Troubleshooting Intermittent Disabled Operator Faceplate Controls on WinCC OS Clients

Intermittent greying out of faceplate control buttons on long-running PCS 7 V8.0 WinCC OS client sessions is caused by user authorization token expiration or security context desynchronization between WinCC User Administrator and SIMATIC Logon. When operator accounts remain logged in indefinitely without automatic logout, background Kerberos authentication tickets expire, domain controller heartbeats lapse, or internal security handle leaks reset the client's local authorization bitmask, forcing APL faceplates to disable command buttons. To resolve this: (1) Configure an automatic inactivity logout (e.g., 60 minutes) in WinCC User Administrator; (2) Verify domain controller ticket renewal policies; and (3) Apply the latest SIMATIC Logon and WinCC Update Rollup patches to eliminate security handle leaks.

Executive Summary

In continuous process control facilities operating 24/7, operator consoles on WinCC OS Clients often remain logged in under a generic 'Operator' account for weeks at a time to prevent monitoring interruptions during shift changes. A perplexing and disruptive operational failure occurs in SIMATIC PCS 7 V8.0 where, after several weeks of continuous uptime, control buttons inside standard APL faceplates (e.g., Start/Stop, Auto/Manual, Setpoint entry) suddenly appear greyed out and unclickable for no apparent reason. The issue is temporarily cleared whenever an operator logs out and logs back in. This article diagnoses the root causes—including SIMATIC Logon ticket expiration, domain trust heartbeats, and WinCC credential handle degradation—and establishes permanent preventative procedures.

Architecture and Fundamental Mechanics

The authorization architecture governing WinCC faceplate interaction relies on an active chain of trust:

APL Faceplate Permission Evaluation: In standard Advanced Process Library (APL) faceplates, button enablement is not hardcoded. When a faceplate opens, internal C-scripts query the current user's authorization level using the function PASSCheckLevelEx() or evaluate internal system tags (@CurrentUserName, @CurrentUserToken, @local::@CurrentUserLevels). If the active user possesses the required authorization level (e.g., Level 5 'Process controlling' or Level 6 'Higher process controlling'), the faceplate sets En_... = TRUE. If authorization checks return 0, the button renders greyed out.
SIMATIC Logon and Windows Security Tokens: In PCS 7, user management is handled by SIMATIC Logon, which integrates WinCC with Windows local accounts or Active Directory (AD) domain controllers. Upon login, Windows issues an authentication token (Kerberos ticket). This token possesses a defined maximum lifetime (typically 10 hours in Active Directory, with ticket renewal up to 7 days). If an operator station remains logged in indefinitely without a logout/login cycle, the ticket renewal window closes, causing subsequent Windows token verification requests from CCUsrAc.exe or PassDBProvider to fail.
Local Authorization Mask Reset: When an Active Directory domain controller undergoes a network renegotiation, maintenance reboot, or Kerberos ticket expiration, WinCC attempts to validate the user's group memberships. If the domain query fails or times out, WinCC resets the user's authorization bitmask to 0 (unauthorized) while leaving @CurrentUserName visually populated. The operator appears logged in, but lacks all operational rights.
Process Handle and Memory Leaks: In legacy PCS 7 V8.0 releases, long-running WinCC client sessions exhibited memory handle leaks within the user administration runtime process, eventually exhausting security handles and causing permission evaluations to fail.

Step-by-Step Implementation Procedure

To permanently eliminate intermittent faceplate control lockouts, implement the following configuration remedies:

Configure Automatic Inactivity Logout in User Administrator:
- Open WinCC Explorer on the OS project.
- Open User Administrator.
- In the user properties for the Operator group and user accounts, locate the Auto Logout setting.
- Set Auto Logout to a reasonable time interval (e.g., 60 minutes of keyboard/mouse inactivity) rather than 0 (infinite).
- Instruct operations staff to use badge readers or SIMATIC Logon smart cards to ensure effortless re-login between shifts.
Configure Active Directory Kerberos Ticket Renewal:
- In the corporate Active Directory Group Policy (GPO) governing the PCS 7 domain, inspect Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Kerberos Policy.
- Ensure that Maximum lifetime for user ticket renewal is configured appropriately (e.g., 7 days) and that domain controllers are reachable across the terminal bus without intermittent firewall drops.
Configure Local Fallback Accounts in SIMATIC Logon:
- If clients communicate across complex enterprise networks, configure SIMATIC Logon to authenticate against the local Windows computer account database or local OS Server rather than a remote corporate domain controller.
- Open Configure SIMATIC Logon in Windows Control Panel. Select the local machine or dedicated PCS 7 domain controller.
Apply PCS 7 V8.0 and WinCC Updates:
- Verify installed software updates via SIMATIC Manager -> Help -> About -> Display Installed Software.
- Ensure WinCC V7.2 (PCS 7 V8.0) Update 14 (or latest available Update Rollup) and SIMATIC Logon V1.5 SP1 are installed on all OS Clients to eliminate security handle leaks.

Verification

Confirm stable user authorization and faceplate operation:

Authorization Tag Inspection: In WinCC Explorer -> Tag Management, observe internal tags @CurrentUserName and @local::@CurrentUserLevels. Confirm that when logged in as Operator, the bitmask corresponds to Levels 5 and 6.
Long-Running Session Simulation: Lock the workstation or leave the session idle. After 24–48 hours, open motor, valve, and controller faceplates. Confirm that setpoint fields and mode switch buttons remain active and fully functional.
Domain Disconnection Resilience Test: Temporarily disconnect the terminal bus link to the corporate domain controller. Verify that cached credentials on the local OS client maintain operational rights without freezing faceplates.

Limitations and Operational Precautions

Leaving operator consoles logged in indefinitely with zero inactivity timeout violates critical industrial cybersecurity standards (such as IEC 62443). If operational requirements mandate continuous screen visibility without logins, configure a dedicated read-only 'Monitoring' account for idle display, and require operator credential elevation via SIMATIC Logon only when executing commands.

Engineer FAQ

Why does logging out and logging back in immediately fix the greyed-out buttons?

Logging in forces WinCC and SIMATIC Logon to issue a fresh Windows security token and rebuild the user's authorization bitmask, restoring operational permissions.

Which authorization levels are required to operate APL faceplates?

Level 5 ('Process controlling') is required for standard manual/auto and start/stop operations. Level 6 ('Higher process controlling') is required for tuning parameters, interlock overrides, and alarm limits.

Can network latency to the domain controller cause buttons to grey out?

Yes. If a WinCC client fails to validate an Active Directory token due to a domain controller timeout, WinCC defaults to an unauthorized state (rights bitmask = 0).