TN - AppSrv09112610 - Before You Call Support: AVEVA Infrastructure & Security Checklist

• Document Version: 001
• Applies to Version(s): All supported AVEVA System Platform versions on Windows Server 2016 and later

Overview

Estimated time: 5-10 minutes 

Many AVEVA communication, deployment, licensing, and authentication issues are caused by changes in the underlying Windows or IT infrastructure rather than the AVEVA software itself.

This checklist provides a quick reference for verifying common Windows, network, authentication, and security settings before opening a support case. Completing these checks can often identify common infrastructure issues and help reduce troubleshooting time.

💡 Support Tip

Before beginning detailed troubleshooting, ask one simple question:

"What changed?"

Recent Windows updates, password changes, Group Policy modifications, certificate renewals, DNS changes, firewall updates, and antivirus or EDR policy changes are among the most common causes of unexpected behavior in AVEVA environments.

Infrastructure & Security Health Check

Before opening a support case, verify the following:

🖥️ Windows

• ☐ Windows updates reviewed
• ☐ System time synchronized
• ☐ Windows Event Viewer checked
• ☐ Windows Firewall reviewed
• ☐ User Account Control (UAC) settings reviewed
• ☐ Required .NET Framework version installed

🌐 Network

• □ Forward DNS resolution verified
• □ Reverse DNS resolution verified
• □ Network connectivity confirmed
• □ Required ports accessible
• □ No recent firewall, VLAN, or routing changes
• □ DNS server assignment confirmed via ipconfig /all

🔐 Security

• □ Certificates valid
• □ TLS configuration verified
• □ Antivirus exclusions configured
• □ Local Security Policy reviewed
• □ No recent Group Policy changes affecting services

👤 Authentication

• □ Computer joined to correct domain
• □ Domain trust verified
• □ Kerberos authentication functioning
• □ Service accounts verified
• □ SPNs reviewed (if applicable)
• □ No duplicate SPNs present (setspn -x to verify)

⚙️ AVEVA Specific

• □ AVEVA Technology Matrix reviewed for software compatibility
• □ Operating system is supported for the installed AVEVA version
• □ License Server reachable
• □ Required AVEVA services running
• □ Recent configuration changes reviewed
• □ AVEVA OCMC Logger reviewed for errors and warnings

📋 General

• □ Recent changes identified
• □ Review recent IT maintenance
• □ Review recent password changes
• □ Review recent infrastructure changes
• □ Review recent antivirus or EDR policy changes

Common Symptoms

Use the "Check First" column as a starting point. These items represent the most common infrastructure-related causes for each symptom.

Useful Windows Diagnostic Commands 

The following Windows commands can help verify common network, authentication, and Windows configuration issues that may impact AVEVA products.

hostname

Purpose:
Displays the local computer's hostname (computer name). 

Common Use:
Verify the correct AVEVA node when troubleshooting multi-node environments.

whoami

Purpose:
Displays the currently logged-in user account, including the domain (if applicable).

Common Use:
Verify the account running AVEVA software or administrative tools. Also helps confirm whether you are running as a domain account or local account, which affects AVEVA authentication behavior. 

whoami /groups

Purpose:
Lists all security groups the current user belongs to. 

Common Use:
Verify group memberships and confirm the user has the required permissions for AVEVA software. Look for expected AVEVA-related groups such as aaAdministrators, aaRuntimeUsers, AELicmgr, etc.

ipconfig /all

Purpose:
Displays detailed network configuration, including IP addresses, DNS servers, gateways, DHCP status, and network adapter information.

Common Use:
Verify IP, DNS, and network settings for AVEVA communications. Verify the IP address matches the address configured in AVEVA software and check whether DHCP has unexpectedly reassigned an address that should be static.

nslookup <hostname>

Purpose:
Queries DNS to resolve a hostname to an IP address.

Common Use:
Verify AVEVA nodes resolve to the correct IP address. Also run nslookup <IP Address> to confirm reverse DNS is working. AVEVA products rely on both forward and reverse resolution and a missing PTR record can cause communication failures even when forward resolution is working.

ping <hostname>

Purpose:
Tests basic network connectivity to another device using ICMP echo requests. 

Common Use:
Verify that a device is reachable and that basic name resolution is functioning. Note that a failed ping does not always mean a connectivity problem. Windows Firewall may be configured to block ICMP while allowing other traffic to flow normally. If ping fails but nslookup succeeds, check firewall rules before assuming a network issue. 

nltest /dsgetdc:<domain>

Purpose:
Locates the Active Directory Domain Controller for the specified domain and verifies that it can be contacted.

Common Use:
Verify domain connectivity for AVEVA authentication and service accounts. Run this when AVEVA services fail to start, when login failures occur, or after a network change to confirm the expected domain controller is being reached. 

nltest /sc_verify:<domain>

Purpose:
Verifies a computer's secure channel with the domain.

Common Use:
Identify broken domain trust relationships affecting AVEVA authentication.  A successful result returns NERR_Success.

klist

Purpose:
Displays the current Kerberos ticket cache for the logged-in user. Useful when troubleshooting Kerberos authentication problems. 

Common Use:
Verify Kerberos authentication between AVEVA nodes and domain resources. If the cache is empty or tickets are expired, Kerberos authentication will fail. Look for tickets issued to krbtgt and verify expiration times are valid.  

gpresult /r

Purpose:
Displays the Group Policy Objects (GPOs) currently applied to the computer and user.

Common Use:
Identify Group Policies that may affect AVEVA services or security settings. Pay attention to any GPOs controlling firewall rules, logon rights, or service account permissions, as these are common sources of unexpected AVEVA behavior after routine IT maintenance. 

w32tm /query /status

Purpose:
Displays the Windows Time service status and synchronization source.

Common Use:
Verify the system clock is synchronized, as time drift can cause authentication and communication failures in AVEVA systems. By default, Kerberos authentication will fail when clocks are skewed by more than 5 minutes from the Domain Controller. If the time source appears unreliable or the stratum is high, ask your IT team to review the NTP configuration.

sc query

Purpose:
Displays the status of Windows services.

Common Use:
Verify required AVEVA services are installed and running. 

Get-Service

Purpose:
PowerShell command that lists Windows services and their current status. Can be filtered to quickly locate specific AVEVA services.

Common Use:
Quickly check the status of AVEVA services using PowerShell.

Test-NetConnection <ServerName> -Port <port>

Purpose:
PowerShell command that tests connectivity to a specific server and TCP port. 

Common Use:
Verify required AVEVA communication ports are accessible between nodes.

Information to gather before opening a support case

Providing the following information can help expedite troubleshooting:

• AVEVA product name and version
• Windows version and edition
• Description of the issue and any recent changes
• Screenshots of exact error messages
• AVEVA OCMC Logger or Diagnostic Manager logs
• Windows Event Viewer logs (if applicable)
• Results from the diagnostic commands above
• Network diagram (if communication issues are involved)
• Recent Windows updates or IT infrastructure changes

Related Resources

AVEVA Technology Matrix
Verify supported operating systems, SQL Server versions, .NET Framework requirements, and software compatibility.
https://gcresource.aveva.com/TechnologyMatrix

AVEVA Security Central
Review the latest AVEVA security advisories, vulnerability bulletins, security reports, and product-specific cybersecurity updates.
https://softwaresupportsp.aveva.com/en-US/securitycentral/security-reports

AVEVA Antivirus Exclusions
Recommended antivirus exclusions for AVEVA products.
https://knowledge.insourcess.com/aveva-intouch-tech-notes/wonderware-antivirus-exclusions

Ports Used by System Platform Products
Reference the default communication ports used by System Platform, Historian, InTouch, Licensing, OI Servers, OMI, Platform Common Services, SQL Server, and other AVEVA components.
https://docs.aveva.com/bundle/system-platform/page/686254.html

Common Causes of OI Server Communication Issues
Troubleshooting guidance for common OI Server communication problems.
https://knowledge.insourcess.com/aveva-communication-drivers-tech-notes/common-causes-of-oi-server-communication-issues