Apply role-based security to the application folder

Applying role-based security to application folder ensures that only the authorized users can access the resources within the application folder and edit the application. The application with the role-based security is hereafter, referred to as the Secure Application. The application without the role-based security is referred to as the insecure application. You can secure the application folder even when you import or modify an existing application.

By default, the InTouch application is secure. That is the Limit access to all Standalone InTouch Application to users in InTouchDevelopers and InTouchOperators groups option inside the Application Manager under Tools > Node properties > Security is enabled by default. When the security feature is enabled on a node, strict read and write permissions are applied to the InTouch Application.

Defining security user roles

With the new default security setting, Operating System user group membership is required to run InTouch applications:

• WindowMaker can be run only by users who are members of the InTouchDevelopers Operating System user group.

• WindowViewer can be run only by users who are members of the InTouchDevelopers or InTouchOperators Operating System user groups.

With the installation of InTouch HMI, the following InTouch user groups are automatically added as local users groups:

• InTouch Developers - Users belonging to this group have full control on the InTouch application root folder. They can edit and manage the application, with Read/Write permissions to the entire application.

• InTouch Operators - Users belonging to this group have limited control on the InTouch application root folder. They can run the application. They have Read-Only access to most file and will need Read/Write permissions to a few files.

You can limit access to InTouch application to users in 'InTouchDevelopers' and 'InTouchOperators' groups only.

Assigning domain groups

You can assign a domain group to the 'InTouchDevelopers' or 'InTouchOperators' group. The users belonging to the domain group will have the Developer or Operator level access.

Assigning a local group to the 'InTouchDevelopers' or 'InTouchOperators' group is not supported. It is recommended to add the users to the "InTouchDevelopers" or "InTouchOperators" group.

To enable security for the InTouch application folder

1. Launch the Application Manager as an Administrator.

2. In the Tools menu, on the Tools tab, click Security.

   The Security screen appears.

3. Select Limit access to all Standalone InTouch applications to users in InTouchDevelopers and InTouchOperators groups to enable security to all the application folders or select Limit access to specific standalone InTouch applications to users in InTouchDevelopers and InTouchOperators groups to enable security to only selected application folders.

   

4. Select Ok.

Additional information

• When you select Ok in this node properties dialog, Access Control Lists (ACL) to application folder are applied if they selected to secure per machine or per application.

  • For per machine, the ACLs of every application which has its folders will be updated.

  • For per application, it will only update the apps which the user selected.

• Any applications which are on Universal Naming Convention (UNC) path or mapped network drive are excluded.

• When you perform 'import application' or ‘find application’, and if you have enabled application folder security at machine level, then the security is applied to the newly added application folder.

• Before System Platform 2026, the security feature is disabled by default. The default option was Standalone InTouch application inherit from parent folder.

• When upgrading to System Platform 2026, security is automatically applied to all applications. This includes existing InTouch applications, migrated applications, newly created applications, and demo applications.

• A new folder named Resources is automatically created when a new application is set up. This folder allows you to add the necessary files to the application. Read and write permissions are granted to the InTouchDevelopers and InTouchOperators groups. The Resources folder is also added to applications migrated from a previous release.

• During a product upgrade, explicit access rules are removed from the application folder. Details of the removed users and groups are recorded in a designated log file, allowing users to review what changes were made. The file is located at %ProgramData%\Wonderware\InTouch\Logs\application_permission_changes.csv

• Files in the view application are organized into two categories:

  • Executable Code

    • This category includes files that contain code executed by ABC, such as script libraries, graphic scripts, and window scripts.

    • Files in this category cannot be created or modified by all users. Only users with privileges to edit, update, or retrieve an application can create or modify these files. All other users have read-only access.

  • Data Files

    • This category includes files such as compiled window files, LGH files, and retentive tags. These files are written during runtime and do not contain executable code.

    • Users with permission to run Viewer can create and modify these files.

For more information watch the video titled Application Development Options.