Accessing SIMATIC Logon Role Management in WinCC and PCS 7

1. Problem Definition: SIMATIC Logon Role Management Not Reachable

Engineers integrating SIMATIC Logon with WinCC 7.0 and SIMATIC PCS 7 frequently report that the SIMATIC Logon Role Management dialog cannot be opened, or that the controls inside it (New Role, Edit, Copy, Delete) remain grayed out even when the user is logged on as a Windows administrator. This blocks central user administration because role assignment, group mapping, and password policy configuration all live inside that dialog.

Three distinct symptoms appear in the field:

1. The Role Management dialog does not exist anywhere in the WinCC Explorer menu tree.
2. The dialog opens but the toolbar entries New Role, Edit, Copy, Delete, and Properties are disabled.
3. The dialog is reachable, but the User Management / Access Protection checkbox in the WinCC project properties cannot be activated.

All three symptoms trace back to the same architectural rule: SIMATIC Logon Role Management is not a standalone WinCC tool. It is a shared component that is only registered and activated from a parent engineering environment that has integrated the SIMATIC Logon libraries.

2. Architecture: Where the Role Management Component Lives

SIMATIC Logon is shipped as a redistributable Windows service (SLService.exe) and a set of COM/.NET libraries (SimaticLogon.Core.dll, SimaticLogon.RoleManagement.exe). According to the official SIMATIC Logon documentation, SIMATIC Logon help (slhelp_b_en-US.pdf), Role Management is used to regulate access to applications and functions by users and groups, while Access Protection forces users to log on to the system.

The role-management executable is registered as a shell extension for the following host applications only:

Standalone WinCC installations (WinCC RT, WinCC Explorer without an integrated STEP 7 component) do not register the role-management UI. This is the root cause of the "I cannot find it" symptom.

3. Prerequisites

Before attempting to open Role Management, verify the following prerequisites:

• Windows account: the logged-on user must be a member of the local group SL Users (created by the SIMATIC Logon installer) or have administrative rights on the engineering station.
• SIMATIC Logon version: v1.4 SP2 minimum for WinCC 7.0 SP3 and higher; v1.5 or higher for integrated PCS 7 V8/V9 projects. The role-management UI is disabled when the installed version is older than 1.4 SP2.
• License: SIMATIC Logon itself is free of charge, but the host application (ALM, PCS 7, STEP 7) must be licensed. Without a valid ALM or STEP 7 license the Role Management dialog will start but refuse to save changes.
• Project integration: for WinCC, the project must be an integrated WinCC project (created from SIMATIC Manager) rather than a standalone WinCC project. A standalone project opens WinCC User Administrator instead.
• Windows user/group setup: Windows domain users and groups (operators, supervisors, engineers) must already exist in Active Directory or the local SAM database before they can be assigned to a SIMATIC Logon role.

4. Step-by-Step: Enabling Access Protection to Reveal Role Management

This is the canonical procedure that exposes the Role Management dialog from inside SIMATIC Manager for an integrated STEP 7 + WinCC project.

1. Open SIMATIC Manager with the integrated project that contains the WinCC sub-project.
2. Right-click the WinCC sub-project icon (the icon showing a small monitor symbol) and choose Access Protection.
3. If Access Protection is unchecked, select Enable. Confirm the dialog that warns the project is about to be locked.
4. Enter a project password (Project password) when prompted. The project password is the engineering password used to unlock the project for editing — it is independent of any operator password.
5. Click OK. The project icon now shows a red key overlay, indicating that access protection is active.
6. Right-click the same WinCC sub-project and choose Access Protection → Manage. The SIMATIC Logon Role Management dialog opens.
7. Inside Role Management, the toolbar now exposes New Role, Edit, Copy, Delete, Properties, and Import/Export.
8. Click New Role, name it (for example OPERATOR_LEVEL_1), and on the Members tab add the Windows group DOMAIN\WinCC_Operators as the principal.
9. Repeat for additional roles (SUPERVISOR, ENGINEER, MAINTENANCE) and assign the appropriate Windows groups.
10. Click Save or close the dialog with the floppy-disk icon to persist the role database to <project>\GraCS\SIMATIC Logon\Roles.sdf.

5. Alternate Path: Automation License Manager (ALM)

On engineering stations that have only WinCC installed (no STEP 7, no PCS 7), the Role Management dialog is still reachable — but only through the SIMATIC Automation License Manager. This is the path documented in Siemens FAQ SIMATIC Logon in a domain (entry ID 26639558) and confirmed by multiple field reports.

1. Launch SIMATIC Automation License Manager from the Windows Start menu (Start → Siemens Automation → Automation License Manager).
2. From the menu bar choose File → Role Management.
3. The same Role Management dialog opens. Because no project is loaded, role changes here apply only to global (computer-wide) roles, which are stored under %ProgramData%\Siemens\Automation\SimaticLogon\Roles.sdf.
4. Import or create roles, then close. The dialog automatically writes the SDF and registers the role service with SLService.exe.

6. Wiring WinCC User Administrator to SIMATIC Logon

Even after roles are created, WinCC itself must be told to honor them. Inside WinCC Explorer, the per-project User Administrator must reference the SIMATIC Logon user database rather than its own internal user list.

1. Open WinCC Explorer on the engineering station.
2. Right-click User Administrator in the project tree and choose Open.
3. From the User Administrator menu choose Options → Select SIMATIC Logon User Administration (or in newer builds: Options → SIMATIC Logon).
4. Confirm the dialog. The User Administrator now queries the SIMATIC Logon role database for authentication.
5. Add a WinCC user with the same name as the Windows account that belongs to the SIMATIC Logon role (for example DOMAIN\jdoe), enable the checkbox SIMATIC Logon in the user properties, and assign the matching WinCC authorization level (number 100 = operator, 200 = supervisor, 300 = engineer by default).
6. Save and close User Administrator. Restart the WinCC Runtime to apply.

7. Configuration of the SIMATIC Logon Service

The SIMATIC Logon service (SLService.exe) is the Windows service that performs the actual authentication call against the role database. Verify its state before commissioning:

• Service name: SIMATIC Logon Service (display name) / SLService (service key name).
• Startup type: Automatic (Delayed Start). Manual startup causes the runtime to fall back to local WinCC users on reboot.
• Log on as: a domain account with read access to the role SDF, or the local SYSTEM account for single-station setups.
• Configuration tool: SLCfg.exe in %ProgramFiles%\Siemens\Automation\SimaticLogon\bin. From this tool you set the data source path, the remote authentication mode (SLRA), and the inactivity timeout (default 600 s).

For multi-station deployments with a central user management server (UMC), the SIMATIC Logon Remote Authentication (SLRA) interface can be configured to forward credentials through a UMC server. The official configuration guide is available at Configuring Simatic Logon Remote Authentication (SLRA) in UMC v2.15.3.

8. Verification Procedure

After configuration, run the following checks to confirm the deployment is functional:

1. Service check: open services.msc, confirm SIMATIC Logon Service is Running and the startup type is Automatic.
2. Role enumeration: from an operator console, press Ctrl+L to open the WinCC login dialog. The user field should accept DOMAIN\username.
3. Authorization probe: log on as a member of the Operator role. Attempt to open a screen object whose Authorization property is set to User level 200 (Supervisor). The click must be blocked and a status-bar message "No authorization" displayed.
4. Event-log audit: open Windows Event Viewer → Applications and Services → SIMATIC Logon. Successful logons, failed logons, and role changes are logged with source SLService and event IDs 0 (info), 1 (warning), 2 (error).
5. Database integrity: run sqlcmd -S .\SLDB -d Roles (or open the SDF with SQL Server Management Studio) and execute SELECT * FROM Roles to confirm the role definitions were persisted.

9. Troubleshooting Matrix

10. Edge Cases and Field-Proven Caveats

Workgroup vs. domain: When the engineering station is in a Windows workgroup rather than a domain, SIMATIC Logon still works but every OS (operator station) must mirror the same local users and groups. Replication scripts should include net user and net localgroup exports.

Character encoding: Role names and user principal names containing non-ASCII characters (umlauts, Cyrillic, CJK) are supported by SIMATIC Logon v1.5+ but require the regional settings of the OS to match the encoding of the project database. Mixing encodings produces silent authorization failures.

Password change propagation: When a user changes their Windows password, the change is picked up by the SLService immediately on the next login — there is no need to restart the service. However, role-membership changes in Active Directory may take up to one logon cycle of the service because the SLService caches group membership in memory; restart the service after bulk group edits.

Backup strategy: The role SDF is a binary file and is not transaction-safe. Always perform project backups while the SLService is stopped (net stop "SIMATIC Logon Service") to avoid corrupted Roles.sdf files that cause the runtime to fall back to local WinCC users without warning.

HMI panels: For Comfort Panels and RT Advanced / RT Professional panels, the SIMATIC Logon integration is configured under User administration → Central user administration using SIMATIC Logon, documented at TIA Portal v20 — Central user administration using SIMATIC Logon. The role-management workflow on TIA Portal differs from the classic WinCC 7 procedure: TIA WinCC uses the User administration editor inside the project, and roles are imported from the SIMATIC Logon service via UMC.

Audit trail: For FDA 21 CFR Part 11 / GxP-regulated environments, enable the SIMATIC Logon audit-log option in SLCfg.exe. The audit log is written to %ProgramData%\Siemens\Automation\SimaticLogon\Audit\<date>.csv and contains every role assignment, login, and logout event with timestamp and operator name.

11. Frequently Asked Questions