Resolving HRESULT Error 0x80030005 Access Denied in WinCC V5.1

Resolving HRESULT Error 0x80030005 Access Denied in WinCC V5.1

SIMATIC WinCC V5.1 is the legacy PC-based HMI/SCADA platform used on Chinese-built machinery with S7-300 PLCs and PC-based operator stations. A frequent commissioning complaint on these installations is HRESULT error 0x80030005: Access denied when the integrator or end-user attempts to open a transferred WinCC project in the WinCC Explorer. This reference details the underlying root cause, the Windows-level remediation, project-file recovery steps, and the secondary PROFIBUS connection setup between an S7-300 CPU and the WinCC station.

1. Problem Description and Symptoms

On a freshly delivered Chinese-built production machine running SIMATIC WinCC V5.1 ASIA (Chinese localization) on Windows 2000, the integrator attempts to open a WinCC project from the manufacturer-supplied restore media. WinCC Explorer returns the dialog:

Hresult error 0x80030005: Access denied.

The following symptoms are observed on a typical installation:

• Project opens partially, then hangs at Project initialization.
• WinCC Explorer event log reports CSArchive / OLE-COM storage could not be opened.
• Re-installation of WinCC 5.1 ASIA does not resolve the issue.
• Formatting the hard drive and re-imaging from the vendor DVD also fails on the same error code.
• The vendor's default username/password combination 001 / 001 is rejected by WinCC Explorer.

None of the symptoms indicate a defective media image because the same image opens correctly under a freshly created Windows administrator account. The error reproduces on every login until the user-rights constraint is corrected.

2. Root Cause Analysis

2.1 HRESULT 0x80030005 Mapping

HRESULT 0x80030005 corresponds to the COM structured-storage return code STG_E_ACCESSDENIED. WinCC V5.x stores project data inside OLE Compound Document files (*.pdl, project databases) and relies on Windows security descriptors to grant the logged-on user read/write access to the project directory tree. The structured-storage layer refuses to open the file when the caller's access token does not include FILE_GENERIC_READ and FILE_GENERIC_WRITE on the file.

2.2 Why the Project Looks Corrupted

The OLE storage layer opens the compound document, enumerates the directory entries, and validates the security descriptor against the caller's token. When the Windows user logged into the HMI PC is a member of Users rather than Administrators, the structured-storage API fails at the very first IStorage::OpenStream call. WinCC V5.1 then surfaces the lower-level COM error to the operator, who assumes the *.pdl archive is unreadable. The 30% size of project files being identical to the vendor backup is the first evidence that the file itself is intact.

2.3 Vendor Default Account Behavior

Chinese machine builders commonly ship the HMI PC with a non-administrative local account (often named 001 with password 001) to satisfy factory-acceptance-test checklists. This account is intentionally restricted so that line operators cannot modify the project. WinCC V5.1 honors this restriction: even with the correct credentials, the limited account cannot load the project's Regensburg archive. WinCC never asks for project-level passwords in this scenario; it fails before reaching the project authentication screen.

3. Prerequisites for the Fix

• Windows 2000 / XP / Server 2003 administrator password for the local PC (or ability to boot Safe Mode and rename accounts).
• WinCC V5.1 ASIA installation CD or pre-installed C:\SIEMENS\WinCC path.
• Vendor-supplied WinCC project restore media (CD, USB, or network share).
• Read/write access to the destination project directory (typically D:\Projects\<MachineName>\ or C:\SIEMENS\WinCC\Projects\).
• For the secondary PROFIBUS task: SIMATIC NET PC software, CP 5611 / CP 5613 / CP 5614 PROFIBUS card, and the S7-300 station with its MPI/DP port configured.

4. Step-by-Step Resolution

Step 1 - Identify the Active Windows Account

1. Press Ctrl+Alt+Del and select Log Off on Windows 2000 / XP.
2. At the login prompt, note the username. If the field is greyed out, the default account is 001 with auto-login enabled.
3. Click Cancel and log in as a local administrator using Administrator with the password set during imaging (typically blank on factory-default Chinese machines - reset immediately).

Step 2 - Promote the Operating Account to Administrator

1. Open Control Panel > Administrative Tools > Computer Management.
2. Expand Local Users and Groups > Users.
3. Right-click the operator account (for example 001) and choose Properties.
4. Select the Member Of tab.
5. Click Add, type Administrators, and confirm with Check Names.
6. Click OK twice and close Computer Management.

Step 3 - Reset NTFS Permissions on the Project Tree

1. Open Windows Explorer and navigate to the WinCC project root, for example:

   D:\Projects\FeedingSystem\

2. Right-click the folder and select Properties > Security.
3. Click Advanced and enable Replace permission entries on all child objects.
4. Add Everyone with Full Control if commissioning, or Users with Read / Write / Modify if hardening for production.
5. Apply and confirm the security propagation warning.

Step 4 - Clear the Lock and Temp Files

1. Stop any orphaned WinCC process via Task Manager (kill CCExplorer.exe, WinCC.exe, S7wnasvc.exe).
2. Delete stale lock files inside the project directory:

   del /s /q *.ldb
   del /s /q *.lck
   del /s /q ~*.*
   

3. Empty the recycle bin to release COM storage handles.

Step 5 - Reopen the WinCC Project

1. Log off and log back in as the operator account (now in Administrators group).
2. Launch WinCC Explorer from Start > SIMATIC > WinCC > Windows Control Center.
3. Select Open > Open Project and choose the project's *.mcp master file.
4. Verify that WinCC Explorer enters Runtime ready state without the HRESULT dialog.

5. PROFIBUS Connection Between S7-300 and the WinCC PC

After the project loads, the second commissioning task is establishing the S7-300 to PC link. The classic recipe for WinCC V5.x on a Chinese-built feeding system uses the integrated PROFIBUS / MPI interface on the S7-300 CPU and a CP 5611 / CP 5613 card on the PC side.

5.1 Hardware Topology

  +----------------+          PROFIBUS DP / MPI           +----------------+
  |   S7-300 CPU   |  ----------------------------------> |  WinCC PC      |
  |   (e.g. 314C-2 |   9.6 kbit/s ... 12 Mbit/s           |  CP 5611 A2    |
  |   DP / 315-2DP)|   bus terminator ON at both ends      |  or CP 5613 A2 |
  +----------------+                                       +----------------+

5.2 SIMATIC NET Configuration in the PC Station

1. Open SIMATIC NET Commissioning Tool (part of the WinCC V5.1 ASIA install).
2. Insert a new PC station and add the CP 5611 / CP 5613 module under Index 1.
3. Set the PROFIBUS address on the CP to 1 (the PC station). The S7-300 default is 2.
4. Confirm the bus profile matches the S7-300 CPU. Use Universal (DP/FMS) with 187.5 kbit/s for legacy wiring or 1.5 Mbit/s for new installations.

5.3 WinCC Variable Driver Setup

1. In WinCC Explorer, open Tag Management > SIMATIC S7 PROTOCOL SUITE > PROFIBUS.
2. Right-click PROFIBUS and select System Parameters. The default logical connection name is PROFIBUS(1).
3. In Connection Properties, enter the S7-300 station address (2), the rack (0), and the slot of the CPU (2 for an S7-300).
4. Create the connection and verify with Status > Connection Status in WinCC Explorer.

5.4 STEP 7 Side - Enable PROFIBUS on the S7-300

1. Open the STEP 7 project for the feeding system.
2. In HW Config, double-click the CPU's DP/MPI port.
3. On the Interface tab, select PROFIBUS and assign address 2.
4. On the Subnet tab, click New to create a PROFIBUS(1) subnet with the chosen transmission rate.
5. Save and download the hardware configuration to the CPU.

5.5 MPI as a Fallback

If PROFIBUS cabling is not feasible, WinCC V5.1 can also communicate over MPI at 187.5 kbit/s using the same CP 5611 / CP 5613. In WinCC Tag Management, select SIMATIC S7 PROTOCOL SUITE > MPI instead of PROFIBUS, set the PC station address to 0, and the S7-300 MPI address remains 2. MPI is limited to a single master and a maximum of 32 nodes, which is acceptable for a single HMI station.

6. Verification Procedure

1. Confirm WinCC Explorer opens the project with no COM error dialog.
2. Activate the project (File > Activate) and observe WinCC Runtime startup; absence of Channel DLL not loaded or Connection failure messages indicates a healthy tag driver.
3. Open WinCC Tag Management > Diagnostics. Tag status should show OK for every external variable tied to the S7-300.
4. On the S7-300 side, observe the SF / BF LEDs. BF (bus fault) must be off; SF (system fault) must be off.
5. Toggle a test bit in the S7-300 OB1 and confirm it reflects in the WinCC screen within one update cycle.
6. Run the WinCC project for a full 30-minute burn-in to expose intermittent COM-storage access problems.

7. Troubleshooting Matrix

8. Project Recovery if the .pdl Archive is Genuinely Damaged

In rare cases where the OLE compound document is actually corrupted (for example, the restore media is scratched or the operator pulled power during a write), recover the project using the following layered approach:

1. Restore from the most recent WinCC project backup. By default WinCC V5.1 saves to <Project>\<ProjectName>.bak\.
2. If no backup exists, request the machine builder's *.zip export that contains the GraCS\, Library\, and PAS\ subfolders.
3. Re-create the project in WinCC Explorer: File > New Project, then File > Migrate Project if migrating from WinCC V5.0.
4. Re-import pictures via Graphics Designer > File > Open from the recovered GraCS\ folder.
5. Re-link the S7-300 connection in Tag Management.

9. Hardening the PC After Commissioning

Once WinCC is operational, reduce the administrator privilege back to the operational level:

1. Create a dedicated WinCC user winccop as a member of Users only.
2. Assign NTFS rights Read, Write, Modify on the project folder, Read & Execute on C:\SIEMENS\.
3. Disable auto-login and require the operator to log in with the restricted account.
4. Enable the Windows 2000 / XP Do not display last user name policy to prevent password probing.
5. Apply the latest WinCC V5.1 SP updates (Service Packs 5 and 6 are the last released for V5.x; refer to the official SIMATIC WinCC V5.1 ASIA Sales/Delivery Release notice for shipped media content).

10. Reference Tables

11. FAQ