Resolving WinCC WebUX Monitoring-Only Popup During Auto-Login

Problem Summary

The Siemens SIMATIC WinCC WebUX client (the HTML5-based runtime web client) displays a modal dialog captioned "You are logged in with monitoring only" (localized: "Sie sind nur mit Monitorrechten angemeldet" in German, "Vous êtes connecté en mode surveillance uniquement" in French) every time the WebUX session is started under an account whose only authorization is the WinCC operator-level right Web Access - Monitoring only. In a typical plant-screen application the WebUX page is configured for Auto Logon: the browser navigates directly to the runtime page, the WinCC WebUX server authenticates the configured user silently, and the runtime opens in read-only mode. The monitoring-only system message box is shown immediately after the runtime view has loaded, and it is the only interactive element on the page until it is dismissed. In a control-room setting where the WebUX screen is intended to be a self-healing, hands-off status display, the requirement to manually click the dialog's OK button is unacceptable.

This article documents the exact root cause of the message, the configuration steps that are available in Siemens Industry Online Support (SIOS)-referenced WinCC V8 to suppress the dialog natively, the workarounds that must be applied when running WinCC V7.5 SP2 (where the option does not exist in the WebUX Configurator), and the field-proven verification procedure to confirm the fix is durable across WebUX server restarts, network reconnections, and client-browser re-launches. The discussion applies to the on-premise WinCC V7 and V8 product lines; the SIMATIC WinCC Unified PC Runtime and the TIA Portal WinCC Unified use a different web client (the Unified Comfort Panel web server) and are not in scope of this article.

Root Cause and Authorization Model

The dialog is generated by the WebUX front-end runtime when the following three conditions are simultaneously true on the new WebUX session:

1. The WebUX Configurator entry Auto logon is enabled and points to a specific WinCC user account.
2. The referenced WinCC user account has the operator-level right Web Access - Monitoring only granted, but no higher authorization such as Web Access - Operator, Web Access - Administrator, or any process-related authorization (acknowledgement, operator-input, switching, etc.).
3. The WinCC project property Display system dialogs in the WebUX client settings is set to the default value (active).

The dialog is the WebUX equivalent of the WinCC Operator Station message that appears on a WinCC client when a user without operator rights signs in. It is a security-relevant notification, intentionally displayed, and is not a bug: the system must inform the operator that the active user cannot acknowledge alarms, write tags, or perform any write action against the automation. In a normal operator workstation the user simply dismisses the message with OK; in a non-interactive plant-screen display the dismissal cannot occur without automation, hence the requirement to suppress the dialog at the source.

The WinCC operator-rights model used by WebUX is layered as follows. Every WinCC user has a numeric authorization set. The two operator-level rights relevant to WebUX are Web Access - Monitoring only (numeric value 1002 by default; the exact number is project-specific and is defined in the WinCC project's Authorization list) and Web Access - Operator (numeric value 1003 by default). The WebUX server checks the granted set on every authentication request; if the user has only 1002, the runtime queues the message box into the WebSocket push channel to the browser, and the client renders the modal on the next animation frame. The dialog's OK button triggers an internal HMIRuntime.SystemMessage.Confirm() call that simply marks the message as acknowledged; no further action is taken.

Affected Versions and Components

The behavior and the available remediation differ between WinCC V7 (classic) and WinCC V8 (Unified). The table below summarizes the matrix of interest. Component versions can be confirmed via WinCC Explorer > Help > About on the server, or via the file properties of CCWebUxService.exe in %ProgramFiles(x86)%\Siemens\Automation\WinCC\WebUX\bin\.

For mixed-version environments (e.g. a V8 WebUX server with V7.5 SP2 clients via the legacy Web Navigator) only the V7.5 SP2 behavior applies to the WebUX connection; the V8 native fix does not propagate. Plan a homogeneous upgrade for any environment where the auto-logon dialog suppression is required.

WinCC V8 Native Configuration to Eliminate the Popup

WinCC V8 (and the V8.1 maintenance release) introduce an explicit drop-down inside the WebUX Configurator that allows the engineer to choose the authorization level that the auto-logon user is granted. This is the recommended remediation path for any new project or any project that can be upgraded. Proceed as follows:

1. Open the WebUX Configurator from the Windows start menu on the WinCC server: Start > Siemens Automation > SIMATIC > WinCC > WebUX Configurator. Remote configuration of the WebUX Configurator is supported on V8.1 and later via the WinCC remote configuration interface; on V8.0 the configuration must be performed on the server's console session.
2. Select the project of interest in the project tree; the right pane shows the runtime configuration.
3. Enable the option Auto logon.
4. In the User name field, enter the WinCC user that the WebUX client should use.
5. In the Password field, enter the password; it is stored encrypted in the project database (CCWebUX.cfg) using WinCC-internal AES-128.
6. Open the new drop-down Authorization for auto logon (label may be localized: Autorisierung für Auto-Logon in German, Autorisation pour l'auto-connexion in French). The available values are:
   • Monitor — equivalent to Web Access - Monitoring only (this is the legacy default and triggers the popup)
   • Operator — equivalent to Web Access - Operator; suppresses the dialog because the runtime sees the user as a full operator
7. Select Operator.
8. Click Apply, then OK. The WebUX service (CCWebUxService) is restarted automatically by the configurator.
9. Open the WebUX URL in a browser and verify that no system dialog appears.

For projects that are strictly read-only and where granting Operator is rejected by the process-control administrator, WinCC V8 still offers a second option: a project-property flag that suppresses the system-dialog class. Navigate to WinCC Explorer > Computer > Properties > WebUX and clear the check box Display system dialogs on monitoring-only sessions. This flag is persisted in CCWebUX-Ini in the project directory and is honored by the V8 WebUX runtime.

Both settings can also be applied to a project that is opened in read-only mode for inspection, which simplifies auditing: open the project in the WinCC Explorer, navigate to the WebUX properties, and inspect the current value. The setting is also visible in the project export under Project Documentation > WebUX Configuration.

WinCC V7.5 SP2 Configuration Path

In WinCC V7.5 SP2 the WebUX Configurator exposes the auto-logon user and password, but the authorization drop-down shown in V8 is not present. The auto-logon user is always assigned the lowest web authorization, i.e. Web Access - Monitoring only. The relevant fields in the configurator are listed below. The configurator itself is installed to %ProgramFiles(x86)%\Siemens\Automation\WinCC\WebUX\WebUXConfigurator.exe.

Because the authorization level cannot be raised inside the configurator, the only paths to suppress the dialog in V7.5 SP2 are the workarounds documented in the following sections. Engineers should weigh the cost of upgrading to V8 (license migration, project re-validation) against the cost of deploying and maintaining a client-side suppression script or a reverse-proxy injection (no licensing cost but ongoing maintenance).

Workaround 1: Grant Operator Rights to the Auto-Login User (V7.5 SP2)

The least invasive workaround in V7.5 SP2 is to grant the auto-logon user the Web Access - Operator right in the WinCC User Administrator, even though the runtime was intended to treat the user as a monitoring-only user. The runtime only displays the popup if it sees the user in the Monitoring only tier; once the user has any operator-tier right, the dialog is suppressed.

1. Open WinCC Explorer > User Administrator on the WinCC server.
2. Create or select the user used for WebUX auto-logon (e.g. plntscr).
3. In the Authorizations tab, grant Web Access - Operator (numeric value: 1003 by default; the exact number is project-specific and can be read from the project's Authorization list). Do not tick the Monitoring only box; the Operator right subsumes it.
4. Do not grant any of the process-control authorizations (numeric values typically in the range 2000-2999) such as Process controlling, Higher process controlling, or System monitoring.
5. Compile the User Administrator changes and restart the WinCC runtime.

Workaround 2: Browser-Side Script Suppression

The dialog is a DOM element rendered by the WebUX front-end. By injecting a small JavaScript snippet into the WebUX page (or by serving a wrapper HTML page that hosts the WebUX inside an <iframe>) the popup can be detected and dismissed on load. The snippet below can be used as a starting point.

Variant A: Standalone HTML wrapper deployed on the client

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Plant Status Screen</title>
  <style>
    html, body, iframe { margin: 0; padding: 0; width: 100%; height: 100%; border: 0; }
  </style>
</head>
<body>
  <iframe id="webux" src="http://<server>:8088/WebUX/?autologin=1"></iframe>
  <script>
    // The WebUX page is loaded inside the iframe. We poll its DOM for the
    // monitoring-only message box and click its OK button.
    function dismissMonitoringPopup(frame) {
      try {
        var doc = frame.contentDocument || frame.contentWindow.document;
        if (!doc) return false;
        var nodes = doc.querySelectorAll('div, span, p, button');
        for (var i = 0; i < nodes.length; i++) {
          var n = nodes[i];
          var t = (n.textContent || '').toLowerCase();
          if (t.indexOf('monitoring only') !== -1 ||
              t.indexOf('nur mit monitorrechten') !== -1 ||
              t.indexOf('surveillance uniquement') !== -1) {
            // Walk up to the modal container and click OK
            var modal = n.closest('.wincc-msgbox, .modal, [role="alertdialog"]') || n;
            var btn = modal.querySelector('button, input[type="button"], .ok, .confirm');
            if (btn) { btn.click(); return true; }
            else { modal.style.display = 'none'; return true; }
          }
        }
      } catch (e) { /* cross-origin: ignore until same-origin applies */ }
      return false;
    }
    setInterval(function () {
      var f = document.getElementById('webux');
      if (f) dismissMonitoringPopup(f);
    }, 500);
  </script>
</body>
</html>

Variant B: Tampermonkey / Userscript for environments where modifying the WebUX page is not acceptable. The same logic, attached to the WebUX URL pattern, achieves the same effect without an iframe and without a wrapper page.

// ==UserScript==
// @name         WinCC WebUX - dismiss monitoring-only popup
// @namespace    plant.local
// @version      1.0
// @match        http://<server>:8088/WebUX/*
// @match        https://<server>:8443/WebUX/*
// @grant        none
// @run-at       document-idle
// ==/UserScript==
(function () {
  'use strict';
  function dismiss() {
    var all = document.querySelectorAll('div, span, p, button');
    for (var i = 0; i < all.length; i++) {
      var t = (all[i].textContent || '').toLowerCase();
      if (t.indexOf('monitoring only') !== -1 ||
          t.indexOf('nur mit monitorrechten') !== -1) {
        var modal = all[i].closest('.wincc-msgbox, .modal, [role="alertdialog"]') || all[i];
        var btn = modal.querySelector('button, input[type="button"], .ok, .confirm');
        if (btn) btn.click(); else modal.style.display = 'none';
        break;
      }
    }
  }
  setInterval(dismiss, 500);
})();

Variant C: PowerShell auto-dismiss fallback (Windows only) for legacy plant-screen PCs that cannot run a userscript. A small PowerShell script launched at logon polls the WebUX window for the popup and sends an Enter key when the dialog is detected:

# WinCCWebUxAutoDismiss.ps1
# Run as a scheduled task at user logon, trigger: At log on of <plant-screen-user>
Add-Type -AssemblyName System.Windows.Forms
$wsh = New-Object -ComObject WScript.Shell
$procName = "msedge"
$pollMs = 500
while ($true) {
  Start-Sleep -Milliseconds $pollMs
  $procs = Get-Process -Name $procName -ErrorAction SilentlyContinue
  foreach ($p in $procs) {
    $title = $p.MainWindowTitle
    if ($title -match "monitoring only|Monitorrechten") {
      $wsh.AppActivate($p.Id) | Out-Null
      $wsh.SendKeys("{ENTER}")
      break
    }
  }
}

Workaround 3: Server-Side Script Injection via Reverse Proxy

For installations that already run an IIS reverse proxy in front of WebUX, the cleanest deployment is to extend the proxy's URL rewrite to inject the suppression script as a response transformation. On Microsoft IIS with the URL Rewrite and Application Request Routing modules, the following web.config snippet serves the WebUX content from a virtual directory /WebUXNoPopup with a small inline script appended to every HTML response:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Inject popup dismiss" enabled="true">
          <match url="^WebUXNoPopup/(.*)$" />
          <action type="Rewrite" url="WebUX/{R:1}" />
        </rule>
      </rules>
    </rewrite>
    <outboundRules>
      <rule name="Append dismiss script" preCondition="IsHtml" enabled="true">
        <match filterByTags="None" pattern="</body>" />
        <action type="Rewrite" value="
<script>
  setInterval(function(){
    document.querySelectorAll('div,span,p,button').forEach(function(n){
      var t=(n.textContent||'').toLowerCase();
      if(t.indexOf('monitoring only')!==-1){
        var m=n.closest('.modal,[role=alertdialog]')||n;
        var b=m.querySelector('button'); if(b) b.click(); else m.style.display='none';
      }
    });
  },500);
</script>
</body>" />
        <preConditions>
          <preCondition name="IsHtml">
            <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
          </preCondition>
        </preConditions>
      </rule>
    </outboundRules>
  </system.webServer>
</configuration>

The downside of Variant 3 is that the injected script runs in the same origin as the WebUX page, which means the suppression is robust against cross-origin restrictions but it is also a non-trivial change to the IT infrastructure and must be coordinated with the server team and the firewall rules. The benefit is that the suppression is centrally deployed: every WebUX client connecting through the reverse proxy benefits, including mobile clients, multiple plant-screen PCs, and remote maintenance laptops.

An alternative to IIS is the open-source NGINX reverse proxy with the sub_filter module. The relevant configuration fragment is:

location /WebUXNoPopup/ {
    sub_filter '</body>' '<script>setInterval(function(){document.querySelectorAll("div,span,p,button").forEach(function(n){var t=(n.textContent||"").toLowerCase();if(t.indexOf("monitoring only")!==-1){var m=n.closest(".modal,[role=alertdialog]")||n;var b=m.querySelector("button");if(b)b.click();else m.style.display="none";}});},500);</script></body>';
    sub_filter_once off;
    sub_filter_types text/html;
    proxy_pass http://wincc-server:8088/WebUX/;
}

Workaround 4: Kiosk-Mode Browser Configuration

If the plant-screen client is a dedicated PC running Microsoft Edge in Assigned Access (kiosk) mode or Google Chrome in Kiosk mode, the page is launched in a single-tab environment with no possibility for the operator to interact. In this configuration the browser can be launched with the additional argument --autoplay-policy=no-user-gesture-required and the WinCC WebUX page can be preconfigured to inject the userscript at startup. The msedge.exe --kiosk http://server/WebUX/ --edge-kiosk-type=public-browsing launch line combined with a Microsoft Edge EdgeKioskMode ADMX policy achieves the same effect. The popup is generated client-side, so a userscript is still required; the kiosk configuration only guarantees that the page is the only thing the browser can display.

For Windows 10/11 IoT Enterprise on the plant-screen PC, the recommended configuration is to set the assigned-access profile to enforce the kiosk launch on every boot. The exact UserAccounts value is XML-generated by the Windows Set up a kiosk wizard. Document the chosen URL (http://<server>/WebUX/ or http://<server>/WebUXNoPopup/ if the reverse-proxy injection is in use) in the assigned-access configuration XML so that the kiosk always opens on the same page even after a Windows update resets the assigned-access profile.

Verification Procedure and Log Reference

After applying any of the above remediations, perform the following verification sequence to confirm the dialog is suppressed under all relevant failure conditions. Each step should be signed off in the change-management ticket before the plant screen is signed back to operations.

1. Open the WebUX URL in a fresh browser session and confirm that the plant screen loads without any modal dialog. The first paint of the runtime should occur within 2-3 seconds of the browser receiving the WebUX HTML.
2. Open WinCC Explorer > Tools > System Diagnosis > WebUX Log on the server and confirm that the log shows a successful login for the auto-logon user with the expected authorization level. Log entries of interest are:
   • WebUX: Auto logon user 'plntscr' authenticated, level=Operator (for V8 with Operator selected or V7.5 SP2 with operator right granted)
   • WebUX: Auto logon user 'plntscr' authenticated, level=Monitor (for V8 with Monitor selected, popup will still appear)
   • WebUX: System message 0x8001 suppressed by configuration (only on V8 with the Display system dialogs flag cleared)
3. Restart the WebUX service from an elevated command prompt: net stop "CCWebUxService" && net start "CCWebUxService". Confirm that the browser's auto-reconnect logic re-authenticates silently without the popup. The re-authentication should complete within 5 seconds on a gigabit LAN.
4. Disconnect the client PC from the network for at least 30 seconds (use ipconfig /release + Disable-NetAdapter -Name "Ethernet" -Confirm:$false on Windows, or pull the patch cable), then reconnect. The WebUX client will drop the WebSocket, attempt to re-establish it, and (if the auto-logon re-authentication is enabled) re-authenticate the user. Confirm that no popup appears on reconnection.
5. If a userscript or wrapper script is in use, open the browser's developer tools (F12), navigate to the Console tab, and confirm that the suppression interval is firing (no exception is thrown) and that the DOM no longer contains a visible modal after page load. Use document.querySelectorAll('.modal, [role=alertdialog]') in the console to inspect the modal elements.
6. From a different user account that still has monitoring-only rights, log in manually to the WebUX URL with the syntax http://server/WebUX/?user=readonly and confirm that the popup still appears for that account; this validates that the suppression is targeted at the plant-screen user only and does not weaken the security for the rest of the user base.
7. Stress-test the WebSocket by opening and closing the WebUX page in five consecutive browser tabs within 30 seconds. The WebUX server should not leak memory, the log should show five clean sessions, and the dialog should not appear on any of the tabs after the first suppression cycle.

Edge Cases and Field-Reporting Issues

Best Practices and Hardening

• Document the auto-logon user in the project Functional-Safety Plan and explicitly state that the user is intended for read-only plant status displays. Reference the workarounds used to suppress the dialog in the plan, including the exact authorization numeric values granted in the WinCC User Administrator.
• If the plant screen is part of a 24/7 control room, schedule a quarterly test that the WebUX re-authentication still works after a controlled service restart. The verification procedure in this article is suitable for that test; record the result in the plant's Cyber-Security Operations Log.
• Avoid mixing auto-logon users and interactive users in the same WinCC user database. A dedicated plntscr-style user for the plant screen simplifies auditing and avoids accidental rights escalation. Disable interactive logon for the plntscr user on the WinCC server's console session by clearing the Allow logon locally right in the local security policy.
• Whenever the WebUX server is moved to a new host or a new certificate is installed, retest the suppression script. TLS termination changes frequently break origin alignment and the userscript or wrapper may silently stop working.
• When migrating from V7.5 SP2 to V8, prefer the native Authorization for auto logon drop-down over the legacy client-side workarounds. The native setting is server-side, applies to every client, and is auditable from the WinCC project.
• If a reverse-proxy injection is in use, monitor the proxy's response-time metric. A 1-3% increase in mean response time is expected because of the sub_filter pass; an increase above 5% indicates that the filter pattern is too greedy and may be matching non-HTML content.
• For the WinCC V7.5 SP2 to V8 migration, perform the upgrade in a test environment first and confirm that the V8 native fix is honored by every WebUX client variant in the fleet (kiosk PC, control-room operator PC, mobile tablet). Different client builds may cache the old WebUX HTML and re-trigger the dialog for a short time after the upgrade.

FAQ