Disabling SIMATIC Logon on TP1200 Comfort HMI Panels

Problem Overview

Operators commissioning a SIMATIC TP1200 Comfort panel (12.1" widescreen HMI from the Comfort Panels product line) sometimes observe an 8-10 second delay before the local login dialog accepts credentials. The delay is most visible when the panel is connected to an Ethernet network for remote access (VNC viewer, Sm@rtServer, TIA Portal HMI transfer), but the project only uses the local user administration (HMI users, HMI passwords). The configured runtime still has the Enable SIMATIC Logon option checked in the TIA Portal project, so at every startup - and whenever the panel is reachable on the network - the WinCC Runtime service attempts to contact a SIMATIC Logon server, cannot resolve it, and only then falls back to the local user administration.

The visible symptom is therefore a "slow" login that is, in fact, a network-discovery timeout against a server that does not exist on this machine. Once the timeout elapses, the local user list is queried and the operator can authenticate normally. From an operations standpoint the issue is purely a misconfiguration, but the cure requires access to the original TIA Portal project so that the runtime settings can be recompiled and reloaded. The sections below cover root-cause verification, the supported fix path inside TIA Portal, and field-proven workarounds when the project is not available.

Symptoms and Reproduction

The behavior is reproducible on a panel that was originally configured with SIMATIC Logon enabled but is later deployed without a Logon server reachable on the network. The typical reproduction steps are:

1. Power-cycle the TP1200 Comfort or perform a controlled HMI restart.
2. Wait for the WinCC Runtime to start. The panel boots to the configured start screen.
3. Trigger a logout or a screen change that requires re-authentication.
4. Enter credentials in the local login dialog.

If SIMATIC Logon is enabled but unreachable, the login dialog pauses for roughly 8-10 seconds before the input is processed and access is granted. Operators have reported the same behavior when a VNC client is connected via Ethernet, because the network interface then becomes available for the Logon discovery broadcast. With no Ethernet cable attached the discovery fails faster and the delay may be less noticeable. The table below summarizes the symptoms.

The diagnostic buffer entry ("Searching for SIMATIC Logon server") is the most reliable indicator that the Logon service is enabled and active. It can be viewed on the panel under Start > Settings > Control Panel > System > Diagnostics Buffer or remotely via Sm@rtServer / VNC.

Root Cause: SIMATIC Logon Service Behavior

SIMATIC Logon is a separately licensed Siemens product that implements centralized user administration for SIMATIC HMI panels and WinCC stations. It is built on top of Windows domain or Windows workgroup authentication and requires a Logon server (Logon.RFCServer) running on a Windows host in the network. When the TIA Portal project has the Enable SIMATIC Logon checkbox activated under Runtime settings > User administration, the WinCC Runtime on the panel registers itself as a SIMATIC Logon client at startup. The client then attempts to contact the configured Logon server using the name/address specified in the project.

If the panel boots before the network is available, the client retries the connection. If the network is available but no server is reachable, the client waits for the configured timeout (typically aligned to the Windows domain-controller query timeout, observable as ~8-10 s on TCP-level name-resolution failure). Only after the timeout does the Runtime fall back to the locally configured HMI user list. That fallback is what produces the perceived "slow local login." The state diagram below illustrates the login decision path inside the WinCC Runtime when SIMATIC Logon is enabled.

The key insight is that SIMATIC Logon is not an "and/or" with the local user list. When the option is enabled, the Logon client has priority; the local list is a fallback after timeout. Leaving it enabled in a plant that does not run a Logon server therefore buys nothing and costs 8-10 s of operator waiting time per login.

The relevant documentation entry is the TIA Portal V20 help page "Logging on using SIMATIC Logon (Panels, Comfort Panels, RT Advanced, RT Professional)". The same path applies to TIA Portal V17, V18, and V19 with minor wording changes.

Diagnostic Verification

Before opening the project, confirm that SIMATIC Logon is the cause using a non-invasive procedure on the running panel. This is especially useful when the project file is not available.

1. Diagnostic buffer check - On the panel, navigate to Start > Settings > Control Panel > System > Diagnostics Buffer (this requires admin/operator access on the panel itself; some sites disable the Control Panel). Look for entries containing "SIMATIC Logon" or "Logon server not found".
2. Network isolation test - Disconnect the Ethernet cable, perform a controlled restart, and re-test the login time. If the login is immediate without Ethernet, the Logon client is the cause. Reconnect the cable and confirm the 8-10 s delay returns.
3. Process inspection via VNC - From a VNC session, open Start > Task Manager > Processes (on Windows CE: Task Manager). The process slclient.exe (SIMATIC Logon client) should be listed and consuming a small amount of CPU during the timeout window. Its presence on a panel that has no Logon server is the smoking gun.
4. Cross-check with project source - If the TIA Portal project is available, open it in TIA Portal, select the HMI device, and inspect Runtime settings > User administration > SIMATIC Logon. The "Enable SIMATIC Logon" checkbox state confirms the runtime configuration.

Permanent Solution: TIA Portal Configuration

The supported fix is to disable SIMATIC Logon in the TIA Portal project, recompile, and transfer the new runtime to the panel. The procedure is identical for TP1200 Comfort and for any other Comfort Panel in the family.

1. Open the TIA Portal project containing the TP1200 Comfort configuration.
2. In the project tree, select the HMI device (e.g., HMI_1 [TP1200 Comfort]).
3. Open Runtime settings (right-click > Runtime settings, or via the project navigation under the HMI).
4. In the Runtime settings editor, expand the User administration section.
5. Locate the SIMATIC Logon group. The checkbox Enable SIMATIC Logon is the master switch.
6. Clear the checkbox. The dependent controls (Windows domain / Windows computer, server name, etc.) become greyed out.
7. Confirm the local user list is still populated. If the project previously relied on a domain account, ensure the equivalent local user has been added under Users and roles before the transfer.
8. Save and compile the project (TIA Portal: Project > Compile > Software (rebuild all)).
9. Transfer the project to the panel using one of:
   • Online > Download to device (TIA Portal) over Ethernet / PROFINET
   • ProSave with a backup/restore workflow
   • SIMATIC Automation Tool for multi-panel bulk transfer
10. After the transfer, the panel reboots. The new runtime starts with SIMATIC Logon disabled, and local logins are immediate.

The official documentation for the runtime configuration options is the TIA Portal help page linked above. The TIA Portal help also lists the differences between Windows domain mode (uses Active Directory, requires a domain controller) and Windows computer mode (uses a local SAM database on a Windows host, no domain required). For a TP1200 Comfort that previously only used local users, both modes produce the same 8-10 s delay if the server is unreachable.

SIMATIC Logon Runtime Settings Reference

The table below lists the configuration options visible in Runtime settings > User administration > SIMATIC Logon and the impact of each on a TP1200 Comfort. Settings marked "n/a" are greyed out when the master switch is off.

Because the option to tune the timeout is not exposed in older TIA Portal versions and is rarely adjusted, the practical fix is to clear the master switch rather than try to shorten the timeout. The typical TIA Portal V17-V20 dialog also exposes a field for the Logon server port (default 1433 / RFC), which only matters when the master switch is on.

Workarounds When Project Is Unavailable

When the original TIA Portal project cannot be obtained, the supported workarounds are limited. The runtime settings are compiled into the HMI image and cannot be edited on the panel itself. The options, in order of preference, are:

1. Request the project from the system integrator or end customer. The .apXX (TIA Portal V20) or .zapXX (TIA Portal V13-V19) project archive is the authoritative source. Once it is available, follow the procedure in the previous section.
2. Restore a panel backup that pre-dates the Logon enablement. If a ProSave or SIMATIC Automation Tool backup exists, restore it to the panel. The backup contains the runtime image. This is the cleanest field workaround but requires a known-good backup and a maintenance window for the restore (typically 5-10 minutes for a TP1200 Comfort).
3. Network isolation during operation. If the Logon service is enabled but the Logon server is not present, leaving the Ethernet cable disconnected (when not actively transferring) eliminates the discovery delay. The trade-off is that Sm@rtServer, VNC, and TIA Portal transfer are unavailable during the offline window. This is acceptable for a panel that uses PROFINET/DP to the PLC, where Ethernet to the Logon server is not required for control.
4. HMI image reset and partial re-configuration via ProSave. A factory reset followed by transfer of any locally available project (even a stripped-down project with the same tags and screens but without Logon) avoids the discovery behavior. This requires at least a minimal project; without any project, the panel is non-operational.
5. Do not attempt to edit the runtime configuration via registry or file editing. The user-administration data is stored inside the TIA Portal-compiled runtime and is not intended for direct modification. Manually changing files on the panel can leave the HMI in an inconsistent state and is not supported.

In a plant with multiple affected panels, opening one project in TIA Portal, removing SIMATIC Logon, and re-transferring is the most efficient path. The same project can serve as the source for ProSave or SIMATIC Automation Tool rollouts to the other panels.

Network and Licensing Requirements

When SIMATIC Logon is intentionally used (i.e., the plant has a Logon server), the following conditions must be met for the TP1200 Comfort to operate without the 8-10 s delay:

If any one of these is not satisfied, the panel will exhibit the slow-login behavior. Removing the Logon configuration (as described in the previous section) eliminates all these requirements and is the correct response for plants that have no central user-administration server.

Verification Procedure

After the project has been recompiled and transferred, verify the fix on the running panel:

1. Confirm the project version on the panel: Start > Settings > Control Panel > System > Device > Version (or in TIA Portal: Online > Accessible devices > [panel] > HMI Version). The transferred project should show a new compile timestamp.
2. Power-cycle the panel. With the Ethernet cable connected, the WinCC Runtime should reach the configured start screen without Logon discovery entries in the diagnostic buffer.
3. Trigger a logout / re-login. The login dialog should accept credentials immediately (sub-second response on TP1200 Comfort hardware).
4. Open the diagnostic buffer and confirm no "SIMATIC Logon" entries are written during the login cycle.
5. If VNC / Sm@rtServer are used, confirm remote login still works through the same path. The fix should not affect these services, which run on the same panel but use a different authentication mechanism.
6. Optional: monitor the panel with Wireshark on the engineering station. With SIMATIC Logon disabled, no SIMATIC Logon RPC traffic should be observed between the panel and any server during startup or login.

Related Configuration Considerations

The SIMATIC Logon setting is one of several user-administration options in TIA Portal. Operators migrating a panel from Logon to local-only administration should also review:

• User administration mode - Under Runtime settings > User administration > Mode, the value "Manage users on the HMI device" is the appropriate mode for local-only operation. "Manage users on the server" is the mode that requires a Logon or LDAP server. If the project was previously set to "Manage users on the server," change it to the local mode at the same time as disabling SIMATIC Logon.
• Number of users / logon attempts - The runtime allows configuring the maximum number of users and the lockout behavior. For panels with a small operator pool, the defaults (typically 50 users, 3 attempts) are usually sufficient.
• Password policy - The password complexity settings (length, character classes, expiration) are configured in the same editor. Local-only deployments should still enforce a policy that meets the plant's cybersecurity standard.
• Audit trail - If the plant requires traceability of operator actions, configure the audit trail to a network share or to the local SD card (TP1200 Comfort supports an SD card slot for storage).
• HMI certificate for HTTPS - The TP1200 Comfort uses self-signed certificates by default. When a Logon server is used, the certificate is part of the secure handshake. Removing the Logon configuration does not require any certificate change.

After these changes, recompile and transfer the project once. No further maintenance is required unless the plant later introduces a centralized user-administration system.

FAQ