Avigilon ACC Manual

Initial ACC™ System Setup andWorkflow Guide
If you are setting up an Avigilon Control Center (ACC) system for the first time, complete the following
recommended setup procedures. Other features can be set up and adjusted as required.
For an overview of the procedures that should be performed before you arrive at site, see Pre-Site
Checklist on pageA.
For an overview of the procedures that should be performed at site, see System Setup Checklist on pageC.
More detailed information about each of the procedures in this guide is available on help.avigilon.com/acc.
Before Arriving On-Site 2
Network Setup 2
Install Hardware and Software 3
Managing Certificates on the ACC Server 5
Configure Anti-Virus Settings 7
Configure Sites and Servers 8
Activate Site Licenses 12
Configure Devices 14
Add Users and Groups 32
Customize Video Monitoring Setup 35
Avigilon Cloud Services 38
External Notifications 39
For More Information 41
Initial ACC™ System Setup andWorkflow Guide 1

Before Arriving On-Site
Important: If this is the user's first ACC 7 Server or if the server will be upgraded to ACC 7 software
for the first time, see the Avigilon Licensing Portal User Guide. You may need to contact Avigilon
Order Management to set up the user's Company account, Customer Administrator account, and
Customer User accounts.
Pre-configure the network video recorders as much as possible and familiarize yourself with the system
design and the customer network setup to streamline the setup process.
For more information, see Pre-Site Checklist on pageA.
Network Setup
For most systems using Avigilon-certified network video recorders (NVRs) and NVR workstations, no
network configuration is required.
If your system uses zero-configuration networking (Zeroconf), follow the guidelines below to use a static IP
address or DHCP enabled network instead.
IPAddressing
Plan the IP addressing scheme for server network ports, cameras, devices, and viewing stations.
1. Determine the number and type of network interface card (NIC) ports of the server.
2. Determine the quantity and location of the cameras and devices. Refer to the system design files to
determine how many server NICs are required for inbound video traffic and group cameras and
devices accordingly.
3. If the cameras and devices are grouped, assign each group to a unique IP subnet. Use a subnet mask
that defines the required network scope (for example, networks with less than 250 devices generally
use a 255.255.255.0 subnet mask).
4. Assign one server NIC port for outbound video traffic. Assign only one default network gateway to it.
This will connect to the customer's network where the viewing stations are and also for Internet
access.
5. Use the other server NICs for the camera network. These are for inbound video traffic.
lEach NIC belongs to one unique IP subnet.
lIf using VLANs, one subnet should belong to one unique VLAN.
lDo not assign any default network gateway to these NICs. Camera traffic should be as local as
possible.
lAssign one static private IP address to each NIC. If using DHCP, use IP address reservation so
each NIC always gets the same unique IP address.
lFor the initial setup:
Before Arriving On-Site 2

lIf using Static IPaddressing:
lAssign a temporary second IP address to each NIC. This is a unique Zeroconf IP
address of 169.254.x.x network with a 255.255.0.0 subnet mask. After the cameras
and devices using the Zeroconf subnet are connected to the ACC Server, change
their IP addresses to the private IP address subnet of the server NIC.
For example, a server NIC has:
IP address / subnet mask: 192.168.10.10 / 255.255.255.0
Temporary IP address / subnet mask: 169.254.100.100 / 255.255.0.0
After cameras (with IP addresses 169.254.x.x) are connected to the ACC Server,
change the camera IP addresses to 192.168.x.x / 255.255.255.0 range.
lAfter the initial setup, remove the server NIC's temporary 169.254.x.x IP
addresses.
lIf using a DHCP enabled network:
lConsider the DHCP lease time configured on the DHCP server. When the lease
time expires, the cameras will negotiate an IP address renewal and this may
cause an interruption in the video streaming. This might appear as an abnormal
camera restart.
lSet the DHCP lease time to Forever, or long enough to minimize unnecessary
camera IP address renewals.
lIf possible, set DHCP reservations so each camera always gets the same unique
IP address.
Network Connectivity
Ensure each server NIC is connected to a network switch port that is 1 Gbps or higher.
The server NIC connected to the customer's network can have a 100 Mbps connection if the expected
outbound traffic is low.
Install Hardware and Software
Cameras and Devices
Install the cameras and devices according to the system design. Each device must be:
lConnected to the network.
lPositioned and focused in the direction specified in the system design.
lAssigned a descriptive name.
lAssigned an IPaddress (static or dynamic depending on network policy).
Before a camera is connected to the ACC system, it can be configured from the camera web interface or
using the Camera Configuration Tool.
Refer to the device installation guide for more information.
Network Connectivity 3

Tip: For bulk configuration, use the Camera Configuration Tool available on avigilon.com. You can
also use the device's web interface for configuration. If needed, use the Avigilon USBWifi Adapter
System to access the camera interface through a wifi network.
Video Recorders
Install the video recorders. An ACC system can feature NVRs, HD Video Appliances, or Avigilon Hardened
OS appliances. Each video recorder must be:
lConnected to the network — camera and corporate network as required.
lAssigned an IP address.
lAssigned a new password for the administrator account.
lAssigned a CA-signed certificate. Refer to your server documentation for details.
lWindows systems only:
lAssigned a unique name.
lConnected to an uninterruptible power supply (UPS). Refer to your server documentation for
details.
lConfigured for NTP time synchronization. Refer to your server documentation for details.
Refer to the recorder installation guide for more information. If you are installing a Windows based NVR
system, see the Windows help files for more information.
ACC Software
Important: Upgrade to the latest version of ACC™ 5 software before upgrading to ACC 7 software
to avoid losing data.
If you're using version 5.4, upgrade to version 5.6.2.28 first, and then to the latest version of 5.10
software.
If you installed an Avigilon NVR, the ACC software is pre-installed. When you start the NVR, complete the
initial ACC configuration wizard.
If you installed a third-party NVR:
lDownload and install the latest ACC Server software and ACC Client software from avigilon.com.
lInstall the ACC Analytics Service to use the Avigilon Appearance Search feature and Face
Recognition.
Install the ACC Web Endpoint Service to use Avigilon Cloud Services, the ACC Mobile 3 app and web-
based integrations.
Video Recorders 4

Logging In
To open the ACC Client software:
lDouble-click the desktop shortcut icon .
lIn the Start menu, select All Programs or All Apps > Avigilon > Avigilon Control Center Client.
When logging in to the site for the first time, the default credentials use administrator as the username
without a password. You'll be asked to immediately enter a new password.
1. In the New Task menu , click Site Login.
2. Select your site from the list of connected sites.
If you don't see your site, click Find Site… to manually search your network.
3. Enter your credentials, or select Use current Windows credentials and click Log In….
Managing Certificates on the ACC Server
FOR WINDOWS SERVERS ONLY
By default, the ACC server uses a self-signed certificate for verifying client communications. Avigilon
recommends using a trusted CA-signed certificate or other intermediate certificate, such as a Windows CA
or custom CA certificate. You must be a Windows Administrator to make these changes.
If you are using a CA-signed certificate, you will need to disable trust of the default Avigilon certificates after
setting up your CA-signed certificates to ensure the default certificate can no longer be used.
Important: When logging into the server from a client after setting up your certificate, you will need
to use the full hostname, including the domain.
Generating the Certificate
1. On the Windows machine running the ACC server, open the Certificate Manager. Select Run in the
Start menu and enter certlm.msc.
2. Navigate to the Personal > Certificates folder.
3. Right-click in the folder contents area and select All Tasks > Request New Certificate....
4. Click Next.
5. In the Select Certificate Enrollment Policy window, select the Active Directory Enrollment Policy and
click Next.
6. In the Request Certificates window, select the Avigilon Computer checkbox, then expand the Details
drop-down arrow and click Properties.
7. On the General tab, enter the Friendly Name as AccServerCert.
Logging In 5

Important: Make sure to enter the correct Friendly Name, AccServerCert, or the ACC server
and clients will not recognize the certificate and will fail to connect.
8. On the Private Key tab, in the Key options area, fill the Make private key exportable checkbox.
9. Click OK.
10. On the Request Certificates Window, click Enroll. Click Finish when the operation is complete.
Exporting the Certificate and Private Key
1. Using the certlm.msc tool, right-click the new certificate and select All Tasks > Export....
2. Click Next.
3. Select Yes, export the private key and click Next.
4. Leave the Export File Format settings as default and click Next.
5. On the Security window:
a. Select the Group or user names (recommended) checkbox and select the Active Directory
group or user to which you want to assign access to the certificate and private key.
b. Click Add.
c. Click Next.
6. Enter the name and location for the exported certificate, or click Browse to navigate to the location
where you want to save the exported certificate. Click Next.
7. Click Finish to export the certificate and private key.
Importing the Private Key
1. Using the certlm.msc tool, right-click in the Personal > Certificates folder contents area and select All
Tasks > Import....
2. Click Next.
3. On the File to Import window, enter the certificate name and path in the File name field or click
Browse to navigate to the certificate you want to import. Click Next.
4. Select the Import option to Mark the key as exportable and Include all extended properties, then
click Next.
5. Leave the settings as default and click Next.
6. Click Finish.
Exporting the Certificate and Private Key 6

Configure Anti-Virus Settings
When anti-virus software runs an automated scan on a heavily utilized Avigilon NVR or workstation, it may
prevent video data from being written. Some anti-virus software packages are equipped with live process
scanning and incorporated firewalls. These features may cause communication failures between cameras
and NVRs or between NVRs and clients.
You may need to set up exceptions in the anti-virus software running on NVRs, workstations or clients within
the ACC system. For more information on how to exclude locations and applications from being scanned,
see your anti-virus software manual.
Preventing Data Write Issues
To ensure the anti-virus software does not interfere with the ACC software's ability to write video data and
other important files, exclude the following locations from being scanned:
AvigilonData Located on each of the Primary and Secondary Data Volumes.*
AvigilonConfig Located on each of the Config Volumes.*
Avigilon Program Files Located at C:\Program Files\Avigilon.
*Do not use the C drive or an OSdrive for these volumes. To see which drives are configured as the Primary
and Secondary Data Volumes and Config Volumes, use the ACC Admin Tool.
lIn the Admin Tool, click Settings >Storage.
The Primary and Secondary Data Volumes and Config Volumes are displayed.
Preventing Network Communication Failure
To prevent communication failure, exclude the following from having their network traffic scanned or
analyzed:
Configure Anti-Virus Settings 7

lACC Server Applications:
lC:\Program Files\Avigilon\Avigilon Control Center
Server\VmsAdminPanel.exe
lC:\Program Files\Avigilon\Avigilon Control Center
Server\VmsAdminPanelLauncher.exe
lC:\Program Files\Avigilon\Avigilon Control Center
Server\VmsDaemonService.exe
lC:\Program Files\Avigilon\Avigilon Control Center Web
Endpoint\WebEndpointService.exe*
lC:\Program Files\Avigilon\Avigilon Control Center
Server\LPR6\LprDaemonApp.exe*
lC:\Program Files\Avigilon\Avigilon Control Center Analytics
Service\AnalyticsDaemonService.exe*
*If installed on the server
lACC Client Applications:
lC:\Program Files\Avigilon\Avigilon Control Center
Client\VmsClientApp.exe
lAvigilon Data folder
lD:\AvigilonData
Configure Sites and Servers
In the ACC software, a site can contain one or more servers depending on the license edition. Site settings
control user access and system-wide events. Server settings control video and storage settings for devices
connected to that server.
When there are multiple servers in a site, you can assign a failover connection to a backup server. This
connection allows a device to continue recording if the primary server fails.
Multiple Server Sites
FOR ENTERPRISE EDITION
A site can contain multiple servers that share settings and tasks. For example, users and groups that are
added to the site will automatically have access to all linked servers.
Tip: Plan how your system should be configured before connecting servers to sites to avoid
reconfiguring settings each time a server is added.
Connecting Servers to a Site
Sites only have one server by default, but you can add multiple servers to a site and manage them together.
All servers within a site share settings and are represented as one unit in the SystemExplorer.
Configure Sites and Servers 8

When servers are installed a significant distance apart, they may only share users and group information.
These sites can be joined into families. For more information, see Site Families on the next page.
Note:
lIf you're using the Avigilon Artificial Intelligence (AI)Appliance, connect the appliance to an
NVR before connecting that NVR to your site.
lServers must have the same version of the ACC software to be connected.
lServers should be on the same broadcast domain or broadcast network because the servers
will exchange data.
lEnsure ports 38880 to 38884 TCP/UDP are open across the network.
lEnsure servers have unique hostnames.
lWhen a server joins a site, its site license must be reactivated.
1. In the New Task menu , click Site Setup.
2. Click .
The Site Management tab lists all accessible and connected sites and servers. If you can't find your
site, you'll need to search for it.
3. Select your server and drag it to a different site.
Sites without any servers are automatically removed from the list.
4. Reactivate the site license.
After the server is connected to the site, settings are merged and the following rules are applied:
lUnique settings from the server are added to the site.
lWhen settings are identical, only the site version is kept.
lWhen a server setting and a site setting share the same name but are configured differently, the
server setting is added to the site and renamed: <setting name> (server name), e.g. Email1 (Server2F).
lSite Views are combined.
lSite organization settings override server settings when merged. Any unorganized elements
from the server are listed at the bottom of the site View.
lAll user groups are merged.
lIf groups have the same name, the site settings are used and users from both the site and the
server are added to the group.
lNew groups to the site automatically receive access to all the devices in the site.
lNew groups to the added server automatically receive access to all the devices that are
connected to the server.
Connecting Servers to a Site 9

lUsers with the same name will share configured settings, including passwords, and gain group
permissions from the server.
lActive Directory settings are configured at the site level. Before adding a server to a site with Active
Directory, check the following or the connection will fail. .
lA Windows server is connected to the same Active Directory domain as the site.
lIf adding an Avigilon Hardened OS appliance to a site with Windows servers, the site must
clear the Use ACC service account and Enable nested groups checkboxes and enter a
username (for example, [email protected]) and password.
lIf Active Directory is configured on an Avigilon Hardened OSappliance, it must be connected
to the same Active Directory domain as the site. An appliance without any Active Directory
configuration can be added to a site and will inherit the domain from the site.
Note: Disconnect the server from a site before making any of the following changes:
lChanging the hostname
lChanging the IP address
lReinstalling Windows or installing a different version of Windows
lReplacing the server with another server
lDecommissioning the server
Disconnecting Servers from a Site
When you disconnect a server from a site, it becomes a separate server under its own site.
Disconnected servers retain all settings from the site it was previously connected to.
1. In the New Task menu , click Site Setup.
2. Click .The Site Management tab lists all the sites that you can access and all the servers that are
connected to each site.
3. Select a server from the site and click Disconnect from Site….
4. After the server is disconnected, you'll need to reactivate the site licenses.
You can purchase new licenses for a disconnected server or you can deactivate the required licenses from
the previous site. Deactivated licenses can be activated for other sites.
Site Families
FOR ENTERPRISE EDITION
Independent sites can be connected to create a site family. User, rank, and group information is centrally
managed by the parent site while the child sites can define local users and groups.
Disconnecting Servers from a Site 10