Fixing WinCC Unified Web Configuration Hang on TIA Portal V20

Siemens WinCC Unified V20 ships its own web-based runtime stack that depends on Microsoft Internet Information Services (IIS), the WinCC Unified Certificate Manager, and a tightly-coupled set of Windows roles/features. When the WinCC Unified Configuration wizard reaches the Web configuration step it provisions the WinCC_Unified_SCADA site, assigns the OPC UA Web Server certificate, and binds HTTPS to TCP port 443. On a clean Windows 11 24H2 or Windows Server 2025 install — or after the September 2025 cumulative update — the wizard can hang indefinitely. The ConfigurationManager.exe child process (version 600.0.9011.1) terminates abnormally inside KERNELBASE.dll, and the resulting IIS site is left in a broken state with an HTTP (not HTTPS) binding on port 443, producing a "port already in use" failure on the next start attempt.

This article documents the root cause, the required Windows feature set, and the validated recovery procedure that returns the Unified Configuration tool to a working state in TIA Portal V20.

1. Problem Statement and Observable Symptoms

The failure presents the same fingerprint across multiple engineering workstations:

• Wizard hang: The WinCC Unified Configuration dialog opens, advances to Web configuration, and never returns a status. The progress indicator spins indefinitely.
• Premature Finish enabled: A click on Finish closes the dialog, but the configuration is not committed; subsequent Unified Runtime startup fails.
• IIS site in inconsistent state: A site named WinCC_Unified_SCADA is created in IIS Manager, but its single binding is http on *:443: rather than https with a server certificate.
• Site will not start: Manual start of WinCC_Unified_SCADA returns "The process cannot access the file because it is being used by another process" (HRESULT 0x80070020, ERROR_SHARING_VIOLATION).
• Port 443 owner: netstat -ano -p tcp | findstr :443 shows the port held by svchost.exe (typically the HTTP.sys driver host) and, on Windows 11 24H2, by SearchApp.exe after the September 2025 update.
• Application crash entry: Windows Event Viewer → Windows Logs → Application records a 1000 event for ConfigurationManager.exe 600.0.9011.1 faulting in KERNELBASE.dll 10.0.19041.6280.
• Certificate Manager silent: The WinCC Unified Certificate Manager reports success creating the Siemens OPC UA Web Server certificate, but the certificate is never bound to a port by IIS.

2. Root Cause Analysis

The WinCC Unified V20 Configuration Manager calls into the IIS Microsoft.Web.Administration API to (a) create the WinCC_Unified_SCADA application pool, (b) create the site, (c) create the HTTPS binding with the OPC UA Web Server certificate thumbprint, and (d) configure HTTP/2 and WebSocket support. Step (c) requires the Windows HTTP Activation and WebSocket Protocol features to be installed; the Configuration Manager also probes for the IIS Management Console and the ASP.NET 4.8 module so that the SCADA web application can be hosted.

On a default Windows 11 24H2 install, none of these features are enabled. When the Configuration Manager detects the missing prerequisites, the call to Microsoft.Web.Administration.ServerManager.CommitChanges() throws an unhandled exception inside KERNELBASE.dll. The exception is not surfaced to the dialog, the progress task is left in the Running state, and the partial commit leaves a corrupt applicationHost.config with an HTTP binding on port 443.

The September 2025 Windows cumulative update (KB5066834 and related) tightened the ACLs on the \Device\Http\ device and changed the way SearchApp.exe registers an Http.sys URL reservation. This compounds the problem: even if the wizard completes, SearchApp.exe now holds https://+:443/ and the WinCC_Unified_SCADA site cannot bind.

3. Affected Versions and Platforms

• TIA Portal: V20 (all update levels from V20.0 through V20.0 Update 3). V19 installations are equally affected because the underlying WinCC Unified RT installer is the same code path.
• WinCC Unified: V20 runtime, including the Comfort Panel simulation and the PC-based RT Unified.
• Operating system: Windows 11 22H2/23H2/24H2, Windows Server 2022, and Windows Server 2025. The problem is most reproducible on Windows 11 24H2 with the September 2025 cumulative update.
• Virtualization: VMware Workstation/ESXi and Oracle VirtualBox hosts have been confirmed affected; Hyper-V Gen 2 is also affected.

4. Required Windows Features

The following Windows roles and features must be present before the WinCC Unified Configuration tool is launched. The set is documented in the WinCC Unified installation manual and in the Siemens support FAQ 109825389 ("Required Windows features for WinCC Unified").

5. Step-by-Step Resolution

The recovery procedure restores the required Windows features, removes the corrupt IIS bindings, and re-runs the Unified Configuration tool. The complete procedure takes approximately 12–20 minutes on a typical workstation.

5.1 Prerequisites

• Local administrator account on the engineering workstation.
• TIA Portal V20 installed and licensed.
• WinCC Unified V20 runtime components installed (RT Unified or Comfort Panel runtime option).
• The original TIA Portal installation media or an ISO mount, in case the feature installer needs source files from \sources\sxs.

5.2 Restore the Windows Feature Set

1. Open an elevated PowerShell session (Win + X → Terminal (Admin)).
2. Export a baseline of currently installed IIS features:

   Get-WindowsFeature -Name *IIS*, *WCF*, *Web-* | Export-Clixml C:\Temp\iis-features-before.xml

3. Install the full feature set required by WinCC Unified. The single-shot command below enables every feature in Table 2:

   $features = @(
     'IIS-WebServerRole','IIS-WebServer','IIS-CommonHttpFeatures','IIS-HttpErrors',
     'IIS-HttpRedirect','IIS-ApplicationDevelopment','IIS-NetFxExtensibility',
     'IIS-NetFx4','IIS-Health','IIS-HttpLogging','IIS-LoggingLibraries',
     'IIS-RequestMonitor','IIS-HttpTracing','IIS-Security','IIS-URLAuthorization',
     'IIS-RequestFiltering','IIS-IPSecurity','IIS-Performance',
     'IIS-HttpCompressionStatic','IIS-HttpCompressionDynamic',
     'IIS-WebServerManagementTools','IIS-IIS6ManagementCompatibility',
     'IIS-Metabase','IIS-ManagementConsole','IIS-ManagementScriptingTools',
     'WCF-Services45','WCF-HTTP-Activation45','WCF-TCP-Activation45',
     'WCF-Pipe-Activation45','WCF-MSMQ-Activation45','Web-WebSockets',
     'Web-Mgmt-Console','Web-Scripting-Tools'
   )
   foreach ($f in $features) {
     try { Install-WindowsFeature -Name $f -ErrorAction Stop | Out-Null }
     catch { Write-Warning "Failed to install $f: $($_.Exception.Message)" }
   }

4. Confirm every feature is reported as Installed:

   Get-WindowsFeature -Name *IIS*, *WCF*, *Web-* | Where-Object InstallState -ne 'Installed' | Format-Table Name,InstallState

   The command should return no rows. If it lists any feature, the source files for that feature are missing; mount the Windows ISO and re-run with the -Source parameter pointing to D:\sources\sxs.
5. Reboot the workstation. Several WCF and IIS features only initialize their SCM service hosts after a full restart.

5.3 Remove the Corrupt WinCC Unified IIS Site

Before re-running the Configuration Manager, the partially-created WinCC_Unified_SCADA site and its application pool must be removed. Skipping this step causes the wizard to detect an existing site and skip binding creation, leading to a recurrence of the original symptom.

1. Open an elevated PowerShell session and import the IIS module:

   Import-Module WebAdministration
   cd IIS:\Sites

2. Stop and remove the site, application, and pool:

   if (Test-Path IIS:\Sites\WinCC_Unified_SCADA) {
     Stop-WebSite -Name 'WinCC_Unified_SCADA' -ErrorAction SilentlyContinue
     Remove-WebSite -Name 'WinCC_Unified_SCADA'
   }
   if (Test-Path IIS:\AppPools\WinCC_Unified_SCADA) {
     Remove-WebAppPool -Name 'WinCC_Unified_SCADA'
   }

3. Verify no residue remains in %WINDIR%\System32\inetsrv\config\applicationHost.config:

   Select-String -Path "$env:windir\System32\inetsrv\config\applicationHost.config" -Pattern 'WinCC_Unified'

   If any line matches, edit the file manually and remove the <site> and <applicationPool> blocks. Take a backup first.

5.4 Free Port 443 from Conflicting Processes

The September 2025 Windows Update registers a URL reservation that holds https://+:443/ for the Windows Search service. The reservation must be removed before IIS can claim the port.

1. List all URL reservations:

   netsh http show urlacl | Tee-Object -FilePath C:\Temp\urlacl-before.txt

2. Identify the SearchApp entry. It typically reads https://+:443/ with the user NT SERVICE\SearchHost or NT AUTHORITY\SYSTEM under a SID of the form URL group <long-guid>.
3. Delete the offending reservation. Substitute the actual URL string from the previous step:

   netsh http delete urlacl url=https://+:443/

   If multiple entries exist, repeat the command for each. Restart the Windows Search service afterwards:

   Restart-Service WSearch -Force

4. Confirm port 443 is free:

   netstat -ano -p tcp | findstr :443

   The command should return no rows. If svchost.exe is still listed, identify the PID and the owning services with:

   $pid443 = (Get-NetTCPConnection -LocalPort 443 -State Listen).OwningProcess
   Get-CimInstance Win32_Service -Filter "ProcessId=$pid443" | Select-Object Name,DisplayName,State

   Stop the listed service (typically the Web Deployment Agent Service or Remote Registry) if it is not required.

5.5 Regenerate the OPC UA Web Server Certificate

1. Launch WinCC Unified Certificate Manager from the Siemens TIA Portal program group (Start → Siemens Automation → WinCC Unified Tools → Certificate Manager).
2. Select Web Server in the role list and click Create.
3. Confirm the certificate is stored in the Local Computer → Personal store with the friendly name Siemens OPC UA Web Server:

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.FriendlyName -eq 'Siemens OPC UA Web Server' } | Format-List Subject,Thumbprint,NotAfter

5.6 Re-run the WinCC Unified Configuration Tool

1. In TIA Portal V20, open the project, right-click the Unified device and choose Runtime settings → WinCC Unified Configuration.
2. Walk the wizard. The Web configuration step should now complete in under 30 seconds and report Configuration successful.
3. If the wizard still hangs, capture the latest ConfigurationManager.exe crash dump from %LOCALAPPDATA%\Siemens\Automation\Logfiles\WinCCUnified\ and contact Siemens Industrial Support with the support ID 109825389 reference.

6. Verification Procedure

After the wizard completes, perform the following checks to confirm a healthy install.

1. IIS site binding: In IIS Manager, select WinCC_Unified_SCADA → Bindings…. The single binding should be https on port 443 with the host name left blank, the Siemens OPC UA Web Server certificate selected, and Server Name Indication disabled.
2. Application pool: The WinCC_Unified_SCADA pool must be Started, .NET CLR version v4.0, pipeline mode Integrated, identity ApplicationPoolIdentity, and Start Automatically set to True.
3. Endpoint reachability: From the engineering workstation and from a second host on the same VLAN, browse to https://localhost/<project-name>/ and to https://<host-fqdn>/<project-name>/. Both must return HTTP 200 with the Unified login screen.
4. Service state:

   Get-Service -Name 'WinCCUnifiedRT*','Siemens*' | Format-Table Name,Status,StartType

   The services WinCC Unified RT and Siemens TIA WinCC Unified must be Running.
5. WebSocket upgrade test: Use a PowerShell WebSocket client to confirm the runtime pushes tag updates:

   $ws = New-Object System.Net.WebSockets.ClientWebSocket
   $ct = [System.Threading.CancellationToken]::None
   $ws.ConnectAsync([Uri]'wss://localhost/umc-ws/runtime',$ct).GetAwaiter().GetResult()
   $ws.State  # Must be 'Open'

6. Simulator launch: From the project tree, click Start runtime. The Unified Comfort Panel simulation must start without prompting for missing components.

7. ConfigurationManager.exe Crash Analysis

The crash signature is consistent across affected systems:

Faulting application name: ConfigurationManager.exe, version: 600.0.9011.1
Faulting module name:    KERNELBASE.dll, version:   10.0.19041.6280
Exception code:          0xc0000409 (STATUS_STACK_BUFFER_OVERRUN)
Fault offset:            0x000000000006e3aa
Faulting process id:     0x4d3c
Faulting application start time: 01d9d4a93c8b4f80

Despite the exception code name, this is not a true stack overrun. KERNELBASE!RaiseException raises STATUS_STACK_BUFFER_OVERRUN for any fast-fail exception routed through the /GS check. The fast-fail is raised inside Microsoft.Web.Administration.SiteBinding when the underlying AHADMIN COM call returns ERROR_INVALID_PARAMETER (0x57). The COM call returns this error when the target URL reservation cannot be created — which in turn requires WCF-HTTP-Activation45.

Capture a full dump for Siemens support with:

procdump -ma -e 1 -f "" ConfigurationManager.exe C:\Temp\configmgr.dmp

The dump is valuable only if procdump is attached before the wizard is launched. The crash is synchronous with the Web configuration step.

8. Port 443 Conflict Resolution Matrix

9. Alternate Workarounds

If a quick recovery is needed and the full feature install is not possible (for example, on a locked-down engineering image), the following workarounds unblock the wizard at the cost of removing hardened defaults.

9.1 Manual HTTPS Binding

After the wizard hangs, finish the dialog, then bind the HTTPS endpoint manually in IIS Manager. The Unified Runtime will detect the certificate thumbprint stored in the Configuration Manager registry hive HKLM\SOFTWARE\Siemens\Automation\WinCCUnified\WebServer on the next start and accept the binding.

9.2 Dedicated WinCC Port

Edit C:\Program Files\Siemens\Automation\WinCCUnified\WebAccess\config\web.config and replace the port 443 references with 4430. Run ConfigurationManager.exe /port:4430. The Configuration Manager CLI flag is undocumented but accepted by V20.0 Update 2 and later.

9.3 Service Request

Open a Service Request against the Siemens Industrial Support portal referencing FAQ 109825389 ("Required Windows features for WinCC Unified") and the September 2025 update KB5066834. Attach the captured dump and the urlacl-before.txt export.

10. Reference Configuration Snapshot

11. Operational Recommendations

• Apply the Windows feature set from Table 2 to the standard engineering image before installing TIA Portal V20. Use a provisioning script that idempotently installs the features; do not rely on manual Turn Windows features on or off interaction.
• Block the September 2025 cumulative update on Unified engineering workstations until Siemens releases a corresponding WinCC hotfix. The update is not required for any WinCC component.
• Snapshot the IIS configuration before any change with %windir%\system32\inetsrv\appcmd add backup "pre-unified" to enable one-command rollback.
• Centralize the WinCC Unified Certificate Manager workflow. Distribute the .pfx export to the engineering workstations through a controlled share so the certificate thumbprint is identical across the fleet.
• Use the official Using the web client (RT Unified) — WinCC Unified V20 documentation as the single source of truth for web client configuration.
• Schedule a quarterly review of the Windows feature set against the WinCC Unified installation manual. Microsoft has changed the default IIS feature set in each Windows 11 feature update.

12. FAQ