Siemens SIMATIC S7-1500 System Manual page 347

Protection
11.3 Local user management
Loading the user administration during operation
As of firmware version V3.1, certain security-relevant configuration data can be loaded both
in STOP system state and in RUN-Solo or RUN-Redundant system state. This means that
loading the hardware configuration does not necessarily lead to a CPU STOP.
You can load the following changes in STOP, RUN-Solo or Run-Redundant system state
(Download to device > Hardware configuration):
• Local user management extended/changed
• TIA Portal-configured certificates added/modified
• Syslog configuration changed
If you made additional changes to the hardware configuration (for example, added modules,
reassigned parameters, etc.), then the CPU automatically prompts for the STOP state before
loading the configuration.
Therefore, when you load just one user with modified roles/function rights to the CPU, for
example, this process does not require any STOP state of the CPU.
The preview dialog for loading contains a security area so that you can determine when
loading how the CPU should deal with user data that has changed in the meantime (not
when loading for the first time). This allows changes to user data (e.g. password changes
during runtime) to be retained.
Loading the device as a new station - with user data
If you load an already configured CPU into a new project, for example, because you do not
have the original project, the user data is loaded into the project and is available for further
processing of the CPU settings.
Changing of passwords during operation
You can use the API of the Web server to write an application that any user can use to change
their password during runtime, provided that the original password was entered correctly and
the new password complies with the configured password policy.
Requirement: You have enabled access control for the CPU.
A user can change their own password at any time, even if the password has expired. If the
password has expired, the user must change the password. Login will not be possible with an
expired password.
API methods used:
• Api.ChangePassword
• Api.GetPasswordPolicy
346
S7-1500R/H redundant system
System Manual, 01/2024, A5E41814787-AF