO_ISSUE_MODESWITCH": null,

   "SYSTEMS_NOTALLOWED_TO_ISSUE_MODESWITCH": "DSS"

   }

   }

4. Note the following:

   • When adding more than one name to the value field, separate each entry with a comma. For example, computer 1,computer 2.

   • The JSON file supports the single use of the wildcard character "*" at the end of the computer name. For example, abc* would mean computers whose names start with "abc" are authorized for mode switches.

   • Entries for this field are case-insensitive.

5. Save the file.

6. Restart the RealTime service.