AVEVA™ InTouch HMI

AVEVA InTouch HMI 2023 R2 SP2 release notes

Save PDF

AVEVA InTouch HMI 2023 R2 SP2 release notes

Save PDF

Last UpdatedAug 27, 2026
12 minute read

This document provides information about AVEVA InTouch HMI 2023 R2 SP2. Release notes from previous releases of AVEVA InTouch HMI are posted on the support site.

Expectations and limitations

No InTouch HMI expectations and limitations have been identified in this release.

Restricted DLL loading

The registry-based mechanism for restricted DLL loading is designed to strengthen system security by controlling which directories are permitted for library loading. This mechanism aims to minimize the risk of malicious or unintended DLLs being loaded into the system.

By default, restricted DLL loading is disabled. It is recommended to test this feature in a test environment first to determine if it affects your application's functionality.

You can enable or disable restricted DLL loading by editing the relevant registry key. This key is generated during installation and has a default value of 0, meaning the feature is off.

Registry Key Location: HKEY_LOCAL_MACHINE\SOFTWARE\AVEVA\SystemPlatform\Security
Value name: EnableRestrictedDllLoading
Type: DWORD (0 = Disabled, 1 = Enabled)

Values

0x00000000 (0): Restricted DLL loading is disabled (default)
0x00000001 (1): Restricted DLL loading is enabled

If the value is not specified or is anything other than 1, restricted DLL loading will remain disabled by default.

Test

If your application is affected by this feature, you might encounter some issues in your system. In the Logger, you may see some warning or error messages.

This functionality may affect following:

Application Server
- Custom Application Objects created with the AOT
- Custom script libraries
- IDE Extensions
- GRAccess-based programs
InTouch HMI
- Custom script libraries
- IDE Toolkit extensions
- Network Application Development
- Some Remote Desktop scenarios

WindowViewer

Service account changes

For improved security, the WindowViewer Virtual Service Account has been removed from the Administrators group and no longer has administrative privileges. The account has been added to the ASBSolution, ArchestrAWebHosting, and aaRuntimeUsers groups.

Application path access

When configuring WindowViewer to run as a service in the Application Manager, the system will automatically check if the WindowViewer Virtual Service Account has the necessary permissions to access the selected application path. If the service account does not have read/write access to the application directory tree, the following will occur:

Automatic permission grant: The WindowViewer Virtual Service Account will be automatically granted read/write access to the entire application directory tree.
User notification: You will see a log message informing you of this permission change.
Service configuration: The application will then be configured to run as a service with the appropriate access rights.

Post-upgrade redeployment requirements

Important: After performing a software upgrade, managed applications running as a service must be redeployed to ensure proper service account permissions. If you do not redeploy after an upgrade, the VIEW service account will not automatically have permission to the application folder for the managed application running as a service.

Standalone applications in protected paths

If a standalone application was created in a protected path and configured to run as a service in an earlier release, the VIEW service account may not have the required permissions after upgrade. This is due to the reduced privileges of the VIEW service account.

Issue: After upgrade and machine restart, the WindowViewer service may fail to start with an "Access Denied" error.

Solution: Manually grant read and write permissions to the VIEW service account for the application folder.

Logging

Detailed log messages are provided to help troubleshoot any service configuration issues. Monitor the Operations Control Management Console for information about permission changes and service setup status.

Security notes

The service account now operates with minimal required privileges for enhanced security.
Permissions are granted only to specific application directories as needed.

The service account no longer has system-wide administrative access.

StringCompareEncrypted() function will be deprecated soon

The StringCompareEncrypted script function compares an unencrypted password with an encrypted password entered through a password input field.

StringCompareEncrypted represents and supports a use case and workflow that is inherently insecure by modern cybersecurity standards, even within the scope of a closed network. Additionally, StringCompareEncrypted uses an insecure comparison mechanism which can lead to clear-text password or credential exposure in memory and in the swap file on disk.

Considering these situations, and recent changes in the stance on the use of decryption methods in live systems in the standards within the cybersecurity community and the software industry, the decision has been made to deprecate the StringCompareEncrypted script function for the next major System Platform release.

From System Platform 2023 R2 SP1 P04 and all upcoming patch releases of System Platform 2023 R2 SP2, usage of the StringCompareEncrypted function generates a warning message in the Operations Control Logger, reminding application maintainers that the function will be deprecated and to adjust the implementation that relies on this soon to be removed script function.

Starting from System Platform 2026, StringCompareEncrypted() function has been fully deprecated, and therefore not be available for use in InTouch HMI scripts. Importantly, after the upgrade of the InTouch application, all occurrences of the StringCompareEncrypted script function will have no effect at runtime and will always return 0.

Deprecation of manual username and password entry

Overview

InTouch HMI currently permits manual username and password entry in several controls. While this approach offers flexibility, it can result in less secure credential handling, such as plain-text or weakly encrypted storage. Enhancing this behavior will help reduce the risk of inadvertent exposure and align with evolving security standards.

To support stronger security posture and modern credential management practices, InTouch HMI will deprecate manual username and password entry in three phases, transitioning all users to Named Credentials.

Affected Controls

Graphics
- TrendClient
- SQLDataGrid
- Embedded Alarm Control
Alarm Controls
- Alarm Pareto
- Alarm DB View Control
Alarm Utilities
- Alarm DB Logger Manager
- Alarm DB Restore
- Alarm DB Purge-Archive
Distributed name manager history provider

Phase 1 was in System Platform 2023 R2 P04 release. In this phase, deprecation warnings will be present in all username and password entry interfaces. Informational messages notifying users of the upcoming deprecation will be logged in the Operations Control Logger whenever manual usernames and passwords are accessed. Otherwise, existing functionality will not be changed.

Phase 2 was in System Platform 2026 release. Users will no longer be able to add or edit manual usernames and passwords. Existing usage of usernames and passwords in applications will continue to function normally but cannot be modified. Warning messages will be logged in the Operations Control Logger to inform users of the deprecation whenever manual usernames and passwords are accessed. All new applications and any existing applications updated by the user must use Named Credentials.

Phase 3 is planned for a next System Platform release in 2026 series. Support for manual usernames and passwords will be completely removed. During application upgrade, existing usernames and passwords in the controls specified previously will automatically convert to Named Credentials, enabling applications to function immediately after migration. Upon completion, the system will generate a detailed report listing affected applications and symbols, original username and password locations, new Named Credential names, and a summary of all changes.

Resolved issues

InTouch HMI 2023 R2 SP2 includes the hotfixes listed in the following table. These hotfixes are listed by their Defect ID, its assigned Service Request (SR) or Case Number, and a brief description of the issue.

Defect ID	SR/Case Number	Description
1521821	960113182	InTouch HMI allocated View.exe to individual CPU cores in a Remote Desktop Services (RDS) environment.
4037951	960637314	The snapshot approach for the alarm list could not retrieve alarms when querying the Alarm Hot Backup Pair.
4074215	960610836	The managed InTouch application was temporarily not responsive when the GR node was shutdown.
4316494	962613740	After minimizing and then maximizing the WindowMaker window, focus within the application was lost. The Enter key did not activate the selected object, and the application became unresponsive during minimize operations.
4370864	962641284	After migrating a Galaxy from System Platform 2014 system, the OCMC frequently logged the error "Column does not exist".
4379938	962644999	When Network Application Development (NAD) was enabled, UDTs were missing on a French Operating System.
4384789	962651595	An error was encountered when writing timestamps with a non-zero third millisecond digit in the SQL DataGrid Application.
4413338	962651493	At runtime, frame windows with InteractionMode set to None did not behave correctly during touch interactions.
4416282	962651617	When switching language, Value Display with Truth Table did not display properly in frame windows.
4429632	962678524	An issue occurred while data was written from the InTouch Web Client, during which warnings related to aaServicesMXDataService were observed.
4429717	962691563	A single click in the UDT property dropdown area selected the first item in the list.
4437562	962667642	Domain accounts were not granted the expected permissions when logging into the InTouch application. Upon login, the user access level remained at 0.
4439606	962684788	After migrating a Galaxy from System Platform 2020 R2 to System Platform 2023 R2 SP1 P03 or System Platform 2023 R2 SP1 P04, security-controlled popup animations did not update correctly, and graphic custom properties were not consistently refreshed.
4443292	962670414	After hotfix 4349946 was installed, the Alarm Client Control for InTouch HMI and OMI was corrupted, which caused the application to stop responding.
4459708	962702121	After upgrading from InTouch HMI 2023 R2 SP1 P02 to InTouch HMI 2023 R2 SP1 P03 or System Platform 2023 R2 SP1 P04, some UDT instance properties were incorrect.
4497297	962703741	The Alarm Client Control displayed alarm timestamps in PST when the client time zone was set to Perth (+08:00) until an alarm entry was selected, after which the timestamps were corrected to Perth time.
4513808	962727458	Alarm Client Control was unresponsive when the All System Alarms filter was applied.
4518705	962729521	WindowViewer became stuck on exit when WWControl(InfoAppTitle("View"),"Close"); was called.
4519748	962706218	After migrating the application from InTouch HMI 2020 R2 SP1 to InTouch HMI 2023 R2 SP1 P03, an error stating "WM /Unknown opcode in OperandProcessDbNames0: 0, pPExp:800702BD" occurred when the application was launched.
4528677	962722274	The InTouch application stopped responding intermittently during alarm acknowledgment in InTouch HMI 2023 R2 SP1 P01 or later.
4542543	962740639	In InTouch HMI 2023 R2 SP1 P03 or System Platform 2023 R2 SP1 P04, when Network Application Development (NAD) was temporarily set to None and later enabled, the Local Working Directory was reset to the default path instead of retaining the previously saved custom path.
4545254	962697134	LGH files larger than 2 GB failed to display historical data in Trend controls and caused high CPU usage.
4548076	962714694	InTouch Web did not display graphics correctly when Owning Object was configured on a UDT in a managed InTouch application.
4552217	962748012	In InTouch HMI 2020 R2 SP1 or later, CPU usage for view.exe increased to nearly 100% after approximately 20 minutes when viewing a screen with the Trend Client Control.
4562175	962746550	In System Platform 2023R2SP1P04, leading zeros were removed from the String Custom Property.
4641780	962705600	After migrating the project from version InTouch HMI 2014 R2 SP1 to InTouch HMI 2023 R2 SP1 P02 or later, the alarm filter syntax was not interpreted the same way as in version InTouch HMI 2014 R2 SP1.
4642598	962759453	The input-enabled textbox used to modify a value was always shown on the primary screen, even when the popup graphic displaying the value was on another screen. This issue occurred with all input-enabled text fields.
4652375	962754809	After upgrading to System Platform 2023 R2 SP1 P04, the ShowGraphic() function did not work on OMI MapApp.
4665314	962749965	Trend Pen, when hosted in InTouch Web Client, did not retrieve the historical data from LGH files.
4680522	962740017	After configuring User Authentication and using the Sign Out button to close the session, the lock on free access to the InTouch Web Client still persisted, preventing access from another session.
4683144	962752725	Selecting a row in the DataGrid cleared the displayed data when a custom property was configured for the Selected Row property.
4692757	962786588	After migrating to System Platform 2023 R2 SP1 P04, MapApp using offline maps with an XYZ source stopped working when any XYZ source was defined.
4730773	962706218	After migrating a managed InTouch application from System Platform 2017 to System Platform 2023 R2 SP1 P03, the InTouch script counts were displayed incorrectly.
4748053	962815899	A new public property on the Alarm Viewer control was exposed to provide percent complete information.
4760099	962817719	Error messages in Chinese were logged from the ArchestrASymbolProvider component.
4766947	962823074	The ArchestrA Graphic object using exponential notation displayed values with incorrect rounding when the values were greater than tens.
4769057	962805437	When navigating around and then opening Cross Reference, a "Not enough memory for window" error message appeared in OCMC.
4776916	962824357	The View stopped responding when a user logged in with the login window.
4780397	962817049	Strange behaviour occurred when deploying the InTouch application with "override WindowViewer default configuration".
4786454	962828457	After upgrading the application from InTouch HMI 2020 to InTouch HMI 2023 R2 SP1 P04, the GetEUDesc() functionality to retrieve the engineering unit description did not work.
4793706	962834358	The Trend Pen graphic either failed to plot the trend or took a very long time to plot the trend.
4827767	962848713	In System Platform 2023 R2 SP1 P04 Chinese version, a normal application of Purge/Archive and Activate displayed the error: "User has no permission to run alarm Purge/Archive as a Windows service."
4828672	962834982	After migrating the Galaxy from version System Platform 2014 to System Platform 2023 R2 P01, owning object function not work correctly for grouped objects.
4832577	962849130	The presence of a frame window caused smart symbol template corruption.
4847688	962854828	After installing hotfix 4779989 on a Japanese machine, WindowMaker stopped responding.
4878558	962859511	After migrating the InTouch application to the new version, when loading QuickFunctions with larger scripts into the WindowMaker editor, InTouch WindowMaker became unresponsive.
4889918	962874271	When a trend popup was opened, the View.exe (WindowViewer) process consumed a significant number of USER and GDI handles . When these popups were closed using HideSelf(), the handles were not released, causing the handle count to reach the Windows USER/GDI limit.
4908656	962879544	WindowViewer toolbar was positioned incorrectly after RDP disconnect/reconnect with AlwaysMaximize=1.
4910346	962859868	After migrating the InTouch application from System Platform 2020 R2 SP1 to System Platform 2023 R2 SP1 P04, copying (or duplicating) and pasting an Industrial Graphics Numeric Display within the same window caused the object to become smaller.
4910367	962877576	When historical alarms were queried from SQL server, alarms that had an alarm duration without milliseconds displayed '00:' in the Alarm Client Control.
4913073	962867008	The .exe created by the InTouch Application Publisher utility, when executed, caused the InTouch Application Expander to stop responding and required manual closure.
4939438	962892328	An alarm was triggered from the object and a record for UNACK_ALM was created in the WWALMDB Alarm Details table. However, when the alarm was acknowledged and returned to a normal state, the ACK_ALM and ACK_RTN records were not created in the Alarm Details.
4571993 / 4400295 / 4503020	960642628	When notifying clients, WindowMaker was not able to update the appchng.fsm file once the file existed. Network Application Development (NAD) clients were not notified.
4852329	962827617	After migrating from System Platform 2017 to System Platform 2023, there was a different background appearance between WindowViewer and the InTouch Web Client.

Known issues

This section describes known issues that remain in the release of InTouch HMI 2023 R2 SP2.

Issue ID	Description
4022193	Trend Pen is not connecting to Historian when SMS is turned off and InTouch application was running on a computer other than the Historian. Workaround It will work only for the following SMS configuration: First and second options under Configurator->System Management Server
IMS-3566480 IMS-4878412	Alarm Client Control failed to retrieve alarms from a history block when the number of alarms is huge. Workaround To prevent out-of-memory issues while fetching a large number of alarms in the Alarm Client Control, follow the procedure below: When displaying 100,000 alarms, the process memory of the View process increases by approximately 600 MB. To keep the memory usage within acceptable limits, it is necessary to configure a maximum limit for historical alarms. Configuration Steps: InTouch Or OMI applications Set the MaxTotalRetrievalCount property of alarm client. In the OnShow script of the symbol that contains the Alarm Client Control, set the MaxTotalRetrievalCount property. Using AlarmClient.MaxTotalRetrievalCount = XXXXXX InTouch applications only For InTouch applications, you can also set the maximum limit using the MaxHistAlarmsCount property in the intouch section of the intouch.ini file. Example: MaxHistAlarmsCount=XXXXXX; Location of intouch.ini Managed application: C:\Program Files (x86)\ArchestrA\Framework\FileRepository\<galaxy_name>\ObjectFileStorage\ lt;intouchtemplatename>\CheckedOut C:\Program Files (x86)\ArchestrA\Framework\FileRepository\<galaxy_name>\ObjectFileStorage\ lt;intouchtemplatename>\CheckedIn Deployed application: C:\Program Files (x86)\ArchestrA\Framework\Bin\<YourProjectName>
2612382	MxDataProvider Service is not deploying on Runtime node as PCS-Services Repository is installed on Runtime node.
2897808	Attempting to sign an alarm acknowledgement fails in a Managed InTouch application with an error message warning of incorrect user credentials. The SignedAlarmAck feature is not currently supported for a Managed InTouch application configured for AVEVA Operations Control connected experience.
1928318	When the Supertag instances are created by importing from a .CSV file, the imported Supertags are not displayed in the Supertags pane of the WindowMaker. Workaround: The Supertag instances created by importing from a .CSV file can be viewed in the tag dictionary.
1765301	When an existing Custom Client Control or Web Widget is overwritten to the Cloud, the latest version is not available for other users. Workaround: To overwrite an existing Custom Client Control or Web Widget to the Cloud, restart the WindowMaker and delete the existing client control or Web Widget in the source repository. This allows successful upload/download of the the client control. Similarly, restart the WindowMaker to retrieve the latest Custom Client Control or Web Widget.
TFS-1351507	Language switching is not supported for the Carousel Widget in runtime.
TFS-1369183	A Carousel Widget containing the Web Browser Widget, QR Code Scanner Widget, Trend Client Control, Alarm Client Control or SQL Data Grid Control will not display correctly in WindowViewer, as default browser security options prevent cross-origin requests.
TFS-1371799	When an InTouch 2020 application (.aapkg) is exported and imported to InTouch 2020 R2, then the default namespace for a tag reference within a Carousel widget is not resolved in runtime. Workaround: Open the graphic containing the Carousel widget. Edit any property and save the graphic. The tag reference is resolved, and the graphic is displayed in runtime.
TFS-1374896	After a graphic/toolset is created, the letter case of the graphic name cannot be changed in WindowMaker. For example: INTOUCH cannot be changed to InTouch. Workaround: Rename the graphic to a temporary name. Rename the graphic again with the correct letter case. For example: Rename INTOUCH to ChangeName and then rename to InTouch.
TFS-1377672	Connecting many clients to a busy OPC UA server may cause various warnings and errors to be logged from the InTouch OPCUA Host process. Warning messages are for information purposes only and do not indicate any loss in functionality. Error message indicate that the operation was aborted. Workaround: It is recommended that client connections to the server be planned and monitored, so not to burden the server and cause connection failures.