DEV Community: Hans Study

Aruba CX AOS-CX Hardening: A Practical Baseline

Hans Study — Mon, 09 Nov 2026 23:30:57 +0000

A hardened AOS-CX baseline puts SSH on the management VRF behind an allow-list, authenticates logins centrally with a local fallback, moves SNMP to v3 only, and authenticates NTP. On the access ports it adds port security, BPDU guard or loop protection, DHCP snooping, and ARP inspection, with unused ports shut down in a blackhole VLAN. As on any platform, static-IP cameras need explicit handling before ARP inspection goes on. Plan for that first.

The syntax below was checked against the HPE AOS-CX Command-line interface Reference Guide for 8100 and 8360 Switch Series, published February 2026. Other series such as the 6200 and 6300 share most of it, but confirm against the guide for your model and release. Addresses are from the 192.0.2.0/24 documentation range, and every secret is a placeholder. The Cisco equivalent is in hardening Cisco Catalyst switches, and the audit side is in the switch configuration audit checklist.

Management plane

SSH is disabled until the admin password is set, and it is enabled per VRF. It will not start without it. Put it on the management VRF, restrict who can connect, and turn off Telnet and the web interface where you do not use them. The CLI reference states that the Telnet server is disabled by default, so the explicit line below is a guard against someone enabling it later.

ssh server vrf mgmt
ssh server allow-list
 ip 192.0.2.0/24
 enable
ssh maximum-auth-attempts 3
no telnet server vrf mgmt
no https-server vrf mgmt
session-timeout 10

Enabling the allow-list restarts the SSH servers and ends active sessions, and an enabled list with no entries blocks everyone. Apply it from the console or from a session inside the permitted range. Test it. Keep the HTTPS server only if you use the REST API or web interface, and then keep it on the management VRF.

Authentication comes next. Create named users in the built-in groups, point SSH and console logins at TACACS+ with local last, and test the fallback before you leave the room. AOS-CX stores local passwords hashed, so there is no separate secret type to choose.

user ops1 group administrators password
tacacs-server host 192.0.2.20 key plaintext <strong-secret> vrf mgmt
aaa authentication login ssh group tacacs local
aaa authentication login console group tacacs local
aaa authentication limit-login-attempts 5 lockout-time 300
banner motd ^
This system is private property of [ORGANIZATION]. Authorized use only.
Activity is logged and monitored.
^

The guide warns that command authorization has no fail-through, so a wrong TACACS+ authorization setup can leave a switch unable to run commands. Always end the group list with local, and prove the setup on a lab switch first.

Time, SNMP, and logging

NTP can be tied to a trusted key so the switch only syncs with a source that proves itself, which protects log timestamps from a spoofed time server on the camera VLAN. SNMPv3 users get authentication and privacy, and the switch can be told to drop v1 and v2c entirely. Syslog goes out over the management VRF.

ntp authentication-key 10 sha1 <strong-secret> trusted
ntp authentication
ntp server 192.0.2.30 key 10
ntp vrf mgmt
ntp enable
snmp-server snmpv3-only
snmpv3 security-level auth-privacy
snmpv3 user monitor auth sha256 auth-pass plaintext <strong-secret> priv aes priv-pass plaintext <strong-secret> access-level ro
logging 192.0.2.10 severity info vrf mgmt

The guide notes that a # character in an NTP key stops synchronization once authentication is on, so choose keys without one. The logging command also supports TCP and TLS transports, and TLS is the better choice when your collector can present a certificate.

Control plane basics

AOS-CX applies a predefined control plane policing policy named default at first startup. Review it with show copp-policy rather than rewriting it. Leave it alone. Rate limits on ingress ICMP and broadcast traffic on edge ports add a second layer, and the management plane is already limited by the VRF and allow-list above.

Access ports

Edge ports get an access VLAN, edge port type, BPDU guard, loop protection, a broadcast rate limit, and port security, all applied the same way to every port that faces a camera, reader, or workstation. The client limit defaults to 1. Sticky learning keeps the first MAC the port sees. A violation shuts the port down, and auto-recovery brings it back after a timer.

spanning-tree bpdu-guard timeout 300
port-access port-security enable
interface 1/1/1
 no routing
 vlan access 100
 spanning-tree port-type admin-edge
 spanning-tree bpdu-guard
 loop-protect
 rate-limit broadcast 1 percent
 port-access port-security enable
 port-access security violation action shutdown
 port-access security violation action shutdown auto-recovery enable
 port-access security violation action shutdown recovery-timer 300
 port-access port-security
  client-limit 1
  sticky-learn enable

Port security with one client catches an unmanaged switch added for extra drops, while BPDU guard catches a managed switch or a loop through one. Loop protection is a separate mechanism that sends its own control packets, so it also catches loops that never involve spanning tree.

DHCP snooping is enabled globally and per VLAN, and only the ports that face the real DHCP server, usually the uplinks or the LAG toward the distribution layer, are trusted. Everything else stays untrusted. From release 10.14 the command is dhcp-snooping, and earlier releases use dhcpv4-snooping. ARP inspection is enabled per VLAN on the 8100 and 8360 from 10.12.

dhcp-snooping
vlan 100
 dhcp-snooping
 arp inspection
interface lag 1
 dhcp-snooping trust

ARP inspection discards ARP packets that carry an invalid IP-to-MAC binding, so a camera with a static address and no lease is at risk of being dropped. That is the trap. Convert cameras and door controllers to DHCP reservations where you can. For devices that must stay static, the guide documents ipv4 source-binding, which adds a static entry to the binding database.

ipv4 source-binding 100 192.0.2.50 00:11:22:33:44:55 1/1/5

The guide documents how to enable ARP inspection and view its trust state per interface, but I could not find a command to set a port as trusted in it. Check the security guide for your release, and keep uplinks in mind when you test, because a wrongly untrusted uplink drops ARP between switches.

Unused ports

Unused ports go into a VLAN with no routed interface, get a description, and are shut down.

vlan 666
 name BLACKHOLE
interface 1/1/24
 no routing
 vlan access 666
 description UNUSED
 shutdown

Backups and firmware

Copy the running configuration to a remote server over SFTP or SCP on a schedule, using the management VRF, and diff each copy against the last. The guide lists the copy forms for running configuration and checkpoints.

copy running-config sftp://backup@192.0.2.40/sw01.cfg vrf mgmt

For firmware, read the release notes and the HPE security bulletins for the target version before upgrading. AOS-CX keeps primary and secondary images, so stage the new image on the secondary partition and keep the known-good one until the switch has run clean for a day.

Checking your work

The switch config audit tool checks a configuration you paste or upload against a published checklist. The switch config audit is the remote review across a whole estate, and the Network Hardening Level 1 course and the Network and Windows Hardening training cover the reasoning behind each control.

Book a working session at /book/.

What counts as Specified Information under CPCSC?

Hans Study — Sun, 08 Nov 2026 18:58:19 +0000

Specified Information is government of Canada information that must be protected when a non-government organization handles, processes, or stores it. That is PSPC’s definition in its Level 1 scoping guide. Which of your documents qualify is set by your contract, not by a general list.

The reasoning

The official pages don’t give a catalogue of document types. PSPC tells suppliers to use their contract, security clauses, and any handling instructions to confirm what counts, and then to identify every asset and environment that has it. So the work starts in the paperwork, not on the file server.

On the hub I describe it as sensitive but unclassified government information that a contract identifies as needing safeguarding on supplier systems. The usual candidates are drawings, statements of work, schedules, and technical data. That list is my experience, not PSPC’s wording, and the contract decides each case.

One drawing can be Specified Information on one job and ordinary correspondence on another. Two purchase orders for the same part can come out differently.

Where it ends up

PSPC’s scoping guide says in-scope assets are the ones that process, store, or transmit it. Its examples include computers, mobile devices, file shares, cloud storage, email, servers, backup media, and printers or scanners that can store information. The guide also describes information that is received, created, edited, printed, emailed, transferred, backed up, and destroyed.

That list matters because the copy you know about is rarely the only one. Echoes in backups, sync clients, and downloads folders count.

The same logic covers what you create. A routing sheet, a first-article inspection report, or a quote that restates details from a customer’s drawing can carry the same handling duty, depending on the clause. PSPC’s guide describes information that is created, edited, and generated by an automated system, not only information that arrives from outside.

Edge cases

If a clause is vague, ask the contracting authority or your prime what is meant. Get the answer in writing.

If you can’t tell, treat the material as Specified Information until you can. Wrongly protecting a file costs little, and wrongly ignoring one costs a lot.

Controlled Goods data is a separate regime. A drawing may be both, and meeting one doesn’t satisfy the other.

What to do this week

Collect the security clauses and any handling instructions from every defence-related contract.
Write down, per contract, what the paperwork says is Specified Information.
Trace each item through 5 stages, from arrival to rest, work, leaving, and echoes.
Mark every system it touches, which becomes your boundary.

The scoping page walks through the trace and the ways to shrink the footprint, and does it apply covers the yes-or-no test. CPCSC Bytes has shorter explainers.

If you would like help reading your clauses and mapping the data, book a scoping call.

How long CPCSC Level 2 readiness takes a small shop

Hans Study — Sat, 07 Nov 2026 18:59:26 +0000

By my estimate, a small shop with a contained network and current equipment needs about 6 months of part-time effort to get ready for Level 2. A flat network with shared admin accounts and no logging needs closer to 18 months, plus some capital. Those are my numbers from the work involved, not figures PSPC has published.

The reasoning

Level 2 assesses all 98 ITSP.10.171 requirements, through a certification body accredited by the Standards Council of Canada, with an annual affirmation between assessments. That is a long way from Level 1’s 13 requirements and a yearly self-attestation.

The time goes into governance more than technology. A firewall can be bought and installed in a week. Written policies that people follow, a system security plan that matches the running network, access reviews, log reviews, and one piece of evidence for every requirement take months to build and months more to prove through habit.

Scope sets the calendar. If Specified Information is confined to an enclave, you prepare the enclave. If it has spread across every laptop and mailbox, the same 98 requirements apply to the whole company. The scoping page covers the shrinking steps.

What PSPC has published

PSPC’s September 29, 2026 program overview says Levels 2 and 3 are under development and gives no dates. Its April 2026 announcement planned Level 2 for select contracts from spring 2027, and its earlier timeline page read April 2027 to March 2028. As of my last check in early October, the assessment methodology, the accredited certification body list, and the rules for gaps found at assessment were not published.

PSPC also says suppliers will first need to show they meet the new Level 1 controls. Level 1 comes first, then, and it is the opening step of any Level 2 plan I would draw.

A rough split of my 6-month case looks like this. The first 6 to 8 weeks go to scoping and the Level 1 foundation. The next stretch goes to policies and the system security plan, written to match what the network really does. The last stretch goes to collecting evidence, running your own rehearsal, and fixing what it finds. A flat network adds a rebuild phase in front of all that, and the rebuild is where the capital goes.

Edge cases

Open items at assessment are the biggest unknown. CMMC allows limited plans of action with a 180-day closeout, but no published Canadian position exists, so don’t assume the same here.

If your prime never asks for Level 2, you may not need it for years. The contract names the level, so read the clauses before you commit a budget.

What to do this week

Confirm which contracts carry Specified Information clauses.
Map where that data lives and draw a boundary.
Run a gap check against the 98 requirements and note which are policy gaps and which are technical.
Complete Level 1, since it is everyone’s first step.

The Level 2 page tracks PSPC’s timing changes as they happen, and CPCSC Bytes carries shorter notes.

If you want to size your own timeline, book a scoping call.

Is MFA required for CPCSC Level 1?

Hans Study — Fri, 06 Nov 2026 20:30:42 +0000

Yes. Multifactor authentication is requirement 03.05.03, one of the 13 CPCSC Level 1 requirements. PSPC’s how-to page says it is required for privileged accounts and for systems that store Specified Information, and I would plan for every account that touches those systems.

The reasoning

PSPC’s overview lists MFA as control 7 of the Level 1 set, under identification and authentication. Its how-to page words the duty as MFA for privileged accounts and for systems that store Specified Information. ITSP.10.171 and PSPC’s assessment criteria cover privileged and non-privileged accounts, which is the wider reading.

I plan for the wider reading. The criteria are what you sign against when you attest, and a gap on ordinary user accounts that can open the drawings is hard to defend. MFA is cheap to turn on and expensive to explain away.

Shops coming from CMMC are often surprised by this. The American Level 1 has no MFA requirement, so passing it on passwords alone says nothing about CPCSC Level 1.

Edge cases

Which systems are covered depends on your boundary. If Specified Information lives in an enclave file share plus email, MFA covers those logins and the admin accounts that manage them. Draw the boundary first, using the scoping page.

Shared logins are a problem. MFA tied to a shared shop-floor account doesn’t identify anyone, and requirement 03.05.01 asks for unique identification.

On method, authenticator apps work and hardware keys are the option I push. SMS is the weakest choice, and I would avoid it for admin accounts.

Evidence is simple. PSPC’s list of examples includes screenshots of MFA configuration, so a dated screenshot per system is enough to start.

Remote access deserves its own look. A VPN or remote desktop gateway that reaches the enclave is a privileged path in practice, even when the account behind it is an ordinary one. If MFA is on the Microsoft 365 sign-in but not on the VPN, the front door is locked and the side door isn’t. Fix both before you attest.

The cost of getting this wrong is mostly an attestation problem. Level 1 has no routine evidence review, and PSPC reserves the right to look, so the signature is what carries the weight. I would rather a shop delay its attestation by two weeks to turn MFA on than sign and hope.

What to do this week

List every system that stores or can reach Specified Information, including email and remote access.
List every privileged account on them, and then every ordinary user account.
Turn on MFA for the admin accounts first, then everyone else.
Capture a dated screenshot of each configuration and file it under 03.05.03.

The Level 1 page has the other 12 requirements, and CPCSC Bytes has short notes on the rest.

To check MFA coverage against your own boundary, book a scoping call.

CPCSC Level 1 evidence a prime will ask for

Hans Study — Thu, 05 Nov 2026 21:10:36 +0000

Expect two kinds of request. The first is proof that you attested, which is the results page and the expiry date confirmed in your CanadaBuys supplier profile. The second is whatever supports the 13 answers, which at Level 1 you keep yourself and show on request.

The reasoning

Level 1 is an annual self-assessment against 13 of the 98 ITSP.10.171 requirements. PSPC’s Level 1 page tells suppliers to keep evidence for the duration of the attestation cycle, or at least one year, and lists examples such as account and device lists, access review notes, security policies, training records, patch and sanitization logs, visitor logs, firewall settings, and screenshots of MFA configuration.

PSPC also says you must provide proof of self-attestation and its expiry date in CanadaBuys, and again with a bid on a contract that requires Level 1. That proof is the part nobody can skip. The rest sits in your files until someone asks.

What a prime is likely to ask

PSPC doesn’t set a prime’s questionnaire, so this part is my expectation. Primes already send supplier assurance questions about insurance and quality, and cyber status is a natural addition. I would expect these, roughly in this order:

Your results page with its expiry date
Which contracts, and which systems, your boundary covers
A named person who signed the attestation
Evidence for the requirements a prime cares about most, usually MFA, patching, and who has access
A statement of what happens when your environment changes

None of that is a published prime checklist. Read your contract’s clauses and ask the prime what form it wants.

Edge cases

The attestation is a signed representation in a federal procurement setting, so an answer you can’t back up is a risk to you rather than a formality. If a requirement isn’t met yet, fix it before you attest. Level 1 gaps are usually cheap to close.

Your boundary matters here too. Evidence only has to cover the systems where Specified Information lives, so a tight scope means fewer artifacts. The scoping page covers how to draw it.

What to do this week

Make a folder per requirement identifier, 13 in all.
Put one dated artifact in each, such as a screenshot, an export, or a signed policy.
Save the PSPC results page next to a note of the expiry date, and calendar the renewal a month early.
Draw the boundary on one page and date it.

The Level 1 page lists the 13 requirements in plain language, and the Level 1 checklist pairs each with the evidence an assessor’s methods would reach for. More short explainers live in CPCSC Bytes.

To go through your own evidence folder with someone who reads these requirements daily, book a scoping call.

Your MSP's remote tool is inside your compliance scope

Hans Study — Wed, 04 Nov 2026 20:55:51 +0000

The MSP is the one party in a CPCSC program that doesn't sign anything and still ends up in the assessment. It isn't a defense supplier. Its client is. But if it administers the systems where the client's Specified Information lives, its access, its tooling, and its personnel are inside the client's scope, and the assessor will look at them.

Most MSP relationships weren't built with that in mind.

The bench with a remote tool on every machine

I've had MSPs tell me "this is how we do it" while their whole bench had a remote tool on every machine.

That is very hard to defend against the access control and maintenance requirements, because it isn't role-based anything. Does every technician need access to everything? Almost never. And do the people who hold access have the screening the contract requires?

There is also a security argument that has nothing to do with compliance. I've seen remote support tools compromised and used to wipe fleets. The tool that lets the MSP fix your server is the same tool an attacker wants.

What I'd build instead

Put remote access through a jump host with MFA on the session. 03.07.05, non-local maintenance, requires MFA for it. The technician authenticates to the jump host, the jump host is the only path into the enclave, and the jump host is where the logging happens.

Keep administrative work on separate admin workstations, and never work under an admin account day to day. 03.14.09 sets a stricter bar for those workstations.

If a remote support tool stays, turn on session recording from the moment of login.

The assessor's questions are ordinary. When was the server last touched? By whom? Show the login and logout. Show the patch window and what was applied. Screenshots and a basic central log server answer all of it. Nobody is asking for a SIEM.

Who assesses the MSP's work

Your IT provider shouldn't be assessing its own work. Some won't tell on themselves.

So keep the checking at arm's length. Run your own vulnerability scans, with proper tools. Audit switch and firewall configurations with something like rConfig or Nipper. If the MSP says "we do vulnerability management for you," or "our tool says you're secure," verify it with your own scan and your own read of the configs.

Two red flags. A provider that hides behind "proprietary" or refuses configuration access. And an MSP running a sales-oriented assessment tool and calling it a security assessment. It may tick a box, and it is still a sales tool.

Put it in a matrix

"They handle our IT" is not a control description. The program forces a written responsibility matrix: requirement by requirement, who operates the control, who holds the evidence, and what deliverable arrives on what cadence. Sample rows from the one I use:

Patch management: MSP operates, MSP holds evidence, patch report monthly
Firewall rule set: MSP operates, rule review quarterly, client keeps a copy
Log collection and review: MSP operates, weekly digest to a client mailbox
Backup and restore test: MSP operates, restore test log quarterly

If the MSP runs the control, the MSP produces the evidence, on a schedule, as a contract deliverable. Have that conversation early and in writing. It surfaces 2 uncomfortable discoveries at a survivable moment. Some MSPs can't support this work, and 2026 is a better time to learn that than mid-assessment. And the MSP's own security posture is part of your risk story, because its remote access into your enclave is one of your attack paths.

CPCSC for build-to-print shops: does it apply?

Hans Study — Wed, 04 Nov 2026 20:55:20 +0000

Yes, it can. If a contract identifies your customer’s drawings as Specified Information and those drawings reach your computers, email, file shares, or backups, you are inside CPCSC. Building to print doesn’t exempt you, because the program reads where the data goes and ignores what you make.

The reasoning

PSPC’s Level 1 scoping guide defines Specified Information as government information that has to be protected when a non-government organization handles, processes, or stores it. A drawing package for a bracket, a housing, or a wire harness can fit that description when the contract says so. Making only the part and never designing anything doesn’t change where the PDF lands.

My test has three questions, in order. Is the work connected to a National Defence contract, directly or through a prime? Do the contract’s clauses or security requirements identify Specified Information? Does any of it touch your systems? Three yeses put you in. The full walkthrough is on the does it apply page.

Company size and tier never enter that test. A shop 3 tiers below the department is in scope the same way a prime is, as long as the data got to it.

Edge cases

Some shops find the answer is no. If you sell catalogue parts off a price list and never receive a customer’s technical data, there is nothing to protect. Re-run the test the day a customer sends you a drawing.

A prime’s certification probably won’t cover you. PSPC’s pages say nothing about subcontractors, and my reading is that the safeguarding requirement travels with the data to each supplier that holds it. Your contract’s security clauses decide, so read them and ask the prime in writing.

Controlled Goods registration is a separate matter. It governs who may examine or possess controlled technical data, while CPCSC governs how the systems holding contract data are secured. One doesn’t satisfy the other.

Then there is volume. The published material sets no threshold. One drawing on one laptop puts that laptop in the question, and volume only decides how big the scoping job is.

What to do this week

Pull every contract and purchase order that mentions National Defence, and read the security and handling clauses.
List who at your shop receives drawings, and by what route (portal, email, file transfer).
Find every copy, including downloads folders, quoting files, CAM stations, and backups.
Ask your prime in writing whether it expects a CPCSC Level 1 attestation from you, and by when.

Step 3 is where most shops learn how far the data has spread. The scoping page explains how to shrink that footprint before you buy anything, and Level 1 lists the 13 requirements you would attest to. Short, plain explainers on this are collected in CPCSC Bytes.

If you want a second pair of eyes on your contracts and data flow, book a scoping call.

How scoping took a machine shop from 40 devices to 9

Hans Study — Wed, 28 Oct 2026 19:46:41 +0000

A shop owner told me last spring that CPCSC couldn't apply to him because his DND-connected work was 4 percent of revenue. We found Specified Information in 6 places in an afternoon: the quoting folder, 2 engineers' laptops, the shared drive, his own email, and the cloud backup of everything above.

The program applied to 4 percent of his revenue and roughly 80 percent of his network. That ratio is normal, and it is the whole argument for scoping before anything else.

Scope is the denominator

Every control you implement, document, and prove applies to every system inside your boundary. A supplier that confines contract data to an enclave assesses the enclave. A supplier that lets drawings spread across every laptop and mailbox assesses the whole company. Same controls, same standard, and the second supplier pays several multiples of the first.

What the shop looked like

This is the machine shop the way I keep finding them. CAD workstations, the software driving the CNC machines, the office PCs, and the owner's laptop, all on one small business network behind a modem-router combo. 1 flat subnet, consumer wifi, no segmentation. The customer's drawings were reachable from every device in the building, which put every device in the building in scope.

The build was an architecture job, not a paperwork job. A real firewall at the edge. The shop floor split from the office. Wifi on its own segment. And an enclave for the drawings: 1 file server, 3 workstations, a managed transfer tool for receiving drawings, and a firewall rule set I could read in one sitting.

In-scope devices went from roughly 40 to 9. The build cost a few weeks of an integrator's time and some licensing. The alternative was bringing 40 devices, including the owner's home laptop, to a Level 2 standard by 2027.

The moves, in order of value

Consolidate storage first. 1 project share, or 1 enclave file server, instead of copies on personal drives. That move usually removes more systems from scope than any other.

Contain email second. Every mailbox that ever received a drawing is a system holding Specified Information. Route contract data through a managed transfer folder or a dedicated project mailbox, and make "don't email drawings" a rule with an easy alternative attached, because rules without easy alternatives lose to deadlines.

Separate the enclave third, with its own workstations or virtual desktops, real firewalling at its edge, and its own backup job. For a shop where defense is a minority of revenue, this turns "certify the company" into "certify the room."

Last, purge the echoes: old proposals, dead projects, departed employees' mailboxes. Check the contract's records retention clause first, because some contract data has to be kept for years, and that data gets archived into the enclave rather than deleted.

The owner's laptop

The owner's laptop is where small-shop scoping goes to die. Every shop has the folder. It's named "DND stuff" or "Project X" or just "Drawings," it lives on the machine that also does the banking and the kids' homework, and it's synced to a personal cloud account for convenience.

Nobody wants to tell the owner their laptop is in scope, so the map omits it, and the enclave is fiction from day one. Tell the owner. I've had that conversation a dozen times this year. It takes 5 awkward minutes, the fix is a managed workstation and a habit change, and it beats an assessor finding the folder in minute 20 of the first interview.

One test for "real" separation

Systems that connect to the enclave but are kept from the data by real technical separation can sit outside it. The word doing the work is "real." A VLAN with an any-any rule between segments is a diagram, not a separation.

State of Cyber Hygiene in Ontario: 4,450 Small Businesses Checked

Hans Study — Wed, 28 Oct 2026 18:02:03 +0000

Most weeks I am looking at the networks behind courthouses, water utilities, law enforcement, and the suppliers who build for defence. Big systems, long audits, rooms full of people whose job is to worry about this. Last week I turned the same eye on the other end of the street: the bakery, the law office with two lawyers, the HVAC company with a truck and a website a nephew built in 2017.

I did it because of a bug, and because it felt like the right time, and close to a public service.

On October 21 the PHP project shipped an emergency fix for two flaws, now nicknamed PHP2Shell, that let an attacker take over a web server without a password. PHP runs most of the web, so this is not a problem for someone else’s data centre. It is a problem for whoever runs the software behind the quote form on a local contractor’s site. Within days the United States cyber agency had it on the must-patch list, and Amazon said it had seen attempts before the bug was public.

So I asked a simple question. How exposed are the businesses in my own corner of Ontario, right now?

What I did, and what I did not do

This was not a public records search. I looked at the public-facing side of 4,450 small businesses across seven regions, London and Middlesex County, Sarnia-Lambton, Chatham-Kent, Kitchener-Waterloo, Cambridge, Brantford and Brant County, and Windsor-Essex, and checked for the things I would flag in one of my audits: how their email is set up, whether the software behind the website is current, whether the padlock works, and what their domains give away.

Every one of them runs a website on a domain of its own. Shops, trades, clinics, firms, and contractors. Not chains, and not government. Each was looked at from the outside, the way any visitor could: public DNS records and one visit to the home page. Nobody was hacked or scanned, and no business is named.

This is not name and shame. It is meant to draw attention to things we do not normally pay attention to.

What turned up

The headline, given why I started, is PHP. At least 149 of these local sites are advertising a PHP version that is either behind the PHP2Shell fix or on a release line that will never be patched. Read that as a floor, not a ceiling. Most sites hide their version, so the real number is higher.

The number that bothered me more was email. Of the 3,539 businesses that receive email, 2,942 can be impersonated. That is 83%. There is a DNS record called DMARC that tells Gmail and Outlook to throw away a message forging your address, and four of every five local businesses have not turned it on. That is how a fake invoice, with a real logo and a real signature, lands in a customer’s inbox looking exactly like it came from you. Invoice fraud almost always starts there.

The rest is a grab bag of small, fixable things:

442 domains have no SPF record at all, the most basic email check there is.
1,593 sites run WordPress. 206 of those that reveal a version are behind on security updates, and 229 sites still load a code library retired in 2016. 454 take card payments on that same software.
235 sites serve a broken, expired, or missing certificate.
359 domains that businesses are still listed under no longer work, and 132 more show a parking page. An abandoned domain can be re-registered by anyone, who then receives the mail meant for that business.

Every region has its own report with the breakdown by sector, by town, and by hosting platform, and the method and its limits spelled out. They are all on the State of Cyber Hygiene in Ontario hub, with a map.

The front door nobody has to drive to

When we talk about securing infrastructure, from courthouses to municipal water utilities, there are always holes. Something does not function the way it was intended or designed, something failed, or something was overlooked, on both the physical and the digital side. I see it all the time: a temporary fix becomes permanent, and that becomes the vulnerability. Small businesses are no different.

We look after the physical side without thinking about it. A broken door, a lock that does not latch, a camera someone has covered: we see those and fix them the same day. We are not always paying attention to the same things in the digital world, and the threats there are real, with real impact and real damages.

The biggest change in the last thirty years is that instead of a criminal needing to drive to your business, they can now reach it from the other side of the globe without getting out of their chair. We need to take the same steps on the digital side. At least put a lock on the front door. At least make sure the windows are closed. At the very least, make sure the front door is shut.

This is not a competence problem

I do not want anyone to take the wrong thing from this. These owners are not careless, and they are not foolish. They are busy running a business, and nobody ever sat them down and told them that an afternoon of free changes, to records they probably do not know they have, would close most of the gap. There is no villain here. There is a gap between what is normal and what is possible, and almost nobody told the people on the small end of it.

That gap is the whole reason the fixes are published next to the findings. Five changes close most of what I found, and none of them need new software:

Stop people sending email as you. Publish SPF, turn on DKIM, and set DMARC to quarantine or reject.
Patch the website platform, and hide its version. Keep WordPress, its plugins, and PHP current, and turn off the version numbers in the page and the headers.
Force HTTPS and keep it on. Redirect every visitor to the encrypted site and add an HSTS header.
Turn on multi-factor authentication. On the website admin, the email, and the hosting panel. Remove old staff accounts.
Mind the domains you are not using. Keep them renewed with mail turned off, or let them go on purpose, not by accident.

If you only do one, do the first. It is the most common gap, the cheapest to fix, and the one most likely to cost you or a customer real money.

Where this goes

Seven regions are up. Hamilton-Niagara, the Toronto area, and Ottawa are next, and the plan is to work across Ontario region by region until there is a picture of the whole province and a plain playbook to go with it. Not to sell fear. To put real local numbers next to a national story, and to give small businesses a reason, and a way, to spend the afternoon.

The reports, the combined numbers, and the five fixes are at hans.study/state-of-cyber-hygiene. If you run one of these sites and want to know where you landed, the data is there, and so is my inbox. If you would rather hand the whole list to someone and have it done, book a scoping call.

References

CVE-2026-109618, PHP unauthenticated remote code executionPublished October 21, 2026

NIST National Vulnerability Databasenvd.nist.gov
Known Exploited Vulnerabilities CatalogEntries added October 26, 2026

CISAcisa.gov
RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)March 2015

IETFrfc-editor.org
Baseline cyber security controls for small and medium organizationsCurrent edition

Canadian Centre for Cyber Securitycyber.gc.ca

Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.

Genetec Architecture, Roles, and Workstations

Hans Study — Tue, 27 Oct 2026 19:34:12 +0000

Genetec Security Center, Server Role Architecture

All roles communicate through the Directory. The Archiver, Access Manager, and Media Router are independent roles that can run on separate servers.

The most expensive problems in Genetec Security Center deployments are almost always architectural. Roles placed on the wrong servers. Database failover configured incorrectly from day one. Media Router settings left over from an upgrade three versions ago. Workstations struggling because nobody tuned them for video. These problems are invisible during installation. Everything works fine when you commission it. They surface six months later when the system is under load, when the client starts using features they were not using during testing, or when you add cameras to a system that was not designed with headroom.

This post covers the architecture decisions that determine how a Genetec Security Center environment performs and scales. The recommendations are based on Genetec’s published enterprise guidance and findings from real system assessments across government, law enforcement, airports, and enterprise environments. The same review pattern is offered as an engagement via the Genetec Health Check; broader scope and ongoing advisory live under Genetec Security Center consulting.

The Server Role Model

Genetec Security Center uses a role-based architecture. Each role is a software component that handles a specific function. Roles are assigned to servers. Multiple roles can run on the same server in smaller deployments. Larger deployments separate roles onto dedicated hardware. Understanding what each role does is the foundation for making good architectural decisions.

Archiver

The Archiver manages camera recording. It connects to cameras, pulls their video streams, and writes them to storage. In most deployments, the Archiver is the most resource-intensive role because it is handling continuous video ingestion from multiple cameras simultaneously.

Archiver sizing depends on camera count, resolution, frame rate, codec, and retention period. Genetec publishes sizing guidance that is regularly updated. As a starting point: an Archiver server handling 50 to 80 standard cameras at 1080p H.265 should have a minimum of 16GB RAM and multiple dedicated storage drives for the video archive, separated from the OS drive. The specific numbers depend heavily on bitrate, which is why camera configuration needs to be finalized before server sizing.

Do not mix Archiver roles and Directory roles on the same server in deployments above approximately 50 cameras. The storage and I/O requirements of an Archiver in production conflict with the database I/O requirements of the Directory under load.

Access Manager

The Access Manager handles the Synergis access control integration. It communicates with HID, Mercury, and Axis door controllers, manages cardholder data synchronization, handles access decisions, and processes events from access control hardware. In environments using Genetec Synergis for access control, the Access Manager role must be online for access control to function.

The Access Manager can share a server with the Directory in smaller deployments. In larger deployments with thousands of doors and cardholders, a dedicated server improves responsiveness and simplifies troubleshooting. I/O on the Access Manager is lower than on the Archiver, so dedicated server requirements are less stringent.

Media Router

The Media Router handles live and playback video streams for Security Center clients. When a client opens a live view or plays back recorded video, the stream is routed through the Media Router. This role is particularly important in environments where clients are on different network segments than cameras, where there are firewall traversals involved, or where load balancing of video streams is needed.

Incorrect Media Router configuration is one of the most common causes of video playback problems in Genetec environments. The Media Router needs to be accessible from both the cameras (or Archiver, for playback) and the clients. In environments where the Media Router settings were left from an older configuration or an upgrade that changed the network topology, clients frequently receive degraded video or playback timeouts that are misdiagnosed as storage or camera problems.

Media Router configuration requires specifying the redirect addresses, the IP addresses that cameras and clients use to reach the Media Router. Getting these wrong means video streams get sent to addresses that clients cannot reach. Always verify Media Router redirect addresses after any network topology change or server migration.

Health Monitor

The Health Monitor collects health data from all roles and entities in the system, detects faults and offline conditions, and generates alarms when things stop working correctly. It is a support role that improves operational visibility but is not in the critical path for camera recording or access control operation.

The Health Monitor should be deployed in any production environment. The value of having automated fault detection is immediate the first time a camera goes offline at 2 AM and the operator gets an alert rather than discovering it during the next morning’s review.

Server Sizing Principles

Genetec publishes detailed server sizing guidance in their enterprise best practices documentation (EN.500-BPEN, updated with each major version). The numbers below are starting points for planning conversations, not substitutes for the official sizing guide for the specific version and camera count.

Deployment Scale	Camera Count	Recommended Architecture	Min Archiver RAM
Small	Up to 50	All roles on single server	16 GB
Medium	50, 200	Directory + Access Manager / Archiver(s) separate	32 GB
Large	200, 500	Dedicated server per major role	64 GB+
Enterprise	500+	Multiple Archivers, federated architecture	128 GB+

Storage sizing is separate from server sizing. Video storage requirements depend on camera count, resolution, frame rate, codec, scene complexity, and retention period. The storage calculator in Genetec’s documentation gives reasonably accurate estimates when you feed it real bitrate data from the cameras. Scene complexity is the variable that surprises people most: a parking lot camera at night in clear weather generates very different storage requirements than the same camera in a busy urban environment during the day.

Size for peak, not average. Archive storage estimates based on average bitrate will be wrong during events. When an alarm triggers and cameras switch to high bitrate, or when there is significant motion in the scene, storage consumption increases substantially. Build in at least 20 to 30 percent headroom above the calculated requirement.

Database Configuration

Genetec Security Center requires SQL Server. The edition depends on the deployment size and the database features required. SQL Server Express has a 10 GB database size limit, which is exceeded quickly in any environment with significant event history. SQL Server Standard or Enterprise is required for production deployments.

Key SQL Server configuration items for Genetec environments:

Max Server Memory: Set this explicitly. On a server where SQL shares resources with Genetec roles, leave adequate memory for the Genetec processes. Leaving SQL memory at the default (unlimited) means SQL will expand to fill available RAM, starving Genetec processes under load.
TempDB location: Move TempDB to a dedicated drive if possible. Genetec generates significant TempDB I/O during queries. Keeping TempDB on the same drive as the system or application databases creates contention.
Database maintenance: Index fragmentation in the Genetec database degrades query performance over time. Schedule regular index maintenance. Genetec’s GUS tool (Genetec Update Service) performs some automated maintenance, but database-level maintenance is separate.
Backup: The Security Center database contains all system configuration, cardholder data, and event history. It must be backed up regularly. Test the restore procedure.

Workstation Optimization

Security Center client workstations handle video decoding for the streams displayed in Security Desk. The GPU does most of the heavy lifting for video rendering. An undersized GPU shows up as dropped frames, high CPU usage, and operator complaints about delayed or choppy video.

For Security Desk workstations displaying multiple simultaneous video panes:

GPU: A dedicated GPU with hardware H.264/H.265 decode support is required for any multi-pane display configuration. Intel integrated graphics is not sufficient for a workstation displaying 16 or more simultaneous streams. Nvidia Quadro or comparable professional GPU for display-intensive operator workstations.
RAM: 16 GB minimum for a standard operator workstation. 32 GB for workstations handling high-resolution or high-count video panes.
Display outputs: Verify that the GPU supports the number of display outputs the operator needs. Running a video wall through daisy-chained consumer monitors using USB-to-DisplayPort adapters is a support nightmare.
Network: The workstation’s network connection needs to handle the aggregate video bandwidth being decoded. A workstation pulling 16 simultaneous 5MP H.264 streams at 8 Mbps each requires 128 Mbps of sustained throughput. A 100 Mbps network connection is undersized for that configuration.

Power plan on workstations should be set to High Performance. The Balanced power plan throttles CPU and GPU clock speeds, which directly affects video decode performance. This is the same setting that causes problems on Archiver servers, and it is equally wrong on operator workstations.

Naming Conventions

A consistent naming convention for Genetec entities makes the system significantly easier to operate, troubleshoot, and hand off. The convention does not need to be elaborate. It needs to be applied consistently from day one.

Camera naming: [Site]-[Floor/Area]-[Camera Type]-[Number]. For example: HQ-B2-CAM-001 for the first camera in the basement of headquarters. The Security Center client sorts entities alphabetically, so a prefix-based convention groups related cameras automatically in the tree view.

Server and role naming: Match the server hostname to what it does. GSC-DIR-01 for the first Directory server. GSC-ARC-01 for the first Archiver. This makes the Diagnostic tool and Health Monitor significantly easier to read when there are multiple servers in the environment.

Archiver naming: If using multiple Archivers, give them names that reflect which cameras they manage (by building, by floor, by area). When a camera drops from an Archiver, knowing which Archiver it is by name immediately tells you which area of the building to investigate.

Federation and Multi-Server Considerations

Genetec Federation allows multiple independent Security Center systems to appear as a single unified view to operators. This is the architecture for organizations with multiple sites that each have their own Security Center deployment and their own local administration, but where central operators need visibility across all sites.

Federation is not the same as a single system with multiple Archivers. In a federated environment, each site is an independent system. The Federation Server on the parent system connects to the child systems and makes their cameras, events, and entities visible to the parent operators. Cardholder data does not automatically synchronize across federated systems, that requires Global Cardholder Synchronization, a separate feature.

The decision between a distributed single-system architecture and a federated multi-system architecture depends on whether the sites need independent administration, whether WAN connectivity between sites is reliable enough to support a unified system, and whether cardholder data needs to be unified. Getting this decision wrong at the architecture phase is expensive to fix later.

Common Architectural Mistakes

Directory and Archiver on the same undersized server. Works during testing. Degrades under load. The Archiver’s storage I/O competes with the Directory’s database I/O, and both compete for RAM with SQL Server.

Media Router not configured for the actual network topology. The default Media Router redirect addresses point to localhost. This works when clients are on the same server. It does not work when clients are on a different subnet. Always explicitly configure the redirect addresses to match the actual network.

SQL Server memory unconfigured. SQL will consume all available RAM on the server if not explicitly limited. Genetec processes on the same server will eventually get memory-constrained and degrade.

No storage redundancy on the Archiver. A single drive failure on an Archiver with no RAID takes down recording for every camera on that Archiver. At minimum, the media storage volumes should be RAID 5 or RAID 6. The system drive should also be protected, losing the OS drive on an Archiver takes down all cameras on that server just as completely.

Power plan not set to High Performance. The Balanced power plan throttles performance in ways that are difficult to diagnose. On a server with a CPU that looks adequate on paper but cannot keep up in production, the first thing to check is the power plan. It is almost always the cause when a system runs well under light load and degrades under production load.

Most of these mistakes pass commissioning and surface months later under load. If your system has grown beyond its original design assumptions, a Genetec Health Check finds them before they turn into an incident, and the Health Check Checklist covers the same ground if you want to walk it yourself first.

Active Directory for Genetec Security Center

Hans Study — Mon, 26 Oct 2026 20:04:29 +0000

Active Directory Integration, Authentication Flow

Security Desk

Operator Workstation

Web Client

Browser

Config Tool

Admin Workstation

Kerberos / LDAP →

Active Directory

Domain Controller

← Auth token + group membership

Directory Server

Security Center

Group → Role mapping

Archiver · Access Manager

Service Accounts via AD

AD handles authentication. Security Center uses group membership to assign roles and access privileges.

If you are running a multi-server Genetec Security Center deployment without Active Directory, you are making everything harder than it needs to be. I see this regularly. Environments with a dozen servers, multiple client workstations, hundreds of cameras, and all of it managed through local accounts. Passwords shared across systems. No centralized policy enforcement. No reliable audit trail that ties actions to specific users. No time synchronization that you can trust.

Local accounts scale poorly. They are maintained inconsistently. When an operator leaves, their access has to be revoked on every system individually. When a password needs to change, it changes on some systems and gets forgotten on others. When something goes wrong and you need to reconstruct who did what, the answer is “someone logged into the shared admin account.”

Active Directory solves all of that. It also introduces dependencies and configuration requirements that, if missed, cause authentication failures that are difficult to diagnose. This post covers the AD integration for Genetec Security Center environments: what it requires, how to set it up, and what to watch for. AD integration is one of the standard items reviewed during a Genetec Health Check; broader scope around the Genetec stack lives under Genetec consulting.

Prerequisites

Before integrating Genetec with Active Directory, the following must be in place:

Domain membership. The Genetec servers must be domain-joined. This is a prerequisite for Kerberos authentication, which is the preferred authentication method for AD-integrated Genetec environments. Attempting to configure AD authentication without domain-joining the servers will result in fallback to NTLM, which has known weaknesses and should not be relied on in environments where Kerberos is available.

Time synchronization. Kerberos authentication requires that the time difference between the Genetec servers and the domain controller is under 5 minutes. In practice, keep it under 2 minutes. A time skew that exceeds the Kerberos tolerance causes authentication failures that are cryptic to diagnose if you do not know to look for them. Configure all Genetec servers to synchronize time from the domain hierarchy. In environments with multiple sites, verify that the time synchronization path goes through the domain hierarchy and not through an independent NTP source that may drift relative to the domain.

DNS resolution. The Genetec servers must be able to resolve the fully qualified domain name of the domain controllers. Use the domain’s own DNS servers as the primary DNS for Genetec servers. Using external DNS (8.8.8.8, 1.1.1.1) as the primary DNS for domain-joined servers creates intermittent authentication problems when those servers cannot resolve domain resources.

Active Directory Users and Computers access. You will need permission to create Organizational Units, security groups, and service accounts in AD. Coordinate with the domain administrator before starting the configuration.

Organizational Unit Structure

Create a dedicated OU for Genetec-related AD objects. This keeps Genetec objects organized, makes Group Policy application easier to scope, and makes it straightforward to identify everything related to the Genetec deployment in a single location.

Suggested structure:

OU=Physical Security
  OU=Servers
    [Genetec server computer accounts]
  OU=Workstations
    [Genetec client workstation accounts]
  OU=Service Accounts
    [Genetec service accounts]
  OU=Security Groups
    [Genetec role groups]

Apply Group Policy to the Physical Security OU for settings specific to Genetec servers and workstations. This includes Windows Firewall rules for Genetec ports, exclusion paths for Genetec processes in Windows Defender, and any performance-related OS settings. Keeping these in a dedicated OU means they do not affect general-purpose servers and can be modified without touching broader domain policy.

Service Accounts

Genetec roles communicate with each other and with the directory using service accounts. Create dedicated service accounts for the Genetec environment rather than using the built-in local system account or a shared general-purpose account.

Create a service account for each Genetec role that requires one:

GSC-SVC-DIRECTORY: Account used by the Directory role
GSC-SVC-ARCHIVER: Account used by Archiver roles
GSC-SVC-ACCESSMGR: Account used by the Access Manager role
GSC-SVC-SQL: Account used by SQL Server for the Genetec database

Configure these accounts with passwords that do not expire (service accounts do not interactively log in, so password expiration causes service failures rather than prompting for a change). Use strong, randomly generated passwords and store them securely. Restrict these accounts to log on only as a service, they should not be usable for interactive login. This is one of the hardening baselines that gets skipped most often in deployments that pass commissioning.

If your environment’s security policy requires password rotation on service accounts, use Group Managed Service Accounts (gMSA). gMSAs are AD accounts where the password is managed automatically by the domain, removing the operational overhead of manual password rotation. Genetec supports gMSAs on current versions.

Security Groups and Role Mapping

Genetec uses AD security groups to determine role assignment. When an AD user logs into Security Center, their group memberships are read and mapped to Security Center roles that have been linked to those AD groups.

Create security groups that correspond to Genetec access levels:

Group Name	Genetec Role	Who Gets This
GSC-Operators	Security Desk Operator	Monitoring center staff
GSC-Supervisors	Supervisor / Investigator	Team leads, investigators
GSC-Administrators	System Administrator	IT and security admin staff
GSC-AccessAdmin	Access Control Administrator	HR, access control managers
GSC-VideoAudit	Video Investigator (read-only)	Compliance, legal, audit

In the Security Center Configuration Tool, link each security group to the corresponding Security Center role. When an AD user is added to GSC-Operators, they automatically get Operator-level access to Security Center on their next login. When they leave the organization and their AD account is disabled, their Security Center access is immediately revoked as well.

Group Policy for Genetec Environments

Create a Group Policy Object linked to the Physical Security OU with settings specific to Genetec servers and workstations.

Windows Defender exclusions. Add exclusions for Genetec processes, the installation directory, the media storage directories, and the database files. Incorrect exclusions are one of the most common causes of Genetec performance problems. Genetec publishes the specific exclusion paths in their best practices documentation, apply them precisely. Do not exclude entire drives or root directories.

Windows Firewall rules. Configure inbound rules for the Genetec role ports. The specific ports depend on the roles running on the server and the Genetec version. At minimum: TCP 5500 and 5501 for the Directory, TCP 554 for RTSP streams, and the port ranges for any other roles deployed. Create the firewall rules through Group Policy rather than manually configuring them on each server, this ensures consistency and survives server rebuilds.

Power plan. Set the power plan to High Performance for Genetec servers and workstations. The Balanced power plan throttles CPU and GPU performance in ways that degrade both recording and video display. Configure this through Group Policy to ensure it is applied consistently and not overridden by default settings after a Windows update or restart.

NTP client configuration. Ensure all servers in the Physical Security OU synchronize time from the domain hierarchy. A GPO preference setting that configures the Windows Time service as a domain client is more reliable than manual configuration and ensures consistency.

Kerberos Configuration

Genetec Security Center supports both Kerberos and LDAP authentication for AD integration. Kerberos is strongly preferred. It is more secure, does not require the Security Center service to bind to the domain controller with a service account, and provides better performance in larger environments.

For Kerberos authentication to work correctly with Genetec, the Security Principal Name (SPN) for the Genetec service must be registered in Active Directory. Genetec handles this automatically when the server is properly domain-joined and the service account has the necessary permissions. If authentication is failing in ways that suggest Kerberos ticket issues, verify the SPNs are registered using setspn -L [account-name].

If LDAP is required (for environments where Kerberos cannot be used), configure LDAP over SSL (LDAPS) rather than unencrypted LDAP. Unencrypted LDAP sends credentials in cleartext. LDAPS requires a certificate installed on the domain controller, but it is the only acceptable option for production environments.

Common Pitfalls

Time synchronization drift. This is the most common cause of intermittent AD authentication failures in Genetec environments. The failure mode is that login works most of the time but fails periodically or for specific users. Check the time difference between the Genetec servers and the domain controller immediately whenever AD authentication starts failing intermittently.

DNS pointing to external resolver. A Genetec server configured with 8.8.8.8 as its primary DNS cannot reliably resolve domain resources. Kerberos ticket requests go to the domain controller by hostname. If the hostname cannot be resolved, authentication fails. This is especially common in environments where the Genetec servers were set up before the network was finalized and the DNS configuration was not updated.

Service account password expiration. If Genetec service accounts have passwords set to expire, the services will fail when the password expires and nobody notices until something stops working. Either set service account passwords to never expire, or use gMSAs, or build a process to rotate them before expiration. Whichever approach you take, document it so the next person who inherits the system knows what to expect.

Missing SPNs after server migration. When Genetec servers are migrated to new hardware or new IP addresses, SPNs may need to be re-registered. If AD authentication stops working after a server migration and everything else looks correct, SPN registration is the next thing to check.

Insufficient SPN registration rights. The service account needs specific permissions to register SPNs in AD. If the service account does not have those permissions, SPNs are silently not registered and Kerberos authentication fails. Verify with the domain administrator that the service account has the ability to register SPNs for the hostnames and IP addresses of the Genetec servers.

Genetec Security Center: Tuning and Performance

Hans Study — Sun, 25 Oct 2026 17:46:24 +0000

Server Performance, Before and After Configuration Changes

Before, Default Settings

CPU Usage

82%

Disk Queue

High

SQL Mem

95%

Frame Drop

65%

NIC Buffer

Full

After, Tuned Configuration

CPU Usage

34%

Disk Queue

Low

SQL Mem

52%

Frame Drop

NIC Buffer

Normal

Same hardware. Same camera count. Different results from configuration changes only.

Most performance issues in Genetec Security Center environments are not software defects. They are configuration gaps that were never addressed during deployment or that accumulated over time. Over the years I have audited and remediated dozens of multi-server Security Center deployments across government facilities, airports, law enforcement, healthcare, and enterprise campuses. The same problems show up repeatedly.

NIC buffers left at factory defaults. Power plans set to Balanced. Video drives with Windows indexing enabled. Antivirus scanning every video file as it gets written. Servers running with settings that were appropriate for a general-purpose workstation but not for a machine handling hundreds of continuous video streams.

These recommendations are based on Genetec’s published enterprise best practices, checked against the 5.14 guide in August 2026, combined with findings from real system assessments. Run a current, stable, patched release rather than the newest one, current versions contain performance improvements that make some older configuration recommendations obsolete.

A note on StreamVault appliances: Genetec’s StreamVault units are white-labelled Dell servers running a Genetec-tuned and hardened version of Windows. They ship with over 200 preconfigured security settings and hardening profiles aligned to CIS Level 2. Many of the settings below are already configured correctly on StreamVault hardware. Verify rather than assume, the configuration should be checked even on StreamVault units, particularly after major updates or if the appliance was reimaged.

Power Plan: High Performance

This is the single most common cause of Genetec performance problems on servers that appear correctly sized. The Windows Balanced power plan throttles CPU and storage I/O performance to reduce power consumption. On a server handling hundreds of simultaneous video streams and continuous database writes, that throttling degrades performance in ways that are difficult to attribute without specifically checking the power plan.

Set all Genetec servers to the High Performance power plan:

powercfg /setactive SCHEME_MIN

Or configure it through Group Policy for consistency across servers. The High Performance plan disables processor throttling, keeps storage controllers in full-performance mode, and prevents the CPU from reducing clock speed during periods of activity. The power cost difference on a server-grade machine is typically under 20 watts. The performance difference can be significant.

Verify the setting has applied: powercfg /getactivescheme should return the High Performance scheme GUID.

NIC Buffer Settings

Network interface card receive and transmit buffers control how much data the NIC can hold before the driver processes it. Default buffer sizes are set for general-purpose use and are too small for servers handling high volumes of continuous video traffic. When the buffer fills before the driver can process it, packets are dropped. Dropped packets cause retransmissions, which degrades camera streaming performance and adds load to both the server and the network.

Increase NIC buffers in Device Manager or via PowerShell:

# View current adapter settings
Get-NetAdapterAdvancedProperty -Name "Ethernet" | Where DisplayName -Match "Receive Buffers|Transmit Buffers"
# Set receive and transmit buffers to maximum supported value
Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Receive Buffers" -DisplayValue 4096
Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Transmit Buffers" -DisplayValue 4096

The specific parameter names and maximum values depend on the NIC vendor and driver version. Intel NICs typically support up to 4096 for both receive and transmit buffers. Broadcom NICs vary by model. Check the driver documentation for the specific NIC in your servers.

On servers with multiple NICs (dedicated NIC for management, dedicated NIC for camera traffic), configure both. The buffer settings are per-adapter.

SQL Server Memory Configuration

SQL Server will consume as much memory as available RAM allows, by default. On servers where SQL shares resources with Genetec roles, the Directory server being the primary example, this means SQL expands to fill available RAM, eventually leaving insufficient memory for the Genetec Directory service and other processes.

Set SQL Server maximum server memory explicitly. The appropriate value depends on the total RAM and the other roles running on the server. A general starting point for a dedicated Directory server:

-- Run in SQL Server Management Studio (SSMS)
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
-- For a server with 32 GB RAM running only Directory and SQL:
EXEC sp_configure 'max server memory', 20480;  -- 20 GB, leaving 12 GB for OS and Genetec
RECONFIGURE;

Adjust based on actual memory requirements. Monitor SQL memory usage in production and increase the cap if SQL is consistently hitting it and performance degrades. The goal is to give SQL enough memory to keep frequently accessed data in the buffer cache without starving other processes.

TempDB location also matters on Directory servers. If TempDB is on the same drive as the system database, move it to a dedicated drive. TempDB I/O can be significant during complex queries, and sharing a drive with the system database creates contention.

Antivirus Exclusions

Antivirus software that scans video files as they are written degrades Archiver performance significantly. Video files are large, written continuously, and changed frequently. Scanning them on write is high-overhead and accomplishes nothing useful, video files are not executable and do not carry executable malware payloads in the format the Archiver writes.

Configure antivirus exclusions for the following path types on all Genetec servers. The exact paths depend on your installation directories and the Genetec version.

# Genetec installation directory (default):
C:\Program Files (x86)\Genetec Security Center 5.x
# Health monitoring cache agent folder (default):
C:\ProgramData\Genetec Security Center 5.x\MonitoringCache\Agent
# Video archive directories (all drives used for video storage):

# SQL Server database files:
[SQLData]\*.mdf
[SQLLog]\*.ldf
[SQLTempDB]\*.mdf, *.ldf
# File extensions to exclude from archive directories:
*.g64, *.g64x, *.gek

Do not exclude entire drives or root directories. Scope exclusions precisely to Genetec directories and file types. Broad exclusions create security gaps that antivirus is supposed to address.

For the health monitoring cache folder specifically: exclude file extensions .tik, .xml, .units, .cameras. These files are frequently generated and trigger false positives in some antivirus engines.

Disable automated scans, “scan on definition update,” and any bundled network monitoring or firewall services from antivirus products on Genetec servers. These secondary features block Genetec traffic and strain resources beyond what the core scanning engine requires.

Video Drive Configuration

Video archive drives should be configured for optimal sequential write performance. Several Windows settings that are appropriate for general-purpose storage degrade performance on video archive drives.

Disable Windows Search indexing on all video archive drives. Indexing generates significant I/O on write-heavy volumes and provides no value for video archive directories that are not searched by Windows.

# Disable indexing on the video archive drive (replace D: with your archive drive)
$vol = Get-WmiObject -Class Win32_Volume -Filter "DriveLetter='D:'"
$vol.IndexingEnabled = $false
$vol.Put()

Disable 8.3 filename creation on video archive drives. This is a legacy compatibility feature that generates extra I/O for every file created:

fsutil behavior set disable8dot3 1

Drive letter assignment. Use dedicated drive letters for video archive volumes. Do not use mount points for production video archive paths, some file system operations behave differently on mount points and can cause recording problems in specific Genetec versions.

NTFS allocation unit size. For new video archive volumes, format with a 64 KB allocation unit size rather than the default 4 KB. Large allocation units reduce the overhead of managing many small file system entries across a drive that holds large video files:

Format-Volume -DriveLetter D -FileSystem NTFS -AllocationUnitSize 65536 -NewFileSystemLabel “VideoArchive1”

This applies to volumes being formatted fresh. Do not reformat volumes with existing video archive data unless you intend to lose that data.

Camera Stream Configuration

The camera configuration on the Genetec side has a direct impact on Archiver performance and storage consumption. Default settings are not always appropriate for production environments.

Codec selection: H.265 typically reduces bandwidth and storage by 40 to 50 percent compared to H.264 for equivalent quality. If your cameras support H.265 and your Archiver is running Security Center 5.9 or later with GPU-accelerated decode, use H.265. The compute cost of decoding H.265 is higher than H.264, but the storage and bandwidth savings usually outweigh this on modern server hardware.

Recording mode: Continuous recording generates more data and more I/O than motion-triggered recording. For areas where continuous recording is not required by policy, motion-triggered or scheduled recording reduces storage and I/O load significantly. Configure recording modes per-camera or per-area based on the actual security requirement, not as a single setting applied uniformly.

Stream quality separation: Genetec supports separate high-quality and low-quality streams per camera. The high-quality stream is used for recording; the low-quality stream is used for live monitoring. This reduces the decode load on operator workstations and the bandwidth required for client connections without reducing recording quality.

StreamVault-Specific Notes

Genetec StreamVault appliances ship with Aurora Protect (Cylance-based endpoint protection) pre-configured with the correct Genetec exclusions. If you replace Aurora Protect with a different product, all exclusions must be configured manually using the paths above. The default exclusion configuration in a new installation of any third-party antivirus product will not match what Genetec requires.

StreamVault appliances apply CIS Level 2 hardening by default. Some of these settings are more restrictive than standard enterprise server configurations and may need to be adjusted for specific integrations. Document any changes made to the baseline configuration, the StreamVault baseline exists for security reasons and modifications should be deliberate.

StreamVault firmware updates and Security Center updates are managed through the Genetec Update Service (GUS). GUS automates the update process and can be configured to apply updates during defined maintenance windows. Check the GUS documentation for the specific appliance version before enabling automatic updates in production, not all update combinations are supported simultaneously.

Ongoing Maintenance

A tuned server at commissioning will drift if maintenance is not ongoing. The items below belong on a regular maintenance schedule.

Database maintenance: Run SQL Server index maintenance on the Security Center database monthly at minimum. Index fragmentation builds over time and degrades query performance. Genetec does not automatically maintain SQL indexes beyond basic auto-shrink settings.
Archive partition management: Review archive drive usage monthly. Archiver will delete old recordings when storage reaches the configured threshold, but monitoring usage ensures you are not approaching that threshold unexpectedly during retention-critical periods.
Windows Updates: Apply updates on a defined schedule. Test updates in a non-production environment if possible, particularly major cumulative updates. Some Windows updates have affected Genetec services in specific versions.
NIC driver updates: NIC driver updates occasionally fix performance-related issues. Review available updates when diagnosing network-related performance problems.
Event log review: Review the Windows Application and System event logs on Genetec servers monthly. Recurring errors that are not causing obvious problems today frequently indicate issues that will become problems under higher load.

A tuned server drifts. If you want a second set of eyes across the whole stack, not just one server, see the Genetec Health Check or work through the Health Check Checklist. Many of the symptoms tuning fixes also show up in the 10 most common Genetec Security Center issues.