Account Management Guidelines

These guidelines describe the accounts that GENESIS requires, the default accounts that GENESIS uses, and recommendations for managing the accounts securely throughout the life of the system. Apply the principle of least privilege to every account: give each account only the permissions and access needed to perform its function.

Accounts Required to Use GENESIS

Account

Permissions and Recommendations

Windows administrator

Installing, upgrading, and configuring GENESIS requires local administrator privileges. Learn more

  • Use administrator accounts only for installation and maintenance tasks, not for daily operation.
  • Give each administrator an individual account, so that administrative actions can be traced to a person.

GENESIS service accounts

The GENESIS services run under Windows service accounts:

  • Most services run as NT AUTHORITY\NETWORK SERVICE.
  • The Bridging service runs as NT SERVICE\FwxBridgingService
  • The Connected Field Service service runs as NT SERVICE\FwxCfsService.
  • The OPC UA service runs as NT SERVICE\FwxOpcUaService.
  • The Workbench service runs as NT SERVICE\IcoWorkbenchService.
  • The License Update service runs as NT SERVICE\FwxLicenseUpdateService.
  • The Classic OPC Point Manager runs under the SYSTEM account to access OPC Classic servers. Avoid using OPC Classic communications for this reason. Learn more

Grant these accounts access to additional folders only for the components that need them. Learn more

SQL Server accounts

GENESIS connects to the SQL Server databases with one of the following authentication types, which you select in the Configure System utility. Learn more

  • Windows NT Integrated Security uses the identity of the GENESIS Databases Point Manager service, which is NT AUTHORITY\NETWORK SERVICE by default. This option is recommended because no SQL Server password is stored.
  • SQL Security uses an explicit SQL Server login. Grant the login access only to the GENESIS databases.
  • Entra ID Security uses a Microsoft Entra ID account to connect to Azure SQL.

Keep the Encrypt Connection option selected, and use a fully signed certificate for SQL Server.

GENESIS Security user accounts

Operators, engineers, and administrators log in to GENESIS applications, including Workbench, with GENESIS Security accounts. The accounts can be defined in the local GENESIS database, synchronized from Active Directory or Microsoft Entra ID, or authenticated by an external identity provider through Web Login. Learn more

  • Assign privileges according to each user's role. The preset Administrator, Operator, and Read Only roles are a starting point. Learn more
  • Give users separate accounts for administrative and operational work where their roles require both.

Directory connection accounts

GENESIS Security uses an account to read users and groups from Active Directory, and an application registration with a client secret to connect to Microsoft Entra ID.

  • For Active Directory, leave the connection user name and password blank to use Integrated Windows Authentication, so that no password is stored. This requires the computer to be joined to the domain and FrameWorX Server to run under the Network Service account. Learn more
  • Give the connection account read-only access to the directory.
  • Renew the Entra ID client secret before it expires, and restrict who can view the Security settings in Workbench. Learn more

Windows accounts on client computers

Operators who use GraphWorX and other client applications should log in to Windows with standard user accounts, not administrator accounts.

Default Accounts

GENESIS Security does not include predefined user accounts or default passwords. Until the first user is created, security is disabled and anyone can access Workbench and the client applications. The first user that you create is always an administrator with all permissions.

  • During post-installation setup, select Create a security user in the Configure System utility, and enter a user name and a strong password for the first administrator account. Selecting Do not create a security user leaves the system without security protection. Learn more

  • Use a unique name for administrator accounts instead of a predictable name such as Admin, and change the password of any account that was created with a temporary or shared password. To force users to replace their initial password, select User must set password at first login in the account policy. Learn more

  • A group marked as the default group grants its privileges to all users, including users who are not logged in. Do not mark a group as the default group, or grant it only the minimum privileges that anonymous users need. Learn more

  • The GENESIS service accounts are built-in Windows accounts that have no password to manage.

  • Change the default accounts and passwords of third-party components used with GENESIS, such as the SQL Server sa login, the Rancher bootstrap administrator account, and the default credentials of network and industrial devices. Learn more

Authentication and Password Policies

  • Define account policies that enforce password length and complexity, password expiration and history, account lockout after failed login attempts, and automatic logout after inactivity. You can also restrict logins to specific hours and to specific computers. Learn more

  • When you configure account lockout, consider unlocking accounts automatically after a set time. Accounts that stay locked until an administrator unlocks them can be locked out deliberately by someone who enters wrong passwords.

  • When GENESIS Security uses Active Directory or Microsoft Entra ID, password complexity, expiration, and lockout policies for these accounts are enforced by the directory. Configure them there.

  • Where possible, use automatic login with Integrated Windows Authentication instead of entering user names and passwords. Learn more

  • GENESIS Security does not provide multi-factor authentication (MFA) itself. To require MFA, configure Web Login to authenticate users through an external identity provider that supports OpenID Connect (OIDC) or SAML 2.0 and enforces MFA. Learn more

Reviewing and Removing Accounts

  • Review GENESIS Security accounts periodically, and remove or lock the accounts of users who no longer need access to the system.

    • In Active Directory or Microsoft Entra ID mode, disable or lock the accounts in the directory.

    • In local database mode, lock or delete the accounts in Workbench.

    • For users who log in through an external identity provider, disable the accounts in the identity provider and remove their user mapping in GENESIS. Learn more

  • Review the privileges of administrator accounts and group memberships at the same time, and remove privileges that users no longer need.

  • Keep more than one account with administrator privileges, so that losing access to one account does not lock you out of the system. Learn more

  • When an administrator leaves the organization, change the passwords of any shared or service credentials that the administrator knew.