Fixing PCS 7 V7.1 OS Client Login Failures After Password Change

Problem Overview

Operators report that after the engineering station (ES) Windows password is updated, certain process screens on one of the WinCC Operator Stations cannot be opened from the OS_Client running on the ES. The fault presents even though the user account name is unchanged: only the password string has been rotated. The ES operator logs in successfully, the OS_Client launcher starts, but specific picture trees or area-specific graphics return "no authorization", "picture change not possible" or outright blank-faceplate responses on screens hosted by a specific OS server.

This symptom is well-documented in PCS 7 V7.1 deployments where multiple OS Servers (Windows Server 2003), OS Clients and an Engineering Station (Windows XP SP3) coexist in a Windows workgroup. The same symptom class appears in V8.0 and V9.0 mixed deployments when an operator or engineer forgets to propagate the new credential to every WinCC station.

Typical affected configurations:

• 02 x Windows Server 2003 OS Servers
• 02 x Windows XP SP3 OS Single Stations / Clients
• 01 x Windows XP SP3 ES that also acts as an OS Client
• All machines joined to a flat workgroup (no Active Directory domain)

Root Cause Analysis

In a Windows workgroup, each computer holds its own SAM (Security Account Manager) database. There is no central authority that propagates credential updates. The local SAM stores:

• SID and relative identifier (RID) of the user
• NT-hash and LM-hash of the password
• Group memberships cached at logon time

When the engineer rotates the password on the ES, only the ES SAM is updated. The OS Servers and the OS Single Stations still hold the previous hash for that account. Because WinCC picture-change authorization, DCOM "Launch" permissions and the Simatic HMI group membership are evaluated at the OS Server when the OS_Client connects, the server cannot map the incoming Kerberos/NTLM token to a known group on its own machine.

The result is that the OS Server accepts the TCP connection (DCOM is permissive on RPC ports 135, with high ports 1024-65535 dynamic) but rejects every picture-tree authorization call because the user identity on the server side resolves to an unknown SID with no membership in Simatic HMI or Power User.

Per the official Siemens KB attachment "User Rights (Authorizations) in SIMATIC PCS 7 OS V7.1", every OS computer that participates in user-based picture change authorization must hold a local account with the same name, password and group memberships as every other OS computer. The document specifies the following prerequisites:

• Install SIMATIC Logon on each OS computer when centralized user management is desired
• Assign each operator user to the local group Simatic HMI on every OS
• Grant at least Power User membership, or local Administrator, on every OS
• Maintain identical user name spelling and casing across the multi-project PC station list

Authentication Flow That Breaks

1. Engineer logs into the ES (Windows XP) as PCS7_ENG with new password P@ssw0rd_v2.
2. Operator launches OS_Client locally on the ES; WinCC Project Editor reads the preferred server list from C:\Program Files\Siemens\Automation\WinCC\bin\WinCCExplorer.ini.
3. OS_Client opens DCOM connection to OS Server 1 over TCP 135, then negotiates NTLMv2 over the dynamic RPC port.
4. OS Server 1 receives the NTLM token referencing ES_HOSTNAME\PCS7_ENG. It looks up PCS7_ENG in its own local SAM.
5. The account exists but its stored hash is the old password. The incoming token therefore does not validate against the local SAM. The OS Server falls back to a "guest-equivalent" token or rejects the call entirely.
6. Picture-change API calls (IWinCCPicture::ChangeTo) are denied because the guest token lacks membership in Simatic HMI.

Preconditions & Required Identities

Before you apply any remediation, audit every PC station in the PCS 7 multi-project. Use WinCC Explorer → Computer → right-click each OS → Properties → Startup to confirm the computer name and WinCC project name. Then, on each Windows host, run from a command prompt:

In a workgroup, replace /domain with a direct SAM query. The command returns the SID and group list as cached on each host. The local group list must include:

Additional identities that must be synchronized across the plant if you operate in workgroup mode:

• SIMATIC HMI – the special WinCC service account created by the PCS 7 setup on every station.
• CC_<ProjectName>_Remote – remote-activation identity used by the OS Client.
• S7>on<line> – AS-OS communication accounts (only if NetPro named connections are used).

Resolution Method 1 – Synchronize the Password on Every PC Station

This is the recommended short-term remediation for workgroup installations. Repeat the password change on every PC station with identical spelling and case.

1. Log on to the ES as a local administrator.
2. Open Control Panel → User Accounts → Change an account and rotate the password. Use the same complex password on every host.
3. Remote-desktop or VNC to OS Server 1, OS Server 2, OS Single Station 1, OS Single Station 2.
4. On each host, run control userpasswords2, select the matching user account and apply the same password.
5. On each host, open Computer Management → Local Users and Groups → Groups → Simatic HMI and confirm the user is still a member. The group membership is preserved across password changes but is lost if the account is deleted and re-created.
6. Restart the WinCC runtime on each OS by issuing net stop "CCAlgRtServer" && net start "CCAlgRtServer" from an elevated prompt, or use the WinCC service stop/start sequence in the Automation License Manager.
7. Re-launch the OS_Client on the ES and verify picture change.

Resolution Method 2 – Install SIMATIC Logon for Centralized Credential Management

SIMATIC Logon replaces the per-station SAM lookup with a service that authenticates against a central directory. It is the only sanctioned long-term solution for multi-station PCS 7 plants in workgroup mode.

Prerequisites:

• SIMATIC Logon Service V1.5 or higher (the version shipped with PCS 7 V7.1 is V1.4 SP3; upgrade to V1.5 from the PCS 7 V7.1 SP3 DVD).
• A central user store: either a Windows Active Directory domain, a Novell eDirectory tree, or the local SIMATIC Logon database replicated to every OS.
• The SIMATIC Logon Service account must be added to Simatic HMI on every OS computer.

Procedure:

1. Insert the PCS 7 V7.1 installation DVD. Launch Setup.exe and select SIMATIC Logon as an additional package.
2. On the first OS, install SIMATIC Logon in Server role. Choose the local SIMATIC Logon database if you do not yet have a domain.
3. Define the operator groups in the SIMATIC Logon Admin Tool: e.g., PLANT_OPERATORS, PLANT_ENGINEERS, PLANT_ADMINS. Map each group to a WinCC authorization level (e.g., level 4 "Operator", level 5 "Engineer").
4. Create the operator accounts inside SIMATIC Logon. The Windows local account can be disabled or set to a random long password that the operator never sees.
5. On every remaining OS and the ES, install SIMATIC Logon in Client role. Point each client at the Logon server using the FQDN or IP plus port 5001.
6. Open WinCC Explorer on the OS, choose Computer → Properties → Logon and enable SIMATIC Logon. Repeat on every OS.
7. Reload the OS runtime so the WinCC User Administrator hands off to SIMATIC Logon.
8. Test a password rotation from SIMATIC Logon Admin Tool. Only one entry has to be changed; all OS computers pick up the new credential on the next operator logon.

Resolution Method 3 – Migrate the Plant to an Active Directory Domain

For plants exceeding six PC stations, a domain migration is more sustainable than SIMATIC Logon in workgroup mode. The password then lives in Active Directory and is automatically picked up on every OS.

1. Promote a Windows Server 2008 R2 or 2012 R2 host to a Domain Controller. Install the AD DS role and the DNS role. Choose a single-label or two-label domain name (e.g., plant.local).
2. Add each OS server, OS client and the ES to the domain using System Properties → Computer Name → Change → Domain. A domain account that is a local Administrator on each host is required for the join operation.
3. Create an Organizational Unit (OU) named PCS7_Stations. Move every PC object into the OU.
4. In the OU, create a Group Policy Object (GPO) named PCS7 - WinCC User Rights and link it to the OU.
5. Edit the GPO: navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Restricted Groups. Add the domain group PLANT_OPERATORS as a member of the local group Simatic HMI on every joined computer.
6. Run gpupdate /force on each PC station and verify with gpresult /r that the GPO is applied.
7. Rotate a test password from Active Directory Users and Computers. The new password is honored on every station after the next operator logon without further action.

Special Case: Machine Account Password Drift

On a domain-joined station the computer itself maintains a machine account password that is rotated automatically every 30 days. If the OS_Client cannot reach the Domain Controller for 60 days, the secure channel breaks and any incoming NTLM token from the OS Client is rejected. This produces a symptom identical to a manual password rotation failure.

Microsoft documents the mitigation in the KB article "Disable machine account password changes - Windows Server". To inspect the secure channel state from a workstation, run:

If the secure channel is broken, reset it with:

For environments where the Domain Controller is permanently unreachable (air-gapped plants), set the registry value to disable the 30-day auto-rotation:

Apply this only when there is no DC to talk to; otherwise leave the default and ensure reliable DNS plus network reachability.

Verification Procedure

1. Log on to the ES with the new password.
2. Start the OS_Client launcher. Confirm the OS Server selection dialog shows every configured server.
3. Choose OS Server 1 (the one that previously failed). The startup picture should load.
4. Open the area overview and click every area button. All picture-change requests must succeed.
5. Open a faceplate that requires authorization level 4 ("Operator"). Verify the button set is enabled.
6. Open a faceplate that requires authorization level 5 ("Engineer") with the operator account. Verify it correctly denies the change.
7. From the OS Server console, run whoami /groups /fo list during a live operator session to confirm the local group membership evaluates to Simatic HMI.
8. Capture a WinCC diagnostic trace by enabling HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\WinCC\Diagnostics\TraceLevel = 0x00000003 on the OS Server and reproducing the change.

Troubleshooting Matrix

Field-Proven Caveats and Edge Cases

Engineers who maintain PCS 7 V7.1 plants should keep the following operational notes in mind:

• Windows Server 2003 reaches end-of-life in July 2015. Password-propagation problems often surface immediately after a Server 2003 to Server 2008 R2 migration because the new SAM enforces NTLMv2 by default while Server 2003 still accepts LM responses. Force NTLMv2 minimum on every host via GPO: Network security: LAN Manager authentication level = Send NTLMv2 response only / refuse LM & NTLM.
• Windows XP SP3 must have KB968389 or successor installed to support NTLMv2 session security. Without it, XP falls back to LM and the OS Server rejects the credential outright.
• SIMATIC Logon Service account must never be locked out. If the account used by the SIMATIC Logon service is locked, every OS that relies on the service enters a startup loop and the OS_Client shows "WinCC not ready".
• Multi-project considerations: PCS 7 V7.1 SP3 supports up to 8 OS servers in a single multi-project. When you change a password that participates in the multi-project user list, edit the user in the master project first, then run Multi-project → Synchronize to propagate the WinCC authorization change to every sub-project.
• WinCC user administration vs SIMATIC Logon: when SIMATIC Logon is active, the WinCC User Administrator is bypassed. Operators configured only in WinCC User Administrator will be unable to log on until you import them into SIMATIC Logon Admin Tool.
• SID filtering: if you ever migrate a child domain into the PCS 7 forest, enable SID history and disable SID filtering for the trust. Otherwise domain users receive a filtered SID that is not recognized as a member of Simatic HMI even though the group membership is correct.
• WinCC redundancy: with redundant OS Servers, both servers must hold the updated password. A failure to update the standby server results in a redundant failover that authenticates against the un-rotated SAM and breaks picture change.
• Service mode vs interactive mode: the OS Client uses interactive logon, but the OS Server runtime runs as a service. Services authenticate with the SAM using a different logon type. A user can be valid for interactive logon but lack "Log on as service" rights, producing picture-change denials during long-running sessions.

Step-by-Step Commissioning Checklist

1. Confirm PC station list in WinCC Explorer matches the physical plant (Computer Name, WinCC Project Name, Startup Type).
2. Decide on workgroup + SIMATIC Logon or full Active Directory. Document the choice in the plant cyber-security file.
3. For workgroup: install SIMATIC Logon Service on every OS. Define operator groups in the SIMATIC Logon database.
4. For domain: join every PC station, deploy the PCS7 - WinCC User Rights GPO, force gpupdate /force.
5. Add the operator account to local Simatic HMI on every OS. Validate with net localgroup "Simatic HMI".
6. Validate DCOM launch permissions on every OS using dcomcnfg. Confirm both local and remote launch rights include the operator group.
7. Rotate a test password and follow the verification procedure above.
8. Document the new password in the plant password vault. Enforce rotation policy per IEC 62443-3-3 (every 90 days minimum).
9. Repeat the rotation drill quarterly to confirm operators and engineers know the procedure.

Standards and Documentation Cross-References

For deeper reading, the following Siemens and Microsoft documentation sources are directly applicable:

• SIMATIC PCS 7 OS V7.1 – User Rights (Authorizations) (Siemens Support PDF, attachment 60575347)
• SIMATIC Manual Collection – Changing your password (Siemens TIA Portal documentation)
• Microsoft – Disable machine account password changes (Windows Server)