WINK-SecurityCenterTools-Setup-0.9.0.0.exe contains both the console and the GUI — pick the components you want during setup. For deployment questions email support@wink.co.
users.json to fill missing -h / -u / -p; command-line arguments still take precedence.Engine.ProductVersion, app version, build date, and brand line.--sdk is now auto-detected from the loaded DLL by default; only needed as an override.LogOn failure).users.json path and a copy-paste schema example.WINKSCData is a command-line tool for reading from and (selectively) writing to Genetec Security Center systems. It is designed for scripts, scheduled tasks, CI pipelines, and remote shell sessions where a GUI is impractical.
For the WPF graphical counterpart, see the APIBridge Metro Manual. Both tools share the same Genetec SDK assemblies, the same Forge XML output format, and the same users.json credentials file.
| Capability | Modes |
|---|---|
| Read the Security Center inventory | --forge, -c, -a, -e, --cameraunit, --connectedentities, -n |
| Audit decoder / camera bindings | --comparenames |
| Write name changes to AnalogMonitors | --associatemonitors (preview), --associatemonitorseven (apply) |
| Write video routing via SDK actions | --applyassociations, --reassociate, -r |
| Inspect the Security Center license | -l |
All write modes also produce a log of what changed.
The console ships inside the combined installer WINK-SecurityCenterTools-Setup-0.9.0.0.exe. During installation, tick the WINKSCData console (Genetec SDK 5.9, --forge) component.
After install:
C:\Program Files\WINKStreaming\SecurityCenterTools\Console\ ├── WINKSCData.exe ├── WINKSCData.exe.config ├── users.json (blank by default) ├── Genetec.Sdk.dll (5.9.x) └── ... ~155 supporting files
The Start Menu shortcut WINKSCData Console (cmd) opens a Command Prompt already cd-ed into the install folder and prints --help.
WINKSCData is fully portable. Copy the entire Console\ folder to a USB drive or network share and run WINKSCData.exe from there. No registry writes are required for the console itself. The optional Windows Service component is separate — see section 9.2.
users.jsonThe console reads users.json to fill in -h, -u, and -p if you do not provide them on the command line. Command-line arguments always take precedence — users.json only fills in what is missing.
First match wins:
users.json in the same folder as WINKSCData.exe%APPDATA%\WINKStreaming\users.json (shared with APIBridge Metro){
"host": "10.18.183.20",
"username": "YOUR_SDK_USER",
"password": "YOUR_PASSWORD",
"useDemoCertificate": false
}
useDemoCertificate: true is equivalent to passing --democert.%APPDATA%.| Command line | users.json | Effective values |
|---|---|---|
-h X -u Y -p Z (all three) | (anything) | CLI values; --democert only if passed |
-h X only | has username / password / useDemoCertificate | CLI host + file user / pass / cert |
| (none) | complete | All from file |
| (none) | empty | Exits with code 2 and prints schema example |
Use the GUI's Save Credentials button to write %APPDATA%\WINKStreaming\users.json, then on the same machine simply run:
WINKSCData.exe --forge
The console picks up the file automatically.
Every invocation prints a banner:
================================================================ WINKSCData 0.9.0.0 (build 0 / 2026-06-28) Genetec SDK 5.9.3 WINK Streaming LLC — Authorized Genetec Partner ================================================================
The Genetec SDK line reflects the actually loaded Engine.ProductVersion — not a hardcoded value. If the displayed version is not what you expect (for example you wanted 5.11), confirm which Genetec.Sdk.dll is on disk next to the EXE.
The banner is followed by an SDK-version detection line:
SDK version (auto-detected from Engine.ProductVersion 5.9.3.123): 5.9
This tells you which internal code branch will be used (5.9 vs 5.12 query patterns). Override with --sdk 5.9|5.12 if auto-detection picks the wrong branch.
Run WINKSCData.exe --help at any time to print the auto-generated option list. Below is the same with usage notes.
| Option | Default | Notes |
|---|---|---|
-h, --host <ip-or-name> | from users.json | Genetec Security Center server |
-u, --username <name> | from users.json | SDK-enabled account |
-p, --password <pwd> | from users.json | Plain text; quote if it contains spaces |
--democert | from users.json useDemoCertificate, else false | Use the Genetec demo certificate |
--sdk 5.9|5.12 | auto-detect | Force internal code branch |
--help | — | Print auto-generated help and exit |
| Option | Output | Purpose |
|---|---|---|
-f, --forge | GenetecForge_<ts>.xml | Hierarchical nested XML grouped by IP / unit; full camera + decoder attributes. The primary reporting mode. |
-c, --cameralist | stdout XML | All cameras with model, resolution, codec, FPS, GPS |
-a, --analoglist | stdout XML | All analog monitors with UDP port, IP, MAC, online state |
--connectedentities | stdout XML | Analog monitors + their connected camera reference |
--cameraunit | stdout XML | Cameras grouped by their parent VideoUnit |
-e, --entitylist | stdout XML | Mixed entity browser |
-n, --nested | stdout XML | Nested XML similar to --forge but without writing a file |
-j, --json | switches XML to JSON for any of the above | Output format toggle |
-l, --license | stdout text | Print Security Center license + version info |
| Option | Output | Purpose |
|---|---|---|
--comparenames | stdout text + compare_names_<ts>.xml | Compare each decoder's name against the camera currently displayed on it. Reports MATCH / MISMATCH / NO CAMERA per row plus a summary with percentages. |
| Option | Writes | Purpose |
|---|---|---|
--associatemonitors | nothing (preview) | Print what --associatemonitorseven would change |
--associatemonitorseven | AnalogMonitor Name + Description | Evenly distribute cameras across decoders matching the WF### pattern, then rename each monitor {CameraName} - {WF###}-{UdpPort}. Original name preserved in Description with an Original: marker. |
| Option | Writes via | Purpose |
|---|---|---|
-r, --reconnect | ActionManager.DisplayOnAnalogMonitor | Walks every analog monitor with a connected entity and re-issues the display action. Use after a routing wipe. |
--applyassociations | ActionManager.DisplayOnAnalogMonitor | Re-apply existing camera-to-decoder assignments based on monitor name (matches {CameraName} in name to a Camera entity). |
--reassociate | RemoveFromAnalogMonitor then DisplayOnAnalogMonitor | For each monitor with a connected camera: disconnect first, then reconnect. Use when a routing assignment is "stuck" and -r alone does not take. |
REM Reads creds from %APPDATA%\WINKStreaming\users.json WINKSCData.exe --forge
Output: GenetecForge_20260628_143025.xml in the current directory.
WINKSCData.exe -h 10.18.183.20 -u sdkuser -p "P@ssword 1" --forge
Use double quotes around passwords containing spaces or special characters.
WINKSCData.exe --comparenames
Stdout shows progress per monitor, then a summary like:
=== SUMMARY === MATCH: 287 (89%) MISMATCH: 24 ( 7%) NO CAMERA: 12 ( 4%)
Full per-row details written to compare_names_<ts>.xml.
WINKSCData.exe --reassociate
-r runs are not taking.
WINKSCData.exe --associatemonitors REM preview only WINKSCData.exe --associatemonitorseven REM actually write the names
Only monitors with names matching WF### are touched.
WINKSCData.exe -j -c > cameras.json WINKSCData.exe -j -a > monitors.json
WINKSCData.exe -l
Outputs SDK version, server version, license expiration, and feature flags — useful for asset and compliance reports.
| Code | Meaning |
|---|---|
| 0 | Success |
| 2 | Missing credentials (no -h/-u/-p and users.json is empty or missing) |
| Non-zero (other) | Mode-specific failure (LogOn failure, SDK exception, etc.) — see stdout for details |
Scripts that wrap WINKSCData should check %ERRORLEVEL%:
WINKSCData.exe --forge
if errorlevel 1 (
echo Forge export failed >> wink-error.log
exit /b 1
)
| Mode | Filename pattern | Location | Notes |
|---|---|---|---|
--forge | GenetecForge_<yyyyMMdd_HHmmss>.xml | current directory | Hierarchical, full attributes, CDATA-escaped |
--comparenames | compare_names_<ts>.xml | current directory | One row per analog monitor |
--associatemonitorseven | associate_monitors_log_<ts>.txt | current directory | What was renamed, before → after |
-c, -a, -e, -n, --cameraunit, --connectedentities | none (stdout only) | — | Redirect with > |
For very large deployments (more than 1,000 monitors), redirect stderr too:
WINKSCData.exe --forge 2>&1 | tee forge-run.log
Create a Basic Task pointing at WINKSCData.exe with arguments --forge. The trigger frequency is your choice — common patterns:
Microsoft-Windows-NetworkProfile/Operational eventSet the working directory to the install folder so output files land predictably. Credentials come from users.json in %APPDATA%\WINKStreaming\ — this works because the scheduled task runs as the user account whose %APPDATA% you populated via the GUI's Save Credentials button.
If the task runs as SYSTEM instead, drop a users.json next to WINKSCData.exe in the install folder so the portable search path finds it.
A purpose-built Windows Service (installed via the GUI's Configuration → Windows Service tab) runs --forge every 20 minutes, compares exports for changes, and emails diffs. See the GUI manual section 7 for setup details.
The service uses DPAPI-encrypted credentials at %APPDATA%\WINKStreaming\APIBridge\settings.encrypted — NOT the plain-text users.json. The two credential stores are independent.
Example PowerShell wrapper for a CI pipeline that produces a nightly Forge export and uploads it:
$ErrorActionPreference = 'Stop'
$cwd = 'C:\Program Files\WINKStreaming\SecurityCenterTools\Console'
Set-Location $cwd
& .\WINKSCData.exe --forge
if ($LASTEXITCODE -ne 0) { throw "Forge export failed: $LASTEXITCODE" }
$xml = Get-ChildItem -Filter 'GenetecForge_*.xml' |
Sort-Object LastWriteTime -Descending | Select-Object -First 1
# Upload to your artifact store / S3 / etc.
Copy-Item $xml.FullName "\\fileserver\reports\$($xml.Name)"
--forge emits a hierarchical XML grouped by archiver IP and command port. Top-level structure:
<wink report_time="2026-06-28T14:30:25" generation_duration="00:00:14.523">
<monitors decoder_count="1801" camera_count="1674">
<monitor_device ipaddress="162.249.44.100" macaddress="8C1F64428000" guid="...">
<monitor_unit cmdport="5602">
<decoder guid="..." name="..." udpport="15000" online="true" ...>
<connectedcamera guid="..." name="..." model="..." resolution="..." ...>
<!-- 58+ camera attributes -->
</connectedcamera>
</decoder>
<!-- more decoders on this unit -->
</monitor_unit>
</monitor_device>
<!-- more units -->
</monitors>
</wink>
Decoder attributes include: guid, name, description, udpport, online, runningstate, currentsignalstate, streamconnectiontype, supportedconnectiontypes, monitorgroupguid, plus connected-alarm fields.
Camera attributes (when an <connectedcamera> is present) include: guid, name, manufacturer, model, resolution, codec, framerate, bitrate, keyframeinterval, quality, gpslatitude, gpslongitude, encryptiontype, runningstate, currentsignalstate, isblocked, isinmaintenance, timezone, and more.
All string fields are XML-escape-safe (&, <, >, ", ' handled) and wrapped in CDATA where appropriate. JSON output (-j) emits the same data with field names converted to camelCase keys.
The SDK account used must have:
--associate* mode-r, --applyassociations, --reassociate--forge produces a file with decoder_count=0 or blank IP/MAC, the SDK user is missing one of the above. Run the Connectivity & Permissions tab in the GUI to identify exactly what is missing — faster than guessing from the console output.
Cameras and AnalogMonitors are pulled in batches of 5. After each batch the session liveness is rechecked; if dead, the console auto-reconnects using cached credentials with progressive backoff (0 / 30 / 60 / 120 / 300 / 600 seconds) and resumes from the next batch.
--forge cumulatively appends to GenetecForge_progress.jsonl in the current directory. If a run dies mid-way, simply re-run — the next invocation reads the progress file as a starting cache and only re-queries entities not yet collected. Successful completion renames the progress file to GenetecForge_completed_<ts>.jsonl.
For a healthy SC 5.11.3 server with a privileged SDK user:
| Inventory size | --forge time |
|---|---|
| ~100 monitors | < 30 seconds |
| ~500 monitors | ~2 minutes |
| ~1,800 monitors | ~5–10 minutes |
| ~1,800 monitors on a restricted SDK user (permission cascades) | 20–60 minutes |
If you observe times longer than these, check the SDK user's privileges first.
Engine.ProductVersion could not be read — usually means Genetec.Sdk.dll is not loadable. Verify the DLL is present next to WINKSCData.exe and is not blocked (right-click → Properties → Unblock if it came from a download).
You did not pass -h/-u/-p and no users.json was found. The error message includes the expected schema and the per-user path. Save credentials via the GUI or create the file by hand.
Same root cause as above — verify the scheduled task runs as the user whose %APPDATA%\WINKStreaming\users.json is populated, OR drop a users.json next to the EXE so portable-mode discovery picks it up.
SC 5.11.3 firewall throttle. Wait ~5 minutes between connect attempts. The console will retry with patient backoff automatically (look for "Reconnect attempt N/5" lines).
decoder_count=0 camera_count=0 in the Forge outputThe SDK user cannot see entities. Most often a missing View Analog Monitors privilege. Confirm in Config Tool against the SDK user's role.
User lacks View hardware configuration on the VideoUnit entity. This is the most common partial-data scenario.
Engine.ProductVersion reflects the loaded DLL. Override with --sdk 5.9 or --sdk 5.12 to force a different code branch. If your DLL is genuinely SDK 5.11 but you want the 5.12 code paths (since they are largely compatible), --sdk 5.12 is the right flag.
--forge runs but the XML has unescaped ampersandsShould not happen in v0.9 — all output goes through XmlEsc / XmlAttr / Cdata helpers. If you see this, file a support case with the offending camera/decoder name; it indicates a code path that bypassed the escaper.
Usually a .NET Framework 4.8 mismatch on the target. Install the runtime from Microsoft (it ships with Windows 10 1809+ and all Windows 11; older OS needs the redistributable).
| Path | Purpose |
|---|---|
{install}\Console\WINKSCData.exe | The executable |
{install}\Console\users.json | Portable credentials (blank by default) |
%APPDATA%\WINKStreaming\users.json | Per-user credentials (shared with GUI) |
| current directory | Output files (GenetecForge_*.xml, compare_names_*.xml, etc.) |
| current directory | GenetecForge_progress.jsonl (in-flight resume cache) |
WINKSCData has shipped roughly eight releases since 2017, most of them quiet — bug fixes, Genetec SDK compatibility refreshes, and the occasional small security touch. Feature work has been incremental and conservative; the v0.9 release in 2026 is the largest functional jump in the tool's lifetime, pairing the console with the APIBridge Metro WPF GUI under a combined installer.
Combined-installer release. Introduces shared credentials and dynamic SDK detection, and tightens long-running-export resilience so unattended jobs survive a network hiccup.
users.json to fill missing -h/-u/-p; CLI args still win.Engine.ProductVersion, app version, build date, and brand line.--sdk is now auto-detected from the loaded DLL by default; only needed as an override.GenetecForge_progress.jsonl sidecar file lets a killed or crashed run be re-launched and continue where it left off; on successful completion the file is renamed to GenetecForge_completed_<ts>.jsonl.--sdk and Engine.ProductVersion are unavailable.users.json path and a copy-paste schema example.users.json a scripted job is using) but the password itself is never written to stdout or the log file.Resilience release. Removes the last third-party JSON dependency and adds a three-tier fallback for camera detail queries on locked-down SDK 5.9 deployments.
Newtonsoft.Json reference entirely — zero third-party JSON dependencies. Smaller install footprint, one less supply-chain surface to track.CameraConfigurationQuery access for SDK 5.9 (works around partial-failure cascades on restricted users).CameraConfigurationQuery → EntityConfigurationQuery → direct Camera entity properties. Whichever succeeds first wins; previously a single failed query nulled the whole batch.Maintenance release. SDK compatibility refresh and small fixes accumulated from field deployments.
--comparenames summary formatting.Quiet maintenance and a small security touch.
-v dumps used for troubleshooting).--analoglist field ordering for downstream parsers.Maintenance release.
monitor_unit elements were occasionally written for shared archivers.Maintenance release with a small security touch.
First post-release fix wave.
-l / --license for SDK and Security Center version reporting.Initial release. Built against the Genetec Security Center deployments common at the time — primarily 5.2 and the then-current 5.4 line — with forward-compatibility against the 5.x query patterns Genetec was settling on.
--forge export — hierarchical XML of the Security Center inventory grouped by archiver IP and command port, the reference format consumed by downstream WINK products.-c / --cameralist, -a / --analoglist.-h, -u, -p), .NET Framework target, Genetec SDK binding, standalone Inno Setup installer.WINKSCData ships alongside APIBridge Metro, a WPF graphical operator console that performs the same reads and writes through a point-and-click interface. Use the GUI for ad-hoc work and diagnostic walk-throughs; use WINKSCData for everything that needs to run unattended, in a script, or on a schedule.
| Question | Answer |
|---|---|
| Are credentials shared? | Yes — both read the same users.json paths. |
| Are output formats shared? | Yes — Forge XML from --forge matches the GUI's Export XML output byte-for-byte. |
| Are write actions shared? | Yes — same SDK actions (DisplayOnAnalogMonitor, RemoveFromAnalogMonitor, name changes). |
| Are the JSONL caches shared? | No — console writes to current directory; GUI writes to %USERPROFILE%\Documents. |
| Are the SDK versions the same? | No — Console ships SDK 5.9; GUI ships SDK 5.11. They cannot share an install folder for this reason. |
| Can I run both at the same time? | Yes — each opens its own SDK session. |
For the GUI side of the story, read the APIBridge Metro User Manual.
When reporting issues, please include:
> log.txt 2>&1)-l --license)