Configuring WinCC v7.3 WebUX: Setup, Licensing, and Deployment Guide

WinCC v7.3 introduced the WebUX option as a vendor-neutral, HTML5-based remote visualization channel for the WinCC Server / WinCC Client SCADA stack. Unlike the legacy WinCC WebNavigator (ActiveX-based) and the newer WinCC / WebUX line in TIA Portal (WinCC Runtime Professional), the v7.3 WebUX delivers plant-floor screens to any modern browser, including mobile devices, without installing a browser plug-in. This article consolidates the configuration path, licensing, IIS prerequisites, user administration, and commissioning checks an integrator must complete before the first WebUX client connects to a WinCC v7.3 server.

1. WebUX in WinCC v7.3 — Architectural Overview

WebUX is a thin-client option of the WinCC v7.3 SCADA system. The WebUX server component is installed on the same machine that runs the WinCC Server project (or on a dedicated WebUX server within a distributed WinCC system). The component exposes the running WinCC runtime database and graphics to HTML5-capable browsers using a Microsoft Internet Information Services (IIS) web server as the host process.

The reference architecture consists of three logical layers:

• WinCC Server (process level): Hosts the configured WinCC project, tag database, alarm logging, and archive system.
• WebUX Server (presentation level): Hosts the IIS instance, the WebUX web application, the WebUX Configurator, and the user administration plug-in. It obtains its data from the WinCC runtime via the WinCC APIs.
• WebUX Client (browser level): Any HTML5-capable browser (Internet Explorer 11 in compatibility mode, Microsoft Edge, Mozilla Firefox, Google Chrome, Apple Safari, plus the mobile variants on iOS and Android).

For the broader TIA Portal counterpart, see the official Siemens TIA Portal documentation: WebUX - Overview (RT Professional) - WinCC.

For WinCC v7.3 reference material, the following Siemens support pages provide the manual set, application examples, and firmware/engineering notes used to build this article:

• WinCC/WebUX manual entry on Siemens Industry Online Support
• Manuals, examples, and engineering notes for WinCC/WebUX and WinCC/WebNavigator

2. Prerequisites

Before the WebUX option can be commissioned on a WinCC v7.3 system, the following hardware, software, and licensing prerequisites must be satisfied. The integrator should treat this list as a hard gate — bypassing items in this section is the most common reason a WebUX deployment fails to come up cleanly.

2.1 Hardware and Operating System

• Microsoft Windows Server 2012 R2 / 2016 / 2019 (the platform set supported by WinCC v7.3 / v7.4 / v7.5) for a production WebUX server.
• Microsoft Windows 10 (64-bit) is acceptable for engineering workstations and small test rigs.
• Sufficient RAM to host the WinCC runtime plus the IIS worker process; Siemens guidance is to start with the WinCC server baseline and add 4 GB dedicated to the WebUX/IIS pool.
• Stable Ethernet connectivity between the WebUX server and the WinCC server, plus reachable routing from the WebUX clients.

2.2 Software Stack

2.3 Licensing

WebUX is sold as a separate option on the WinCC v7.3 license storage medium (the so-called ASIA license stick or the software Certificate of License). The integrator receives:

• A WinCC/WebUX base license for the server (single-server licensing).
• WebUX client licenses counted as concurrent access. The license count is independent of the device the browser runs on; it is the number of simultaneously active WebUX sessions.

2.4 Network and Security Baseline

• Open inbound TCP 80 (HTTP) and/or TCP 443 (HTTPS) between WebUX clients and the WebUX server. If only intranet access is required, restrict the listener to the corporate subnet.
• For HTTPS, install the server certificate in the local computer Personal certificate store and bind it in IIS to the WebUX site.
• Make sure the WinCC server computer name is resolvable from the WebUX server (same domain or proper DNS / hosts entries). WebUX queries WinCC services by computer name.

3. Installing the WebUX Option

1. Insert the WinCC v7.3 product DVD or mount the v7.3 installation ISO on the target server.
2. Launch Setup.exe from the installation media root.
3. In the install type dialog, select "Package Installation" (custom / user-defined) so individual options are exposed.
4. Open the "WinCC Options" node and tick the "WinCC/WebUX" checkbox.
5. Accept the licensing terms. The installer transfers the WebUX files, registers the IIS web application, and configures the default WebUX site.
6. When the installer finishes, reboot the server if prompted. Some IIS component registrations only take effect after a restart.
7. After reboot, transfer the WebUX license to the local license container using the Automation License Manager. Verify that the WebUX entry shows the correct number of client tags / sessions.

4. Verifying the IIS Web Server Role

The WebUX web application is hosted by IIS. If the WebUX installer reports that the role is missing, install the role manually:

1. Open Server Manager → Add Roles and Features.
2. Select Web Server (IIS) and continue through the wizard.
3. In Role Services, ensure the following are enabled:
   • Common HTTP Features → Static Content, HTTP Errors, HTTP Redirection
   • Application Development → ASP.NET (4.x), .NET Extensibility, ISAPI Extensions, ISAPI Filters
   • Management Tools → IIS Management Console, IIS Management Scripts and Tools
   • Security → Basic Authentication, Windows Authentication, Request Filtering
4. Complete the wizard and confirm that http://localhost returns the default IIS splash page.

5. Configuring the WebUX Website

The WebUX site is configured in the IIS Manager. The WebUX installer creates a default site; for production deployments, replace it with a dedicated site bound to the operator-facing IP and TCP port.

1. Open IIS Manager (type inetmgr at an elevated command prompt).
2. Expand the server node and locate the WebUX application pool. Confirm that the pool runs under an identity with permission to read the WinCC project directories (typically the local SYSTEM account or a dedicated service account that is a member of the local SIMATIC HMI group).
3. Open the WebUX site and check the bindings:
   • HTTP on port 80, all unassigned IP, host name left blank — for pure intranet.
   • HTTPS on port 443 with the production server certificate — for any client outside the trusted zone.
4. Test the site by opening http://localhost/WebUX on the server. A login mask should render. The first load takes noticeably longer because the static assets (HTML5 client, JavaScript bundles) are transferred.

6. Publishing the WinCC Project for WebUX

Publishing is the step that takes the running WinCC runtime and exposes it through the IIS site. The WebUX Configurator is the tool that drives this step.

1. Start the WebUX Configurator (Start → Siemens Automation → WinCC → WebUX Configurator). The tool must run on the same machine that hosts the IIS site to which the project will be published.
2. In the Project field, select the WinCC v7.3 project to publish. The Configurator can read any project that the local WinCC installation can open.
3. Set the Target site to the IIS site that was prepared in Section 5. The dropdown is populated from the IIS configuration on the local machine.
4. Choose the operating mode:
   • Read-only — operators can view values and acknowledge alarms but cannot change setpoints. Use this on shared information displays and on every client for which you do not explicitly want write access.
   • Read/Write — operators can issue setpoints, perform switching actions, and operate faceplates. The user rights matrix still controls what individual users may do.
5. Click Publish. The Configurator generates the WebUX data, transfers it to the IIS site, and registers the project under the site.
6. Confirm that the WinCC runtime is running. The WebUX site only serves the screens of an active runtime; if the runtime is in "configuration mode", the WebUX login page returns a "WinCC runtime not running" error.

For an alternative platform — the TIA Portal V20 line — the equivalent publish workflow is documented in WebUX - Overview (RT Professional) - WinCC.

7. User Administration and Access Rights

WebUX does not maintain its own user database; it delegates authentication to the WinCC User Administrator. Every WebUX login is checked against the same users and groups configured for the WinCC project. This is intentional: it prevents a parallel user base that drifts away from the operator permissions used in the WinCC client.

1. Open WinCC Explorer → User Administrator on the engineering station.
2. Create a new group WebUX_Operators (or use an existing group) and assign the WebUX authorization under Authorizations. The WebUX authorization is required to log in at all; without it, the WebUX login form returns "No authorization".
3. Add at least one user to the group. The password is stored in the WinCC user database; the WebUX site submits the credentials over the configured transport (HTTP or HTTPS).
4. If you intend to give operators write access from the browser, grant the same write authorizations (e.g. Process controlling, Value input) you would grant in the WinCC client. The WebUX Configurator's Read-only / Read-write switch is a coarse gate; the granular checks are still enforced by the WinCC user administrator.
5. Export the user list and keep a controlled copy in the project documentation. WebUX failures caused by missing WebUX authorization in the user group are the single most common cause of a "login is rejected for this user" message in the field.

8. Client Access and Browser Behavior

Once the project is published and at least one user has the WebUX authorization, the deployment is reachable from any HTML5-capable browser. The WebUX client is fully responsive: the same screens scale to a desktop browser, a tablet, or a phone.

To launch the WebUX client from a desktop, the operator navigates to:

• http://<webux-server>/WebUX — unencrypted, intranet only.
• https://<webux-server>/WebUX — encrypted, required for any traffic that crosses a security boundary.

The login form takes the WinCC user name and password. After a successful login, the operator lands on the configured start screen of the WinCC runtime. Status, alarm, and trend screens are reachable from the standard WinCC screen tree.

9. Verification and Commissioning Checklist

The following checks should be performed in order at the end of the install. They map to the most common field-failure modes seen on WebUX commissioning trips.

1. Open the URL http://localhost/WebUX on the server itself. The login page must render without HTTP 500 errors. If it returns 500.19, the IIS role services listed in Section 4 are incomplete.
2. Log in with a user that has the WebUX authorization. A "no authorization" error indicates the user is not in the correct group; verify with the WinCC User Administrator.
3. Confirm that the screens that load in the WebUX browser match the screens of the WinCC runtime. A blank screen with a status bar "Runtime not running" means the WinCC runtime is stopped — start it from WinCC Explorer.
4. Trigger a configurable alarm and verify that it appears in the WebUX alarm view. If alarms do not propagate, the Alarm Logging service on the WinCC server is paused or the WebUX site is pointing to a different project than the runtime.
5. From a second client (laptop, tablet) on the same network, repeat steps 1–4. A successful login from a remote client confirms that the bindings, firewall rules, and DNS are correct.
6. Open a write-protected process screen and try to change a setpoint. The WebUX site must refuse the input. If the input is accepted, the WebUX Configurator was set to read/write but the user has the Process controlling authorization; demote the user or switch the Configurator to read-only.
7. Stop the WebUX site in IIS Manager and verify that the client browser returns a clean "site unavailable" message rather than a generic 404. The site must be stopped, not deleted, to keep the configuration intact for re-enable.
8. Reboot the WebUX server and confirm that the WebUX site comes up automatically and the runtime reconnects. This catches services that have been configured with manual start-type.

10. Troubleshooting Matrix

11. Operational Notes and Field-Proven Caveats

• Single source of truth for users. WebUX delegates authentication to the WinCC user administrator. Centralize user and group management in the WinCC project, not in a parallel identity store, to keep operator permissions consistent between the WinCC client and the browser.
• Publish on every project change. Screens that are edited in the WinCC project are not visible in the WebUX client until the WebUX Configurator is re-run. Add a publish step to the engineering change-management procedure.
• Concurrent client licensing is enforced. The WebUX license model is concurrent, not per seat. Plan the client count from the maximum simultaneous WebUX sessions, not the number of named operators.
• HTTPS is the production transport. Browsers (and most mobile platforms) deprecate clear-text HTTP for new features. Deploy the WebUX site with a valid certificate from the start; retrofitting HTTPS after the fact costs more than planning it in.
• Distinguish the v7.3 WebUX from the TIA Portal WebUX. The two products share the WebUX brand and the HTML5 client model, but the configuration path, the option key, and the licensing mechanism are different. The TIA Portal counterpart is documented in WebUX - Overview (RT Professional) - WinCC.
• ActiveX-only faceplates are not portable. If the WinCC project contains faceplates built on ActiveX controls, they do not render in HTML5 browsers. Audit the project for ActiveX usage before promising a WebUX rollout to a client that relies on those faceplates.
• WebUX and WebNavigator can coexist. A WinCC v7.3 system can run both the legacy WebNavigator (ActiveX) and the new WebUX (HTML5) on the same WinCC server. Each has its own IIS site and its own license; they do not interfere with each other beyond the standard WinCC runtime load.

12. Reference Documents

• WinCC/WebUX manual entry — Siemens Industry Online Support
• Manuals, examples, and engineering notes for WinCC/WebUX and WinCC/WebNavigator
• WebUX - Overview (RT Professional) - WinCC (TIA Portal V20)

FAQ