Fixing WinCC 7.4 HMI Download Error When Changing User Passwords

1. Problem Overview

When an engineer checks out a WinCC 7.4 SP1 Update 1 (Upd. 1) runtime project from a version-control archive (VersionDog, TIA-multiuser, SVN, or a manual file copy) and edits the password of a WinCC user (for example the operator account PTAuser), the subsequent HMI download to the target WinCC server fails. The typical symptom chain is:

1. WinCC Explorer on the Engineering Station (ES) raises a dialog: "The configured server is not available. Do you want to open the project with the local computer as server?"
2. After clicking Yes, the project opens locally.
3. An attempt to perform OS Download / Compile-and-Download Objects from WinCC Explorer, or to use the integrated download from SIMATIC Manager, fails before any changes are transferred to the runtime server. The error dialog in the field report referenced a generic download error, sometimes appearing as "Compile and Download Objects - error during download" (WinCC error code 0x80047200 family) or, in PCS 7 variants, as "OS project cannot be activated".
4. Minor edits (graphics, text field labels) often download successfully without reproducing the failure. The error is reproducible specifically when the modification includes changes inside User Administrator (passwords, group membership, authorizations).

The same workflow may also fail on WinCC 7.0 SPx stations that share the same SIMATIC Manager project tree, although the failure signature is occasionally more cryptic (silent rollback of the downloaded user database).

2. Root Cause Analysis

Two independent defects conspire to produce the failure. Both must be addressed for a clean download.

2.1 Computer Name Mismatch Between Source Project and Target Server

If the user then performs a download while these references still point at the now-non-existent source host, the WinCC download manager tries to contact the original server (offline) and aborts. This is the same root cause documented in Siemens FAQ 33123686 — "Which settings should you check if OS loading fails with PCS 7 or the OS project cannot be activated?"

2.2 Missing User Rights for the ES Account on the WinCC Server

For WinCC 7.4, the User Administrator database (UserAdmin.mdf) and the Project Password settings are downloaded as part of a server-side change. The download is performed over the WinCC Configuration API, which authenticates using the Windows account of the logged-in engineer. If the Windows account running WinCC Explorer on the ES is not a member of the WinCC Administrators group on the target WinCC server (or does not have explicit "Configuration" authorization in User Administrator), the download is rejected with no clear error text. The dialog is usually truncated to the generic "error during download" string with no detail. The field report confirmed that granting the correct user rights resolved the WinCC 7.4 Upd. 1 instance of the fault.

3. Prerequisites

Before performing the password change and download, verify the following on both the Engineering Station and the target WinCC server:

• WinCC 7.4 SP1 Update 1 installed (ES) and matching runtime license (server). Build 7.4.1.1_R1 or later is recommended.
• SIMATIC Manager STEP 7 V5.5 SP4 or V5.6 with the integrated WinCC add-in loaded.
• The engineer is a member of the local SIMATIC HMI group on the ES and of the WinCC Administrators group on the server.
• A clean, writeable copy of the running project extracted by VersionDog (or your backup tool) into a working directory other than the project directory on the server.
• The target WinCC server is reachable by name (ping / \<server>\<project>); the project's Server Name matches the Windows hostname exactly (case-insensitive but must match).

4. Pre-Download Sanity Checks

1. Open the project copy on the ES. Accept the "open with local computer as server" prompt.
2. Open WinCC Explorer → Computer in the tree. Right-click the server entry → Properties. Note the Computer Name field.
3. Open Start → Run → sysdm.cpl → Computer Name on the ES. Note the Full computer name.
4. If the two names differ, proceed to Section 5.
5. From the ES, start User Administrator on the server (right-click the project server in WinCC Explorer → User Administrator opens the server-side database over the network). Confirm the engineer account has the Configuration authorization number (default 999 or any custom value, but the right flag must be set).

5. Step-by-Step Resolution

5.1 Align the Project's Computer Name with the Target Server

1. Close WinCC Explorer completely (right-click tray icon → Close WinCC Explorer; do not just minimize).
2. Open the working copy of the project again from the file system, not from SIMATIC Manager. The "configured server is not available" dialog should not appear if the project file's embedded server name already matches the local computer; if it does, accept and continue.
3. In WinCC Explorer, right-click Computer → Properties. In the Computer Name field, type the exact Windows hostname of the target WinCC server (for example WC74SRV01). Click OK.
4. Close the project. Reopen it from WinCC Explorer using File → Open → Open in Window or by double-clicking the project's <project>.MCP file. Verify the title bar shows the new server name.
5. Repeat the same edit inside SIMATIC Manager: select the WinCC station in the project tree, press Alt+Enter (or right-click → Object Properties), and on the Computer tab set the same server name. The two values must match; otherwise the integrated download from SIMATIC Manager will revert the WinCC Explorer change.

5.2 Grant the Engineering Account Administrative Rights on the Server

1. Log on to the target WinCC server with an administrative Windows account.
2. Open Computer Management → Local Users and Groups → Groups and double-click WinCC Administrators (and SIMATIC HMI if you also intend to download STEP 7 logic to the same machine).
3. Add the engineer's Windows domain or local account (for example PLANT\alexagmz). Confirm with OK.
4. If the project uses SIMATIC Logon for central user management, also add the engineer to the matching SIMATIC Logon role on the server. The corresponding entry is in the Central User Management (CUMC) configuration tool.
5. Force a refresh of group policies (or sign out and back in on the ES) so the ES picks up the new group membership when it reopens the project.

5.3 Authorize the ES Account Inside WinCC User Administrator

1. On the ES, reopen the project (now with the corrected server name).
2. Right-click User Administrator in the WinCC Explorer tree and choose Open. The local copy of UserAdmin.mdf opens.
3. Select the engineer's account (or the group that contains it) → Authorizations tab.
4. Enable the Configuration authorization (default tag: System configuration / number 999). Without this, User Administrator will refuse to download the user database back to the server.
5. Save and close User Administrator.

5.4 Clear Stale Lock Files on the Server

If a previous download attempt was interrupted, the server may hold a lock on the user database, silently blocking the next download.

1. On the target server, stop the WinCC runtime: Start → SIMATIC → WinCC → WinCC Runtime Stop, or run net stop "CCAlgStartService" followed by net stop "CCArchiveConnService".
2. Navigate to <project>\<server>\.
3. Delete all files with the *.lck extension, in particular UserAdmin.mdf.lck and UserAdmin_log.ldf.lck.
4. Confirm the SQL Server instance (default WinCC) is running: SQL Server Configuration Manager → SQL Server Services → SQL Server (WinCC) → Start.

5.5 Perform the Download

1. In WinCC Explorer, select Server Data → Computer in the tree, then choose Menu → Server Data → Compile and Download Objects (or right-click the server → Download).
2. In the dialog, select only the change sets you need. For a password change, the minimum is:
   • User Administration (mandatory)
   • Project Password (if the global project password is also being rotated)
   • Any graphics or text lists that are part of the same change set
3. Click Download. The dialog should report "Download successfully completed". The runtime remains live; no activation is required for password changes.
4. Verify on the server that the new password works: open a WinCC client session and log in as PTAuser with the new password.

6. Alternative Path: Integrated Download from SIMATIC Manager

For STEP 7 integrated WinCC stations, the same change can be downloaded from the SIMATIC Manager without opening WinCC Explorer separately:

1. Select the WinCC station in the SIMATIC Manager project tree.
2. Right-click → Target System → Download.
3. SIMATIC Manager opens WinCC Explorer in the background and performs the download. The same computer name and user rights prerequisites apply; the integrated path simply reuses them.
4. After the download, the WinCC Explorer title bar should show the target server name and the message "Download of OS <servername> successfully completed".

7. Verification Checklist

8. Field-Proven Caveats and Edge Cases

• Multiple servers in one project. In a WinCC client-server project with a redundant server pair, the computer name has to be updated for each server entry; otherwise the partner server download will fail with a similar generic error.
• Domain vs. local account. If the ES account is a local account on the ES but a domain account on the server, the WinCC Configuration API may authenticate against the local SAM and reject the download. Use a domain account or mirror the local account on both machines with the same password.
• WinCC 7.0 projects. The same procedure applies, but User Administrator in 7.0 stores authorizations in a different database (UADBO) — a manual export/import may be required if the 7.0 server does not have the Configuration authorization slot.
• SIMATIC Logon central user management. When SIMATIC Logon is active, the password is stored on the central server, not in UserAdmin.mdf. The download will appear to succeed but the password will not change. Verify by checking SIMATIC Logon → Roles rather than User Administrator.
• Antivirus / file locking. Some endpoint protection suites (Trend Micro, Cylance) hold a short-lived handle on UserAdmin.mdf for scanning and block the SQL Server write. Exclude the project directory from real-time scanning or add the SQL Server process to the whitelist.
• UAC and elevated Explorer. Always start WinCC Explorer with the same elevation as SIMATIC Manager (both elevated or both not). Mismatched integrity levels cause the API handshake to fail silently.

9. Diagnostic Reference: Common Error Strings

10. Related Siemens Resources

• Siemens FAQ 33123686 — Which settings should you check if OS loading fails with PCS 7 or the OS project cannot be activated? — covers the same computer-name and user-rights checks from a PCS 7 angle.
• SIMATIC HMI WinCC V7.4 SP1 — Working with WinCC → "Downloading Project Data" section in the WinCC Information System (installed with the product, or online via the Siemens Industry Online Support portal).
• SIMATIC HMI WinCC V7.4 SP1 — User Administration manual chapter "Configuring the User Administrator" (covers the Configuration authorization flag).

11. FAQ