System policies in exported policies

In the exported XML file, there are many values representing different policy settings. Users can find the corresponding values and their explanations in the tables below.
System Policies > Audit Policy
Node
UI setting
Description
Value
AuditAccesDenied
Audit security access failures
Determines whether to generate an audit message when a user attempts an action and is denied access to the secured object or feature because of insufficient security permissions
  • 0
     means this setting is
    Disabled
     (default).
  • -1
    means this setting is
    Enabled
    .
AuditAccessGranted
Audit security access successes
Determines whether to generate an audit message when a user attempts an action and is granted access to the secured object or feature because the user has the required security permissions.
  • 0
     means this setting is
    Disabled
     (default).
  • -1
    means this setting is
    Enabled
    .
AuditingEnabled
Audit changes to configuration and control system
Determines whether to generate audit messages when configuration and control system changes occur across the FactoryTalk system.
  • 0
     means this setting is
    Disabled
    .
  • -1
    means this setting is
    Enabled
     (default).
System Policies > Security Policy
Node
UI setting
Description
Value
AccessTokenExpiration
Access token expiration
Sets the amount of time before the access token expires.
  • Minimum:
    1
     minutes
  • Maximum:
    525600
     minutes
  • Default:
    60
     minutes
AccountLockoutAutoReset
Account lockout auto reset
The amount of time that must expire before a locked account is reset, allowing the user to attempt access again.
  • Minimum:
    0
     minutes
  • Maximum:
    999
     minutes
  • Default:
    15
     minutes
AccountLockoutThreshold
Account lockout threshold
Sets the number of consecutive failed log-on attempts that will cause an account to be locked. If set to 0, accounts are never locked.
  • Minimum:
    0
     invalid logon attempts
  • Maximum:
    999
     invalid logon attempts
  • Defaults:
    3
     invalid logon attempts.
AuditNonSecureClientConections
Audit non-secure client connections
Determines whether an audit message is created when client computers with FactoryTalk versions earlier than 2.50 connect to a directory server computer with FactoryTalk 2.50 or later.
  • 0 means
    Disabled
    .
  • -1 means
    Enabled
    (default).
AuthorizationCodeExpiration
Authorization code expiration
Sets the amount of time before the authorization token expires.
  • Minimum:
    1
     minutes
  • Maximum:
    1440
     minutes
  • Default:
    10
     minutes
BadgeEnableSetting
Allow badge login
Determines whether FactoryTalk user accounts can log on to FactoryTalk using an RFID badge.
  • 0 means
    Disabled
    .
  • -1 means
    Enabled
    (default).
DataBitsSetting
Number of bits in ID
The number of bits for the badge ID.
This value is obtained from the badge provider.
DirectoryCacheExpiration
Directory cache expiration
Determines how long the cache files remain available after the client computer is disconnected from the server. Once this time elapses, reconnect to the directory server to access the latest data files.
If set to 0, cache files never expire.
  • Minimum:
    0
     hours
  • Maximum:
    9999
     hours
  • Default:
    0
     hours
DirectoryCacheExpirationWarning
Directory cache expiration warning
Determines when a warning notification displays in the notification area prior to the directory cache expiring.
If set to 0, warnings do not appear prior to cache expiration.
  • Minimum:
    0
     hours
  • Maximum:
    24
     hours
  • Default:
    0
     hours before expiration
DNSAliasNameoftheFactoryTalkDirectoryServer
DNS Alias Name of the FactoryTalk Directory Server
Sets the DNS alias name of FactoryTalk Directory server.
This value is the DNS alias name associated with the computer hosting the FactoryTalk Directory server.
FACBitsSetting
Number of bits for Facility Code
Identifies the number of bits used as the Facility Code (FAC).
This value is obtained from the badge provider.
FacilityCodeSetting
Use Facility Code
Determines whether badge identification numbers must also have a matching facility code to log on.
  • 0 means
    No
    .
  • -1 means
    Yes
    (default).
FactoryTalkWebAuthenticationport
FactoryTalk Web Authentication port
Sets the communication port that FactoryTalk Web Authentication server can access.
The default value is 7110.
FactoryTalkWebSupportServiceport
FactoryTalk Web Support Service port
Sets the communication port that FactoryTalk Web Support Service port can access.
The default value is 7111.
FACValueSetting
Facility Code
The facility code or codes that match the facility code embedded in the badge. This will be used as the first criteria when checking whether a badge can be used to log on.
Contact the badge manufacturer to customize the facility code.
FileTransferTimeout
Directory cache transfer waiting time
Sets how long the client computer waits before transferring cache files. This only applies when security authorization uses local client cache.
  • Minimum:
    5
     seconds
  • Maximum:
    600
     seconds
  • Default:
    5
     seconds
LogonSessionLease
Logon session lease
Sets the maximum number of hours that a user can remain logged on before the system checks whether the user’s account is still valid.
  • Minimum:
    0
     hours
  • Maximum:
    999
     hours
  • Default:
    1
     hour
MaximumPasswordAge
Maximum password age
Sets the maximum number of days passwords can be used before they must change. If set to 0, passwords never expire.
  • Minimum:
    0
     days
  • Maximum:
    999
     days
  • Default:
    0
     days
MinimumPasswordAge
Minimum password age
Sets the minimum number of days passwords must be in effect before they can change. If set to 0, users can change their passwords immediately following a prior change.
  • Minimum:
    0
     days
  • Maximum:
    999
     days
  • Default:
    0
     days
MinimumPasswordLength
Minimum password length
Sets the minimum number of characters a user account password to a must contain. A value of 0 allows you to create user accounts without passwords.
  • Minimum:
    0
     characters.
  • Maximum:
    64
     characters
  • Defaults:
    • For the network directory,
      6
       characters.
    • For the local directory,
      0
       characters.
PasswordExpirationWarning
Password expiration warning
Sets the number of days before passwords are due to expire that the system begins prompting users to change their passwords.
If Maximum password age is set to 0, the password expiration warning never appears.
  • Minimum:
    0
     days before expiration
  • Maximum:
    999
     days before expiration
  • Default:
    14
     days before expiration
PasswordHistory
Previous passwords remembered
Sets the number of unique new passwords that must be created before reusing an old password.
  • Minimum:
    0
     passwords
  • Maximum:
    24
     passwords
  • Default:
    3
     passwords
RefreshTokenExporationTime
Refresh token expiration time
Sets the amount of time before the refresh token expires.
  • Minimum:
    1
     minute
  • Maximum:
    1440
     minutes
  • Default:
    1440
     minutes
RequireComputerAccounts
Require computer accounts for all client machines
Determines whether client computers can access the FactoryTalk network directory without having a computer account in the network directory. Disable this policy to allow users to connect remotely from any computer, even if the computer does not have a computer account in the FactoryTalk Directory.
  • 0 means
    Disabled
    .
  • -1 means
    Enabled
    (default).
RetainDeletedAccountHistory
Keep record of deleted accounts
To keep a record of accounts that were deleted and force all new accounts to be unique, select
Enabled
. Also, change a policy setting to show deleted accounts in the list of users. To discard accounts when they are deleted, select
Disabled
.
  • 0 means
    Disabled
     (default).
  • -1 means
    Enabled
    .
ReverseProxyPort
Reverse Proxy Port
Sets the website port for the computers using FactoryTalk Proxy Server.
When enabling HTTP, the default value is 80. When enabling HTTPS, the default value is 443.
ReverseProxyProtocol
Reverse Proxy Protocol
Sets the communication protocol for the computers using FactoryTalk Proxy Server.
  • HTTPS
  • HTTP
ShowDeletedAccountsInUserList
Show deleted accounts in user list
Sets whether deleted account records are listed in the Users folder in the System tree.
  • 0 means
    Disabled
     (default).
  • -1 means
    Enabled
    .
SupportNonSecureClients
Support non-secure clients
Determines whether client computers with FactoryTalk versions earlier than 2.50 can access a directory server computer with FactoryTalk CPR 9 SR5 or later.
  • 0 means
    Deny
    .
  • -1 means
    Allow
     (default).
SupportSecureCryptography
Password encryption method
Determines how the password is encrypted when stored in the FactoryTalk Directory.
  • 0 means
    MD5
    .
  • -1 means
    SHA-256
     (default).
SynchronizedTransferCacheFile
Security authorization policy
Determines whether the client computer is authorized with directory files from server or local client cache files.
  • 0 means
    Use local client cache
    .
  • -1 means
    Require directory update from server before authorizing
     (default).
TrailingBitsSetting
Number of trailing parity bits to strip
Identifies the number of parity bits included in the badge identification number.
This value is obtained from the badge provider.
UseClientComputerName
Identify terminal server clients using the name of
Determines what computer name identifies clients connecting to the FactoryTalk Directory through Remote Desktop Services.
  • 0 means
    Server computer
    .
  • -1 means
    Terminal client
     (default).
UseSingleSignOn
Use single sign on
Sets whether users can log on once to the FactoryTalk system or must log on to each FactoryTalk product separately.
  • 0 means Disabled.
  • -1 means Enabled (default).
UseStrongPasswords
Password must meet complexity requirements
Determines how simple or complex passwords must be.
Disabled means that passwords to user accounts can include any characters or combinations of characters.
Enabled requires users to create passwords that are more secure.
  • 0 means
    Disabled
     (default).
  • -1 means
    Enabled
    .
System policies > Application Authorization
Node
UI setting
Description
Value
EnableLearningMode
Enable Default Access
Determines whether new applications are automatically allowed access to FactoryTalk Directory.
  • 0
     means
    Disabled
    .
  • -1
     means
    Enabled
    (default).
VerifyAppSignature
Verify Publisher Info
Determines whether to verify the publisher certificate information of FactoryTalk applications.
  • 0
    means
    Disabled
     (default).
  • -1
     means
    Enabled
    .
System policies >
FactoryTalk Alarms and Events
 > System settings
Node
UI setting
Description
Value
AuditToAlmLog
Send operator action audit messages to the alarm history log
Select this check box to generate tracking events for operator actions and send them to the alarm and event history log.
  • 1
     means the check box is selected.
  • 0
     means the check box is cleared.
EventBufferSize
Buffer events before sending to clients, until xx events have occurred
The number of events that alarm servers queue before sending the events on to attached clients.
  • Maximum:
    100
  • Minimum:
    1
  • Default:
    10
EventBufferTime
Buffer events before sending to clients, until xx second have elapsed
The number of seconds that alarm servers queue events before sending the events on to attached clients.
  • Maximum:
    5000
     milliseconds (5 seconds)
  • Minimum:
    500
     milliseconds (0.5 seconds)
  • Default:
    500
     milliseconds (0.5 seconds)
HighLowerLimit
High priority - lower limit
Defines alarm priority settings by filling in the values in the
Low
column.
Default severity value is
501
.
MediumLowerLimit
Medium priority - lower limit
Define alarm priority settings by filling in the values in the
Low
 column.
Default severity value is
251.
SuppressLog
Send suppressed alarms to the alarm history log
Use this setting to configure whether changes in the alarm state for suppressed alarms are recorded in the alarm and event history log.
  • 1
     means the check box is selected.
  • 0
     means the check box is cleared.
OnlyQualityChangedForActiveLog
Only send changes in Quality for active alarms to the alarm history log
Select this check box to send changes in quality for only active alarms to the alarm history log.
Clear this check box to send changes in quality for all alarms (active or otherwise) to the log.
  • 1
     means the check box is selected.
  • 0
     means the check box is cleared.
UrgentLowerLimit
Urgent priority - lower limit
Define alarm priority settings by filling in the values in the
Low
 column.
Default severity value is
751
.
System policies >
FactoryTalk Alarms and Events
 > Severity settings
Node
UI setting
Description
Value
ControllerStatusSeverity
Control status alarm
The severity for controller status alarms that are generated by the Rockwell Automation Device Server (FactoryTalk Linx).
  • Minimum:
    1
  • Maximum:
    1000
  • Default:
    800
OperatorActionSeverity
Operator Actions
The severity for the tracking events that are logged when an operator acknowledges, resets, enables, disables, suppresses, or unsuppresses an alarm.
  • Minimum:
    1
  • Maximum:
    1000
  • Default:
    100
System policies > Live Data Policy
Node
UI setting
Description
Value
DefaultProtocolSetting
Default Protocol Setting
Sets the default protocol from TCP/IP to DCOM or vice versa.
  • -1
    : TCP/IP
  • 0
    : DCOM
System policies > Redundant policies
In the exported XML file, the corresponding section of
Redundant policies
 is
Health Monitoring
.
Node
UI setting
Description
Value
ICMPPeriod
Computer detection interval
The amount of time that the health monitoring service waits between its attempts to detect the existence of a computer on the network.
  • Default:
    2
     seconds
  • Minimum:
    1
     second
  • Maximum:
    600
     seconds
ReadyTimeout
Maximum delay before server is active
The maximum amount of time during a switch back that the server becoming active waits for clients to be ready for the switch.
  • Default:
    2
     minutes
  • Minimum:
    0
     minutes
  • Maximum:
    60
     minutes
TCPPeriod
Network failure detection interval
The time of how often the health monitoring service attempts to verify the health of the network connection to remote computers.
  • Default:
    2
    seconds
  • Minimum:
    1
     second
  • Maximum:
    600
     seconds
TCPTimeout
Maximum network glitch
The maximum duration of a network disruption before the health monitoring service determines that communications failed.
  • Default:
    5
     seconds
  • Minimum:
    1
     second
  • Maximum:
    600
     seconds
Provide Feedback
Have questions or feedback about this documentation? Please submit your feedback here.
Normal