Crestron 3 Series User manual

3-Series® Control Systems
Reference Guide
Crestron Electronics, Inc.

Original Instructions
The U.S. English version of this document is the original instructions.
All other languages are a translation of the original instructions.
Crestron product development software is licensed to Crestron dealers and Crestron Service Providers (CSPs) under a
limited non-exclusive, non-transferable Software Development Tools License Agreement. Crestron product operating system
software is licensed to Crestron dealers, CSPs, and end-users under a separate End-User License Agreement. Both of these
Agreements can be found on the Crestron website at www.crestron.com/legal/software-license-agreement.
The product warranty can be found at www.crestron.com/legal/sales-terms-conditions-warranties.
The specific patents that cover Crestron products are listed at www.crestron.com/legal/patents.
Certain Crestron products contain open source software. For specific information, visit www.crestron.com/legal/open-
source-software.
Crestron, the Crestron logo, 3-Series, 3-Series Control System, Crestron Studio, Crestron Toolbox, Crestron XiO Cloud,
SIMPL+, and VT-Pro e are either trademarks or registered trademarks of Crestron Electronics, Inc. in the United States
and/or other countries. Active Directory is either a trademark or a registered trademark of Microsoft Corporation in the
United States and/or other countries. Other trademarks, registered trademarks, and trade names may be used in this
document to refer to either the entities claiming the marks and names or their products. Crestron disclaims any proprietary
interest in the marks and names of others. Crestron is not responsible for errors in typography or photography.
©2019 Crestron Electronics, Inc.

Reference Guide – DOC. 7150B Contents •i
Contents
Introduction 1
Tools and Utilities 2
3-Series Architecture 3
Memory and Directory Structure.............................................................................................. 3
Console Commands..................................................................................................................... 5
Establish Communications 6
USB Connection............................................................................................................................ 6
TCP/IP Connection.......................................................................................................................8
Time and Date Settings 9
Authentication 10
Enable Authentication............................................................................................................... 10
User and Group Management ................................................................................................. 10
User Group Rights ...................................................................................................................... 13
Password Management ............................................................................................................ 14
Login Behavior ............................................................................................................................ 15
Session Timeout Functions....................................................................................................... 17
Blocked User Functions ............................................................................................................. 18
Blocked IP Address Functions .................................................................................................. 18
Certificate Management 20
Certificate Requirements ........................................................................................................ 20
Add a Certificate ........................................................................................................................ 21
TLS/SSL ....................................................................................................................................... 21
Server Certificates..................................................................................................................... 22
802.1X 26
Firmware Updates 28

ii •Contents Reference Guide – DOC. 7150B
Message Logging 29
Persistent Log ............................................................................................................................. 29
Remote System Logging........................................................................................................... 31
Audit Logging .............................................................................................................................. 32
Control Subnet 33
Prepare the Control Subnet.....................................................................................................34
Control Subnet Architecture.................................................................................................... 35
Program Management 37
Load Programs to the Control System ................................................................................. 37
IP Table Configuration .............................................................................................................. 37
Run Multiple Programs............................................................................................................. 40
Run Programs from External Storage ................................................................................... 41
Master-Slave Mode 42
Definitions.................................................................................................................................... 42
Master-Slave Configuration ....................................................................................................43
Functional Behavior ...................................................................................................................45
Auto Update Mechanism 46
Configure the Auto Update Mechanism................................................................................46
Manifest File................................................................................................................................ 47
Results File...................................................................................................................................55
Error Handling............................................................................................................................. 57
Connect to Crestron XiO Cloud Service 58
Claim a Single Device ............................................................................................................... 58
Claim Multiple Devices ..............................................................................................................59
Appendix A: Restore to Factory Defaults 62
Appendix B: Port Forwarding 63

Reference Guide – DOC. 7150B 3-Series Control Systems •1
3-Series® Control Systems
Introduction
Crestron® 3-Series Control System® automated processors unify disparate
technologies in buildings so they can communicate and work together
intelligently, which lowers costs and boosts efficiency. Their unique distributed
architecture enables multitasking essential to a complete building control
solution. Up to 10 programs can operate independently and simultaneously while
rapidly communicating with each other. Code is organized into a few smaller
programs rather than one large one, so programming, troubleshooting, and
uploading are much faster and easier.
3-Series® control systems offer a wide range of features, including:
•Scalable hardware that supports a broad range of space types and
architectures
•One system running multiple programs
•SNMP and BACnet/IP support to seamlessly communicate and integrate
with IT, HVAC, BMS, and security systems
•Crestron XiO Cloud™ service connected
•Full network security protocols, including 802.1X, AES, and
Active Directory® service
For more information on Crestron control systems, including available products
and additional resources, refer to www.crestron.com/Products/Featured-
Solutions/Crestron-Control-Systems
NOTE: The features and functions described in this document apply to 3-Series
control systems with firmware version 1.600 or newer. Crestron recommends
updating to the latest firmware version to ensure the control system receives the
most recent features and security patches. For more information, refer to
“Firmware Updates” on page 28.

2•3-Series Control Systems Reference Guide – DOC. 7150B
Tools and Utilities
Standard IT tools, such as SFTP (secure file transfer protocol) clients and SSH
(secure shell) clients, can be used to initiate various control system tasks and
functions.
Additionally, the following Crestron tools and utilities may be used to program
and configure the control system:
•Crestron Studio® software
•Crestron Toolbox™ software
•SIMPL Debugger
•SIMPL Windows
•SIMPL Sharp Pro
•VT-Pro e® software
All tools and utilities may be downloaded from www.crestron.com/Support. For
more information on the features and functions of each tool, refer to its
embedded help file.
NOTE: Access to software downloads and other files is reserved for Authorized
Crestron dealers, Crestron Service Providers (CSPs), and Crestron partners only.
New users must register for an account to access certain areas of the Crestron
website. For more information on registering, navigate to
https://www.crestron.com/register.

Reference Guide – DOC. 7150B 3-Series Control Systems •3
3-Series Architecture
The following sections provide an overview of the architecture of a 3-Series
control system.
Memory and Directory Structure
A 3-Series processor has between 256 MB and 1 GB of built-in SDRAM
(synchronous DRAM) volatile memory. For more information regarding the
memory specifications for each 3-Series control system model, refer to the
appropriate product page at www.crestron.com.
Flash memory contains the file system inside the 3-Series control engine. The
3-Series processor also has 128kB of NVRAM (nonvolatile RAM). NVRAM contains
program variables that are retained after the loss of electrical power, while
volatile memory is lost.
Flash Memory
Flash memory for a 3-Series control system contains the following components:
•Operating system (.puf file)
•SIMPL and SIMPL Sharp Pro programs
•SIMPL+® programming modules
The files that reside in flash memory confirm to a flat directory structure. The
following table details the overall file system:
3-Series Control System Directory Structure
TOP LEVEL SECONDARY LEVEL DESCRIPTION
\ The root of the file system
HTML Web pages
Nvram NVRAM legacy directory
ROMDISK/User/display Contains files for the onscreen display
RM/RM2 Mounting point for external removal
media
Simpl/AppXX Control system program files (where
XX is the program number)
Sys Contains vario
us system configuration
files
User Provided for user-defined files

4•3-Series Control Systems Reference Guide – DOC. 7150B
The directory structure of a 3-Series control system can reside on the internal
flash memory and on optional external memory (SD/SDHC). Programs, data
files, and data can be stored on either internal or external memory. The files that
reside in the internal flash conform to a flat directory structure, while the
external memory system conforms to a FAT32-compatible file system.
NOTE:Although file system names are case insensitive, the case is preserved to
maintain file checksums.
Observe the following about external media directories:
•The RM and RM2 directories appear only when external removal media is
inserted into the control system. To reference files in external memory,
prefix "\RM\" or "\RM2\" to any fully qualified path from the computer
OS environment.
•When a SIMPL Windows or SIMPL Sharp Pro program is stored in
external memory, the files reside in the "\RM[2]\Simpl\AppXX\" directory,
where XX is the program number.
•When web pages are stored in external memory, the pages reside in the
"\RM[2]\HTML\" directory.
•Storing programs and web pages in external memory gives them
precedence over files stored in internal flash memory. For example, if
different programs are stored in both internal flash and external memory,
the program in external memory will run when the system is booted.
SDRAM (Volatile)
Volatile SDRAM is used by the operating system to dynamically store the
following components:
•Digital and analog signal values
•SIMPL+ variables (default is no options are specified, or if using "volatile"
qualifier or #DEFAULT_VOLATILE)
The actual amount of SDRAM used at any given time depends on the particular
program that is running; therefore, usage is variable (dynamic) during normal
operation.
NVRAM (Nonvolatile)
Nonvolatile NVRAM contain the following components:
•SIMPL+ variables (if "volatile" qualifier or #DEFAULT_VOLATILE is
removed)
•Signals explicitly written to NVRAM (such as Analog RAM, Analog RAM
from database, Serial RAM, Serial RAM from database, Analog
nonvolatile ramp, Digital RAM, and so forth)
NOTE:SIMPL Sharp Pro has no access to the NVRAM. Programmers should write
files for persistent variables instead.

Reference Guide – DOC. 7150B 3-Series Control Systems •5
Console Commands
The 3-Series processor is capable of understanding and responding to a set of
phrases known as console commands. Console commands are used to configure
the control system.
Observe the following about console commands:
•Console commands can be sent to the device using an SSH client once the
IP address or hostname of the device is known. Console commands may
also be sent to the device using the Text Console tool in Crestron Toolbox
via one of the supported communication protocols.
•Console commands are grouped logically. Issuing the help command
from the console responds with various command categories.
•Issuing the help all command responds with a list of all exposed console
commands for the device.
•The same command may be listed in more than one category. Commands
are case insensitive and can be entered from the appropriate prompt.
•To view the available options and parameters for a command, issue the
command followed by a space and "?" (for example, ADDMASTER ?).
•Support for new console commands is added via firmware updates. Refer
to the firmware release notes for more information.

6•3-Series Control Systems Reference Guide – DOC. 7150B
Establish Communications
The control system must establish communications with a computer in order to
upload programs, troubleshoot, or perform diagnostics.
Depending on the control system capabilities, the following communication
protocols may be used to connect with a 3-Series control system:
•USB communication with a PC via the COMPUTER port on the control
system (requires Crestron Toolbox software)
•Ethernet communication via SSH or SSL/TLS
USB Connection
To connect to the control system via USB:
1. Connect the COMPUTER USB port of the control system to the USB port
of a computer with a USB A to B cable.
2. Open Crestron Toolbox software.
3. Click the pencil icon at the bottom left of any tool in Crestron Toolbox.
A dialog box for editing the connection type is displayed.
4. Click the USB radio button.
Connection Type Dialog Box - USB

Reference Guide – DOC. 7150B 3-Series Control Systems •7
5. Enter the following search parameters for the device (required only if
multiple USB connections are active):
•Model: Enter the model name of the Crestron device (for example,
PRO3). The model is not user-defined; it is the actual model name of
the device as displayed in the System Info tool (under Device Name in
the Product Info section)
•Hostname: Enter the user-defined hostname, as previously assigned
in the TCP/IP settings
•Serial: Enter the serial number (not the model number or TSID) of the
Crestron device. The serial number is a seven digit number (not
beginning with 60 or 65) that may contain letters. The serial number is
printed on a sticker affixed to the device.
6. Enter the following advanced authentication parameters for the device (if
required):
•Username: Enter the username required to authenticate device
communications
•Password: Enter the password required to authenticate device
communications
7. Click OK.
The device status reports as "Connected" at the bottom of the selected tool if
communications have been established.
Text Console - Connection Status
The USB connection information for the control system may be saved using the
Address Book function in Crestron Toolbox. For more information, refer to the
Crestron Toolbox help file.

8•3-Series Control Systems Reference Guide – DOC. 7150B
TCP/IP Connection
DHCP (dynamic host configuration protocol) is enabled by default for 3-Series
control systems.
NOTE:Crestron Toolbox autodiscover can be used if the control system has
access to the DHCP server. The Device Discovery tool may also be used to
discover the device and its IP address on the network.
If DHCP is available on the local network, no additional configuration changes are
required. If DHCP is not available or if the administrator wishes to configure a
static IP, the IP address, default gateway, and DNS server settings must be set.
These settings may be configured via USB using the Text Console tool or the
Ethernet Addressing function in Crestron Toolbox.
To configure Ethernet settings using Text Console:
1. Connect the LAN RJ-45 port of the control system to the LAN with an
Ethernet cable.
2. Open Crestron Toolbox software.
3. Select the Text Console tool (Tools > Text Console)
4. Establish a USB connection to the control system as described in "USB
Connection" on page 6.
5. Issue the following commands:
•DHCP 0 OFF: Turns off DHCP so that manually configured network
information is used
•IPADDRESS 0 xxx.xxx.xxx.xxx: Sets the IP address of the control
system to the specific address, where "
xxx.xxx.xxx.xxx " is the four
octets that comprise the IP address
•IPMASK 0 xxx.xxx.xxx.xxx: Sets the IP mask of the control system
to the specified mask, where "
xxx.xxx.xxx.xxx " is the four octets that
comprise the mask address
•DEFROUTER 0 xxx.xxx.xxx.xxx: Sets the default network gateway
to the specified IP address, where "
xxx.xxx.xxx.xxx " is the four octets
that comprise the IP address
•ADDDNS xxx.xxx.xxx.xxx: Sets the DNS (domain name server) to
use for DNS name lookups, where "
xxx.xxx.xxx.xxx " is the four octets
that comprise the DNS address.
To configure Ethernet settings using the Ethernet Addressing function, refer to
the appropriate section of the Crestron Toolbox help file.
Once a static or dynamic IP address has been set for the control system, the
TCP/IP connection information for the control system may be saved using the
Address Book function in Crestron Toolbox. For more information, refer to the
Crestron Toolbox help file.

Reference Guide – DOC. 7150B 3-Series Control Systems •9
Time and Date Settings
The internal clock of the control system can be configured using console
commands.
1. Issue the timedate command to manually set the time and date.
•Syntax: timedate [hh:mm:ss mm-dd-yyyy]
oFor hh:mm:ss, enter the time in hours (using 24-hour format),
minutes, and seconds format.
oFor mm-dd-yyyy (or mm/dd/yyyy), enter the date in month (1–12),
day (1–31), and year format.
•Example: timedate 12:18:30 03-14-2019
2. Issue the timezone command to set the time zone:
•Syntax: timezone [LIST | zone]
oFor zone, enter the three-digit code for the time zone.
oUse the LIST parameter to print a list of all time zones and their
codes in the console.
•Example: timezone 014
3. Issue the SNTP START command to synchronize the internal clock with an
SNTP server:
•Syntax: SNTP START [SERVER:address] [PERIOD:time]
oFor SERVER, enter the address (in dot decimal notation) of the
SNTP server.
oFor PERIOD, enter the interval (in minutes, minimum is 10) that the
internal clock synchronizes with the SNTP server.
•Example: SNTP START SERVER:255.255.255.255 PERIOD:60
The internal clock can also be set using the System Clock function in Crestron
Toolbox. For more information, refer to the Crestron Toolbox help file.

10 •3-Series Control Systems Reference Guide – DOC. 7150B
Authentication
3-Series control systems provide various authentication options that can be used
to create user accounts and passwords, to set password policies, and to set
access levels for users and groups.
Use the following procedures to enable authentication and configure
authentication settings on the control system.
Enable Authentication
By default, 3-Series control systems do not have user authentication enabled.
Once authentication is enabled, authentication settings may be configured for
the control system.
To enable authentication, which will create an initial administrator account:
1. Issue the AUTHentication ON command from the control system console
over a secure connection protocol (SSL/TCP, SSH, USB).
2. When prompted, create a username and password for the administrator
account. The password must be at least six characters.
CAUTION: Do not lose the username and password for the administrator
account. The control system cannot be accessed without this information
after an administrator account has been created.
3. Issue the reboot command to reboot the device with the new
authentication settings.
After rebooting, the control system will prompt for the administrator account
username and password before a connection is allowed.
Authentication settings can also be configured using the Authentication function
in Crestron Toolbox. For more information, refer to the Crestron Toolbox help file.
NOTE: To manually reset authentication, use a small, pointed object (such as the
tip of a pen) to press and hold the recessed SW-R button on the control system
for 15 seconds.
User and Group Management
Local users and groups can be added to the control system after an
administrator account has been created. Additionally, the control system can
grant access levels to existing Active Directory users and groups.
The following sections describe how to manage users and groups on the control
system.
NOTE: Additional console commands for listing users and groups and for showing
user information can be viewed by issuing the help system command.

Reference Guide – DOC. 7150B 3-Series Control Systems •11
Add Local User
To add a local user to the control system, issue the ADDUSER command.
•Syntax: ADDUSER -N:username -P:password
o-N: Specifies the name of the local user that will be created
o-L: Specifies a password for the local user
•Example: ADDUSER -N:jsmith -p:user01
A local user is created without any access rights. To assign access rights to a local
user, the user must be added to at least one local group. For more information,
refer to "Add User to Group" on page 13.
Delete Local User
To remove a local user from the control system, issue the DELETEUSER username
command.
When a local user is removed, the user is also removed from any local groups.
Add Local Group
To add a local group to the control system, issue the ADDGROUP command.
•Syntax: ADDGROUP -N:groupname -L:accesslevel
o-N: Specifies the name of the local group that will be created
o-L: Specifies the access level for the local group
A: Administrator
P: Programmer
O: Operator
U: User
C: Connection only
•Example: ADDGROUP -N:CresProgs -L:P
NOTE: A predefined access level must be assigned to a group when it is created.
When a user is added to a group, the user inherits the access level set for the
group. Certain control system functions and console commands are accessible
only to users with corresponding access levels.
If a user belongs to multiple groups, the user's access level is the combined
access level of all groups that contain the user.

12 •3-Series Control Systems Reference Guide – DOC. 7150B
Delete Local Group
To remove a local group from the control system, issue the DELETEGROUP
groupname command.
When a local user group is removed, users in the group are not removed from the
control system. However, the user will lose the access rights associated with the
removed group.
Add Active Directory Group
To add an existing Active Directory group to the control system, issue the
ADDDOMAINGROUP command.
NOTE: Use the ADLOGin command to log in to the Active Directory server.
•Syntax: ADDDOMAINGROUP -N:groupname -L:accesslevel
o-N: Specifies the name of the Active Directory group to be added
o-L: Specifies the access level for the Active Directory group
A: Administrator
P: Programmer
O: Operator
U: User
C: Connection only
•Example: ADDDOMAINGROUP -N:ADProgs -L:P
NOTE: The control system cannot create or remove a group from the Active
Directory service, but it can grant an access level to an existing Active Directory
group.
All users of the Active Directory group inherit the access level set for the group.
Certain control system functions and console commands are accessible only to
users with corresponding access levels.
Remove Active Directory Group
To remove a local group from the control system, issue the DELETEDOMAINGROUP
groupname command.
When an Active Directory group is removed from the control system, it is not
deleted from the Active Directory service. Once the group is removed from the
control system, all members of that group lose access to the control system.

Reference Guide – DOC. 7150B 3-Series Control Systems •13
Add User to Group
To add a local or an Active Directory user to a local group, issue the
ADDUSERTOGROUP command.
•Syntax: ADDUSERTOGROUP -N:username -G:groupname
o-N: Specifies the name of the local or Active Directory user
o-G: Specifies the name of the local group
•Example: ADDUSERTOGROUP -N:jsmith1 -G:CresProgs
Local users are created on the control system without any access rights. Adding a
user to a local group grants the user the access level assigned to the group.
NOTE: The control system cannot create or remove a user from the Active
Directory service, but it can grant an access level to an existing Active Directory
user. This may be accomplished either by adding the Active Directory user to a
local group on the control system or by adding the Active Directory group(s) of
which the user is a member to the control system.
Remove User from Group
To remove a local or an Active Directory user from a local group, issue the
REMOVEUSERFROMGROUP command.
•Syntax: REMOVEUSERFROMGROUP -N:username -G:groupname
o-N: Specifies the name of the local or Active Directory user
o-G: Specifies the name of the local group
•Example: REMOVEUSERFROMGROUP -N:jsmith1 -G:CresProgs
User Group Rights
The control system architecture supports multiple user groups (either locally or
from the Active Directory service). Any user can be a member of multiple groups.
Both local and Active Directory groups can be given the following rights based on
the chosen access level. The numbers associated with these rights correspond
with the table on the following page.
1. Logging into console and having access to read-only system
status/setting commands
2. Using a customer web XPanel interface
3. Using the built-in web XPanel interface
4. Logging in to connect to CIP/gateway connections
5. Inputting administrator commands, such as ones dealing with user
accounts and changing system settings
6. Inputting programmer commands, such as ones dealing with loading
programs and loading files
7. Inputting operator commands, such as ones that restart programs

14 •3-Series Control Systems Reference Guide – DOC. 7150B
Out of the box, the device ships with the following local user groups with the
associated rights:
Default Rights of Local Groups
GROUP 1 2 3 4 5 6 7
Crestron Admin
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Crestron Programmer
Yes
Yes
No
Yes
No
Yes
Yes
Crestron Operator
Yes
Yes
No
Yes
No No
Yes
Crestron User No
Yes
No No No No No
Crestron Connect No No No
Yes
No No No
Password Management
The following sections explain how to manage passwords for local users on the
control system.
Set Password Policy
To set the password policy for the control system, issue the SETPASSWORDRULE
command.
•Syntax: SETPASSWORDRULE {-ALL | -NONE} |
{-LENGTH:minPasswordLength} {-MIXED} {-DIGIT} {-SPECIAL}
o-ALL: All password rules are applied.
o-NONE: No password rules are applied.
o-LENGTH: Specifies the minimum password length. By default, the
minimum password length is six characters.
o-MIXED: Specifies that the password must contain a lower and upper
case character.
o-DIGIT: Specifies that the password must contain a number
character.
o-SPECIAL: Specifies that the password must contain a special
character.
NOTE: The -LENGTH, -MIXED, -DIGIT, and -SPECIAL parameters
cannot be combined with NONE.
•Example: SETPASSWORDRULE -LENGTH:9 -MIXED -DIGIT -SPECIAL
All passwords that are created, updated, or reset for local users must follow the
password rules set by this command to be considered valid.

Reference Guide – DOC. 7150B 3-Series Control Systems •15
Update Local Password
To update the current user's password, issue the UPDATEPASSWORD command.
When authentication is enabled, users may update their password. The user is
prompted to enter the current password once and the new password twice. If the
old password does not match the current password, the operation fails and the
password is not changed.
Reset User Password
To reset a user's password, issue the RESETPASSWORD command.
•Syntax: RESETPASSWORD -N:username -P:defaultpassword
o-N: Specifies the user whose password will be reset
o-P: Specifies a default password that can be provided to the user
following the reset
•Example:RESETPASSWORD -N:jsmith1 -P:Default321!
Login Behavior
When authentication is enabled, users must enter a username and password to
connect to the control system.
A user is given a maximum of three login attempts for each type of transport
protocol (Ethernet, USB, and dynamic). If a user fails to authenticate against
console within the maximum attempts allowed, the transport protocol used to
attempt the connection is blocked.
•For USB transport, the transport is blocked for 5 seconds after the
maximum logon attempt is reached. If the user tries again after 5 seconds
and continues to fail, the block time is doubled. The block time continues
to be doubled until a successful logon or control system reboot happens.
Once a user successfully authenticates against console, the failure count
is reset to zero, and the block time is reset to 5 seconds.
•For Ethernet transport, after a remote IP fails to logon within maximum
attempts allowed, the console forces the transport to close and blocks
further logon attempts from that remote IP for 24 hours.
NOTE: To regain access to the control system from a blocked IP,
successfully log in to the console over USB, and then use the
REMBLOCKEDip console command to remove the blocked IP. For more
information, refer to “Blocked IP Address Functions” on page 18.
•For dynamic transport (mainly used by console symbol), console
authentication is not required, and the user’s access level is granted by
default.

16 •3-Series Control Systems Reference Guide – DOC. 7150B
Local User Login
If authentication is on and a user opens a connection to the console, the console
prompts the user for a username and password as shown in the example below.
PRO3 Console
Login: jsmith1
Password: ******
PRO3>
Local users are created with no access rights. Even if a user has an account in the
control system, the user cannot connect to the control system console when
authentication is on unless the user been added to a group. To grant access to
the user, an administrator must ensure that the user has been first added to a
group.
Active Directory Login
To log onto the console as an Active Directory user, both the domain name and
username must be provided (separated by a "\" or "/") when prompted by the
console.
PRO3 Console
Login: csusers\jsmith1
Password: *****************
PRO3>
After an administrator adds an Active Directory user or group to the control
system, the name and SID of the user or group is stored in the control system.
When an Active Directory user attempts to authenticate against the console, the
console in turn uses the user credentials to authenticate against the Active
Directory service. If the Active Directory authentication is successful, the console
queries the Active Directory service for the user's SID:
•If the user has been added to the control system, the console compares
the SID from the Active Directory service with the stored SID. Access is
granted to the user only if the SIDs match.
•If the user has not been added to the control system, the console queries
the Active Directory service for all groups containing the user and
retrieves the group SIDs. The console then iterates these SIDs to compare
them to the stored group SIDs. Access is granted to the user only if at
least one match is found.