WinCC Unified PC Runtime: Disabling the Login Dialog with Automatic Login

On a SIMATIC WinCC Unified PC Runtime station, the runtime browser opens a credential dialog every time the project starts. Operators must select a username, enter a password, and confirm before the operating screen becomes visible. For operator-facing panels such as vision-system program selectors, packaging-line overview screens, or kiosk-style dashboards, this dialog is unacceptable: the screen must be visible immediately, without operator interaction.

This reference documents the exact configuration path to suppress the WinCC Unified PC Runtime login screen by activating Automatic Login in the SIMATIC Runtime Manager, combined with the required user-administration setup in the TIA Portal engineering system. The procedure targets TIA Portal V20 and WinCC Unified V20 Runtime, but the structure applies to V17/V18/V19 with minor path differences.

1. Problem Description

Symptom observed on the desktop PC running SIMATIC WinCC Unified PC Runtime:

• Browser launches the project URL (default https://<localhost-or-ip>/ or https://<host>:443).
• The "User Login" dialog appears immediately, covering the intended start screen.
• No user or password was configured in the TIA Portal project user administration.
• The dialog cannot be dismissed permanently; closing it leaves the start screen blank or returns to it on the next reload.
• Touch panels and operator stations are blocked until credentials are entered.

This is a default behavior of WinCC Unified, not a defect. The runtime enforces user-based authorization for every protected screen, function, and tag operation. When the runtime detects that the current connection is unauthenticated, the login dialog is invoked automatically the first time a protected operation is requested.

2. Root Cause Analysis

The login dialog in WinCC Unified is rendered by the runtime when the active session has no authenticated user. There are three independent triggers:

1. No automatic login is configured. The Runtime Manager > Automatic Login setting is disabled (default) or unset, so the runtime expects an interactive sign-in.
2. No user account exists in the project. The TIA Portal user administration is empty. WinCC Unified requires at least one user to be present in the runtime database to perform any automatic login.
3. The user management was skipped during download. The default download option "Skip user administration when downloading to the target device" is enabled, so even a configured user is not transferred to the runtime.

When all three conditions occur together, WinCC Unified uses an internal placeholder identity. Depending on the firmware version this may be a special hard-coded fallback user with limited rights, or the dialog may still appear because no role assignment can be resolved.

3. Prerequisites

Before changing configuration, verify the following:

4. Configuring Automatic Login

Two coordinated changes are required: a user in the TIA Portal project, and the Automatic Login flag in the Runtime Manager on the PC. Both must be transferred to the runtime.

4.1 Create the runtime user in TIA Portal

1. Open the project in TIA Portal V20.
2. In the project tree, expand the WinCC Unified device (the PC station or the Unified Comfort Panel).
3. Open "Security settings > Users and roles".
4. In the user table, click "Add new user".
5. Enter a username (e.g., Operator), a password meeting the runtime password policy (default: minimum 8 characters, at least one uppercase, one lowercase, one digit, one special character), and a comment.
6. Assign the user to a role. For an unrestricted kiosk-style start screen, the predefined HMI Administrator role is the simplest. For limited visibility, create a custom role with the needed screen permissions.
7. Confirm with OK.

4.2 Enable Automatic Login in Runtime Manager

Open the Runtime Manager on the runtime PC. The setting lives under the configuration of the running project:

1. Launch SIMATIC Runtime Manager.
2. Select the project entry in the list.
3. Open the project settings (gear icon or context menu > Settings).
4. Navigate to "Automatic Login" (German: Automatische Anmeldung).
5. Tick the checkbox "Enable Automatic Login".
6. Enter the username and password exactly as defined in TIA Portal.
7. Apply with OK.

The official Siemens documentation for this step is published at Activating Automatic Login (Runtime Unified) - TIA Portal Help V20. The same path applies for V17/V18/V19.

4.3 Download the project with user administration

When downloading the project to the PC station, the default download dialog contains a critical checkbox:

• "Skip download of user administration to target device" — this is enabled by default.

If the checkbox is left enabled, no users are transferred, and Automatic Login cannot find a matching account. The runtime either falls back to an internal system user (with restricted rights) or opens the login dialog. To force the transfer:

1. In TIA Portal, select the PC station in the project tree.
2. Right-click > "Download to > PC station".
3. In the download dialog, click "Options" or expand the advanced section.
4. Uncheck "Skip user administration when downloading".
5. Continue the download.

Additionally, when the download starts you may be prompted about resetting the runtime to start values. Accept this prompt ("Reset to start values") so the new user database replaces the previous one. Skipping the reset keeps the old user table in the runtime even though the project changed.

5. Verification

After download, verify the Automatic Login chain end-to-end:

1. On the runtime PC, stop and restart the SIMATIC Runtime Manager service (or the specific WinCC Unified Runtime service) so the new configuration is read.
2. Launch the runtime project from Runtime Manager.
3. Open the project URL in the browser (typically https://localhost or the published URL).
4. The login dialog must not appear; the configured start screen is rendered directly.
5. Open the Runtime Manager log (Diagnostics > Log) and confirm an entry such as "Automatic login as user 'Operator' succeeded".

Optional sanity checks:

• Temporarily break the password in Runtime Manager and reload the page: the login dialog should reappear with an authentication error, confirming the Automatic Login is the gatekeeper.
• Open a system diagnostic screen and inspect the system tag @UserName. It should report the configured automatic-login user, not an empty string or system placeholder.

6. Troubleshooting Matrix

7. Programmatic Control with ShowLoginDialog

WinCC Unified exposes the system function "ShowLoginDialog" on screens and in scripts. This function forces the login dialog to appear on top of the current screen, independent of the Automatic Login configuration. It is useful for explicit logout, role escalation, or credential refresh flows.

From the TIA Portal help at Configuring the display of the login dialog (RT Unified) - TIA Portal Help V20:

The login dialog is a pop-up window displayed in Runtime via the "ShowLoginDialog" system function. The dialog lets a user enter the login name and password for a new session. Once the user confirms, the session is updated with the new identity.

Typical usage:

• On a "Logout" button: ShowLoginDialog is called with no parameters to prompt re-login.
• On a "Switch user" button: ShowLoginDialog followed by Logoff re-authenticates a new identity.
• On start screen without Automatic Login: removing all ShowLoginDialog calls in screen events suppresses manual triggers but does not remove the implicit authentication requirement; Automatic Login must still be configured.

If the dialog is unexpectedly appearing even after Automatic Login is set, search the project for any script or button event that calls ShowLoginDialog. Vision-system program-switcher screens frequently include a "Change operator" button wired to this function.

8. Security Considerations

Automatic Login removes the explicit authentication step but does not remove authentication. The runtime session still carries an identity, audit logging still records user-tag changes, and screen-level authorization still applies. Plan accordingly:

• Use a dedicated kiosk user with the minimum role needed for operator visibility; do not reuse an administrative account.
• Disable Windows fast-user-switching on the runtime PC to prevent secondary sessions from leaking into the runtime.
• Lock down physical access to the runtime PC. Automatic Login assumes the person at the keyboard is the authorized user.
• Document the password in a controlled location; it must be re-entered after every runtime reinstall or major version upgrade.
• For audit-bound industries (food/pharma packaging regulated by FDA 21 CFR Part 11 or EU GMP Annex 11), Automatic Login may not satisfy the "unique user identification" rule. Use individual accounts with RFID or barcode login instead.

9. Version Notes and Migration

Project migration between versions preserves the user database if the Skip user administration option was unchecked during the last download. Re-validate Automatic Login after each major upgrade.

10. Field-Proven Caveats

• On Windows Server 2019/2022 used as the runtime host, the Runtime Manager must run as a service. The Automatic Login credentials are persisted in the service profile and survive reboots, but a service-account password rotation will break Automatic Login silently.
• When the same project is loaded on multiple PCs (e.g., a primary line HMI and a backup), each PC needs its own Automatic Login entry in its local Runtime Manager; credentials are not replicated through the project download.
• If the runtime PC is in a domain and uses Group Policy to clear cached credentials, Automatic Login may fail after policy refresh. Add the Runtime Manager service to the Log on as a service GPO exception.
• Touchscreen kiosks with virtual keyboards: the login dialog renders a virtual keyboard, but Automatic Login eliminates this overhead entirely and reduces wear on the touch surface.

11. Related Functions and System Tags

These are stable across V17–V20 and can be used in screen visibility animations, alarm routing filters, and audit-tag tagging.