FactoryTalk AssetCentre: Do You Need It, What It Costs, and How to Run It

Ask practitioners about FactoryTalk AssetCentre and you get two verdicts. “No plant should go without having this product,” an engineer wrote on Reddit in 2022. “Expensive. Limited. If you have only Rockwell products it’s alright,” another wrote in 2023. Both are right, about different plants.

This guide covers FactoryTalk AssetCentre, Rockwell Automation’s software for backing up, versioning and comparing plant automation files, as of version 16.00.00 (November 2025). Its position is plain: AssetCentre is a fairly simple tool, and a properly managed shared drive, run with real versioning and backup discipline, solves most of what it solves. Evaluate before you spend. What a shared drive cannot do is upload from running controllers on a schedule and flag the ones that no longer match the approved version. That is what the money buys, and some plants need it.

Vladimir Romanov, Joltek’s founder, has worked on multiple projects centered on AssetCentre, deployed it at four plants and worked at more than a dozen sites that run it. In those plants the installs mostly went smoothly, and most of the work was with IT. The hard part came after go-live: getting people to use the system instead of saving programs on their own PCs.

The guide has two halves:

• Part 1, the decision, is for the engineering manager or director. It covers what AssetCentre is, the shared-drive test, who it fits, how it is licensed, what it backs up beyond Rockwell devices, and how it compares with FactoryTalk Vault, Git, Copia and SDA.
• Part 2, running it, is for the engineer who owns it. It covers the architecture, installation, the asset tree and schedules, reading compare results, the operating model, securing the server, failures by symptom, and rescuing a deployment that is going badly.

It builds on Joltek’s field guide to PLC version control, which covers the wider choice of tools.

Part 1: the decision. Written for the engineering manager or director deciding whether to buy, expand or fix an AssetCentre system.

What is FactoryTalk AssetCentre?

FactoryTalk AssetCentre is Rockwell Automation’s on-premises server for plant automation files. Its base package versions files through check-in and check-out and logs who changed what. Its Disaster Recovery option adds agents that upload programs from running controllers, HMIs, drives and some other vendors’ devices on a schedule, and compare them with the approved version.

AssetCentre is a set of Windows services around a SQL Server database. Rockwell sells it in pieces, and the pieces matter, because a plant that bought “AssetCentre” may own only some of them.

What comes with the server:

• The Archive. Engineers check files out to a local working folder, change them, and check them back in. Every check-in where the file actually changed becomes a new version, and any version can be pinned as the master, the copy everyone else gets and the copy scheduled jobs compare against. Labels group one version of several files, such as a release.
• Logs. The audit log records what users do in FactoryTalk software, such as going online with a ControlLogix controller and deleting a rung. The event log records what AssetCentre itself does, and a diagnostics and health log collects system messages.
• Security. Access to every action is controlled through FactoryTalk Security.

Rockwell’s Help is explicit that the Archive, the logs and the address book need no extra capability licence. Disaster Recovery has to be bought:

• Backup and compare. An agent uploads a device’s program on a schedule, stores it, and compares it with the master.
• Change Detect. For Logix controllers that support it, AssetCentre reads the controller’s own change log. That includes changes programming software cannot see, such as a keyswitch mode change.
• Source Code Validation. On ControlLogix 5580, CompactLogix 5380 and 5480 and their GuardLogix versions at firmware 34 or later, it checks for signs of a published code-injection vulnerability.

Asset Inventory scans the network for devices and pulls Rockwell’s lifecycle status for each one. Version 16 added security posture checks for Logix controllers: rules that flag a controller in the wrong mode, with forces on, or with its web pages enabled.

A Logix backup shows how the parts fit. The agent asks the server for the archived ACD file, opens the matching version of Studio 5000 Logix Designer, goes online through FactoryTalk Linx or RSLinx, uploads the controller to a new ACD, and sends it back to the server, which stores it as the latest revision.

The product has grown by accretion, which is why the documentation reads in layers. Rockwell’s product page and version history and the Help date the main steps:

• Change Detect from 4.10;
• Management of Change and Source Code Validation from 11.00;
• the web client, TIA Portal and Mitsubishi support from 13.00;
• Schneider and remote FactoryTalk Directories from 15.00;
• security posture checks, FactoryTalk Optix and SFTP from 16.00.

For how AssetCentre fits Rockwell’s controller version control story, see Joltek’s page on how AssetCentre handles controller version control, and the FactoryTalk portfolio for the products around it.

Do you need AssetCentre, or will a managed shared drive do?

Most plants need the discipline more than the tool. A shared drive with a fixed folder structure, version naming, read-only approved copies and tested backups covers most of what AssetCentre’s archive does. A shared drive cannot upload from running controllers on a schedule and flag the ones that no longer match the approved version. That is what the money buys.

In Vladimir’s view, AssetCentre is a fairly simple tool, and most of the problems plants buy it to solve can be solved with a properly managed shared drive and good habits around versioning and backups. The mistake Vladimir sees most often is buying first and evaluating later.

What a well-run shared drive does:

• one folder per line and machine, the same structure everywhere;
• a version name and a comment on every saved program;
• the approved copy of each program kept read-only, with a named person allowed to replace it;
• backups that are actually restored now and then, to prove they work.

That covers the core of AssetCentre’s Archive: versions, an approved master and controlled access. It costs time and discipline rather than licences.

What a shared drive cannot do:

• It cannot look at the running device. It holds only what people choose to save. A Disaster Recovery schedule uploads what is actually in the controller and compares it with the master.
• It cannot catch online edits nobody saved. One practitioner put the gap plainly: “Managing by an IT backup does not give you the latest version on the machine.”
• It records no audit trail from the programming software. AssetCentre collects audit messages from FactoryTalk products, such as each edit made online in Logix Designer.
• It cannot read the controller’s change log. Change Detect can, and it sees things a file never shows, such as a keyswitch moved to Program.

The honest boundary, then: a plant needs AssetCentre, or something like it, when the gap between the file and the running device is a real risk. That is a plant with many devices, many hands on the code, online edits that do not always get saved, outsiders such as machine builders changing programs, or an auditor who wants proof.

How to evaluate before spending:

1. Count the devices, by vendor and type: controllers, HMIs, drives, switches, robots. The count drives both the decision and, if it comes to that, the quote.
2. Run the shared-drive discipline for a quarter. Structure, naming, read-only masters, a restore test.
3. Measure the gap. Upload a sample of controllers by hand each month and compare them with the approved files. If they keep differing, the plant has the problem AssetCentre solves.
4. Then decide, with real numbers on how often programs drift and what a wrong one would cost.

Joltek’s guide to what to back up and how to prove a restore works covers the backup half of that discipline in detail. A plant systems assessment produces the device inventory in step 1 as part of a wider installed-base review.

Who is AssetCentre for: plants, machine builders or integrators?

It is built for plants maintaining what they run: scheduled backups of running equipment, a pinned master and an audit trail. Machine builders and integrators doing development often find it a poor fit. It has only major versions with no branching, it needs a Windows server and SQL Server, and practitioners in those roles report using Git for development instead.

AssetCentre’s design follows the plant’s question: is what runs on the floor what we approved?

• The master. One pinned version per device, used by every scheduled compare.
• The schedule. Agents that visit every device, whether or not anyone remembered to save.
• The record. Audit and event logs that show who did what.

Development work asks different questions: what changed between two branches of a project, and how do two engineers’ changes come together?

• Versions are a single line. The Archive keeps major versions only, with no minor versions, and nothing like branching.
• Design mode is one person at a time. Only one user in the whole system can be in Design mode, which is where the asset tree is edited.
• The overhead is real. A Windows server, SQL Server and a FactoryTalk Directory are a lot of infrastructure for a builder’s engineering office.

The community splits along exactly this line. An OEM engineer asked in 2019 whether AssetCentre was usable for active development before a panel was powered. One reply in that thread, from an engineer at an OEM that ran both AssetCentre and a Git service, was blunt: “AssetCentre is laughably bad at this.” Plant users in other threads are far warmer, because they are using it for what it was built for.

The practical split: a plant maintaining Rockwell-heavy lines is AssetCentre’s natural user. A builder or integrator developing code is better served by Git-based tools, and can hand a finished, approved project to the plant’s AssetCentre at commissioning.

How is FactoryTalk AssetCentre licensed, and what does it cost?

Rockwell publishes no price. AssetCentre is sold as a perpetual licence or a subscription, sized by asset count. The base package is the server and 10 assets. The Standard package adds 100 assets and Disaster Recovery for Rockwell devices. Each other vendor’s backup, the approval workflow and security monitoring are separate options, and SQL Server is extra.

No price list for FactoryTalk AssetCentre is public. Rockwell’s own commerce page shows none, and distributors quote on request. What Rockwell does publish, in its April 2026 ordering guide, is the structure, and the structure is most of what a buyer needs to get a sensible quote.

Two ways to buy:

• Perpetual (catalog numbers beginning 9515M): a one-time payment with first-year support. After that, support must be maintained separately to get new versions.
• Subscription (9515C): a timed licence with recurring payments and 8x5 support included.

Two packages:

• Base: the server and 10 assets, with version control, event and audit logging, and security. SQL Server is required but not included.
• Standard: the server, 100 assets and Disaster Recovery for Rockwell Automation devices. Asset Inventory is included only with the subscription.

Options, each sold separately:

Option	What it adds
Disaster Recovery for Rockwell Automation	Backup and compare for Logix controllers, PowerFlex drives, E300 relays, Stratix switches, PanelView Plus and FactoryTalk View SE
Disaster Recovery for Generic FTP	Devices that host an FTP, FTPS or SFTP server, such as ABB and FANUC robots and Cognex cameras
Disaster Recovery for Siemens TIA Portal	S7-1200, S7-1500 and ET 200 controllers, TIA Portal V15.1 or later
Disaster Recovery for Schneider Control Expert	M340 and M580 controllers, Control Expert 15.2 or later
Disaster Recovery for Mitsubishi	iQ-R, iQ-F, Q, L and F controllers, through GX Works3 or GX Works2
Disaster Recovery for Motoman	Motoman robots over FTP
Disaster Recovery for Remote Computer	A shared folder on another computer
Inventory Agent	Device discovery across Ethernet, ControlNet, DeviceNet, DH+ and DH-485 networks, with lifecycle data
Security Compliance Monitoring	Security posture checks on controllers
Archive Management of Change	An electronic signature workflow for check-out and check-in
Capacity add-ons	100 or 25 more assets; 4 more agent groups

Source: FactoryTalk AssetCentre Ordering Guide, FTALK-SG004A-EN-P, April 2026.

What counts as an asset. Only device assets count toward capacity: controllers, drives, HMIs, switches, robots and the like. Files, folders, binders, containers, generic devices and Asset Inventory assets are unlimited. Two details change the count:

• Drives inside the controller project ride free. A drive whose configuration is managed in Logix Designer is part of the controller’s ACD file, so it needs no asset of its own.
• Old assets keep counting. Process-device assets left over from versions 9.00 and earlier still consume capacity after an upgrade, even though the features behind them are gone.

Rockwell’s ordering guide works two examples:

Plant	Devices	Assets needed	Rockwell’s recommendation
60 Logix controllers, 30 PowerFlex drives configured inside the controller projects, 30 PanelView Plus 7 terminals	120	90	Perpetual Standard package (100 assets), 24x7 support
115 Logix controllers, 30 Siemens S7-1500, 200 ABB robots, 5 FactoryTalk View SE, scanning 15 VLANs	350 devices plus inventory scans	365	Subscription Standard package, plus TIA Portal, Generic FTP and Security Compliance Monitoring options, and three 100-asset add-ons

Source: FactoryTalk AssetCentre Ordering Guide, FTALK-SG004A-EN-P, April 2026.

When a licence lapses. A time-based activation warns at each desktop client launch from 45 days before expiry. Rockwell’s activation and licensing Help sets out what an expired server activation does:

• users cannot enter Design mode or view logs;
• users cannot perform archive operations, except getting a file;
• an expired Disaster Recovery activation stops schedules from being created, run or changed.

The web client gives no warning of an expiry.

The cost beyond the licence:

• SQL Server, licensed separately;
• server hardware, sized in the next part of this guide;
• support after the first year on a perpetual licence;
• setup labor. The one figure in public view is old: in 2017 a Reddit poster said a reseller wanted $15,000 to install and configure AssetCentre at a site with about 50 PLCs, on top of the licence. Treat it as one data point, not a price.

Getting a real quote. Bring the device count, split by vendor and type. Mark which drives are configured inside controller projects, and say whether the plant wants perpetual or subscription. With that, the quote is a matter of arithmetic on the structure above.

What does AssetCentre back up and compare, device by device?

Rockwell devices get the deepest support. Logix projects are uploaded and compared logic by logic with the Logix Designer Compare Tool. Siemens TIA Portal V15.1 to V19, Schneider Control Expert and Mitsubishi GX Works work only through the vendor’s own software on the agent. Robots and other FTP devices are backed up as files and compared by checksum unless a compare tool is added.

“AssetCentre backs up Siemens” is true, and it hides most of what matters. The table sets out what version 16 does with each device family, from Rockwell’s Help, release notes and ordering guide.

Device family	How it is backed up	How it is compared	What it needs
Logix 5000 (ControlLogix, CompactLogix, GuardLogix)	Upload through Studio 5000 Logix Designer on the agent	Logix Designer Compare Tool, logic by logic	The matching Logix Designer version; FactoryTalk Linx only at firmware 38 or later
PLC-5, SLC 500, MicroLogix	Upload through RSLogix 5 or RSLogix 500	Rockwell’s compare viewer	RSLogix 5 10.00 or later, RSLogix 500 12.00 or later; RSLogix 5 is not supported on Windows 11 24H2 or Server 2025
PowerFlex drives, E300 relays	Drive backup files through bundled drive software	Rockwell’s compare viewer	Drives configured inside a Logix project are backed up with it; an E300 on a Class 1 connection cannot be backed up
PanelView Plus, MobileView	The .MER application	Rockwell’s compare viewer	FactoryTalk View ME on the agent, FactoryTalk Linx on the client
FactoryTalk View SE	The whole network application	Checksum only	View Studio Enterprise on the agent, and the FactoryTalk Directory available
FactoryTalk Optix	The .optixz project	Backup and compare	Version 16 or later; Optix Studio 1.6.4 or later applications; runtime data such as recipes and users is not captured
Stratix switches	Configuration files over Telnet or SSH	Text compare of the configuration; checksum for the rest	Password authentication and an administrative user
FactoryTalk Directory	Applications or the whole directory	Binary, and it always reports a difference	Disaster Recovery for Rockwell Automation
Siemens S7-1200, S7-1500, ET 200	Through TIA Portal V15.1 to V19 and TIA Openness on the agent	Through TIA Portal on the agent	The agent as a desktop application, FIPS off, minimum firmware per CPU; no S7-1500 R/H, T or software CPUs
Siemens S7-300, S7-400, S5	Through STEP 7 5.6 SP1 or later	Rockwell’s compare options, with SIMATIC Manager on the client	A manual install in version 16 that Rockwell “no longer updates”
Schneider M340, M580, M580 Safety	Through Control Expert 15.2, 15.3 or 16	Through Control Expert’s comparison component	Projects with a file password: backup only; no MC80, Atrium or M580 hot standby
Mitsubishi iQ-R, iQ-F, Q, L, F	Through GX Works3 or GX Works2	Through GX Works on the agent	Listed CPU models only; one file-access password per project
ABB, FANUC and Motoman robots, Cognex cameras, other FTP devices	File backup over FTP, FTPS or SFTP	Checksum, unless a compare engine is set up	Files in the upload directory only; subdirectories are ignored
Shared folders (Remote Computer)	A copy of a network share	Verifies the folder’s contents	Locked or open files cannot be backed up
Anything else (Custom Device)	Your own backup command	Your own compare command	Scripts you write and maintain

Sources: FactoryTalk AssetCentre 16.00.00 Help, release notes and Ordering Guide (FTALK-SG004A-EN-P). Version 16 behavior, as of October 2026.

What every non-Rockwell family shares. Siemens TIA Portal, Mitsubishi and Schneider backups need four things on every agent that serves them:

• The vendor’s engineering software, installed there. Rockwell’s word is “MUST”.
• The agent running as a desktop application under a named Windows domain user, not as a service. Rockwell requires that mode for these device families.
• FIPS mode turned off.
• The right versions. The TIA Portal device table stops at V19 and sets a minimum firmware for each CPU family, higher still for certificate-protected communication. The backup file, the configuration file and the TIA Portal version must all match.

Two warnings follow from the release notes:

• Schneider: uninstalling or upgrading Control Expert on an agent breaks the agent, because the Schneider installer affects FactoryTalk Services Platform. The fix is to repair the AssetCentre agent.
• Siemens S7-300 and S7-400: recovery became a manual install in version 16. Rockwell says installing it “could reduce the system’s security”.

What is not covered at all:

• Design Studio projects. Logix projects created in FactoryTalk Design Studio cannot be backed up, compared or validated, because Logix Designer cannot upload them. Change Detect and posture checks still work.
• Licence-protected ACDs without the dongle. Disaster recovery fails unless the licence device is on the agent, and nothing is written to the event log.
• Vendors with no asset type. KUKA, Omron and others appear nowhere in Rockwell’s lists. They are reachable only through Generic FTP, Remote Computer or a Custom Device script.

Source-protected routines can be compared. Rockwell’s Help says the Logix compare covers protected content when the source key is configured and the key file is present on every agent.

Inventory has limits too. Asset Inventory’s CIP scan uses RSLinx Classic and finds Rockwell devices only. Its SNMP scan supports version 2 but not version 3, and does not add Siemens devices. The difference between network-based and configuration-based inventory is covered in Joltek’s page on network-based and configuration-based inventory.

For FactoryTalk Optix, Rockwell’s own Optix version control page confirms the dependency: the feature “requires FactoryTalk AssetCentre version 16 or later with the Disaster Recovery license”.

How does AssetCentre compare with FactoryTalk Vault, Git, Copia and SDA?

They solve different parts of the problem. AssetCentre schedules backups of running equipment, on premises. FactoryTalk Vault is Rockwell’s cloud storage for project files in FactoryTalk Hub. Git versions text exports, with branches and merges. Copia and SDA combine Git-style source control with device backups across vendors, offered as cloud services with on-premises options.

The alternatives are not five versions of the same product. Each starts from a different question, and the right one depends on which question the plant is asking.

	FactoryTalk AssetCentre	FactoryTalk Vault	Git with exports	Copia	SDA
Where files live	The plant’s SQL Server	Rockwell’s cloud, in FactoryTalk Hub	Any Git server	Cloud (AWS); customer-managed options announced	Cloud or on premises, per the vendor
Uploads from running devices on a schedule	Yes, with Disaster Recovery	Not described	No	Yes, through its DeviceLink agent	Yes, through automated backup
Branching and merging	No	No	Yes	Yes	TIA Portal only, in beta
Vendors	Rockwell first; Siemens, Schneider, Mitsubishi and FTP devices by option	Rockwell Logix files	Any vendor that exports text	Many, per its vendor list	12 vendors on its published list
Published price	No	Free with a Studio 5000 support agreement	Free tools; hosting varies	No	Per device, on request

Sources: Rockwell FactoryTalk Vault Help and What's New page; Rockwell's ra-logix-designer-vcs-custom-tools repository on GitHub; Copia product and documentation pages; Software Defined Automation product, pricing and documentation pages. Vendor statements, read October 2026.

FactoryTalk Vault is easily confused with AssetCentre, and it is a different thing. Rockwell’s Vault Help describes it as “the secure storage space provided with FactoryTalk Hub”, used to share, back up and version Logix project files that people upload, with history and revert. Rockwell describes no scheduled upload from running controllers, and its AssetCentre documents do not mention Vault.

Git versions text, and Logix projects can be exported as text. Rockwell publishes its own MIT-licensed tooling, ra-logix-designer-vcs-custom-tools. It explodes an L5X export into text files, commits and diffs them through Git, and converts back to an ACD with the Logix Designer SDK.

Copia and SDA come from the Git side. Copia’s source control product offers Git branching and merging with rendered ladder logic, and its DeviceLink agent takes scheduled device backups. Software Defined Automation sells automated backup, version control and browser-based engineering per device, and lists 12 automation vendors in its documentation. Both describe themselves in their own terms, and both should be tested on the plant’s own devices before a decision.

AssetCentre and Git can work together. A PLCtalk post from 2020 describes a plant where AssetCentre backed up about 95 PLCs daily and a script used Rockwell’s Archive Extractor utility to commit the backups to Git. AssetCentre handled the upload; Git handled the history.

Joltek’s full tool-by-tool comparison covers the wider market, and its page on Git against approved versions explains the two models.

Part 2: running it. Written for the engineer who installs, owns or inherits an AssetCentre system.

What does an AssetCentre system look like?

A Windows server runs the AssetCentre server and IIS. A SQL Server database holds every archived file and log. A FactoryTalk Directory holds users and security. Agents do the uploads, and desktop or web clients do the work. Rockwell allows one AssetCentre server per FactoryTalk Directory and qualifies up to 100 agents, 150 desktop clients and 200 web clients.

The parts:

• The AssetCentre server. Windows services that schedule work, hold the asset tree and serve the web client through IIS.
• SQL Server. Everything lives here: archived files, logs and the system’s own configuration. A second database holds the Management of Change workflow.
• The FactoryTalk Directory. Users, groups and permissions. A user must authenticate against it to use AssetCentre at all.
• Agents. The machines that do the work: uploads, compares, inventory scans and scheduled searches. Every system needs at least one.
• Clients. The desktop client does everything. The web client cannot edit the asset tree, but it can check files in and out, run schedules and view logs. It is designed for Windows devices, not phones or tablets.

Sizing. Rockwell defines three system sizes:

Size	Layout	Agents	Desktop clients	Web clients
Small	AssetCentre server, SQL Server and FactoryTalk Directory on one computer	1 to 5	10	25
Medium	AssetCentre server and SQL Server together; the Directory on its own computer	6 to 25	60	100
Large	All three on separate computers	26 to 50	100 to 150	200

Source: FactoryTalk AssetCentre 16.00.00 release notes and Installation Guide (FTAC-IN005N).

The limits that bite:

• One server per Directory. Rockwell’s limit of one AssetCentre server per FactoryTalk Directory “cannot be exceeded”.
• Agent throughput. A single agent services about 100 assets every 12 hours, depending on the network and the programs.
• Agent groups. Rockwell tested up to five agents per agent group.
• System totals. The qualified limits are 100 agents (no more than 50 remote), 100 agent groups, 150 desktop clients and 200 web clients.

Hardware. Rockwell recommends 2 cores and 8 GB of RAM for a small-system server, and 4 cores and 16 GB for medium and large ones, physical or virtual. The release notes give virtual machine sizing, but no source names a supported hypervisor. None describes clustering or a redundant AssetCentre server either.

What resilience exists:

• SQL Server database mirroring;
• the Archive Extractor, which pulls every file out to a folder while the server is down;
• clients that cache audit and event messages, up to 4 GB, until the server returns.

Network. AssetCentre’s own ports are TCP 7002 for the server and TCP 7004 for the agent controller. On top of those come SQL Server (1433), IIS (443, or 80 without HTTPS), FactoryTalk Directory, FactoryTalk Linx, activation and EtherNet/IP ports, plus a wide dynamic range for DCOM. Rockwell’s firewall guide lists them all, and recommends Remote Desktop Services rather than opening that many ports through a firewall. The same advice covers links slower than 100 Mbps.

Domains. The server, the agents and the desktop clients must sit in the same Windows domain, in trusted domains or in the same workgroup. A mixed domain and workgroup setup does not work. Management of Change needs a domain. Engineers working from outside the plant should come in through a controlled path. Joltek’s guide to remote access for engineers and vendors covers the options.

How do you install or upgrade AssetCentre?

Treat it as an IT project. Agree the server, SQL Server version and collation, service accounts, ports and certificates with IT before the media arrives. Record the database encryption passphrase, and back up both databases before any upgrade. Every component must run the same version, so the server, agents and clients upgrade together.

In the plants Vladimir has worked in, the installs mostly went smoothly. Most of the work was with IT: servers, accounts, SQL Server and the network. Rockwell’s Installation Guide has the steps. These are the decisions that are easy to get wrong.

Before installing:

• SQL Server. The version 16 release notes list SQL Server 2019 and 2022. Rockwell’s Help says Express, Standard and Enterprise editions all work, and that an existing instance can be reused. The collation must be SQL_Latin1_General_CP1_CI_AS, case-insensitive, or the database install fails. Include Full-Text and Semantic Extractions for Search.
• Service accounts. A remote SQL Server needs a standalone or group managed service account. When SQL Server sits on the AssetCentre server, a virtual account is used automatically. SQL Server authentication is “discouraged due to security concerns”.
• The FactoryTalk Directory mode. A new Directory can start in Standard mode, where any local administrator on any connected computer has full access, or in Secure mode, with a preset access list and HTTPS. Choose Secure deliberately.
• Windows quirks. AssetCentre 16 and earlier need VBScript to install, and VBScript became optional in Windows 11 24H2 and Windows Server 2025. A system disk with a sector size above 4 KB makes the install fail until a registry workaround is applied.
• Third-party connectors. The Siemens, Mitsubishi and Schneider connectors are unchecked by default. Selecting one asks for the Windows user the agent will run as.

The encryption passphrase. Since version 15, a key generated from a passphrase encrypts sensitive data in the database, such as device passwords. If the passphrase is lost, a new key can be generated. But the old encrypted data becomes unreadable, and schedules that depend on it fail until every credential is entered again. Rockwell lists 16 asset types that hold such credentials. Write the passphrase down where IT keeps its other recovery secrets.

Upgrades:

• Paths. Upgrades to 16.00.00 are documented from 7.00 and later. Older systems go to 7.00 first, and some paths need a log-retention patch along the way.
• Backups first. The upgrade to 15.00 starts an encryption key refresh, so back up the database before it. In practice, back up before any upgrade.
• Version lockstep. All components must run the same version. A client older than the server shows “The client and server versions are incompatible”. An older agent shows nothing: it simply does not run, and logs the reason in the Windows and AssetCentre event logs.
• Scheduled utilities. Upgrading to 15.00 or later clears the configuration of the cleanup and extractor utilities, so their Windows Task Scheduler jobs stop until they are set up again.
• The firmware 38 trap. Logix firmware 38 and later talks through FactoryTalk Linx only. A controller first added through RSLinx Classic and later upgraded to firmware 38 fails its scheduled backups until it is browsed again with FactoryTalk Linx.

Practitioners describe the version problem from the floor. In a 2024 Reddit reply, one wrote that most issues “derive from the client devices being updated semi-regularly, while the server install is basically never updated.”

Database care:

• Two databases, both backed up. The AssetCentre database and the Management of Change database.
• Full recovery model. The database installs that way, so the transaction log must be backed up too, or it grows without limit. Rockwell’s example is a weekly full backup and daily log backups, stored on a different drive.
• Auto-growth. Rockwell recommends 2,048 MB, because slow growth can time out the web server.
• Cleanup. Version 16 can shrink the database during a scheduled cleanup task, which removes old versions and log records. Rockwell says the first or last version of a file is always retained.

How should you design the asset tree, schedules and agent groups?

Mirror the plant: site, area, line, machine, with security set at the root and inherited down. Give every device a pinned master, schedule backup and compare by area outside production peaks, and size agents at about 100 assets per agent every 12 hours. Give third-party devices their own agent group, because those agents run differently.

The asset tree. It is the plant’s map inside AssetCentre:

• Security inherits downward. A new asset inherits its container’s settings, and a container its parent’s. Rockwell’s advice is to set security on the root first, then on containers, then add assets.
• Working folders. Each user needs a working folder to get files out of the Archive. A check-out recreates the tree’s folder structure on the local drive.
• Binders. A binder groups files that belong together, such as a drive’s project folder, and checks them in and out as a unit.

The master. Every device in a Disaster Recovery schedule needs Configuration Data: the archived file that schedules treat as the truth. By default the latest version is the master, and any version can be pinned instead. Disaster Recovery compares against the pinned master, while check-out hands engineers the latest version. Know which one each device points at.

Backup against Backup and Compare:

• Backup uploads the device and checks the result in, even if nothing changed.
• Backup and Compare uploads, compares with the master, and checks in only if told to. With “Promote New Upload to Master” turned on, any difference is checked in and becomes the new master automatically.

Promote-on-difference makes AssetCentre accept whatever is running. That suits some plants. In others it quietly blesses a change nobody approved.

Schedules:

• Containers pull devices in. A device added to a scheduled container joins the schedule at once. To leave one out, disable it in the schedule.
• Unsupported devices drop out. A device whose Disaster Recovery option the plant has not bought is excluded without fuss. Rockwell’s example is a Motoman robot in a plant without that option.
• Two reports. One says when the schedule ran and whether it found differences. The other details each asset, the agent and the master file used.

Agents:

• Groups must match inside. Agents in a group need identical RSLinx and FactoryTalk Linx drivers, reach to every asset, and every programming software the group’s devices need.
• Separate the third-party agents. Third-party agents run as desktop applications under a named user, so give them their own group.
• Not on engineering laptops. Rockwell supports agents on engineering workstations but does not recommend it.
• Remote groups. Since version 15, remote agent groups let one AssetCentre server reach devices in another FactoryTalk Directory.
• Change Detect scale. From version 16, one agent can watch up to 500 controllers with Change Detect.

Asset Inventory scans take far longer than a single backup, so each inventory asset should get a schedule of its own.

How do you read a backup and compare result?

Know which compare you are looking at. A Logix result compares the logic itself. A View SE, robot or generic FTP result is usually a checksum that only says something changed, and a FactoryTalk Directory compare always reports a difference. The detail of what changed reaches email only if the compare report is attached.

A compare result is only as good as the compare behind it.

Compare depth by family:

• Logix. The Logix Designer Compare Tool compares projects structurally, logic by logic, with an option to report incremental differences.
• Stratix. A detailed text compare of the switch configuration, and a checksum for the VLAN and ring files.
• View SE, Generic FTP and robots. A checksum by default. It says the file changed, not what changed. A compare engine can be configured for FTP devices.
• FactoryTalk Directory. A binary compare that always reports differences, because the backup files carry timestamps. Rockwell’s advice is to watch the Archive versions instead.

The email trap. The detail of what differed reaches email only if “Attach Report to email” is set for that device. Without it, a recipient learns that something changed and has to open AssetCentre to find out what.

Known failure points:

• Large Logix projects. These can fail the compare because the Compare Tool runs out of memory. Rockwell’s fix is to turn on its Memory Saver option.
• Incremental differences. With this option on, a task fails if the controller firmware no longer matches the ACD labeled as the incremental checkpoint.

What a version number means. The Archive creates a new version only when the file’s checksum changes. A new timestamp alone does not count.

What “no differences” proves: that the device matches the master. It does not prove that the master is right. If the master was promoted from an unapproved upload, a clean compare is a clean compare against the wrong program.

Who owns AssetCentre after go-live?

Someone has to, by name. In the plants Vladimir has worked in, the installs went smoothly and the hard part came after: getting people to check programs in instead of saving them on their own laptops. A working setup has an owner, a check-in rule with required comments, a weekly look at compare results, and training for every shift.

In Vladimir’s experience the failure is rarely the software. People do not understand how to manage their programs through the new workflow, and the results depend on the training and hygiene of the people using it. A 2025 Reddit reply made the same point from the other side: “you’re not going to solve the problem of best practices that keep those files in check” with a better tool.

The owner. One named person owns the asset tree, the schedules and the weekly review, with a deputy. Without a name, compare reports pile up unread.

The check-in rule:

• Required comments. By default, a comment at check-in is optional. In FactoryTalk Administration Console, the AssetCentre product policy “Allow Empty Comment at Check-in” is granted to all users. Remove them, and every check-in needs a comment. The setting covers all assets, and comments cannot be edited once checked in.
• Approvals. Where a change needs sign-off, the separately licensed Archive Management of Change option adds a workflow. A user submits a check-out request with a reason, and nobody else can check that file out until it is approved, rejected or unblocked. Approvals can require a minimum number of approvers per group, with escalation if nobody answers. A checklist of steps can be required before a request is submitted.

The weekly loop:

1. Read the compare reports from the week’s schedules.
2. Resolve every mismatch once. Either the change was right, and the upload is checked in and pinned, or it was not, and the master goes back to the controller.
3. Run the saved audit searches. Rockwell’s own example is a scheduled search for program edits at the end of each shift.

Know the audit log’s limits:

• Views are short. Rockwell’s Utilities manual says the log view shows the last 500 records in the desktop client and 2,500 in the web client. For anything broader, Rockwell supplies read-only SQL views to query directly.
• Coverage needs software everywhere. Audit records from other FactoryTalk software arrive only from computers with the AssetCentre client or the Diagnostics Connector installed.

Regulated plants. Rockwell’s 21 CFR Part 11 whitepaper is dated February 2021 and covers version 9.00. It says AssetCentre “does not directly provide a workflow with electronic signature capability”, and that compliance needs “strong management procedures” alongside the technology, with validation the customer’s job. The Management of Change option, added in version 11, is Rockwell’s signature workflow for check-out and check-in. A regulated plant should validate whichever version it runs.

Training. Every shift that touches code needs the same short routine: get the file from AssetCentre, never from a laptop; check it in with a comment; and know who to call when a compare flags a mismatch at 2 a.m.

How do you secure the AssetCentre server itself?

Treat it as one of the most sensitive servers in the plant: it holds every program and reaches every controller. Keep it on a qualified patch level, run it in a Windows domain with FactoryTalk Directory in secure mode, use TLS 1.2 or later with a CA-signed certificate, and restrict who can download, change schedules or enter Design mode.

The AssetCentre server holds a copy of every program in the plant, and its agents can reach every controller. That makes it a target.

Old versions are exposed. CISA advisory ICSA-21-091-01, from April 2021, lists nine vulnerabilities in FactoryTalk AssetCentre v10.00 and earlier. Each is scored CVSS v3 10.0 and exploitable remotely with low attack complexity. The first, CVE-2021-27460, is described in its record as allowing “a remote, unauthenticated attacker to gain full access to the FactoryTalk AssetCentre main server and all agent machines”. Rockwell’s fix is AssetCentre v11 or later, with IPsec as the fallback where an upgrade is not possible. A plant still on 10.00 or earlier is running them.

Hardening, from Rockwell’s own documents:

• A domain, not a workgroup. In a workgroup, IIS Anonymous Authentication is enabled and required. Rockwell’s answer is that AssetCentre “must be run in a domain environment”.
• Secure mode. Start the FactoryTalk Directory in Secure mode, not Standard, where any local administrator has full access.
• TLS. AssetCentre uses TLS 1.2. Rockwell recommends disabling TLS 1.0 and 1.1, and strongly recommends a certificate signed by a certificate authority. Where TLS 1.3 is the target, both 1.2 and 1.3 must stay enabled.
• SQL Server. AssetCentre supports Force Encryption for the database connection but not Force Strict Encryption.
• Feature Security. By default every user can do everything in AssetCentre. Restrict upload, download, schedules and Design mode through Feature Security in the FactoryTalk Administration Console.

Patching. Rockwell’s Microsoft patch qualification page lists Windows and SQL Server updates qualified with AssetCentre 16.00.00. Patch to what is qualified, on a schedule. The installer also enforces operating system lifecycles: it warns 18 months before Microsoft’s end date and refuses to install 6 months after. For Windows Server 2016, it refuses from July 12, 2027.

Posture checks are not server security. Version 16’s security posture checks watch controllers: mode, keyswitch, forces, firmware, and whether web pages are enabled. They say nothing about the AssetCentre server itself.

For the wider program, see ISA/IEC 62443 for plant leaders. For restoring after an attack, see the ransomware recovery runbook.

Why does AssetCentre stop working, and how do you fix it?

The common failures trace to a short list of causes. The client, agents and server are on different versions. The FactoryTalk Directory points at the wrong server. An activation has expired, which the web client does not warn about. Drivers or vendor software differ between agents. Or a Windows domain or account has changed. The table maps each symptom to its fix.

Symptom	Likely cause	Fix
The client will not start: “The client and server versions are incompatible”	The client is older than the server	Upgrade the client to the server’s version
Scheduled tasks never run, with no message	The agent is on a different version from the server	Upgrade the agent; check the Windows and AssetCentre event logs
“Waiting for Interface” next to scheduled assets	All agents are busy, or none is online	Add agents, or stagger schedules so they do not overlap
The client connects to the wrong Directory, or to localhost	The FactoryTalk Directory location changed	Reset it with the Specify FactoryTalk Directory Location utility
Nobody can enter Design mode or view logs	The server activation expired	Renew it in FactoryTalk Activation Manager; the web client gives no warning
Backups fail after a Logix firmware 38 upgrade	The controller was added through RSLinx Classic	Browse the asset again with FactoryTalk Linx
TIA Portal, GX Works or Control Expert tasks fail	The agent runs as a service, or FIPS is on	Run the agent as an application under a domain user; turn FIPS off
An agent stops working after a Control Expert update	The Schneider installer affected FactoryTalk services	Repair the AssetCentre agent
Server services do not start after a reboot	A distributed setup on fast disks	Set the services to Automatic (Delayed Start)
LDAP users cannot sign in to the web client	A known version 16 limit, with no workaround	Use Windows-linked users
A large Logix compare fails	The Compare Tool ran out of memory	Turn on the Compare Tool’s Memory Saver
GX Works2 backups fail on some agents	The agent’s Ethernet adapter differs from the project’s	Restrict those tasks to the matching agent with an agent group
A Stratix backup fails to log in	The switch uses key-based or interactive login	Enable password authentication
Agents cannot connect to the server	Agent and server are in different domains	Put them in the same domain or workgroup
Device passwords stopped working after a key change	Credentials were encrypted with the old key	Enter the credentials again on each affected asset

Sources: FactoryTalk AssetCentre 16.00.00 release notes, Help and Installation Guide; the Directory location fix from a 2024 practitioner report.

When the server is down. The Archive Extractor gets the latest or pinned version of every file out to a folder, and Rockwell calls it an emergency backup solution. Run it on a Windows schedule now, so the copy exists before it is needed. Audit data from FactoryTalk software is cached and arrives when the server comes back. Edits to the tree and new schedules wait.

How do you rescue an AssetCentre deployment that is going badly?

Start with what is running on the floor, not what the archive says. Upload every controller, compare it with the archive’s master, and resolve each mismatch once. Then name an owner, set the check-in rule, prune schedules nobody reads, and fix version drift. Only then add devices. A rescue is mostly a reset of people and process.

The deployments that go badly look alike: compare reports nobody reads, masters nobody trusts, engineers back to saving programs on their laptops, and a server that has drifted from its clients. In Vladimir’s experience, the same mistakes recur from plant to plant. Nobody understands how to manage the software through the new workflow.

The rescue, in order:

1. Baseline the floor. Run a backup and compare on every device. The result is the honest state of the plant.
2. Triage every mismatch. For each one, decide once: the running program is right, so check it in and pin it, or the master is right, so plan a download. Record the decision.
3. Name the owner and set the rule. Required comments, and approvals where the plant needs them.
4. Clean up the schedules. Remove devices that no longer exist, disable schedules nobody reads, and set report attachments so the detail reaches the people who act on it.
5. Audit versions and licences. Bring the server, agents and clients to one version, and check activation expiry dates. Make sure retired assets are not eating capacity.
6. Train every shift, then add devices.

When a rescue sits inside a larger project, such as a migration, a new line or an integrator’s delivery, it helps to have someone on the plant’s side holding the standard. That is the job of an owner’s engineer on the project.

Frequently asked questions

What is FactoryTalk AssetCentre used for?

FactoryTalk AssetCentre is Rockwell Automation’s on-premises software for managing plant automation files. Its archive versions PLC, HMI and drive files through check-in and check-out and logs who changed what. With its Disaster Recovery option, agents upload programs from running devices on a schedule and compare them with the approved version, so a plant learns when a controller no longer matches its file.

How much does FactoryTalk AssetCentre cost?

Rockwell does not publish a price. AssetCentre is quoted through Rockwell and its distributors as a perpetual licence or a subscription, sized by the number of device assets. The base package is the server and 10 assets; the Standard package adds 100 assets and Disaster Recovery for Rockwell devices. Other vendors’ devices, approval workflows and security monitoring cost extra, and SQL Server is licensed separately.

Can FactoryTalk AssetCentre back up Siemens PLCs?

Yes, with conditions. Version 16 backs up and compares S7-1200, S7-1500 and ET 200 controllers programmed in TIA Portal V15.1 to V19, through a separately licensed option. TIA Portal must be installed on the agent, which runs as a desktop application with FIPS mode off. S7-300 and S7-400 controllers need a manual STEP 7 add-on that Rockwell no longer updates.

Does FactoryTalk AssetCentre need SQL Server?

Yes. Every archived file, log and setting lives in a Microsoft SQL Server database, and no other database is supported. The version 16 release notes list SQL Server 2019 and 2022. Rockwell’s Help says the Express, Standard and Enterprise editions work, and that an existing instance can be reused. SQL Server is not included in the AssetCentre licence.

Can AssetCentre force a comment on every check-in?

Yes. In FactoryTalk Administration Console, the AssetCentre product policy “Allow Empty Comment at Check-in” is granted to all users by default. Remove the groups from that policy and AssetCentre requires a comment on every check-in. The setting applies to all assets. Approvals before check-out or check-in need the separately licensed Archive Management of Change option.

Is FactoryTalk AssetCentre the same as FactoryTalk Vault?

No. FactoryTalk Vault is the cloud storage that comes with FactoryTalk Hub, where people upload Logix project files to share, back up and version them, and Rockwell says it is free with a Studio 5000 support agreement. AssetCentre is installed on premises, and with Disaster Recovery it uploads from running devices on a schedule and compares them with the approved version.

Discipline first, then software

FactoryTalk AssetCentre does three things a shared drive cannot: it uploads what is actually running, compares it with the approved version, and records who changed what. For a plant with many devices, many hands on the code or an auditor to satisfy, those are worth paying for. For many other plants, the same results come from a well-run shared drive and the discipline to use it.

Either way the work underneath is the same: an inventory of devices, an approved version of every program, a rule for changes, and someone who owns the result. AssetCentre automates the checking. It does not supply the discipline.

Joltek helps in three ways. It offers training on the practices that make either approach work, and deploying AssetCentre where it earns its place. When an AssetCentre project is not going well, it can step in on the plant’s side as owner’s engineer. A free modernization consultation is the simplest place to start.

Photos: Vjanodic WERSOV and Brett Sayles (Pexels).