Fix TIA Admin V3 localhost Connection Refused on Windows 11 24H2

Problem Overview

After launching TIA Admin V3 SP5 via the standard launcher URL TIAAdminV3_System.html on a Windows 11 24H2 engineering workstation, the embedded web service returns ERR_CONNECTION_REFUSED on localhost (loopback 127.0.0.1). The browser reports the generic message "This page can't be reached — localhost refuses to connect." No logon dialog appears, and the TIA Admin dashboard never renders. The error is reproducible immediately after a fresh OS image build of Windows 11 24H2, on both physical hosts and Hyper-V/VMware virtual machines, and is independent of the choice of browser.

This guide documents the field-confirmed root cause (a Windows 11 24H2 feature removal that disables the legacy WMI Command-line wmic.exe), the exact remediation steps, and the supporting TIA Admin configuration that must coexist with the fix to avoid residual failures.

Affected Environment

The error is not browser-related, not caused by a language-specific launcher file rename, and not resolved by re-running legacy V3 batch scripts (start_server.cmd, start_chrome.cmd, start_firefox.cmd) that targeted the older V2 architecture. Those scripts are no longer the supported bootstrap path for V3.

Root Cause Analysis

TIA Admin V3 SP5's local web service enumerates system information, installed software, license bindings, and TIA Portal project metadata through WMI on first contact. On Windows 11 24H2, Microsoft has shifted the WMI command-line utility wmic.exe from a default-installed feature to an optional on-demand component governed by the Capabilities framework (WMIC.exe Feature on Demand, package Wmic). A Windows servicing update, a clean 24H2 install, or a corporate hardening baseline can leave the workstation in a state where wmic.exe is absent from %SystemRoot%\System32\wbem\.

When the TIA Admin launcher process attempts its initial WMI query and the COM/WMI subsystem cannot resolve the Win32_OperatingSystem, Win32_Processor, and Win32_Product classes via the wmic alias provider, the embedded TIA Admin service crashes during the pre-bind phase, before the HTTPS socket is registered. The browser, hitting https://localhost:<port>/TIAAdminV3_System.html, receives a TCP RST and Chrome reports ERR_CONNECTION_REFUSED.

Field evidence confirming the diagnosis:

• PowerShell Get-Command wmic -ErrorAction SilentlyContinue returns $null on affected hosts.
• Event Viewer > Application logs show Siemens.Automation.Portal.Admin.Service terminating with .NET Runtime exception code 0x80131506 referencing System.Management.ManagementException.
• Installing WMIC via the Windows Optional Features path returns the service to operation within one minute of reboot, with no TIA Admin reinstall required.

Pre-Flight Checklist

Before applying the WMIC fix, validate the following to eliminate secondary causes of the ERR_CONNECTION_REFUSED symptom. Each item has caused the same error in production troubleshooting and is fast to verify.

1. Confirm the launcher URL. The V3 launcher must be TIAAdminV3_System.html. Regionalized variants such as TIAAdminV3_System_de-DE.html are not the supported entry point and have been observed to 404 on the local service. Do not use the V2 TIAAdminV3.html filename.
2. Verify the TIA Openness group membership. The Windows account launching the browser must be a member of the local group Siemens TIA Openness. Local Administrators are not automatically members. Open lusrmgr.msc > Groups > Siemens TIA Openness and add the engineering account.
3. Confirm Automation License Manager is running. The almsrv.exe service must be Running and a valid TIA Portal V19 license must be present. Without it, the launcher binds to the port but stalls on license acquisition, mimicking a refused connection after a long timeout.
4. Validate loopback reachability. Run Test-NetConnection -ComputerName localhost -Port 443 (or the documented TIA Admin port — typically 4444 or 8443; confirm in %ProgramFiles%\Siemens\Automation\Portal Admin V3\config\appsettings.json). The TcpTestSucceeded field must be True.
5. Disable conflicting HTTPS bindings. If IIS, SQL Server Reporting Services, or another engineering tool already binds 0.0.0.0:443, the TIA Admin Kestrel host cannot bind and silently fails. netstat -ano | findstr LISTENING | findstr :443 must not return a conflicting PID.
6. Confirm TLS 1.2/1.3 are enabled. TIA Admin V3 SP5 requires SCHANNEL protocols TLS 1.2 and TLS 1.3. The V3 service will not negotiate TLS 1.0/1.1. Inspect HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols for both protocol subkeys with Enabled=1 and DisabledByDefault=0.
7. Check for proxy interception on loopback. WinHTTP or a corporate proxy configured to force-tunnel all requests can intercept localhost and return a refused connection. Run netsh winhttp show proxy and confirm Direct access (no proxy server) for loopback traffic.

Step-by-Step WMIC Installation on Windows 11 24H2

WMIC is delivered as an optional feature on demand in Windows 11 24H2. The service-failure root cause documented above is resolved by restoring this feature. The fix is non-destructive and does not require a TIA Admin reinstall.

Method 1 — Settings UI (Recommended)

1. Open Settings > System > Optional features (or run ms-settings:appsfeatures).
2. Click View features next to Add an optional feature.
3. Search for WMIC. Select WMIC (Windows Management Instrumentation Command-line).
4. Click Next > Install. Wait for the feature to reach the Installed state.
5. Reboot the workstation. Reboot is required to register the WMI providers the TIA Admin service depends on.
6. Verify by opening cmd.exe and running wmic os get caption,version. Expect a populated result table; an empty output confirms a broken install.

Method 2 — DISM Command Line

Use this method when group policy or a hardened image blocks the Settings UI path.

REM Step 1 — Enable the WMIC feature on demand (online source)
DISM /Online /Add-Capability /CapabilityName:WMIC~~~~0.0.1.0

REM Step 2 — Confirm the binary is staged
where wmic
REM Expected: C:\Windows\System32\wbem\wmic.exe

REM Step 3 — Trigger WMI repository rebuild if previously crashed
winmgmt /salvagerepository
winmgmt /verifyrepository

REM Step 4 — Reboot
shutdown /r /t 0 /c "TIA Admin: WMIC feature install complete"

Method 3 — Offline Source (SCCM/MDT Image)

For golden-image deployment, mount the Windows 11 24H2 install install.wim and add the capability to the offline image.

DISM /Mount-Wim /WimFile:E:\sources\install.wim /Index:1 /MountDir:C:\mount
DISM /Image:C:\mount /Add-Capability /CapabilityName:WMIC~~~~0.0.1.0 /Source:C:\mount\windows\winsxs
DISM /Unmount-Wim /MountDir:C:\mount /Commit

TIA Admin Service Verification

After WMIC is installed and the workstation is rebooted, validate the TIA Admin stack end-to-end. Open an elevated PowerShell session and run the following diagnostics. Each block is intentionally idempotent.

# 1. Confirm WMIC provider health
wmic os get caption,version,buildnumber /value

# 2. Confirm the TIA Admin Windows services are present and running
Get-Service -Name "Siemens.Automation.Portal.Admin*" | Format-Table Name, Status, StartType

# 3. Confirm the launcher port is bound locally
$cfg = Get-Content "$env:ProgramFiles\Siemens\Automation\Portal Admin V3\config\appsettings.json" -Raw | ConvertFrom-Json
$port = $cfg.Kestrel.Endpoints.Https.Url -replace 'https://[\w\.]+:',''
Test-NetConnection -ComputerName 127.0.0.1 -Port $port

# 4. Confirm the TIA Openness group contains the active user
whoami /groups | Select-String "Siemens TIA Openness"

# 5. Hit the launcher URL via PowerShell to validate the TLS handshake
Invoke-WebRequest -Uri "https://localhost:$port/TIAAdminV3_System.html" -UseBasicParsing -SkipCertificateCheck | Select-Object StatusCode, StatusDescription

The final Invoke-WebRequest must return 200 OK and an HTML body beginning with <!DOCTYPE html>. A 0 status code, an SSL/TLS alert, or a refused-connection error indicates a remaining service-bring-up issue; revisit the Pre-Flight Checklist items 1 through 7.

TLS and Network Configuration

TIA Admin V3 SP5 ships with a self-signed server certificate bound to the loopback interface. Browsers will warn on first contact; this is expected. The Kestrel host honors the following appsettings.json schema:

Verify the SCHANNEL protocol set is current. Microsoft has deprecated TLS 1.0 and TLS 1.1 in Windows 11 24H2 by default; the registry must reflect this.

# TLS 1.2 client and server must be Enabled=1, DisabledByDefault=0
$reg = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
Set-ItemProperty -Path $reg -Name Enabled -Value 1 -Type DWord
Set-ItemProperty -Path $reg -Name DisabledByDefault -Value 0 -Type DWord

$reg = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server"
Set-ItemProperty -Path $reg -Name Enabled -Value 1 -Type DWord
Set-ItemProperty -Path $reg -Name DisabledByDefault -Value 0 -Type DWord

Privilege Requirements

TIA Admin V3 performs a two-stage authorization: a Windows ACL check against the launcher process and a runtime role check against the Siemens TIA Openness group. Local Administrator elevation is not a substitute. The documented privilege matrix is:

To audit the active account's role, run whoami /priv /groups and look for the S-1-5-21-*-1138 relative identifier (RID) suffix that marks Siemens TIA Openness membership.

Launcher URL, Authentication, and Browser Behavior

Three frequently misunderstood aspects of TIA Admin V3 contribute to the appearance of a connection error when the underlying service is, in fact, healthy.

1. URL. The supported entry point is https://localhost:<port>/TIAAdminV3_System.html. The trailing _System token is case-sensitive. Variant files such as TIAAdminV3_System_de-DE.html, TIAAdminV3_System_zh-CN.html, or TIAAdminV3_System_fr-FR.html are not part of the V3 SP5 service contract; they 404 even on a working service.
2. Credentials. The HTTP basic-auth dialog (or Windows integrated auth prompt) presented by the TIA Admin page requests the Windows session credentials, not a Siemens Single Sign-On account and not a Siemens Support Customer Center account. A valid DOMAIN\username + password pair is required. SSO tokens from support.industry.siemens.com are not consumed.
3. Browser compatibility. TIA Admin V3 SP5 supports Chrome, Edge, Firefox, and Brave at the version baselines shipped with Windows 11 24H2. Internet Explorer 11 is not supported. Switching browsers will not fix a missing WMIC dependency — the symptom is identical across all four engines because the failure is on the Kestrel side, not the browser side.

Virtual Machine Performance Caveat

On virtual machines, especially Hyper-V Generation 2 and VMware Workstation guests with limited vCPU allocation, the TIA Admin service requires approximately 90 to 120 seconds from the moment the URL is first requested to the moment the dashboard renders. During this window, the Kestrel host is initializing the WMI provider cache, the TIA Portal project enumeration provider, and the license binding stub. If the browser is the first contact point, the service may register the socket after the first browser request, producing a transient ERR_CONNECTION_REFUSED that resolves on a hard refresh.

To reduce the cold-start delay, increase the startTimeout of the TIA Admin service to 180000 ms in the registry and pre-warm the WMI repository by running wmic cpu get name immediately after reboot.

Troubleshooting Matrix

Preventing Recurrence in Managed Environments

For SCCM, Intune, or MDT-managed fleets, lock the WMIC feature in place so Windows Update servicing does not regress the configuration.

1. Intune — Settings Catalog. Deploy a Allow optional features on demand policy (AllowOptionalFeaturesOnDemand = 1) and add WMIC~~~~0.0.1.0 to the Optional components on demand allowlist.
2. SCCM — Configuration Item. Create a CI of type Windows Optional Component, scope WMIC~~~~0.0.1.0, set remediation to Install when missing, and assign to the TIA engineering collection.
3. Group Policy. Under Computer Configuration\Administrative Templates\Windows Components\Windows PowerShell, disable Turn on PowerShell scripting in the Windows PowerShell ISE is not relevant; instead, use the policy Specify settings for optional component installation and component repair to point to a UNC source containing the WMIC FOD payload.
4. Configuration baseline export. After remediation, capture the working state with Export-StartLayout-equivalent for capabilities: Get-WindowsCapability -Online | Where-Object Name -like 'WMIC*' | Export-Clixml C:\baseline\wmic.xml. Diff against future baselines to detect regression.

FAQ