Emerson Exchange 365

• Not Answered

How to restrict some users access to single user session out of 6 sessions.

Hi All,

We have a remote desktop with 6 sessions out of which 5 are with Visitor rights and one with admin rights.

Can anyone suggest how to restrict access to only the admin right session for some users?

Thanks for your time.

Senthilkrishnan 

• user
• Remote session
• Admin Rights

Senthilkrishnan M

• 19 Feb 2025 2:18 PM
• Cancel

6 Replies

• Matt Forbis

  

  • 19 Feb 2025 2:59 PM

  Since this is in the Services section, I am assuming DeltaV, but it doesn't appear that your post specifies which control system.  That being said, if it is DeltaV, if you right click on the session and choose properties, there is a reserved for user list you can use.

  

  Let me know if this helps at all.  If you were asking about another control system, please specify and maybe one of the other experts can help you.

  • Cancel
• Senthilkrishnan M

  

  • 19 Feb 2025 3:11 PM

  In reply to Matt Forbis:

  Thanks, Matt.
  
  Yes, it is on DeltaV.
  
  If we add the user here, I can see that the specific Session shows < Not Available> for all other users. This solves my problem. Thank you.
  
  But still, I couldn't understand how only one session was providing the Users with their original access rights, while other sessions were only having visitor rights even though the same user was logging in to these sessions.
  
  Do you have any idea how & where this restriction of one client session having more rights than another is configured in DeltaV ??
  
  Thanks
  Senthilkrishnan

  • Cancel
• Andre Dicaire

  

  • 19 Feb 2025 5:12 PM

  In reply to Senthilkrishnan M:

  The rights of a session are based on the assigned areas of that session and the locks assigned to the users in DeltaV user manager. Each Client Session has an Alarms and Events container to which you would assign plant areas. If there are no plant areas assigned, the User on that session has no write privileges to any modules and is effectively a read only user. If the session has a span of control in terms of assigned plant areas, then the Logged on User's rights come into play for what they can change, if anything. Both the session and the User must have rights to a Plant area for online writes to be permitted.
  
  Since the User is defined in DeltaV as a DeltaV user, they are granted access to applications available to the Windows Groups they belong to, mainly DeltaV Group. This gives them windows access to launch a program like DeltaV Explorer. Their DeltaV user rights will limit what they can do in that program.
  
  For DeltaV Visitors, these users would be view only and there DeltaV keys would be limited. They can launch only the programs Windows security grants them access to by the DeltaV Group and associated policies. Once in a program, the end up with view only rights. Not assigning plant areas to the session makes the session view only from a runtime perspective.

  Andre Dicaire

  • Cancel
• Senthilkrishnan M

  

  • 20 Feb 2025 9:47 AM

  In reply to Andre Dicaire:

  Thanks for the detailed information, Andre.
  
  Now it's very clear how a session is made view only for all users.
  
  Thanks
  Senthilkrishnan

  • Cancel
• Andre Dicaire

  

  • 20 Feb 2025 4:57 PM

  In reply to Senthilkrishnan M:

  Senthilkrishnan, I forgot to mention that each Remote Client is licensed, typically with View Only Client license. This license also plays a role in restricting the ability to make runtime changes to DeltaV parameters, even if the User and workstation have assigned Plant areas. View Only License does not provide access to Process History View. This can be added to a view only license station, or you can build Displays with embedded Trends that can provide some viewing of History. The View only license is an added restriction on user privileges in DeltaV.
  
  What are your thoughts about using a Web connection versus an RDP connection for view only?
  
  A Web Server connection removes the need for maintain local DeltaV Users for access and the need to maintain Remote Client connections/licenses for view only users. It also removes the need to provide network access to the DeltaV Remote Client through your Enterprise networks/firewalls and the use of gateway servers. From a Cybersecurity perspective. the Web Server architecture closes some attach vectors including Phishing and other social engineered attacks.
  
  DeltaV Mobile provides a Web Portal with tools to convert Operate displays to web pages. For Live displays, Emerson pivoting to the Edge server environment. Hopefully we will see this at Exchange this May, but I don't know.
  
  If you were to have a Web server for your view only users, what functionality of the DeltaV HMI would they need? How do your current users make use of the Remote Clients. What would be the No Go conditions (i.e. lacking functionality) that would make a Web server interface untenable for your users?
  
  With View Only Remote Clients,
  - the users do not see any alarms in the Alarm Banner or Alarm Lists.
  - Faceplates and Detail faceplates function.
  - History View is an added license to the View Only license
  - Displays are fully functional in their native environment.
  
  DeltaV Mobile Web Portal:
  - Converted HTML web page provides comparable view of source display
  - Faceplates and Detail faceplates are not accessible
  - History is only visible through Embedded Trend object
  - Navigation and custom scripted functions are not converted.
  - only converted displays are accessible.
  
  Since Live displays are already HTML5 based web pages, we anticipate a richer experience with Live on the Edge environment. But I'm curious why more customers did not embrace the DeltaV Mobile Web Portal and what functionality are they wanting for their view only users.

  Andre Dicaire

  • Cancel
• Senthilkrishnan M

  

  • 24 Feb 2025 10:04 AM

  In reply to Andre Dicaire:

  Andre,
  
  Thanks for the additional information. Currently, we are working with DeltaV V12 and are in the process of upgrading to V15. I will check about the DeltaV Mobile portal possibility for this remote connection with the upgrade team.

  • Cancel