Central User Management on End-of-life OT Clients

A life cycle of 20 years for machines and plants in production is not uncommon. Manufacturing companies therefore continue to operate the integrated industrial PCs in these systems even after the operating system manufacturer’s support ends, due to a lack of economic alternatives for replacement or upgrade. This experience was also shared by the OT department of the automotive group.

In addition, not all OT clients were part of the company’s domain. In both cases, the central user management options from IT were therefore not or no longer available on the OT clients. This also made compliance requirements for the use of strong passwords an almost unsolvable task, especially for administrative accounts.

The use of default passwords further aggravated the situation and also needed to be addressed. For these reasons, a solution for the future management of local user accounts on the OT clients was sought and found with ondeso SR.

The first step was the central inventory and display of the currently existing user accounts with ondeso SR. This made it possible to determine the current status on the OT clients and to record the process-related necessity of specific user accounts and groups on the various industrial PCs.

The central display in the ondeso SR Admin GUI made it possible to quickly identify which different user accounts were available on which OT clients. In the next step, the unnecessary accounts were removed from the OT clients via the automated execution of so-called operations. Further operations were used to adjust the group membership of the remaining accounts, and new user accounts were also created with the minimum permissions required for the respective task.

With the introduction of a self-service portal, it is now possible to set up the required user accounts with individual passwords on the respective OT clients only for the authorized users. This means that client administration can continue without restrictions despite the abolition of standard passwords and accounts.

„The additional provision of a self-service portal for the user facility has increased acceptance even further“ notes our OT consultant Markus Kohlhäufl. „This makes it possible for anyone to request authorized access to the necessary machine. With ondeso SR, automatic, time-limited provision of user access can be made available after approval.“

Our customer is pleased to have a „practical yet significantly more secure solution for local user accounts“ on legacy devices and OT clients outside the domain. This enables adherence to central compliance requirements with regard to strong passwords and contributes significantly to increasing security in the automotive group’s production.

Sounds Interesting?

Here you can download a summary of this Success Story as a PDF file.