CCAgent.exe wbemcore.log Flood: Stopping the WinCC LCID Spam

CCAgent.exe is a WinCC background service that, under specific environment conditions, can flood C:\WINDOWS\system32\wbem\Logs\wbemcore.log with the message GetUserDefaultLCID failed, restoring to system version at a rate of one entry every 1-2 seconds. This generates continuous disk I/O, suppresses power management transitions, increases heat, and shortens the service life of rotating media on engineering stations. The following reference walks through identification, root-cause analysis, mitigation, and permanent repair.

1. Problem Statement

Symptom profile as observed on affected WinCC development workstations:

• Process CCAgent.exe is visible in Task Manager / Process Explorer as a child of the svchost.exe instance hosting the WinCC service group, or as a standalone process owned by SYSTEM.
• File wbemcore.log grows continuously. Field measurements show ~30-60 lines per minute, ~3 MB / hour, ~2 GB / week when left unchecked.
• Drive activity LED on a desktop workstation stays lit even when no user activity is occurring.
• Stopping the process via Task Manager only works for a few minutes; CCAgent respawns.
• Log content is repetitive: (Day Mon DD HH:MM:SS YYYY.uSec) : GetUserDefaultLCID failed, restorting to system verion (note the original spelling: "restorting" and "verion" - this is the actual binary string, not a transcription error).

Sample raw log excerpt from a real installation:

(Fri Sep 26 10:47:14 2008.13495195) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:14 2008.13495215) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:15 2008.13496196) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:15 2008.13496206) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:16 2008.13497428) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:16 2008.13497448) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:17 2008.13498199) : GetUserDefaultLCID failed, restorting to system verion
(Fri Sep 26 10:47:17 2008.13498209) : GetUserDefaultLCID failed, restorting to system verion

The high-resolution timestamp suffix (e.g., .13495195) corresponds to a FILETIME-style 100-nanosecond tick value and confirms WMI logging cadence rather than a third-party application poll.

2. What CCAgent.exe Is

CCAgent.exe is part of the Siemens Automation License Manager / WinCC ACE (Automation Communication Engine) stack. The expected install path on a legitimate copy is:

C:\Program Files (x86)\Common Files\Siemens\ace\bin\CCAgent.exe
   - or on legacy installations -
C:\Program Files\Common Files\Siemens\ace\bin\CCAgent.exe

Its responsibilities include:

• Listening for license requests from WinCC Runtime, WinCC Explorer, and connected HMIs.
• Coordinating communication with the ALM (Automation License Manager) service on the local or remote license server.
• Routing authentication / activation events through the WMI provider on the engineering station.

Because CCAgent publishes health and event data through the WMI infrastructure, any fault in the WMI subsystem (including regional/locale resolution) is recorded in the standard WMI log path - hence the file C:\WINDOWS\system32\wbem\Logs\wbemcore.log, which is owned by the Microsoft WMI service, not by Siemens.

3. Malware Differentiation (Critical First Step)

A separate, unrelated piece of malware also called CCAgent.exe was first reported in May 2008. Before applying any fix, confirm that the binary on the affected machine is the Siemens one.

Verification procedure:

1. Open the file Properties → Digital Signatures tab. A valid Siemens signature lists Siemens AG as the signer and the certificate chain anchors to a public CA.
2. Cross-check the file hash against the WinCC installation media.
3. Inspect the parent service. Run sc queryex | findstr CCAgent or open services.msc and look for ACE-related services. A service hosted under SYSTEM with the description mentioning "Automation Communication Engine" is the legitimate one.

4. Root Cause Analysis

The error string is generated inside a WMI provider path that calls the Win32 API GetUserDefaultLCID(). LCID is the locale identifier (e.g., 0x0409 for en-US, 0x0407 for de-DE). The fallback path ("restoring to system version") is reached when the user-default LCID cannot be resolved for the current security token.

Three conditions have been observed to trigger this on WinCC stations:

1. Corrupt or partial user profile. The user profile under which CCAgent runs (often SYSTEM, or a service account) cannot enumerate the user-default locale because the profile hive is missing or denied read access.
2. Regional Options misconfiguration. The system locale is set, but a sub-option (Numbers, Currency, Time, or Date) is set to a value the WMI provider cannot parse, or the East Asian language pack installation is incomplete.
3. WMI repository corruption. The repository at %WINDIR%\System32\wbem\Repository is inconsistent, causing the WMI core to re-attempt locale resolution on every event and fail.

On a default en-US Windows install, with default regional settings, the spam should not appear. The user's report that "All are at the default for US settings. East Asian Language files are installed as well" narrows the field to either (a) a half-installed East Asian language pack that the WMI provider does not fully recognize, or (b) WMI repository damage from an earlier hot-patch cycle.

5. Immediate Mitigation (Stops the Disk Activity)

Use this if you need the drive to stop working right now. The proper repair is in section 6.

5.1 Disable the CCAgent Service

Setting the service to Manual is not sufficient - WinCC ACE components will restart it. You must disable the service.

1. Open services.msc as Administrator.
2. Locate CCAgent (or "Siemens CCAgent") and any companion ALM (Automation License Manager) service.
3. Right-click → Properties → Startup type → Disabled.
4. Stop the service.
5. Repeat for any dependent service entries.

From an elevated command prompt:

sc config CCAgent start= disabled
sc stop CCAgent
sc queryex CCAgent

Confirm the log file is no longer being written:

dir C:\WINDOWS\system32\wbem\Logs\wbemcore.log
:: wait 60 seconds
dir C:\WINDOWS\system32\wbem\Logs\wbemcore.log
:: file size and modification time should be unchanged

5.2 Prevent WMI from Re-Opening the Log

Temporarily restrict NTFS write access on the Logs folder so the WMI core cannot append. This breaks WMI event logging entirely and is for diagnostic isolation only:

icacls "C:\WINDOWS\system32\wbem\Logs" /deny SYSTEM:(W)
icacls "C:\WINDOWS\system32\wbem\Logs" /deny "NT AUTHORITY\LOCAL SERVICE":(W)

Revert with /remove:d after testing. Do not leave this in place - it silently disables WMI event collection.

5.3 Rename the Log File (Free Up the Handle)

WMI keeps an open handle to the active log. Renaming forces a re-open on the next write attempt. Use this to clear the bulk of the historical spam:

1. Stop the WMI service: net stop winmgmt
2. Move wbemcore.log to wbemcore.log.old
3. Start the service: net start winmgmt

6. Permanent Resolution

Apply in order. Stop at the first step that resolves the issue and proceed to the next only if the spam returns.

6.1 Validate and Reset Regional / Locale Settings

1. Control Panel → Region → Administrative tab → Change system locale. Confirm the locale is appropriate (e.g., English (United States) for en-US installations).
2. Click Copy settings... and tick both "Welcome screen and system accounts" and "New user accounts". This propagates the locale to SYSTEM and to any new profiles, which is what fixes the GetUserDefaultLCID failure under service accounts.
3. Reboot.
4. After reboot, verify with: powershell -c "(Get-WinSystemLocale).Name" should match the expected locale.

If East Asian language files were added but never fully configured, either complete the configuration through Settings → Time & Language → Language → Administrative language settings or remove the partial pack.

6.2 Repair the WMI Repository

The repository is the single point of failure for WMI; a damaged repository causes symptoms ranging from the LCID spam to complete WMI failure.

1. Open an elevated command prompt.
2. Stop the service: net stop winmgmt (answer Y to stop dependents).
3. Move the repository: ren %WINDIR%\System32\wbem\Repository Repository.old
4. Restart the service: net start winmgmt. The service rebuilds the repository on first access.
5. Re-register the core WMI providers: cd /d %WINDIR%\System32\wbem && for /f %s in ('dir /b *.mof *.dll') do mofcomp %s is too aggressive for production. Use instead: mofcomp %WINDIR%\System32\wbem\cimwin32.mof and the standard re-registration batch that ships with the OS.

Validate the repository after rebuild:

wmic computersystem get name
wmic os get caption,version
:: both should return without "Invalid class" errors

6.3 Reinstall WinCC ACE / CCAgent

If the LCID and WMI repairs do not stop the spam, the CCAgent binary itself is suspect. Reinstall the Automation Communication Engine from the WinCC installation media:

1. Control Panel → Programs and Features → locate SIMATIC WinCC ACE or Automation Communication Engine.
2. Uninstall. Reboot.
3. Reinstall from the matching WinCC DVD / image. The version of ACE must match the WinCC major.minor version (for example, WinCC V7.x ships with a specific ACE build).
4. Apply the latest WinCC hotfix relevant to the installed version.

6.4 Worst-Case: Rebuild the OS Image

On a development workstation, the time-to-rebuild of a clean WinCC image is often less than the cumulative time lost to the spam. A clean image with the matching Siemens installation order (OS → patches → WinCC → hotfixes → third-party add-ins) is the only configuration for which Siemens support will accept a service request without qualification.

7. WMI Service Health Checklist

After any of the steps above, run this checklist on the affected host:

8. Verification Procedure

1. Clear or rename C:\WINDOWS\system32\wbem\Logs\wbemcore.log as in section 5.3.
2. Restart the host to ensure all services come up clean.
3. Leave the host idle for 15 minutes with no user logon.
4. Inspect the log. It should contain at most a handful of WMI startup events, not a per-second stream of LCID failures.
5. Run wmic process where "name='CCAgent.exe'" get ProcessId,CommandLine to confirm the binary path matches the Siemens install directory.
6. Confirm disk activity has returned to idle: PowerShell Get-PhysicalDisk | Get-Disk read/write counters should be near zero.

If after the repair the host still logs the LCID error more than once per minute, capture 50 lines of the log and the output of wmic computersystem get name /format:list and contact Siemens WinCC support with the WinCC version (from WinCC Explorer → Help → About), the Windows version and build, and the regional settings screenshot.

9. Prevention and Hardening

• Standardize the regional configuration across all WinCC engineering and runtime stations. Use a GPO to enforce the system locale, the user locale, and the copy-to-welcome-screen behavior.
• Avoid mixing language packs on production HMI servers. If a Korean or Chinese WinCC UI is required, build the host with that locale as the primary, not as an add-on.
• Monitor wbemcore.log size. A WMI log that grows beyond ~1 MB between reboots is an early indicator of repository damage. Add a simple scheduled task that emails when (Get-Item C:\WINDOWS\system32\wbem\Logs\wbemcore.log).Length -gt 5MB.
• Document the WinCC service pack level. The ACE component ships with WinCC, and a partial hotfix install (OS patched, WinCC not) is a common root cause for newly introduced WMI faults.
• Keep CCAgent on production HMIs. The fix described in section 5.1 (disable CCAgent) is appropriate for engineering stations that are not actively running WinCC Runtime. Production HMI servers require CCAgent for license coordination and ALM handshake.

10. Related Issues