The DeltaV system makes use of three OUs: DeltaV Users, DeltaV Workstations, and DeltaV Locked-down Workstations. The OUs are created on the domain controller during workstation configuration and are visible in the Active Directory Users and Computers utility.
DeltaV Users OU
The DeltaV Users OU contains all the user-created DeltaV user accounts. DeltaV service accounts such as DeltaVAdmin are not interactive user accounts and are not contained within the DeltaV Users OU. As new domain users are created in the DeltaV User Manager, they are placed in the DeltaV Users OU on the domain controller.
The DeltaV system makes use of two Windows users groups: DeltaV Basic Operator and DeltaV Basic Configuration. A GPO is assigned to each of these groups: DeltaV Basic Operator and DeltaV Basic Configuration and are linked to the DeltaV Users OU. Although most DeltaV users reside in the DeltaV Users OU, only users that have been assigned the Basic Operator or Basic Configuration role will have the corresponding Group Policies applied to them.
The DeltaV Default role is also linked to the DeltaV Users OU but no GPO is assigned to users in the Default role. These users have all of the operating system access permissions that they had in previous versions of the DeltaV software.
For the settings in the DeltaV Basic Operator and DeltaV Basic Configuration group policies, refer to the Emerson Knowledge Base for articles on hardened workstations and GPO settings.
DeltaV user accounts reside in the DeltaV Users OU in the Active Directory Users and Computers utility, not in the Users folder.
DeltaV Workstations OU
In addition to setting individual user access, it is also possible to set access on a computer-by-computer basis with machine GPOs. When applied to a computer, the access restrictions in a machine GPO apply to users of that computer regardless of their individual user access permissions. For example, if a machine GPO denies access to the DVD drive, then access is denied to all users regardless of their user access permissions for this capability. In this case, users would need local user access to the computer to access the DVD drive.
With the exception of workstations configured as backup domain controllers, the DeltaV Workstations OU contains all domain workstations such as Operator Stations and Application Stations. During installation and workstation configuration (where the computer joins a domain), the computer accounts are moved to the DeltaV Workstations OU.
By default, no group policies are applied to the DeltaV Workstations OU. This OU has been created as a convenience for users who may want to create and deploy machine GPOs for their DeltaV system. If you do not want to use machine GPOs, you can ignore this feature and DeltaV workstations will continue to operate as usual. If you do create a GPO to apply to this OU, it is your responsibility to fully test the policies and their impact on the workstations and control network before implementing them. Use only Microsoft tools such as the Microsoft Group Policy Editor to create a GPO. Emerson strongly suggests that if you want to use machine GPOs in a DeltaV system, you contact Emerson SureService to assist in this effort.
DeltaV workstations reside in the DeltaV Workstations OU in the Active Directory Users and Computers utility, not in the Computers folder.
DeltaV Locked-down Workstations OU
You may find it desirable to deploy a machine GPO on certain Operator Stations. The DeltaV Locked-down Workstation OU was created to aid in this effort. The DeltaV Locked-down Workstations OU does not contain any workstations by default but has a default GPO applied to it that was developed by Emerson. You can use Windows tools to move your DeltaV workstations, such as Operator Stations on the plant floor, into this OU. Workstations moved into the DeltaV Locked-down Workstation OU are subject to the settings in the DeltaV Locked-down Workstations group policy.
Due to the complexity of local and wide area plant networks and IT departments' requirements for security and access privileges, it is not possible to define a set of default Group Policy settings that meet all needs for locking down workstations. The DeltaV Locked-down Workstations Group Policy contains an example set of restrictions and allowances. These settings are not considered to be the correct settings for every DeltaV installation. Depending upon your plant or corporate policies, these settings may need to be modified (even to make basic DeltaV functions work as expected). Contact Emerson SureService for consultation services on your Group Policy settings.
For the settings in the DeltaV Locked-down Workstations group policy, refer to the Emerson Knowledge Base for articles on hardened workstations and GPO settings.