Genetec Security Center Hardening Guide: Accounts, Certificates, Omnicast and Synergis Controls

Genetec Security Center unifies video, access control and licence plate recognition on Windows servers, so the default account settings and certificates in each role matter, because one gap can expose cameras, door controllers and cardholder data at once. Genetec publishes a versioned Security Center Hardening Guide (5.12 at the time of writing, checked 8 November 2026) that grades each recommendation as Basic or Advanced. This guide works through that material by risk: the Directory and its accounts, Active Directory and identity provider integration, service accounts, certificates and encryption, Omnicast video and Synergis access control specifics, the Genetec Update Service and logging. It is for security engineers, integrators and system owners who already understand physical access control and need a product-level baseline. For the vendor-neutral view, read the Physical Access Control Systems Security Guide first.

This is an independent guide from NHI Mgmt Group, based on Genetec's public documentation as of November 2026. It is not sponsored or reviewed by Genetec. Product features change, so confirm settings against Genetec's current documentation.

Key takeaways

• Kill the default Admin early. The hardening guide lists changing the default Admin password and then deactivating the default Admin user profile as Basic steps; every administrator should have a named account.
• Service accounts stay local. Genetec recommends the LocalSystem default (not for failover set-ups) or a custom account with local machine privileges only, and notes that domain rights are not needed, for the Genetec Server service.
• Trust the certificate, then enforce it. Replace self-signed server certificates with CA-issued ones, select "Always validate the Directory certificate" at install, and set backward compatibility to your current version so pre-TLS clients (5.4 and earlier) are refused.
• Devices are identities too. Camera and controller passwords, the Synergis Softwire diagnostic account and Global Cardholder Synchronizer users are non-human credentials that need rotation and least privilege.
• Logging is opt-in per event. Security events such as failed logons, unit password exports and manual video deletion are only stored for Activity trails reports if you select them.

How identity and access work in Security Center

The Directory role is the core of a Security Center system: it authenticates users and client applications (Security Desk, Config Tool, Web Client, Genetec Mobile) and holds the configuration that other roles (Archiver for video, Access Manager for doors, Active Directory, Web Client Server, Mobile Server) depend on. Users can be local Security Center users, synchronised Windows Active Directory users, or users authenticated by a third-party identity provider, which the 5.12 guide lists as an Advanced recommendation. Partitions restrict which entities (cameras, doors, cardholders) a user or group can see, and privileges restrict what they can do.

Active Directory and identity provider integration

Synchronising Windows Active Directory with the Security Center Active Directory role lets users log on with Windows credentials and moves joiner, mover and leaver control to one place. The configuration is done in Config Tool under System, Roles, by selecting the Active Directory role and, on the Properties tab, selecting Use SSL connection. Genetec pairs this with a strong AD password policy aligned with NIST guidance. Moving to an identity provider adds the option of enforcing phishing-resistant MFA upstream; see the Physical and cyber security convergence guide for how to bring physical security operators under the corporate identity programme.

• Decision guidance: small single-site systems may keep a handful of local users with a strong policy; any multi-site or regulated deployment should use AD or an IdP and then deactivate local users, keeping one sealed break-glass account documented outside the system.
• Client restriction: the guide recommends restricting client application connections to a specific Directory (Advanced), which prevents a workstation from being pointed at a rogue Directory.
• Desktop sessions: activate auto lock or auto disconnect on desktop clients (Basic), because Security Desk consoles in control rooms are often shared and left signed in.

Admin roles and privileged access

Security Center privilege is granted through user groups, privilege templates and partitions. The hardening guide's Advanced recommendation is to restrict user privileges, and its operational value comes from separating three populations.

• Server Admin: Genetec Server Admin is a web console that configures servers, databases and secure communication. Restricting it to local connections and protecting server configuration with a password removes a high-value remote management surface.
• Macros: run macros with limited access rights (Advanced); a macro runs with the rights it is given and can automate door or recording changes.
• External access: use a Directory gateway for external access to Security Center (Basic) rather than exposing the Directory itself.
• Windows layer: run client applications without administrative privileges (Basic) and keep local administrator rights on Security Center servers to a named group.

Integrations, API tokens and service accounts

Most compromise paths in a unified security platform run through non-human credentials: the service account behind Genetec Server, the SQL Server login, device passwords stored in the Directory and synchronisation users between systems. See the Device and IoT Identity Guide for the broader model.

Store device and service credentials in a vault with an owner and rotation date, and rotate after any integrator handover. For Windows service account patterns, see the Group Managed Service Accounts (gMSA) Guide, and confirm with Genetec documentation which account types your version supports before changing the service logon.

Certificates, encryption and transport

• Server certificates: in Genetec Server Admin, select the server, then Secure communication, Select certificate, and choose a CA-issued certificate trusted by every client. Clients that do not trust it show an invalid certificate dialog; Genetec advises against choosing "don't ask again" and recommends investigating why before proceeding.
• Directory certificate validation: select "Always validate the Directory certificate" on the InstallShield Security Settings page, and use the recommended InstallShield security settings (Basic).
• Backward compatibility: set "Allow applications starting from version (backward compatibility)" to your current version. TLS requires versions later than 5.4; older clients then see "Client-server versions are incompatible", so notify users first. The guide also covers disabling backward compatibility for the Map Manager role.
• Web roles: install valid certificates on Web Client Server and Web App Server roles, disable unlimited session time on Web Client Server, change default ports and disable unused Web App Server features. Enforce certificate validity for Genetec Mobile.
• At rest: encrypt database data files and use BitLocker full volume encryption on servers (both Advanced); apply safe TLS versions in Windows (Advanced).

Omnicast video hardening

The Video section of the 5.12 guide covers: refusing basic authentication to cameras, enabling secure communication in the Media Router, upgrading video unit firmware, connecting to cameras over HTTPS, deactivating unused services on video units, fusion stream encryption for video in transit and at rest (with encryption certificates requested and installed per client), and digital signatures on video files to prove integrity, which depends on setting up a cryptographic key. Digital signature and fusion stream encryption matter most where footage is evidence. For camera-level controls that apply regardless of VMS, see the IP Camera and CCTV Security Guide.

Synergis access control hardening

The Access Control section covers: enabling Secure mode on HID units, strong and periodically rotated passwords on access control units, critical firmware and recommended platform updates, trusted certificates on Synergis units, disabling the ability to drive output relays from the Synergis unit web interface (so a web session cannot open a door), secure reader connections, and disabling peer-to-peer and global antipassback for Access Manager roles where not needed. Secure reader connections protect the reader-to-controller link, which deserves attention in legacy deployments.

Logging and detection

In Config Tool, open System, General settings, Activity trails and select the security events Genetec recommends logging, then report on them in the Activity trails task.

The hardening guide describes storing these events in the Security Center database; it does not describe forwarding them to a SIEM, so check your version's integration documentation for export options. On the Windows layer, forward Security log events from every Security Center server (for example logon events 4624 and 4625 and service installation events) to your SIEM, and synchronise all clocks within the system (Advanced) so video, door and server events correlate. See the CIS Control 8 Audit Log Management Guide.

Metrics

• Named administration: default Admin deactivated and local users disabled on every Directory (target 100 percent).
• Certificate trust: servers and web roles on CA-issued certificates, with backward compatibility at the current version.
• Device credential age: percentage of cameras and controllers with passwords rotated in the last policy period.
• Patch latency: days from a Genetec Security Updates notice to deployment on all servers.
• Event coverage: all recommended Activity trails events enabled, plus Windows logs reaching the SIEM.

Hardening baseline

1. Baseline and back up: record the current version, roles, servers, users and certificates, and back up the Directory database before changes.
2. Accounts first: change and then deactivate the default Admin, create named administrators, set the password policy and protect Server Admin with a password restricted to local connections.
3. Service and database accounts: confirm the Genetec Server service account has local privileges only and the SQL connection does not use an administrative login.
4. Enable logging: select the recommended Activity trails events and start Windows log forwarding, so later changes are visible.
5. Certificates and TLS: deploy CA-issued certificates to servers and web roles in a pilot site, confirm clients trust them, then raise backward compatibility to the current version. Rollback is lowering the setting, which re-admits older clients.
6. Devices: rotate camera and controller passwords, refuse basic authentication, move cameras to HTTPS, enable HID Secure mode and secure reader connections, and disable relay control from unit web interfaces.
7. Directory integration: integrate AD over SSL or an identity provider, then deactivate local users and remove unused roles (Basic).
8. Patching: enrol every Security Center machine in the Genetec Update Service (it needs internet access, optionally through a proxy, and Genetec documents connecting with Server Admin credentials), subscribe to KB article and Security Updates alerts on the TechDoc Hub, and apply Windows security baselines and updates.
9. Evidence protection: enable fusion stream encryption and video digital signatures where footage may be used as evidence.

Common misconfigurations

• Integrator-owned shared Admin: the default Admin left active and shared between staff and the integrator, so no action can be attributed.
• Domain admin as the service account: a custom service logon given domain privileges "to make AD sync work", turning a VMS server compromise into a domain compromise. The guide says local privileges only.
• Clicking through certificate warnings: operators trained to accept the invalid certificate dialog, which removes the protection against a rogue Directory.
• Backward compatibility left open: pre-TLS client support kept after upgrades because one old workstation was never updated.
• Static device passwords: camera and controller passwords set at commissioning and never rotated, often identical across a site.
• GUS on some machines only: servers outside the Genetec Update Service fall behind on patches without anyone tracking them.

Framework mapping

Practitioner checklist

• Change, then deactivate, the default Admin user and give every administrator a named account.
• Confirm the Genetec Server service account has local machine privileges only.
• Replace self-signed server and web role certificates with CA-issued certificates and enforce Directory certificate validation.
• Set backward compatibility to your current Security Center version.
• Integrate Active Directory with SSL or an identity provider, then deactivate local users.
• Rotate camera, controller and Synergis Softwire diagnostic credentials and record their owners.
• Enable the recommended Activity trails events and forward Windows server logs to your SIEM.
• Enrol every machine in the Genetec Update Service and subscribe to Security Updates alerts.
• Enable fusion stream encryption and video digital signatures for evidential footage.

Standards and references

• Genetec: Security Center Hardening Guide 5.12
• Genetec: Using a local service account for Genetec Server
• Genetec: Using trusted certificates on Security Center servers
• Genetec: Disabling backward compatibility
• Genetec: Logging activity trails for security-related events
• Genetec: Keeping Security Center up to date with Genetec Update Service
• Genetec: Using Windows Active Directory integration
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Physical Access Control Systems Security Guide · IP Camera and CCTV Security Guide · Physical and cyber security convergence · Device and IoT Identity Guide