# Locking Out End User From Uploading or Downloading to PLC AS v4.12 **URL:** \ **Category:** B&R Software & Runtime\ **Tags:** automation-studio, automation-studio-6\ **Created:** [June 5, 2026, 2:38pm UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471 "2026-06-05T14:38:05Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jack\_Lin2](https://avatars.discourse-cdn.com/v4/letter/j/FF8800/32.png) [@Jack\_Lin2](https://community.br-automation.com/u/Jack_Lin2)\ **Post date:** [June 5, 2026, 2:38pm UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471/1 "2026-06-05T14:38:05Z")
Hey guys, For Automation Studio v4.12, I was wondering if there is any way of preventing the end user of the PLC from uploads and downloads? The PLC I’d like to do this to is the 4PPC30.043F-21B. Thanks, Jack ---
**Author:** ![alexander.hefner](https://dub1.discourse-cdn.com/brcommunity/user_avatar/community.br-automation.com/alexander.hefner/32/111_2.png) [@alexander.hefner](https://community.br-automation.com/u/alexander.hefner)\ **Post date:** [June 5, 2026, 3:47pm UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471/2 "2026-06-05T15:47:54Z")
Hi, you can’t lock them out just for transfer services, because the online protocol ANSL don’t has different access rights for read and write access or different types of operations. But you can secure the complete online services (including up- and download, but also watch, online monitor and so on) by the ANSL online protocol features “[user role authentication](https://help.br-automation.com/#/en/4/programming/online/settings/online_authentication.html)” or “[certificate-based TLS encryption](https://help.br-automation.com/#/en/4/access_and_security/ssl/ssl_protocollassignament.html)”, or a combination of both. Best regards! ---
**Author:** ![Jack\_Lin2](https://avatars.discourse-cdn.com/v4/letter/j/FF8800/32.png) [@Jack\_Lin2](https://community.br-automation.com/u/Jack_Lin2)\ **Post date:** [June 5, 2026, 6:19pm UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471/3 "2026-06-05T18:19:45Z")
Hey Alexander, Thank you this worked, but perhaps a bit too well… This PLC will be connected via ethernet to an Ignition Server, and it will talk to it with OPCUA tags. Securing the ANSL protocol also secures the OPC server: ![image](https://europe1.discourse-cdn.com/brcommunity/original/2X/b/b2438a467324350a972dfae7049dd0f550bb60f3.png) I’ve tried both the secure and non-secure options. ![image](https://europe1.discourse-cdn.com/brcommunity/original/2X/7/70963141b8910398ed3741ce6786fa8e7b2bfa9d.png) I can connect with Ignition again if I reconfigure this OPC connection with the Administrator login I created, but I actually do not want that for this project. I want the OPCUA tags to be freely accessible, and only the ability to upload and download to be secured. Would that be possible at all? Secondary Question: After doing some research, I learned that B&R PLCs only store compiled code, so uploading from them isn’t even possible. I’m assuming that if I never upload code backup to its flash onboard, then an end user wouldn’t be able to upload programmable code from the PLCs by any means? Thanks you, Jack ---
**Author:** ![alexander.hefner](https://dub1.discourse-cdn.com/brcommunity/user_avatar/community.br-automation.com/alexander.hefner/32/111_2.png) [@alexander.hefner](https://community.br-automation.com/u/alexander.hefner)\ **Post date:** [June 5, 2026, 6:32pm UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471/4 "2026-06-05T18:32:22Z")
Hi, as I know, OPC UA server and ANSL operate completely independent. So securing ANSL via TLS should not influence OPC UA and vice versa (you can / should create own TLS configurations with different certificates for each protocol). Yes you’re right, the system works with compiled code, so uploading modules is not possible and won’t enable source code access. Nevertheless, securing online connection is not a bad idea, because you can also prevent that for example that variable values can be accessed / changed, and to suspress other reverse engineering techniques. Best regards! ---
**Author:** ![Jack\_Lin2](https://avatars.discourse-cdn.com/v4/letter/j/FF8800/32.png) [@Jack\_Lin2](https://community.br-automation.com/u/Jack_Lin2)\ **Post date:** [June 5, 2026, 8:13pm UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471/5 "2026-06-05T20:13:46Z")
Hmm, so it seems like an ANSL setting got messed up in on my last download… Every time I try to transfer, I get this error: ![image](https://europe1.discourse-cdn.com/brcommunity/original/2X/8/8cbca6e98d05765b8a21f058fcb36cbb0939a3d7.png) Online settings no longer asks me for a Username and Password, even though I’m pretty sure I left Online Authentication on. I believe my situation might be similar to what’s described in this thread: [A connection via ANLS is needed to execute transfer properly error - Ask Questions / Mechatronics & Motion - B&R Community](https://community.br-automation.com/t/a-connection-via-anls-is-needed-to-execute-transfer-properly-error/5352) but the /INA=0 trick is not working for me. Where could I have went wrong to get this error? This question is more of a troubleshooting one, let me know if I should post it as a seperate thread. Thanks, Jack ---
**Author:** ![alexander.hefner](https://dub1.discourse-cdn.com/brcommunity/user_avatar/community.br-automation.com/alexander.hefner/32/111_2.png) [@alexander.hefner](https://community.br-automation.com/u/alexander.hefner)\ **Post date:** [June 6, 2026, 4:04am UTC](https://community.br-automation.com/t/locking-out-end-user-from-uploading-or-downloading-to-plc-as-v4-12/11471/6 "2026-06-06T04:04:46Z")
Hi, it looks like you’re now online via INA, yes. This can be the case, if INA as online protocol is still activated (in Automation Studio 4), and ANSL is not (longer) reachable. For example when using ArSim, Automation Studio will try to fallback to INA if ANSL is not reachable (this is what is prevented by /INA=0, but this does not change the availability of an ANSL connection). If you have setup ANSL TLS with a SSL configuration and tranferred this setup.to the PLC, then you have to change your Automation Studio Online setting also to this new setup. As I remember in a SSL setup you have to: - change the destination port number from (default) 11169 to (default) 11179 - in a column in the online settings named “SSL configuration” (or similar) you have to set the path to the SSL configuration in your project that is used with this ANSL connection. **EDIT:** I just created a small HowTo about setup and online connection. > [@How to setup and use a ANSL TLS online connection (AS 4)](https://community.br-automation.com/t/how-to-setup-and-use-a-ansl-tls-online-connection-as-4/11477): > > Hi, as I was asked a few times about TLS secured Automation Studio Online connection with Automation Studio 4, I decided to create a short walkthrough here. All of the information below is also available in the Automation Help, but I thought it makes sense to bring together the infos dedicated to ANSL TLS in one place, and shrink them to the minimum needed. This guide is not intended to explain in detail all steps and functionality behind, and also not about reaching a maximum of security! I… If you additionally have an user role authentication setup, the user + password dialog will pop up earliest after a SSL communication to the PLC was established. So from issue description, I would recommend to check the online settings in Automation Studio and set them to the parameters needed for a TLS online communication, if you’ve configured this on the PLC (I think so). Best regards! PS, independent of your actual issue: when securing an online connection to prevent unauthorized online access, you have then also to deactivate INA in the PLCs ETH interfaces parameters.