Resolving @CurrentUser Tag Prefix in WinCC V7.3 WebNavigator

Problem Statement: WebNavigator Client Returns Server User Instead of Web Client User

In a distributed WinCC V7.3 SP1 Update 15 system configured as a WebNavigator server on a client with its own project, the internal system tag @CurrentUser reports the Windows user logged in to the WebNavigator server (one of two upstream WinCC servers) rather than the user authenticated against the WebNavigator client session in the browser. The symptom is reproducible only when the picture that displays the tag is opened from a picture window or basic picture that has a ServerPrefix and/or TagPrefix property set.

This breaks client-side visualization logic that must display or audit the actual operator interacting with the web session, including:

• Operator name displays in I/O fields, status bars, or faceplates
• User-based authorization checks that branch on @CurrentUser
• Audit trail entries that must record the originating web session
• Custom action logging in C or VBScript that depends on the active user

Reproducing the condition requires the following distributed architecture:

1. A WinCC V7.3 SP1 Update 15 client workstation is configured as a WebNavigator server. WinCC WebNavigator is installed, licensed, and the WebNavigator server service is running on this machine.
2. This client hosts its own project. It is a client with its own project, not a pure WinCC viewer client without local engineering data.
3. Two or more WinCC servers feed the client via Server Data Packages (SDP), providing tags, alarm classes, picture trees, and user archives.
4. From a remote WebNavigator client (browser-based), an operator authenticates to the WebNavigator server and opens a project picture that contains an I/O field, dynamic dialog, or VBScript reading @CurrentUser.

The tag value resolves to the Windows user logged in to whichever upstream WinCC server prefix is bound to the picture window (for example Server01::@CurrentUser), not the user logged in to the web browser session. Tag prefixes and server prefixes are appended automatically by the WinCC runtime because the picture is rendered in the context of the picture window's ServerPrefix.

Root Cause: Server Prefix and Tag Prefix Qualification in Multi-User Systems

WinCC V7.3 enforces tag name qualification in distributed (multi-user) systems. When a picture window or basic picture is configured with a ServerPrefix and/or TagPrefix property, every tag reference inside that picture is rewritten at runtime to the form <TagPrefix>::<ServerPrefix>::<TagName>. This qualification is required so that identical tag names defined in different servers do not collide when a single picture is opened from multiple data sources.

The qualification applies to all dynamization types:

• Direct tag connection on object properties
• Dynamic dialog expressions
• C script functions that read tags via GetTag* family
• VBScript that reads tags via the HMIRuntime.Tags(...).Read or HMIRuntime.Tags(...).Write calls

Qualification also applies to internal system tags such as @CurrentUser, @LocalMachineName, @ProjectName, @RedundantServerState, and @RM_SERVER_NAME. For a client with its own project, the picture window is typically configured with a server prefix that points to one of the SDP-fed servers (e.g., Server01 or Server02). When the WebNavigator session opens that picture, the runtime reads @CurrentUser from the prefixed context, which is the upstream server's logged-on user, not the web client user.

Three factors converge to produce the reported symptom:

1. Prefix qualification. The runtime prepends the server prefix before evaluating @CurrentUser, so the tag is read from the upstream server's tag database, not the local client's.
2. WebNavigator session scope. The @CurrentUser system tag in the prefixed context reflects the upstream server's Windows session, not the web browser session authenticated against the WebNavigator server.
3. Picture window scope. The add-ons @NOTP, @NOSP, and @NOP cannot be entered into the TagPrefix or ServerPrefix properties of a picture window or basic picture. They must be used inline in the tag name within the dynamization where the tag is read.

Removing the ServerPrefix from the picture window is generally not viable, because the same window is typically used to display tags from different servers. The correct fix is to override the prefix inline at the point of use, not to change the window's configuration. Changing the window configuration would also break the SDP-sourced tags that legitimately need the prefix.

Solution: Tag Add-Ons @NOTP, @NOSP, and @NOP

Siemens provides three tag add-ons in WinCC V7.3 that switch off prefix qualification inline. The add-ons are entered as a prefix to the actual tag name, separated by double colons (::), in any dynamization that accepts a tag name string. The add-ons are not visible in the tag selection dialog; they are evaluated by the WinCC runtime when parsing the tag name string.

Add-On Catalog

Tag Name Syntax

The general syntax is:

@NOTP::<TagName>
@NOSP::<TagName>
@NOP::<TagName>

For the reported scenario (WebNavigator client reading its own @CurrentUser in a picture window with both prefixes set), the correct add-on is @NOP. The reference example in the WinCC V7.3 manual uses @NOTP::@CurrentUser in VBScript, which suppresses the tag prefix and resolves the tag in the local client context.

Where the Add-Ons Are Evaluated

The WinCC runtime parses the tag name string at the point of evaluation. If the string starts with one of the add-ons followed by ::, the runtime strips the add-on and reads the remainder of the string without applying the corresponding prefix. The add-on itself is not part of the tag name and is not visible in the tag selection dialog. The behavior is fully supported in WebNavigator and is not affected by the WebNavigator client/server split; the add-on is interpreted on the WebNavigator server, not on the browser.

Environment Prerequisites

Apply the fix only when all of the following preconditions are met:

• WinCC V7.3 SP1 Update 15 (or a compatible V7.3 SP1 update level) installed on the WebNavigator server and on the client with its own project
• WinCC WebNavigator installed on the client with its own project, with the WebNavigator server service running under a dedicated Windows user
• At least one WinCC server connected to the client with its own project via a Server Data Package (SDP), with the SDP downloaded and activated on the client
• The picture window or basic picture that displays the tag is configured with a ServerPrefix and/or TagPrefix property (otherwise the add-on is a no-op and the unprefixed @CurrentUser already returns the local user)

Do not use the @NOP or @NOSP add-on in a standard server configuration (one server, multiple clients without their own project). In a standard server setup, server prefix switching off is not meaningful and is not permitted by the runtime; the add-on is ignored or rejected, depending on the update level.

Step-by-Step Implementation

Step 1 — Identify the Prefix Configuration of the Affected Picture

1. Open Graphics Designer on the client with its own project.
2. Select the picture window that opens the project picture (e.g., the main work area window or the master picture used for navigation).
3. Open the Properties dialog and inspect the ServerPrefix and TagPrefix properties under the "Miscellaneous" or "Picture" attribute group.
4. Note whether each property is empty, contains a server name (e.g., Server01), or contains a tag prefix (e.g., Tag1_).

Step 2 — Choose the Correct Add-On

Step 3 — Configure the I/O Field or Output Object

1. Open the project picture that contains the I/O field bound to @CurrentUser.
2. Select the I/O field and open its Properties dialog.
3. On the Output / Input configuration, set the tag name field to the add-on-qualified string, e.g., @NOTP::@CurrentUser or @NOP::@CurrentUser.
4. Confirm and close the dialog. The tag selection dialog in Graphics Designer may not show @CurrentUser when the add-on is prepended; this is expected behavior. Type the string manually in the tag name field.

Step 4 — Configure VBScript Access (if used)

Replace any direct HMIRuntime.Tags("@CurrentUser") call with the add-on-qualified form:

Dim objTag
Set objTag = HMIRuntime.Tags("@NOTP::@CurrentUser")
objTag.Read
HMIRuntime.Trace "CurrentUser = " & objTag.Value & vbNewLine

The add-on can also be passed to Write for tag writes that should target the local client context rather than the prefixed server context:

Step 5 — Compile, Publish, Deploy, and Activate

1. In Graphics Designer, compile the picture and save the project.
2. Re-run the Web View Publisher (WinCC WebNavigator > Web View Publisher) on the WebNavigator server to regenerate the web-ready picture files.
3. Re-download the Server Data Package to the client with its own project if any tag definition changed.
4. Activate the WinCC runtime on the client with its own project.
5. From a remote browser, open the WebNavigator URL (typically http://<WebNavServer>/WebNavigator/), log in with the operator credentials, and open the affected picture.

VBScript Reference: Reading @CurrentUser with @NOTP

The following VBScript snippet is the official example from the WinCC V7.3 "Working with WinCC" manual, section "Requesting tags without prefix", page 1012 (Siemens support entry ID 102754925). It reads the local @CurrentUser system tag without applying the tag prefix and traces the result to a diagnostics window.

' VBS311 - Read @CurrentUser without tag prefix
Dim tag
tag = HMIRuntime.Tags("@NOTP::@CurrentUser").Read
HMIRuntime.Trace "CurrentUser: " & tag & vbNewLine

Behavior notes:

• HMIRuntime.Tags(...) returns a Tag object; calling Read on the object returns the current value as a Variant. The variant is a string for @CurrentUser.
• If the picture has both a tag prefix and a server prefix set, use @NOP::@CurrentUser instead of @NOTP::@CurrentUser to suppress both.
• To write to a local tag (not a server-qualified tag) from a picture window with a server prefix, apply the same add-on to the tag name passed to Write.
• Tracing to HMIRuntime.Trace requires the GDI diagnostics window or the WinCC DiagTool to be open on the WebNavigator server. In production, route the value to an internal log tag or to a CSV file instead of relying on the trace output.
• For asynchronous access, use the Read method with a callback or the WaitTime property; the Tag object supports both sync and async read patterns via Read with optional parameters.

HMIRuntime.Tag API Quick Reference

Tag Add-On Reference Table

Constraints and Limitations

• Add-ons apply to tags only. The add-ons affect tag name resolution; they do not affect picture name resolution, archive name resolution, or alarm class resolution. Picture windows, user archives, and message classes must still be qualified with their respective prefixes if needed.
• Standard server not supported. On a standard multi-user server (no client project), @NOP and @NOSP are not evaluated; the runtime ignores them or rejects the configuration, depending on the update level. Use @NOTP only when only the tag prefix needs to be suppressed in a standard server.
• No effect outside tag references. Add-ons work only where a tag name string is interpreted. They do not affect direct mouse / keyboard event scripts that do not reference a tag, and they do not affect OpenPicture calls or ActivateScreen calls.
• Case sensitivity. The add-on tokens must be entered in upper case (@NOTP, not @notp) with the leading at sign. The runtime is case-sensitive on these tokens; lower-case entries are not recognized and may produce a tag-not-found error.
• Deployment requirement. After modifying a picture that uses an add-on, the WebNavigator publisher must regenerate the web-ready picture files on the WebNavigator server. Cached client browsers may otherwise continue to use the previous web picture; clear the browser cache or use Ctrl+F5 to force a refresh.
• No nesting. The add-ons cannot be chained (e.g., @NOTP::@NOSP::@CurrentUser is invalid). To disable both prefixes, use @NOP.
• Tag selection dialog. The add-ons are not visible in the WinCC tag selection dialog. Operators and engineers must type the qualified string manually in the tag name field; copy-paste from the documentation is the typical workflow.
• User archive and alarm routing unaffected. The add-ons are tag-resolution directives. They do not change which user archive or which alarm line the runtime writes to; those are controlled by their own configuration objects (user archive configuration, alarm routing).

Common Mistakes and Edge Cases

Verification and Diagnostic Checks

1. Visual check. From a remote browser, log in to the WebNavigator session and open the picture containing the I/O field. The displayed user name must match the Windows user logged in to the browser session, not the Windows user logged in to the upstream WinCC server.
2. Trace check. On the WebNavigator server, open the GDI diagnostics window (WinCC > Tools > Diagnostics) or the WinCC DiagTool. The trace line CurrentUser: <DOMAIN\USER> must show the web client user (or, more precisely, the user under which the WebNavigator server service is running, if the add-on resolves to the local machine).
3. Tag inspector. Use the WinCC "Tag Simulator" or "Tag Force" tool in WinCC Explorer to confirm the value of @CurrentUser on the client with its own project. It must reflect the Windows session of the WebNavigator server process, not the upstream server.
4. Cross-check without add-on. Temporarily revert the add-on in a copy of the picture. The I/O field must again display the upstream server's user. Restore the add-on to confirm the behavior is prefix-driven.
5. Cross-server check. Repeat steps 1–4 with a picture window whose ServerPrefix is set to the second server (e.g., Server02). The behavior must be identical regardless of which server prefix is bound to the window.
6. Process tag audit. Add a process tag of type string (e.g., AuditCurrentUser) in the local client project. In a VBScript triggered on picture open, write the resolved @NOP::@CurrentUser value to this tag. Verify in the tag logger or in Tag Simulator that the value matches the expected local user.

Server Data Package Integration and Per-User Identification

In a WinCC V7.3 distributed system, Server Data Packages (SDP) replicate selected tags, picture trees, message classes, and user archives from the server to the client with its own project. The @CurrentUser system tag is not replicated through SDP — it is a local runtime tag on each machine — but the picture windows that bind to SDP-sourced tags are configured with the originating server's prefix. The prefix is what causes the runtime to query the wrong machine for the system tag.

When a tag add-on is used to suppress the prefix, the runtime reads the system tag on the local client machine, which is the WebNavigator server in this configuration. The @CurrentUser on the WebNavigator server reflects the Windows user under which the WinCC WebNavigator server service is running, not the individual web client user. The @NOTP add-on suppresses prefix qualification; it does not change the source of the @CurrentUser system tag.

Recommended Per-User Identification Pattern

1. Define a local process tag of type string, e.g., WebClientUserName, in the client with its own project (not in the SDP).
2. In the WebNavigator logon picture, on the OnOpenPicture event, call a VBScript that writes the web client user to this tag using the add-on form: HMIRuntime.Tags("@NOP::WebClientUserName").Write sUser.
3. On the WebNavigator logoff picture and on the OnClosePicture event of the main work area, clear the tag: HMIRuntime.Tags("@NOP::WebClientUserName").Write "".
4. Bind the I/O field that displays the user name to @NOP::WebClientUserName in all project pictures. The add-on ensures the tag is read from the local client context regardless of the picture window's ServerPrefix.

WinCC V7.3 vs. TIA Portal RT Professional

The @NOTP, @NOSP, and @NOP tag add-ons are a feature of the classic WinCC V7.x line (and predecessor versions V6.x / V7.0 / V7.2). They are evaluated by the WinCC V7.3 runtime and are documented in the "Working with WinCC" manual for V7.3, available at Siemens support entry ID 102754925.

In WinCC Professional and WinCC RT Professional (TIA Portal V13 and later, including V20), the architecture of distributed systems is fundamentally different. WebNavigator RT Professional is configured per server, and the server hosts the web service directly; there is no "client with its own project" pattern equivalent in the same form. The web client connects to a specific WinCC RT Professional server and renders that server's HMI tags. For the V20 architecture, see the official Siemens documentation at Web Navigator Server on the WinCC Server (RT Professional).

If the project is migrated from WinCC V7.3 to TIA Portal V20, the tag-prefix problem is not portable directly. The migration tool does not translate @NOTP / @NOSP / @NOP references; they must be reviewed and replaced with the equivalent TIA Portal mechanism (typically a local HMI tag on the Unified PC, or a server-local HMI tag on the RT Professional station). Plan a dedicated review pass during migration to catch all add-on usages in tag references, dynamic dialogs, and VBScript.

Frequently Asked Questions