Operating system related considerations
This topic is to alert you to, and to describe, the steps you need to take to successfully install, deploy and run PcVue with regards to the operating system platform and its security features. The steps are not specific to PcVue, however you are liable to encounter them as you install, deploy and run the software on a target computer.
User Account Control
By default, for security reasons, operating systems display a dialog whenever a user action requires a privilege elevation, for example when installing a program. This feature is designed to prevent undesired actions from being executed by background processes such as virus, spyware and other potentially harmful programs.
Accept the user privilege elevation if you are at the origin of the action and approve it.
PcVue complies with the User Account Control feature. It is strongly recommended to keep it enabled at all times, for installing, configuring, deploying or running the application.
User privileges for installation
The user that installs PcVue must have Administrator privileges. This is mandatory for the installation process to execute properly.
You must acknowledge the User Account Control (UAC) privilege elevation for the installation process to run correctly.
Windows operating systems have a security feature called Data Execution Prevention (DEP) to help prevent damage from viruses and other security threats.
With product installation and supported operating systems defaults, sv32.exe runs with effective DEP protection.
VBA scripting can be enabled at deployment time with the Host Deployment Console or the svcmd CLI.
If the VBA scripting feature is enabled, PcVue overrides the system-wide policy at startup by attempting to automatically disable DEP for sv32.exe. The system DEP policy setting must be OptIn (default setting for Windows client versions), OptOut (default setting for Windows Server versions), or AlwaysOff.
If VBA scripting is enabled and the system DEP policy is AlwaysOn, PcVue returns an error and startup is aborted. In such a case, you should contact your system administrator.
User permissions for the installation folders
This paragraph describes general requirements for permissions on installation folders. More detailed information can be found in the following topics:
Specific recommendations when running PcVue as a Windows service
Specific recommendations when running PcVue in a Remote Desktop environment
The hardening guide:
The Windows user account that runs PcVue must have the Read and Execute Permissions on the Program folder, by default C:\Program Files\ARC Informatique\PcVue 17\
The exact permissions required depends on the station host and vary depending on the sub-folders :
- Read and Modify Permissions required on sub-folders \dumps and \logs on all station hosts.
- On an engineering host, the Read and Modify Permissions are required on the project folder so configuration changes can be saved.
- On a host in production, the Read Permissions is required on the project folder and all sub-folders and files it includes. The Write Permissions is required on a subset of files where persistent data are stored.
There may be differences in default permissions depending on the operating systems, in particular desktop OS vs server OS. It also and mainly depends on the target partition and folder (system partition vs other partitions).
In most cases, permissions need to be changed because the installation was run by an administrator user account and the software will be run afterward with standard user accounts.
For this reason, it is strongly recommended to create a dedicated User Group for all Windows user accounts that are due to run the software. This allows for setting permissions on the installation folders once, and ease user account changes. In addition, it securely isolates who can affect PcVue files.
A tool is provided with PcVue that can be used to view the permissions of the current User on selected folders. The tool is named ViewEffectivePermissions.exe and is found in PcVue
Running PcVue
During start-up, PcVue checks that permissions and security features are set correctly for the most common uses.
For security reasons, it is strongly recommended to apply the least privilege principle by not running PcVue with Windows administrator privileges.
If you have several versions of PcVue on the same computer, you must register the components every time when switching from one version to another version, using the Component Registration tool. See below for more information.
The start-up of PcVue will be aborted if one of the following element is not set accordingly: Permissions, DEP exception, missing or incorrectly registered components.
Registering a Previously Installed Version
Multiple versions of the product can be installed side-by-side on a computer host.
This procedure is only necessary if you have two or more versions of PcVue installed on the same computer.
When you install PcVue, its components are registered with Windows. If there is another version of PcVue already installed, its registration is overwritten and it may no longer function correctly.
To overcome this problem a Component Registration utility is supplied with each version of PcVue. Each time that you want to run a different installed version of PcVue, the corresponding Component Registration utility must be run first. A shortcut to the utility can be found on the Windows desktop and in the Start menu: Start.Program Files.PcVue.Tools.Component Registration. 
Show picture
Running the Component Registration Utility resets all system settings associated with PcVue processes to their installation defaults. This includes:
- Settings associated with the SV Core Daemon, SV DbConnect, SV Core Session Host and SV Core Data Isolation services: Startup type, Recovery mode, Service account, Service dependencies.
- Configuration of the 3 DCOM applications associated with PcVue.
We recommend you document these settings as part of your project documentation so you can set them again each time you update the PcVue version, replace a computer or in any other situation requiring that you run the Component Registration Utility.