> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Application Server Advanced Settings

> Advanced Syteca Application Server configuration — change the Client connection port, allow a non-admin user to start the EkranServer service, enable SWIFT username monitoring, and display a Warning and Consent banner on Management Tool login.

This page collects four advanced Application Server configurations that share the same operational pattern: stop the Application Server, edit a configuration value, restart. All four were originally managed through the Windows Registry, but **as of Syteca v.6.53.1, configuration is done through the `EkranServer.Settings.config` file instead**.

<Warning>
  **NOT AVAILABLE IN SAAS for direct configuration** — the `EkranServer.Settings.config` file isn't accessible in SaaS. Contact your Syteca vendor or Syteca Support team to enable these features in a SaaS environment.
</Warning>

## How configuration works

Every setting on this page changes the Application Server's behavior by modifying a single name/value pair. The location depends on your Syteca version:

| Syteca version        | Where configuration lives                                                                      |
| --------------------- | ---------------------------------------------------------------------------------------------- |
| **6.53.1 and higher** | The `EkranServer.Settings.config` file at `C:\Program Files\Ekran System\Ekran System\Server\` |
| **Older than 6.53.1** | The Windows Registry under `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem`                           |

<Note>
  When upgrading **to** v.6.53.1 or higher, all settings previously configured in the Registry are **automatically migrated** to the `.config` file. After the upgrade, any further changes must be made in the `.config` file — the Registry values are no longer read.
</Note>

The `EkranServer.Settings.config` file uses standard `.NET` XML format. Each key looks like:

```xml theme={"system"}
<add key="<name_of_key>" value="<value_of_key>" />
```

## Change the Application Server port for Client connection

The default port Clients use to connect to the Application Server is **9447**. To use a different port:

<Steps>
  <Step title="Stop the Application Server">
    Right-click the **Syteca Server** tray icon in the Windows System Tray and select **Stop**, or stop the `EkranServer` service from the Task Manager / Services console.
  </Step>

  <Step title="Edit the configuration">
    <Tabs>
      <Tab title="Config file (v.6.53.1+)">
        Open `C:\Program Files\Ekran System\Ekran System\Server\EkranServer.Settings.config`. Locate or add the following keys:

        ```xml theme={"system"}
        <add key="PortSecure" value="<custom_port>" />
        <add key="RemotePort" value="<custom_port>" />
        ```

        **Both keys must have the same value** — Syteca uses them in pairs.
      </Tab>

      <Tab title="Registry (pre-v.6.53.1)">
        Open the **Registry Editor**. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem`. Change the **PortSecure** DWORD value to your custom port number, and define the same value for the **RemotePort** parameter.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Restart the Application Server">
    Restart the `EkranServer` service for the change to take effect.
  </Step>

  <Step title="Update Clients and Firewall">
    All [Clients](/docs/administration/clients/windows) that connect to this Application Server must be reinstalled or reconfigured to use the new port. Update [Windows Firewall](/docs/administration/deployment/install-application-server#configure-windows-firewall-manually) rules accordingly.
  </Step>
</Steps>

## Allow a non-admin user to start the EkranServer service

By default, the `EkranServer` service requires administrator privileges to start, stop, and restart. To allow a non-admin user to manage the service, the user needs **three sets** of permissions: local security policies, registry keys, and filesystem directories.

<Note>
  Permission changes to the user account only take effect the next time the owner of the account logs in.
</Note>

### 1. Grant local security policy rights

<Steps>
  <Step title="Open the Local Security Policy editor">
    Log in as an administrator. Press **Windows + R**, enter `secpol.msc`, and click **OK**.
  </Step>

  <Step title="Navigate to User Rights Assignment">
    In the **Local Security Policy** window, expand **Security Settings → Local Policies → User Rights Assignment**.
  </Step>

  <Step title="Add the non-admin user to four policies">
    For each of the following four policies, right-click the policy → **Properties** → **Add User or Group**, search for the user, click **Check Names**, then **OK**:

    * **Act as part of the operating system**
    * **Impersonate a client after authentication**
    * **Log on as a service**
    * **Replace a process level token**
  </Step>
</Steps>

### 2. Grant registry permissions

In the **Registry Editor** (`regedit`), grant the non-admin user **Full Control** for three registry keys. For each key, right-click → **Permissions** → **Add**, search for the user, then select the **Full Control** checkbox.

| Registry key                                                                 | Purpose                               |
| ---------------------------------------------------------------------------- | ------------------------------------- |
| `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Ekran System` | Write events to the Windows Event Log |
| `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem`                                    | Write to the Syteca registry root     |
| `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY`                | Read/write certificates               |

### 3. Grant directory permissions

Grant the non-admin user **Full Control** for three directories. For each, right-click → **Properties** → **Security** tab → **Edit** → **Add**, search for the user, then select **Full Control**.

| Directory                                               | Purpose                                                      |
| ------------------------------------------------------- | ------------------------------------------------------------ |
| `C:\Program Files\Ekran System\Ekran System\ServerLogs` | Write Application Server logs                                |
| `C:\Program Files\Ekran System\Ekran System\Server`     | Prevent file-access errors during service startup            |
| `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`       | Use certificate-based encryption (Master Certificate access) |

### 4. If the MachineKeys directory permission fails

If you receive an error when granting Full Control on `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`, grant access to the Master Certificate's private key through MMC instead:

<Steps>
  <Step title="Open MMC">
    Press **Windows + R**, enter `mmc`, then click **OK**.
  </Step>

  <Step title="Add the Certificates snap-in">
    Select **File → Add/Remove Snap-in → Certificates → Add → Computer account → Next → Local computer → Finish → OK**.
  </Step>

  <Step title="Locate the Master Certificate">
    In the console, expand **Certificates (Local Computer) → Personal → Certificates**. Find `EkranMasterCertificate`.
  </Step>

  <Step title="Manage private keys">
    Right-click `EkranMasterCertificate` → **All Tasks → Manage Private Keys**. In the permissions window, click **Add**, search for the non-admin user, click **Check Names**, then **OK**.
  </Step>

  <Step title="Grant Full Control">
    Select the user you just added, then select **Full Control** (the **Read** permission applies automatically). Click **OK** or **Apply** to save.
  </Step>
</Steps>

### Troubleshooting with Process Monitor

If access issues persist after granting all the permissions above, use Microsoft **Process Monitor (Procmon)** to identify what's being denied:

<Steps>
  <Step title="Open Process Monitor">
    Launch Process Monitor on the Application Server.
  </Step>

  <Step title="Filter to EkranServer.exe">
    Open the **Process Monitor Filter** (click the **Filter** icon on the toolbar), add the condition `Process Name is EkranServer.exe`, then click **Include → Add → OK**.
  </Step>

  <Step title="Clear and restart">
    Click **Clear** to clear the event list. Open the **EkranServer** service properties, select **Take No Action** for recovery, then restart the service.
  </Step>

  <Step title="Filter to denied access">
    In Process Monitor, right-click results other than **Access Denied** and select **Exclude** to leave only the denied operations.
  </Step>

  <Step title="Grant the missing permissions">
    For each remaining **Access Denied** entry, grant the non-admin user the required permission for the affected directory, registry key, or file.
  </Step>
</Steps>

## Enable SWIFT username monitoring

The SWIFT username monitoring feature captures the username used to log in to the SWIFT financial messaging network on a Client computer. The username is written to a separate log file on the Application Server, and optionally forwarded to a SIEM system via [SIEM integration](/docs/administration/integrations/siem).

<Note>
  This feature is configured in **two places** — the Application Server (to enable the underlying capture mechanism, documented below) and the **Editing Client / Editing Client Group** page's **Monitoring \[Windows/macOS]** tab's **Monitoring Parameters** section (to enable the **Enable SWIFT username monitoring** checkbox per Client).
</Note>

<Steps>
  <Step title="Stop the Application Server">
    Stop the Application Server by clicking **Stop** in the context menu of the **Syteca Server** tray icon, or by stopping the `EkranServer` service in Task Manager.
  </Step>

  <Step title="Add the configuration value">
    <Tabs>
      <Tab title="Config file (v.6.53.1+)">
        Open `C:\Program Files\Ekran System\Ekran System\Server\EkranServer.Settings.config`. Add this entry:

        ```xml theme={"system"}
        <add key="SwiftUsernameMonitoring" value="1" />
        ```
      </Tab>

      <Tab title="Registry (pre-v.6.53.1)">
        Open the **Registry Editor**. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem`. Select **Edit → New → DWORD (32-bit) Value**, then add:

        * **Value name:** `SwiftUsernameMonitoring`
        * **Value type:** DWORD
        * **Value data:** `1`
      </Tab>
    </Tabs>
  </Step>

  <Step title="Restart the Application Server">
    Restart the `EkranServer` service.
  </Step>

  <Step title="Enable per-Client">
    On each Client where SWIFT monitoring should be active, open **Editing Client → Monitoring \[Windows/macOS] → Monitoring Parameters** and select **Enable SWIFT username monitoring**.
  </Step>
</Steps>

## Enable the Warning and Consent banner

The Warning and Consent banner displays an HTML page to every user signing in to the Management Tool — typical for legal disclaimers, organization-specific use policies, or compliance attestations that users must acknowledge before accessing the system.

<Steps>
  <Step title="Create the banner.html file">
    On the Application Server computer, create a `banner.html` file containing the warning and consent text. Use standard HTML — the file is loaded and displayed verbatim on the Management Tool login page.

    The file can live anywhere accessible to the Application Server service — common locations include `C:\banner.html` or alongside the Application Server install directory.
  </Step>

  <Step title="Add the configuration value">
    <Tabs>
      <Tab title="Config file (v.6.53.1+)">
        Open `C:\Program Files\Ekran System\Ekran System\Server\EkranServer.Settings.config`. Add this entry, with the path to your `banner.html` file:

        ```xml theme={"system"}
        <add key="WarningBanner" value="C:\banner.html" />
        ```
      </Tab>

      <Tab title="Registry (pre-v.6.53.1)">
        Open the **Registry Editor**. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem`. Select **Edit → New → String Value**, then add:

        * **Value name:** `WarningBanner`
        * **Value type:** String
        * **Value data:** the path to the `banner.html` file (e.g. `C:\banner.html`)
      </Tab>
    </Tabs>
  </Step>

  <Step title="Restart the Application Server">
    Restart the `EkranServer` service for the banner to take effect. The next login attempt to the Management Tool displays the contents of `banner.html`.
  </Step>
</Steps>

## Related

<CardGroup cols={2}>
  <Card title="Install Application Server" icon="server" href="/docs/administration/deployment/install-application-server">
    Initial installation — the source of the `EkranServer.Settings.config` file.
  </Card>

  <Card title="Update Application Server" icon="arrow-up" href="/docs/administration/deployment/update-application-server">
    Upgrade procedure — config file format changed at v.6.53.1.
  </Card>

  <Card title="Administrative permissions" icon="key" href="/docs/administration/users/administrative-permissions">
    The permissions referenced by SWIFT monitoring and banner features.
  </Card>

  <Card title="SIEM integration" icon="plug" href="/docs/administration/integrations/siem">
    Forward SWIFT username events (and others) to your SIEM.
  </Card>
</CardGroup>