AVEVA™ InTouch HMI

InTouch HMI 2023 R2 SP1 P04 release notes

Save PDF

TABLE OF CONTENTS

InTouch HMI 2023 R2 SP1 P04 release notes

Save PDF

Last UpdatedFeb 02, 2026
11 minute read

About this release notes

This document provides information about AVEVA InTouch HMI 2023 R2 SP1 P04.

Restricted DLL loading

Overview

The registry-based mechanism for restricted DLL loading is designed to strengthen system security by controlling which directories are permitted for library loading. This mechanism aims to minimize the risk of malicious or unintended DLLs being loaded into the system.

By default, restricted DLL loading is disabled. It is recommended to enable this feature in a test environment first to determine if it affects your application's functionality.

You can enable or disable restricted DLL loading by editing the relevant registry key. This key is generated during installation and has a default value of 0, meaning the feature is off.

Registry Key Location: HKEY_LOCAL_MACHINE\SOFTWARE\AVEVA\SystemPlatform\Security
Value name: EnableRestrictedDllLoading
Type: DWORD (0 = Disabled, 1 = Enabled)

Values

0x00000000 (0): Restricted DLL loading is disabled (default)
0x00000001 (1): Restricted DLL loading is enabled

If the value is not specified or is anything other than 1, restricted DLL loading will remain disabled by default.

Test

If your application is affected by this feature, you might encounter some issues in your system. In the Logger you may see some warning or error messages.

This functionality may affect following:

Application Server
- Custom Application Objects created with the AOT
- Custom script libraries
- IDE Extensions
- GRAccess-based programs
InTouch HMI
- Custom script libraries
- IDEA Toolkit extensions
- Network Application Development
- Some Remote Desktop scenarios

Plan for moving forward

In the next major release, this feature will be enabled by default, but you will still have the option to disable it. In a subsequent release, the feature will always be enabled and can't be disabled.

WindowViewer as a Service

Service account changes

For improved security, the WindowViewer Virtual Service Account has been removed from the Administrators group and no longer has administrative privileges. The account has been added to the ASBSolution, ArchestrAWebHosting, and aaRuntimeUsers groups.

Application path access

When configuring WindowViewer to run as a service in the Application Manager, the system will automatically check if the WindowViewer Virtual Service Account has the necessary permissions to access the selected application path. If the service account does not have read/write access to the application directory tree, the following will occur:

Automatic permission grant: The WindowViewer Virtual Service Account will be automatically granted read/write access to the entire application directory tree.
User notification: You will see a log message informing you of this permission change.
Service configuration: The application will then be configured to run as a service with the appropriate access rights.

Post-upgrade redeployment requirements

Important: After performing a software upgrade, managed applications running as a service must be redeployed to ensure proper service account permissions. If you do not redeploy after an upgrade, the VIEW service account will not automatically have permission to the application folder for the managed application running as a service.

Standalone applications in protected paths

If a standalone application was created in a protected path and configured to run as a service in an earlier release, the VIEW service account may not have the required permissions after upgrade. This is due to the reduced privileges of the VIEW service account.

Issue: After upgrade and machine restart, the WindowViewer service may fail to start with an "Access Denied" error.

Solution: Manually grant read and write permissions to the VIEW service account for the application folder.

Logging

Detailed log messages are provided to help troubleshoot any service configuration issues. Monitor the Operations Control Management Console for information about permission changes and service setup status.

Security notes

The service account now operates with minimal required privileges for enhanced security.
Permissions are granted only to specific application directories as needed.

The service account no longer has system-wide administrative access.

StringCompareEncrypted() function will be deprecated soon

The StringCompareEncrypted script function compares an unencrypted password with an encrypted password entered through a password input field.

StringCompareEncrypted represents and supports a use case and workflow that is inherently insecure by modern cybersecurity standards, even within the scope of a closed network. Additionally, StringCompareEncrypted uses an insecure comparison mechanism which can lead to clear-text password or credential exposure in memory and in the swap file on disk.

Considering these situations, and recent changes in the stance on the use of decryption methods in live systems in the standards within the cybersecurity community and the software industry, the decision has been made to deprecate the StringCompareEncrypted script function for the next major System Platform release.

From System Platform 2023 R2 SP1 P04 and all upcoming patch releases of System Platform 2023 R2 SP1, usage of the StringCompareEncrypted function generates a warning message in the Operations Control Logger, reminding application maintainers that the function will be deprecated and to adjust the implementation that relies on this soon to be removed script function.

Starting in the next major System Platform release, StringCompareEncrypted will be fully deprecated, and will therefore not be available for use in InTouch HMI scripts. Importantly, after the upgrade of the InTouch application, all occurrences of the StringCompareEncrypted script function will have no effect at runtime and will always return 0.

Deprecation of manual username and password entry

Overview

InTouch HMI currently permits manual username and password entry in several controls. While this approach offers flexibility, it can result in less secure credential handling, such as plain-text or weakly encrypted storage. Enhancing this behavior will help reduce the risk of inadvertent exposure and align with evolving security standards.

To support stronger security posture and modern credential management practices, InTouch HMI will deprecate manual username and password entry in three phases, transitioning all users to Named Credentials.

Affected Controls

Graphics
- TrendClient
- SQLDataGrid
- Embedded Alarm Control
Alarm Controls
- Alarm Pareto
- Alarm DB View Control
Alarm Utilities
- Alarm DB Logger Manager
- Alarm DB Restore
- Alarm DB Purge-Archive
Distributed name manager history provider

Phase 1 is the current System Platform 2023 R2 SP1 P04 release. In this phase, deprecation warnings will be present in all username and password entry interfaces. Informational messages notifying users of the upcoming deprecation will be logged in the Operations Control Logger whenever manual usernames and passwords are accessed. Otherwise, existing functionality will not be changed.

Phase 2 is scheduled for the next major System Platform release. Users will no longer be able to add or edit manual usernames and passwords. Existing usage of usernames and passwords in applications will continue to function normally but cannot be modified. Warning messages will be logged in the Operations Control Logger to inform users of the deprecation whenever manual usernames and passwords are accessed. All new applications and any existing applications updated by the user must use Named Credentials.

Phase 3 is planned for a major System Platform release following Phase 2. Support for manual usernames and passwords will be completely removed. During application upgrade, existing usernames and passwords in the controls specified previously will automatically convert to Named Credentials, enabling applications to function immediately after migration. Upon completion, the system will generate a detailed report listing affected applications and symbols, original username and password locations, new Named Credential names, and a summary of all changes.

Resolved Issues

InTouch HMI 2023 R2 SP1 P04 includes corrections for the issues listed in the following table. These issues are listed by their Defect ID, its assigned Service Request (SR) or Case Number, and a brief description of the issue.

Defect ID	SR/Case Number	Description
3932260	960585769	WindowMaker did not fully maximize and fill the display. It left a border (of whatever was behind the window) around the window. This issue occurred on multiple monitors with equal or varying resolutions.
4032011	960636089	Sorting using the arrow on column headers did not work for columns such as Limit and CurrentValue.
4048432	960632019	In the German version of InTouch, using float values with aaGraphic.CustomPropertyValuePair in a ShowGraphic() function caused a conversion error.
4052703	960638529	The OPC UA client failed to connect to the InTouch OPC UA server using encryption with an authenticated user.
4059759	960633748	The frame window with an overlay/replace shrank or expanded at runtime in both standalone and managed applications, even when the screen resolution matched the application resolution.
4068358	960642447	The OnMouseOver trigger used on an action script for an ArchestrA graphic triggered on a mouse click.
4072376	960634879	The search box on WindowMaker 2023 R2 behaved differently from WindowMaker in InTouch HMI 2023 R2 SP1 and InTouch HMI 2023 R2 P01. The information typed in the search box was cleared only by deleting the data, whereas on InTouch HMI 2023 R2 SP1 and InTouch HMI 2023 R2 P01 it was cleared after a click.
4078066	960648563	The alarm comment was displayed instead of the alarm message when an alarm was acknowledged by right-clicking the control or through scripting.
4079800	960645384	In InTouch HMI 2023 R2 SP1 P02, on Windows 11 Pro 24H2, the WindowViewer process (view.exe) remained active even after the InTouch View application was closed when a user was logged in.
4094432	960648588	The Quality dotfield for loopback tags (IO Tags pointing to themselves) always had an initial value of 32.
4099184	960652903	Changing the start time caused a long delay and intermittent issue in drawing trend pen data.
4100289	960654164	An error occurred in InTouch application after graphics were modified, and the application was deployed using the Load changes into WindowViewer option.
4101810	960645972	AlarmApp displayed incorrect timestamps when a Like or Not like filter was applied to any column; the displayed times reverted to the local system timezone, even though the alarms remained unchanged.
4122984	960662532	Even after installing the hotfix 4100289, an error occurred on InTouch machines after deploying with Load changes into WindowViewer.
4221165	960659845	Owning Object/Me. references did not follow through to the popups.
4225534	960661718	The map app widget did not load the map during InTouch runtime when Google Maps was set as the data source.
4228998	960669623	InTouch combo box did not display any item even though the tag was bound. After the tag value changed, the combo box searched the list from top to bottom to find the first value that matched the assigned tag value.
4250740	960660423	InTouch Web Client initially operated as expected, but after several days, all users who logged in were shown an access level of –1.
4264031	960645290	When multiple tags were written collectively through scripts, all tags ended up with the same value instead of their respective individual values. This occurred specifically with OPC UA server.
4269024	960663856	Post-upgrade from InTouch HMI 2014 to InTouch HMI 2023 R2 SP1 P02, the IDE returned an error message when opening graphics or symbols for editing and then closing them with or without making changes.
4290104	960664274	The OMI AlarmApp Filter did not work properly when the application opened and had to be turned off and on again to function correctly.
4296775	962480947	Setting the $Historicallogging system tag to 0 in the startup script and adding SkipInitialHistdata = 1 did not affect logging to Historian.
4306500	962608080	The Select All and Unselect All options in WindowMaker did not function correctly.
4314197	962609037	In InTouch HMI 2023 and later, the keyboard shortcuts to enlarge/reduce the radius (Shift + ‘plus’ and Shift + ‘minus’) to adjust rounded rectangle radius were no longer functional.
4316716	962608388	After migrating to InTouch HMI 2023 R2 SP1 P03, tags could not be added to the Watch List in Tag Viewer.
4319442	962614261	Resize cursor position was incorrect in InTouch WindowMaker.
4319443	962614303	When the tag name contained the character ‘é’, it appeared correctly in the tag dictionary but displayed as a question mark symbol in the Model - Tagname view.
4319495	962614230	The halo of a graphic element with a configured animation appeared a different color when the graphic symbol was displayed in a frame-type window using the ShowGraphic() function.
4319931	962619503	Compared to Windows, Scripts, and Tags searches, the symbol search required more time, during which WindowMaker entered an unresponsive state.
4320023	962607874	When a new application was created from an existing application’s aaPKG file, the SmartSymbol folder was empty and none of the original smart symbols were included.
4329155	962625209	IOSetItem() with a space " " as the parameter caused WindowViewer to crash.
4329822	962620411	A single click in the properties window automatically selected the first item in the list. This issue affected the “Window Type” and “Frame Style” properties.
4373052	962651473	After installing the hotfix 4250740, all users who logged in were intermittently shown an access level of –1. Refreshing the browser then displayed the correct access level.
4352602	960665563	After migration of the managed InTouch application from InTouch HMI 2017U2 and InTouch HMI 2017U3 SP1 versions to InTouch HMI 2023 R2 SP1, none of the InTouch windows were present in the windows list of WindowMaker.
4354184	962642879	Some InTouch windows that include symbols using ShowGraphic animation could not be resized.
4401329	962659336	In InTouch HMI 2023 R2 SP1 P02, when only tag data was changed, the NAD update message was still shown in the background.

Known Issues

This section describes known issues that remain in the release of InTouch HMI 2023 R2 SP1 P04.

Issue ID	Description
2612382	MxDataProvider Service is not deploying on Runtime node as PCS-Services Repository is installed on Runtime node.
2897808	Attempting to sign an alarm acknowledgement fails in a Managed InTouch application with an error message warning of incorrect user credentials. The SignedAlarmAck feature is not currently supported for a Managed InTouch application configured for AVEVA Operations Control connected experience.
1928318	When the Supertag instances are created by importing from a .CSV file, the imported Supertags are not displayed in the Supertags pane of the WindowMaker. Workaround: The Supertag instances created by importing from a .CSV file can be viewed in the tag dictionary.
1826926	When a window containing a symbol with an embedded MapApp widget is viewed in WindowViewer, the MapApp does not load. Workaround: To view the embedded MapApp widget upon fast switching to WindowViewer: Navigate to C:\Windows\System32\. Locate the file 'dbghelp.dll'. Copy the file and paste it to C:\Program Files (x86)\Common Files\ArchestrA\. Setup the below registry in windows. [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ArchestrA\WebApplications\Default\SuiteLink] "V2Server"=dword:00000001 "V3Server"=dword:00000001
1765301	When an existing Custom Client Control or Web Widget is overwritten to the Cloud, the latest version is not available for other users. Workaround: To overwrite an existing Custom Client Control or Web Widget to the Cloud, restart the WindowMaker and delete the existing client control or Web Widget in the source repository. This allows successful upload/download of the the client control. Similarly, restart the WindowMaker to retrieve the latest Custom Client Control or Web Widget.
TFS-1351507	Language switching is not supported for the Carousel Widget in runtime.
TFS-1369183	A Carousel Widget containing the Web Browser Widget, QR Code Scanner Widget, Trend Client Control, Alarm Client Control or SQL Data Grid Control will not display correctly in WindowViewer, as default browser security options prevent cross-origin requests.
TFS-1372178	Carousel widgets in a managed application migrated from InTouch HMI 2020 to InTouch HMI 2023 R2 SP1 P04, do not contain the latest properties. Workaround: On migrating a Galaxy from InTouch HMI 2020 to InTouch HMI 2023 R2 SP1 P04, run the AVEVA System Platform IDE as an Administrator at least once, to allow loading the latest InTouch 2023 R2 SP1 P04 carousel widget properties.
TFS-1371799	When an InTouch 2020 application (.aapkg) is exported and imported to InTouch 2023 R2 SP1 P04, then the default namespace for a tag reference within a Carousel widget is not resolved in runtime. Workaround: Open the graphic containing the Carousel widget. Edit any property and save the graphic. The tag reference is resolved, and the graphic is displayed in runtime.
TFS-1374896	After a graphic/toolset is created, the letter case of the graphic name cannot be changed in WindowMaker. For example: INTOUCH cannot be changed to InTouch. Workaround: Rename the graphic to a temporary name. Rename the graphic again with the correct letter case. For example: Rename INTOUCH to ChangeName and then rename to InTouch.
TFS-1377672	Connecting many clients to a busy OPC UA server may cause various warnings and errors to be logged from the InTouch OPCUA Host process. Warning messages are for information purposes only and do not indicate any loss in functionality. Error message indicate that the operation was aborted. Workaround: It is recommended that client connections to the server be planned and monitored, so not to burden the server and cause connection failures.

AVEVA™ InTouch HMI