Hi all,

In a WinCC project for a PC Runtime, we need to create different levels of protection with "administrator" as the highest level for the end user and "technician" as the OEM level.

"technician" is on a higher level than "administrator", and thus it can access some critical adjustments.

It is mandatory that  "administrator" can have "User Administration" rights, since end user must be capable of creating new users as operators or maintenance personnel.

The issue here is that "User Administrator" rights are unrrestricted and "administrator" level can erase or even change password for higher level users as "technician" ones.

Password is changed without even asking for the old one, so an "administrator" could set a new password for an existing "technician" user or even create a new one with "technician" access level.

Is there some way of preventing that users with lower access level but with enabled "User Adminsitration" rights can modify data for higher access level users?

Thanks in advance.

Dear Miguel,

this link could be helpful.

https://support.industry.siemens.com/cs/ww/en/view/109738532

With best regards

rh1990

Thanks rh1990, but I had already checked that document and for WinCC user management it doesn't state how to protect users.

Maybe with Simatic Logon it's possible to do something about it, but it means to add another software component and central user management is not really needed so it makes more difficult to justify this action.

There's also an old thread that I didn't want to re-float, with a similar issue than mine:

https://support.industry.siemens.com/tf/ww/en/posts/user-administration/76838/?page=0&pageSize=10

But I cannot access the documentation of the answer, and it says is about WinCC flexible, so maybe it doesn't apply here .

Not sure if the thread creator could finally solve his problem.

Having an administrator user with User Administration rights without interfering with an OEM user with higher level access shouldn't be an extraordinary situation, should it? 

Thanks Murof!!

This way "higher" users are not shown when a "lower" user access to User Administration window.

I had already implemented a script with a password to protect senstitive areas, but I prefer using the tools provided by the system.

Best regards.