In WinCC, rights are numbered authorisation levels created in the User Administrator and assigned to user groups. Each object in Graphics Designer has an Operator authorisation property that references one of those levels. Add automatic logout, a password policy through SIMATIC Logon where required, and enable operation messages so every command is written to the alarm archive with the user name.
- Authorisation levels are numbers assigned to groups; plan the numbering before you create fifty of them.
- An automatic logout time is what actually enforces the rights you configured.
- Operation messages turn the alarm archive into an audit trail at no extra engineering cost.
The WinCC User Administrator
Open User Administrator from WinCC Explorer. It holds user groups, users and the numbered authorisation levels that everything else references.
Create the authorisation levels first and keep the list short. A workable scheme for most plants:
| Level | Name | Granted to |
|---|---|---|
| 1 | User administration | Engineering only |
| 2 | Value input | Setters and above |
| 3 | Process control | Operators and above |
| 4 | Manual operation | Maintenance and above |
| 5 | Alarm acknowledgement | Operators and above |
| 6 | Archive and report access | Supervisors and above |
| 7 | Configuration and runtime exit | Engineering only |
Then create groups such as Operator, Setter, Maintenance, Supervisor and Engineering, tick the levels each group holds, and add users to groups. Never grant levels to individual users directly; when someone leaves you want to delete a user, not audit fifty screen objects.
Each user also carries a logout time and, where configured, web access rights for Web Navigator clients.
Applying Authorisation to Screen Objects
An authorisation level does nothing until an object references it. In Graphics Designer, every object has an Operator authorisation property under Miscellaneous. Select the level that should be required to operate it.
Decide what to protect by consequence:
- Always protect: manual and jog commands, mode changes, setpoint entry, counter and totaliser resets, recipe download, alarm suppression, runtime exit.
- Usually protect: parameter screens, archive deletion, report configuration.
- Leave open: screen navigation, trend viewing, alarm reading, report printing.
Locking navigation is a common overreach. An operator who cannot open a diagnostic screen phones maintenance for information that was on the screen all along.
Use the object's Enable property with a dynamic on the logged-in level so protected buttons appear greyed out rather than rejecting a login the operator will never have. The dynamics options are compared in WinCC Explorer operator controls.
Login, Logout and SIMATIC Logon
Runtime login can be triggered from a button calling the login dialog, from a hotkey, or from a chip card reader on stations that use one.
Automatic logout
Set a logout time per user, typically five to ten minutes for elevated groups. Without it, an engineering login stays active for the rest of the shift on an unattended station, and every right you configured is effectively public.
SIMATIC Logon
Where the site requires enforced password policy, WinCC can delegate authentication to SIMATIC Logon, which uses Windows user groups. That gives you central account management, password expiry, complexity rules and lockout after failed attempts, handled by IT rather than duplicated in the SCADA project.
| Requirement | Handled by |
|---|---|
| Simple operator groups on a standalone station | WinCC User Administrator alone |
| Central accounts shared with plant IT | SIMATIC Logon with Windows groups |
| Password expiry and complexity rules | SIMATIC Logon and Windows policy |
| Electronic signature on critical actions | SIMATIC Logon with the audit option |
| Who changed a setpoint and when | Operation messages in the alarm archive |
Set up WinCC security properly
SCADA sessions cover user administration, SIMATIC Logon, audit trails and handover documentation.
Audit Trail and System Hardening
Enable the operation message on I/O fields and buttons that change the process. WinCC then writes a message to the alarm archive on every operation, recording the old value, the new value, the time and the logged-in user. That archive becomes your audit trail with no additional engineering.
Beyond user rights, a production SCADA station needs a few practical measures:
- Disable runtime exit for everyone except engineering, and hide the Windows desktop and task bar behind the runtime.
- Keep the engineering system on a separate machine from the runtime server where the licence permits.
- Back up the project, the user administration data and the user archives, and test a restore before handover.
- Control USB and remote access; a SCADA server is not a general-purpose PC.
- Document the groups, levels, accounts and the date of the last restore test in the machine file.
The equivalent configuration at panel level is covered in HMI user administration and runtime settings.
Hands-On Lab: Secure a WinCC Station and Prove the Audit Trail
Hands-on- WinCC Explorer with an existing project containing commands and setpoints
- Rights to create users and groups on the station
- Simulation only, no live plant control
- Estimated time: 40 minutes
Create authorisation levels
In User Administrator, create the numbered levels for value input, process control, manual operation and user administration.
Create groups and users
Create Operator, Maintenance and Engineering groups with the appropriate levels, then add one user to each.
Protect the objects
Set Operator authorisation on a jog button, a setpoint field and the runtime exit button.
Set automatic logout
Give the Maintenance and Engineering users a five minute logout time and leave the station idle.
Enable operation messages
Turn on the operation message for the setpoint field, change the value, and open the alarm archive.
Rights come from groups, protected objects reject an unauthorised user, idle sessions log out on their own, and every setpoint change is recorded with a user name in the archive.
Frequently asked questions
How are rights structured in WinCC?
As numbered authorisation levels created in User Administrator and granted to user groups. Screen objects reference a level through their Operator authorisation property.
What does SIMATIC Logon add over the WinCC User Administrator?
Central authentication against Windows user groups, with password expiry, complexity rules and lockout handled by IT, plus the electronic signature option for regulated environments.
How do I create an audit trail in WinCC?
Enable operation messages on the objects that change the process. Each operation is written to the alarm archive with the old value, new value, timestamp and user name.
Why is automatic logout important on a SCADA station?
Because a control room PC is physically accessible. Without a logout time, an elevated login stays active after the engineer leaves, and the configured rights stop meaning anything.