AVEVA Releases System Platform 2023 R2 SP1 Patch 03

AVEVA released System Platform 2023 R2 SP1 Patch 03 (P03) in October 2025. This is a cumulative patch that includes all fixes from P01 and P02, plus a fresh batch of its own. I’ve gone through every ReadMe file so you don’t have to. Here’s what’s in this patch, what I think matters, and whether it’s worth your time.

TL;DR: P03 is lighter on bug fixes than P02, but it brings two meaningful security improvements (restricted DLL loading and JavaScript restrictions in the IDE) and fixes some stubborn issues — particularly around InTouch memory leaks from EnableDisableKeys(), OMI Embed function blackouts, and a nasty Historian bug where InTouch data was being sent to Insight at 10x the actual value. If you’re running 2023 R2 SP1 in production, this is a straightforward upgrade.

What’s Included

Application Server & OMI: 23.1.103
Communication Drivers Pack: 23.02.103
Historian: 23.1.103
Historian Client: 23.1.103
InTouch HMI (all languages): 23.1.103
OMI Web: 1.0.400.0
Platform Common Services: 8.2.25264.1 (PCS 8.2.1)

Prerequisite: P03 can be installed on nodes running System Platform 2023 R2 SP1, SP1 Patch 01, or SP1 Patch 02. It automatically includes all fixes from P01 and P02.

What’s New

This patch actually has some feature content — unusual for a point release.

Simplified Silent Installation

No more response files. P03 streamlines the silent installation process, which is a welcome quality-of-life improvement for anyone managing multi-node deployments. If you’ve ever wrestled with crafting response files for automated installs, you’ll appreciate this.

Restricted DLL Loading (Registry-Based)

This is the headline security improvement. P03 introduces a registry-based mechanism that controls which directories are permitted for library loading, reducing the risk of malicious or unintended DLLs being loaded.

Disabled by default — enable it in test environments first
Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\AVEVA\SystemPlatform\SECURITY
Value: EnableRestrictedDllLoading (DWORD: 0 = Disabled, 1 = Enabled)

My take: This is clearly AVEVA responding to the broader industry push toward supply chain security and DLL hijacking prevention. The fact that it’s disabled by default now but will be enabled by default in the next release — and eventually forced with no opt-out — tells you where this is heading. If you have custom AOT objects, script libraries, or IDE extensions, start testing with this enabled now. You’ll save yourself a headache later.

Restricted JavaScript in IDE Object Help Files

JavaScript in the IDE’s object help editor is now disabled by default. You can re-enable it via registry if needed:

Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\AVEVA\SystemPlatform\SECURITY
Value: EnableJavaScriptInHelpDialog (DWORD: 0 = Disabled, 1 = Enabled)

WindowViewer Service Account Lockdown

The WindowViewer Virtual Service Account has been removed from the Administrators group. It’s now only in ASBSolution, ArchestrAWebHosting, and aaRuntimeUsers.

Important: After upgrading, managed applications running as a service must be redeployed to ensure correct permissions. If a standalone app was created in a protected path, the WindowViewer service may fail to start with “Access Denied” — you’ll need to manually grant the VIEW service account read/write permissions to the application folder.

StringCompareEncrypted() Deprecation Notice

The StringCompareEncrypted() script function will be deprecated in the next major release. In all upcoming P03-era patches, using it generates a warning in the Operations Control Logger. After the next major upgrade, it will always return 0 with no effect. Start planning your migration away from this function now.

Application Server Fixes (16 New Issues)

My pick for the most impactful fix: The MxDataProvider memory leak in multi-galaxy environments (3333465). If you’re running multi-galaxy setups and have noticed creeping memory consumption on your primary GR node, this is your fix.

3333465 — In multi-galaxy environments, MxDataProvider memory on the primary GR node kept increasing.
3844432 — IDE stopped responding when two IDEs (RDP sessions) were open on the GR.
3851390 — Opening an instance for the first time applied the selected default even when it wasn’t included.
3907421 — Runtime graphics looked different from configuration-time graphics.
3942065 — AlarmShelving warnings appeared in the standby engine.
3951200 — Changes to a master template removed some I/O scaling information.
3966348 — WindowMaker was slow to open or hung when saving minor modifications.
3971383 — Validation errors in the Logger caused aaGR.exe memory growth.
3976719 — Importing an aapkg file didn’t include the parent node in the navigation tree.
3983948 — Hierarchical names weren’t resolving at runtime.
3998140 — Alarm message translation took an extremely long time.
4003650 — Dependent DLLs weren’t imported into custom client controls.
4026669 — AlarmAck requests weren’t processed because the remote platform’s LMX version wasn’t received.
4029751 — Deploying managed InTouch applications took too long.
4064188 — State alarms didn’t trigger for Boolean attributes using buffered communication via Telemetry Server.

My take: The WindowMaker responsiveness fix (3966348) is one of those quality-of-life improvements that developers will notice immediately. The aaGR.exe memory growth fix (3971383) is also significant — memory leaks in the Galaxy Runtime engine have a way of causing mysterious production issues weeks after deployment.

AVEVA OMI Fixes (11 New Issues)

Desktop (6 Issues)

3917272 — After using the IDE for a while, Layouts and ViewApp templates wouldn’t open properly.
3919650 — Layout Editor opened multiple windows with the same identity.
3940646 — The Embed function didn’t resolve at runtime (showed ###) and random blackouts occurred.
3966657 — OMI stopped responding when a List Box AddItem script called for 400 items.
3990065 — String attributes containing ‘\r\n’ characters caused script execution to hang.
4070109 — Application Manager GUI didn’t follow regional time format.

Web Client (5 Issues)

3924629 — Title Bar home button had a different color in the web client vs. desktop.
3978121 — Elements with gradients rendered as solid colors in the web client.
3996762 — Transparency property didn’t work on group elements.
4042760 — Custom property expressions overridden in templates couldn’t compile at runtime.
4055729 — Application became unresponsive or crashed after initial loading; data stopped loading.

My take: The Embed function blackout fix (3940646) is the big one here. If you’ve been using EmbedContent() in your OMI layouts and experiencing random black screens, this should resolve it. The web client gradient rendering fix (3978121) is also welcome — anyone who’s spent time debugging why their beautiful gradient-filled elements look flat in the web client will understand.

InTouch HMI Fixes (26 New Issues)

The Headline Fixes

EnableDisableKeys() memory leak (3939033). This built-in function was constantly leaking memory. If you’ve been using EnableDisableKeys() in your InTouch scripts (and it’s a commonly used function), this fix alone is worth the upgrade.

NAD Clients not responding (4015231). When the NAD Host was unavailable, NAD Clients would just… stop. No recovery. This is the kind of thing that erodes confidence in distributed architectures.

All InTouch P03 Fixes

3719329 — Couldn’t paste/place selected InTouch Object from the Symbol Factory.
3728735 — 3-5 second delay populating graphics in applications using UDTs and Owning Object after deployment.
3742715 — WindowViewer not responding when switching windows before graphical objects fully loaded.
3805317 — Symbol revision number increased after first validation post-check-in.
3914845 — WindowMaker stopped responding after creating a UDT and assigning Log Deadband value.
3918592 — Alarm Client Control script filtering didn’t work with Finnish regional settings.
3933914 — German InTouch: Symbol Editor stopped responding after saving action script changes.
3939033 — Built-in EnableDisableKeys() function caused constant memory leaks.
3949590 — GetAlarm() function failed to retrieve alarms from the buffer.
3952152 — Couldn’t navigate the access name list with 10+ access names at 150%/125% resolution.
3957939 — Managed InTouch: clicking a FrameWindow configured in Overlay mode didn’t display the window.
3960140 — French InTouch: special characters displayed in Select Wizard screen.
3962068 — Existing Trend pens didn’t work in duplicated Historian projects.
3973364 — OMI Alarm Client Control displayed “Invalid Column name. Provider” error.
3981350 — Instances couldn’t acquire overridden properties of nested members.
3981615 — Timestamp filters didn’t save in Alarm Client Control with Finnish format.
3995500 — Sorting didn’t work correctly when Limit column had mixed data types.
3997056 — Alarm Client Control displayed incorrect values in exponential notation.
4001145 — Windows weren’t auto-compiling when WindowViewer opened.
4003330 — Number values and characters weren’t sorted correctly in ViewApp Alarm Client.
4009991 — Multiple statements on a single script line caused IntelliSense errors.
4010203 — Visibility animation in A2 graphics didn’t make elements visible on initial display — required an unrelated action first.
4015231 — NAD Clients not responding when NAD Host was unavailable.
4017390 — Alarm Client control not responding when Alarm Hot Backup query was used with many Galaxy queries.
4023123 — Font size issues when machine resolution changed and application language switched at runtime.
4049242 — Trend Client couldn’t resolve Historical Source references — only the first data grid row showed values.
4079735 — InTouch ViewApp stopped responding when WindowViewer launched.
4097470 — Couldn’t run DBLoad on applications with UDTs.

My take: The UDT-related fixes are a theme here — DBLoad failures (4097470), WindowMaker hangs after UDT creation (3914845), Trend pens not working in duplicated projects (3962068). If you’re heavily using UDTs in your InTouch applications, this patch addresses several pain points. The visibility animation bug (4010203) is one of those maddening issues where elements only appear after you click something else — glad it’s fixed.

Historian Fixes (4 New Issues)

IMS-3887122 — InTouch data going to Insight was 10x the actual value.
IMS-3997161 — Operator and DomainName columns were empty (NULL) in EventHistory view.
IMS-4046176 — Bad/NULL values weren’t handled correctly when replicating to PI Historian.
IMS-3188323 — Line charts on dashboards changed to column charts for shared links in Historian Client Web.

My take: The 10x data value bug (IMS-3887122) is the kind of thing that makes operations teams question their entire data pipeline. If anyone noticed that Insight numbers didn’t match what they expected, this was likely the culprit. The PI replication fix (IMS-4046176) is also important for anyone running multi-tier Historian architectures — bad data silently propagating to PI is a data integrity nightmare.

Historian Client Fixes (2 New Issues)

IMS-4009770 — Couldn’t save font size to .aatrend file.
IMS-3987337 — Error when creating dataviews for ComputeMovingAverages.

Communication Drivers Pack Fixes

Drivers Core (1 Issue)

4105971 — [SuiteLink] Closing a newly created SuiteLink client connection resulted in a thread handle leak.

WEBSVC Driver (2 Issues)

4066093 — WEBSVC driver couldn’t connect to a Web Service address due to custom token logic loading error.
(Internal) — Request Access Token didn’t work if the Client Secret included the ‘+’ symbol.

My take: The SuiteLink thread handle leak (4105971) is a quiet one — it won’t crash anything immediately, but over time, leaked handles accumulate. The WEBSVC fixes are niche but important if you’re using OAuth-based web service integrations. That ‘+’ in Client Secret issue is a classic URL-encoding gotcha.

Known Issues to Watch Out For

System Monitor Manager Configuration Block (Bug 4289884)

After installing P03, if you didn’t configure System Monitor Manager during the initial SP1 install, configuration may fail with: “Unable to connect System Monitor Manager. Error code – ServiceUnavailable”

Workaround: Complete all other product configuration first → close Configurator → let Galaxy Patcher finish → restart → open Services.msc → set Sentinel Console Service to Automatic → start the service → reopen Configurator → configure System Monitor Manager.

Workflow Gateway Objects Cause Licensing/Deploy Failures (IMS 4150446 / IMS 4222218)

If your Galaxy includes AVEVA Workflow Gateway objects, applying P03 may cause licensing errors, deploy failures, or IDE not opening with AVEVA CONNECT SSO.

Workaround: Copy these 4 files from ...\AuthenticationProvider\ to ...\Bin\, then restart:

Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Microsoft.Extensions.Logging.Abstractions.dll
PCS.Client.DataStore.dll

My take: This DLL copy workaround pattern keeps showing up in every patch (it was the same story with P02 and Work Tasks). It’s annoying but straightforward. I’d recommend AVEVA address this pattern permanently — having to manually copy DLLs after every patch is not a sustainable workflow.

Historian Known Issues

“Add External Groups” button greyed out after install — relaunch Configurator
Database Export/Import errors when importing from SP2023 R2 or earlier — upgrade source Historian to P01+ first
Workgroup environments: secure Client-to-Server communication may fail — add hosts file entry
Asset field non-functional in Add Comment dialog (Historian Web Client Modern)
Excel Add-In fails when license mode is connected experience with trusted connections required
Replicated tag removed after Stream datatype change — re-add with new destination tag name
AutoSummary replication Store and Forward path can’t be changed via Configurator — requires manual SQL update
OData V1 deprecation warning: migrate to OData V2 now

InTouch HMI Known Issues

2897808 — SignedAlarmAck not supported with connected experience
1928318 — Supertags from CSV import not visible in WindowMaker pane — view in tag dictionary instead
1826926 — Embedded MapApp widget doesn’t load in WindowViewer — copy dbghelp.dll and configure registry
Carousel Widget doesn’t support runtime language switching
Carousel Widget with Web Browser/Trend/Alarm controls won’t display correctly in WindowViewer

Should You Upgrade? My Recommendation

Yes, upgrade if:

You’re using EnableDisableKeys() in InTouch scripts — the memory leak fix is important
You’ve noticed MxDataProvider memory growth in multi-galaxy environments
Your OMI layouts use EmbedContent() and you’ve experienced blackouts
InTouch data going to Insight looks wrong (the 10x multiplier bug)
You’re using UDTs heavily and hitting DBLoad failures or WindowMaker hangs
You want to start testing the restricted DLL loading feature before it becomes mandatory
You need simplified silent installation for automated deployments

You can probably wait if:

You’re on P02 and none of the P03 fixes address issues you’re experiencing
Your system is stable and you’re in a tight change window
You don’t use UDTs, multi-galaxy setups, or the specific features affected

Upgrade tips:

Back up your Galaxy and Historian databases before patching
If you have Workflow Gateway objects, prepare the 4-DLL copy workaround in advance
Redeploy all managed InTouch applications running as a service — the WindowViewer service account permissions have changed
Test the restricted DLL loading feature in a non-production environment
Plan for a maintenance window — this isn’t a zero-downtime patch
After upgrading, relaunch the Configurator to avoid the “Add External Groups” greyed-out issue

Final Thoughts

Patch 03 feels like a maturing release. The security improvements (restricted DLL loading, JavaScript restrictions, service account lockdown) signal that AVEVA is thinking ahead about the security posture of the platform — not just reacting to bugs. The simplified silent installation is a small but meaningful improvement for operations teams.

On the bug-fix side, it’s not as dramatic as P02’s InTouch memory leak extravaganza, but it addresses real pain points — particularly the EnableDisableKeys() leak, the OMI Embed blackouts, and that eyebrow-raising 10x data multiplier in Historian-to-Insight. The UDT-related fixes across InTouch suggest AVEVA has been listening to feedback from teams using UDTs at scale.

The recurring DLL copy workaround for licensing issues is getting old. Three patches in a row now. It’s time for a permanent fix.

Bottom line: if you’re on 2023 R2 SP1, P03 is a safe and worthwhile upgrade. The security improvements alone make it forward-looking, and the bug fixes address enough real-world issues to justify the maintenance window.