Skip to main content
This page collects four advanced Application Server configurations that share the same operational pattern: stop the Application Server, edit a configuration value, restart. All four were originally managed through the Windows Registry, but as of Syteca v.6.53.1, configuration is done through the EkranServer.Settings.config file instead.
NOT AVAILABLE IN SAAS for direct configuration — the EkranServer.Settings.config file isn’t accessible in SaaS. Contact your Syteca vendor or Syteca Support team to enable these features in a SaaS environment.

​
How configuration works

Every setting on this page changes the Application Server’s behavior by modifying a single name/value pair. The location depends on your Syteca version:
When upgrading to v.6.53.1 or higher, all settings previously configured in the Registry are automatically migrated to the .config file. After the upgrade, any further changes must be made in the .config file — the Registry values are no longer read.
The EkranServer.Settings.config file uses standard .NET XML format. Each key looks like:

​
Change the Application Server port for Client connection

The default port Clients use to connect to the Application Server is 9447. To use a different port:
1

Stop the Application Server

Right-click the Syteca Server tray icon in the Windows System Tray and select Stop, or stop the EkranServer service from the Task Manager / Services console.
2

Edit the configuration

Open C:\Program Files\Ekran System\Ekran System\Server\EkranServer.Settings.config. Locate or add the following keys:
Both keys must have the same value — Syteca uses them in pairs.
3

Restart the Application Server

Restart the EkranServer service for the change to take effect.
4

Update Clients and Firewall

All Clients that connect to this Application Server must be reinstalled or reconfigured to use the new port. Update Windows Firewall rules accordingly.

​
Allow a non-admin user to start the EkranServer service

By default, the EkranServer service requires administrator privileges to start, stop, and restart. To allow a non-admin user to manage the service, the user needs three sets of permissions: local security policies, registry keys, and filesystem directories.
Permission changes to the user account only take effect the next time the owner of the account logs in.

​
1. Grant local security policy rights

1

Open the Local Security Policy editor

Log in as an administrator. Press Windows + R, enter secpol.msc, and click OK.
2

Navigate to User Rights Assignment

In the Local Security Policy window, expand Security Settings → Local Policies → User Rights Assignment.
3

Add the non-admin user to four policies

For each of the following four policies, right-click the policy → Properties → Add User or Group, search for the user, click Check Names, then OK:
  • Act as part of the operating system
  • Impersonate a client after authentication
  • Log on as a service
  • Replace a process level token

​
2. Grant registry permissions

In the Registry Editor (regedit), grant the non-admin user Full Control for three registry keys. For each key, right-click → Permissions → Add, search for the user, then select the Full Control checkbox.

​
3. Grant directory permissions

Grant the non-admin user Full Control for three directories. For each, right-click → Properties → Security tab → Edit → Add, search for the user, then select Full Control.

​
4. If the MachineKeys directory permission fails

If you receive an error when granting Full Control on C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys, grant access to the Master Certificate’s private key through MMC instead:
1

Open MMC

Press Windows + R, enter mmc, then click OK.
2

Add the Certificates snap-in

Select File → Add/Remove Snap-in → Certificates → Add → Computer account → Next → Local computer → Finish → OK.
3

Locate the Master Certificate

In the console, expand Certificates (Local Computer) → Personal → Certificates. Find EkranMasterCertificate.
4

Manage private keys

Right-click EkranMasterCertificate → All Tasks → Manage Private Keys. In the permissions window, click Add, search for the non-admin user, click Check Names, then OK.
5

Grant Full Control

Select the user you just added, then select Full Control (the Read permission applies automatically). Click OK or Apply to save.

​
Troubleshooting with Process Monitor

If access issues persist after granting all the permissions above, use Microsoft Process Monitor (Procmon) to identify what’s being denied:
1

Open Process Monitor

Launch Process Monitor on the Application Server.
2

Filter to EkranServer.exe

Open the Process Monitor Filter (click the Filter icon on the toolbar), add the condition Process Name is EkranServer.exe, then click Include → Add → OK.
3

Clear and restart

Click Clear to clear the event list. Open the EkranServer service properties, select Take No Action for recovery, then restart the service.
4

Filter to denied access

In Process Monitor, right-click results other than Access Denied and select Exclude to leave only the denied operations.
5

Grant the missing permissions

For each remaining Access Denied entry, grant the non-admin user the required permission for the affected directory, registry key, or file.

​
Enable SWIFT username monitoring

The SWIFT username monitoring feature captures the username used to log in to the SWIFT financial messaging network on a Client computer. The username is written to a separate log file on the Application Server, and optionally forwarded to a SIEM system via SIEM integration.
This feature is configured in two places — the Application Server (to enable the underlying capture mechanism, documented below) and the Editing Client / Editing Client Group page’s Monitoring [Windows/macOS] tab’s Monitoring Parameters section (to enable the Enable SWIFT username monitoring checkbox per Client).
1

Stop the Application Server

Stop the Application Server by clicking Stop in the context menu of the Syteca Server tray icon, or by stopping the EkranServer service in Task Manager.
2

Add the configuration value

Open C:\Program Files\Ekran System\Ekran System\Server\EkranServer.Settings.config. Add this entry:
3

Restart the Application Server

Restart the EkranServer service.
4

Enable per-Client

On each Client where SWIFT monitoring should be active, open Editing Client → Monitoring [Windows/macOS] → Monitoring Parameters and select Enable SWIFT username monitoring.
The Warning and Consent banner displays an HTML page to every user signing in to the Management Tool — typical for legal disclaimers, organization-specific use policies, or compliance attestations that users must acknowledge before accessing the system.
1

Create the banner.html file

On the Application Server computer, create a banner.html file containing the warning and consent text. Use standard HTML — the file is loaded and displayed verbatim on the Management Tool login page.The file can live anywhere accessible to the Application Server service — common locations include C:\banner.html or alongside the Application Server install directory.
2

Add the configuration value

Open C:\Program Files\Ekran System\Ekran System\Server\EkranServer.Settings.config. Add this entry, with the path to your banner.html file:
3

Restart the Application Server

Restart the EkranServer service for the banner to take effect. The next login attempt to the Management Tool displays the contents of banner.html.

Install Application Server

Initial installation — the source of the EkranServer.Settings.config file.

Update Application Server

Upgrade procedure — config file format changed at v.6.53.1.

Administrative permissions

The permissions referenced by SWIFT monitoring and banner features.

SIEM integration

Forward SWIFT username events (and others) to your SIEM.