Resolving SIMATIC Logon Double-Prompt Issue on WinCC 7.4 SP1

Problem Overview

On a Siemens WinCC V7.4 SP1 runtime station with the WinCC/Audit option installed, the SIMATIC Logon dialog appears twice on project startup: once immediately when the runtime graphics viewer opens the start picture, and again shortly after the user has successfully entered valid credentials. The second prompt is unsolicited - it is not triggered by a hotkey, a button, a script call, or a configured picture change. Closing the second dialog by pressing Cancel allows the operator to continue using the project without re-entering credentials, but the "Logoff" function on user administration pictures remains unavailable until a valid login has been registered. The behavior is reproducible on every cold start of the WinCC Runtime and is independent of the user account supplied.

The symptom is widely reported on runtime stations that were upgraded from WinCC V7.3 to V7.4 SP1 with the Audit/ChangeControl option retained. The behavior is also reproducible on Windows Server 2008 R2 / 2012 R2 / 2016 images running WinCC Runtime in service mode under the CCAgent account, and on standalone engineering stations that have been converted into single-user runtime hosts.

Affected Products and Versions

The following product matrix captures the versions where the duplicate-prompt behavior has been confirmed by Siemens Support:

Systems that have only WinCC Runtime installed (without the WinCC/Audit or WinCC/ChangeControl option) do not exhibit the duplicate-prompt behavior even on WinCC V7.4 SP1 base. The bug is specific to the combination of the runtime, SIMATIC Logon, and the Audit/ChangeControl back-end service that hosts PASSDBRT.exe.

Root Cause Analysis

The duplicate dialog is generated by a recurring user-administration trigger fired by the WinCC/Audit back-end service PASSDBRT.exe (Password Database Runtime). When WinCC V7.4 SP1 is started, the runtime registers a user-change event with SIMATIC Logon and queries the internal tag @CurrentUser for the active user identity. On a healthy station the back-end service answers the query within the configured poll interval and the runtime keeps the dialog closed.

On WinCC/Audit V7.4 SP1 base (and on Updates 1 through 4 of that Audit release) the PASSDBRT.exe process crashes when handling the user-change callback from SIMATIC Logon under specific timing conditions - typically when the runtime start picture has not yet finished initializing its C-script context before the Audit hook fires. The WinCC Runtime detects that no valid session has been registered and reopens the SIMATIC Logon dialog to force a fresh authentication. Because the Audit service has crashed, it cannot record the authentication attempt, which causes the runtime to interpret the absence of an Audit trail entry as a failed login and re-prompt. The cycle continues until the Audit service is restarted by the WinCC Watchdog or the user manually cancels the second dialog.

The Crash Signature visible in the Windows Application Event Log at the time of the failure is:

Source: Application Error
Event ID: 1000
Faulting application name: PASSDBRT.exe, version: 7.4.1.x, time stamp: 0x...
Faulting module name: ntdll.dll, exception code: 0xc0000005
Fault offset: 0x...
Faulting process id: 0x...
Faulting application path: C:\Program Files (x86)\Siemens\Automation\WinCC\Audit\bin\PASSDBRT.exe

The same exception code (0xc0000005 - ACCESS_VIOLATION) is the diagnostic marker that ties the symptom to the Audit back-end rather than to the WinCC graphics engine or to a custom C-script in the project.

Diagnostic Procedure

Run the following checks in sequence before applying the patch. Each step confirms or eliminates one candidate cause. Stop at the first step that conclusively identifies the root cause.

1. Confirm SIMATIC Logon is the prompt source. On the second appearance of the dialog, observe the title bar. A title of "SIMATIC Logon" indicates the WinCC Logon Manager; a title of "WinCC Logon" indicates the legacy WinCC internal user administration is active and the fix described in this article does not apply.
2. Verify the @CurrentUser tag value. In the WinCC Explorer, open Internal Tags > @CurrentUser (or browse the tag via the WinCC Tag Management on a connected client). If the tag remains empty after the first successful login, the runtime has not registered the credentials, confirming that a back-end service (not a script) is at fault.
3. Inspect the Windows Application event log. Filter for Application Error events from PASSDBRT.exe occurring within 30 seconds of the runtime start. A crash signature as listed in the previous section is definitive evidence of the Audit bug.
4. Check the Audit Watchdog restart count. The WinCC/Audit configuration tool logs every restart of PASSDBRT.exe under C:\Program Files (x86)\Siemens\Automation\WinCC\Audit\Log\AuditRestart.log. More than three restarts in the first 60 seconds of runtime operation confirms the crash loop.
5. Disable WinCC/Audit temporarily. Stop the WinCC Runtime, deactivate the Audit option through the WinCC project properties (right-click the project in WinCC Explorer > Properties > Audit/ChangeControl > clear "Activate"), and restart the runtime. If the second SIMATIC Logon dialog no longer appears, the Audit back-end is the root cause and the patch in the next section is required.
6. Check for script- or hotkey-driven calls. Open the WinCC project in the graphics designer and search the script tree (C-Scripts > Project-wide / Picture-wide) for the function PASSLoginDialog. Any hit is a script-issued login call and must be evaluated separately. Also check Project Properties > User Administrator > Hotkeys for any shortcut bound to the login function.

Resolution Steps

The fix is delivered by the WinCC/Audit and WinCC/ChangeControl Update 1 for V7.4 SP1. Apply the updates in the order listed. Both updates can be installed while the WinCC Runtime is stopped; no project recompile is required after patching, but a runtime cold start is mandatory.

1. Stop the WinCC Runtime and the CCAgent service:

   net stop "CCAgent"
   net stop "WinCC Runtime"  (where applicable)
   net stop "SIMATIC Logon Service"

   Use Services (services.msc) or the WinCC "Project Stop" icon to confirm that all related processes have terminated before continuing.
2. Install Update 6 for WinCC V7.4 SP1 (and Update 6 for the ASIA variant when relevant). The update is delivered as a self-extracting archive from Siemens Support Entry 109757608. Run the executable with elevated privileges. The installer replaces the WinCC runtime libraries, the graphics engine, and the Logon Manager DLLs.
3. Install Update 1 for WinCC/Audit V7.4 SP1 and WinCC/ChangeControl V7.4 SP1. The update is delivered from Siemens Support Entry 109754946. The installer replaces PASSDBRT.exe and the Audit database hooks that handle the user-change event from SIMATIC Logon. The post-install version of PASSDBRT.exe must report 7.4.1.6 or higher when checked via Properties > Details > File version.
4. Re-enable the SIMATIC Logon Service if it was stopped, then restart the CCAgent service:

   net start "SIMATIC Logon Service"
   net start "CCAgent"

   Confirm that PASSDBRT.exe stays alive for at least five minutes with no further restart entries in AuditRestart.log.
5. Restart WinCC Runtime from the WinCC Explorer or by activating the project. The runtime should now register the first successful login in the @CurrentUser tag without raising a second dialog.

Verification

After applying the patch, verify the fix on the live system using the following procedure:

1. Start WinCC Runtime and observe the SIMATIC Logon dialog. Enter valid credentials and click OK.
2. Confirm that no second dialog appears within 10 seconds of the start picture being loaded.
3. In WinCC Explorer, expand Internal Tags and inspect @CurrentUser. The tag must contain the Windows domain\user string of the authenticated user.
4. Open a user-administration picture that exposes the "Logoff" button. The button must become enabled and respond to a click by closing the current SIMATIC Logon session.
5. Check the Windows Application event log for any further PASSDBRT.exe crash events. None should be present.
6. Verify the Audit trail: open the WinCC/Audit viewer (Start > SIMATIC > WinCC > Audit Viewer) and confirm that the login event has been recorded with the correct timestamp and user identity. The trail entry is the proof that the patched back-end has acknowledged the session.

If step 4 fails (Logoff button remains disabled) but step 3 passes (@CurrentUser is populated), the user-administration picture is still referencing the legacy internal user administration rather than SIMATIC Logon. Reconfigure the picture to bind its login/logoff buttons to the SIMATIC Logon API.

SIMATIC Logon Server Configuration Reference

Independent of the Audit fix, the SIMATIC Logon Server must be configured correctly on every machine that participates in the WinCC user administration. The following parameters are taken from the official TIA Portal documentation for panels and WinCC Runtime:

• IP address consistency: Always assign a fixed IP address (DHCP reservation or static configuration) to the SIMATIC Logon Server. Host-name resolution is permitted but introduces a dependency on DNS availability that is rarely acceptable on plant-floor networks.
• TCP port: Default port is 16389 (UDP/TCP). The port must be opened bidirectionally in every Windows Firewall profile on the Logon Server and on the WinCC Runtime stations. Verify with: Test-NetConnection -ComputerName <logonserver> -Port 16389.
• User groups: Map Windows Active Directory groups to SIMATIC Logon roles in the Logon Server configuration tool. The role names are case-sensitive and must match exactly the role names referenced in the WinCC user administration.
• Encryption: Activate encrypted communication in the Logon Server console for any production network. The runtime side must then be configured with the matching certificate; otherwise the runtime will silently fall back to unencrypted mode and the login dialog will close without authentication, simulating the duplicate-prompt symptom.
• Redundancy: When a redundant pair of Logon Servers is configured, both server addresses must be entered in the WinCC project properties separated by a semicolon. A mismatch produces an intermittent "Login failed" dialog that is easily mistaken for the Audit bug.

Detailed configuration steps for SIMATIC Logon on Basic Panels, Comfort Panels, and WinCC Runtime are documented in the TIA Portal V20 user administration guide.

Programmatic Login Invocation

If a custom C-script in the WinCC project invokes the login dialog directly, the second appearance of the dialog may be caused by a duplicate call to PASSLoginDialog rather than by the Audit bug. The function signature in apdefap.h is:

Audit every script that contains this call:

• Startup scripts: Project-wide C-Scripts > OpenPicture / ActivateProject. The function must be called only once on the start picture.
• Picture-specific scripts: Each picture can declare an OpenPicture event. A duplicated call across nested pictures is a frequent cause of repeated prompts.
• Hotkey bindings: Project Properties > Hotkeys may bind a keyboard shortcut to the login function. A stray F-key combination on a panel or keyboard will trigger the dialog without operator awareness.

To determine whether a script call is the culprit, comment out every PASSLoginDialog line, rebuild the project, and restart WinCC Runtime. If the dialog appears twice with no script call present, the Audit back-end is the source. If the duplicate disappears with the scripts removed, the script layer needs de-duplication.

Internal Tags and Variables

WinCC exposes a set of internal tags that reflect the state of SIMATIC Logon. These are valuable diagnostic and binding points for custom graphics:

Bind these tags to display objects to provide visual feedback to operators about authentication status. A persistent blank @CurrentUser after the first login is the canonical indicator of the Audit back-end crash.

Common Edge Cases and Field-Proven Caveats

The following conditions have been observed to mimic or exacerbate the duplicate-prompt behavior in production deployments:

• Slow-starting antivirus: Some endpoint protection suites delay the launch of PASSDBRT.exe by several seconds, causing the runtime to time out the Audit response and reissue the login dialog. Exclude the C:\Program Files (x86)\Siemens\Automation\WinCC tree from real-time scanning.
• Multiple domain controllers: When the Logon Server resolves group membership against a remote DC that is temporarily unreachable, the first authentication succeeds but the role lookup fails. The runtime interprets this as a partial login and re-prompts. Configure the Logon Server to use a single preferred DC with a fallback.
• Time skew: Kerberos authentication fails silently when the Logon Server and the WinCC Runtime host differ by more than five minutes (default Kerberos tolerance). The login dialog then opens, accepts any credentials, and re-opens because the authentication ticket is rejected. Synchronize both hosts to the same NTP source.
• WinCC hot-key conflicts: On Comfort Panels, the F-key shortcuts can be reassigned by user. If a key bound to PASSLoginDialog is pressed immediately after a successful login, a second dialog appears. Clear the hot-key list in Project Properties > Hotkeys and verify the picture-level F-key assignments.
• Redundant runtime pairs: When the primary WinCC Runtime host fails over to the standby, the SIMATIC Logon session is not transferred. The standby raises a fresh login dialog while the primary still holds the original session, and a "ping-pong" of prompts results until the operator cancels the redundant request.

Log and File Locations for Troubleshooting

The following file paths are relevant when reproducing or verifying the fix:

Reverting to a Known-Good State

If the patch introduces a regression in the Audit trail behavior - for example, missing audit trail entries after the patch - the following rollback is supported by Siemens:

1. Stop WinCC Runtime and the CCAgent service.
2. In Control Panel > Programs and Features, locate "SIMATIC WinCC/Audit V7.4 SP1 Update 1" and select Uninstall.
3. Restart the runtime in degraded mode (Audit disabled) to capture a baseline of the trail behavior.
4. Open a support request with Siemens referencing both the original KB entry and the regression symptom; attach the contents of AuditRestart.log and the relevant section of the Windows Application event log.

Preventive Hardening

To minimize the risk of recurrence on future WinCC/Audit upgrades:

• Subscribe to the Siemens ProductCERT and WinCC RSS feeds for advance notice of new Update releases.
• Maintain an offline image of the runtime stations and validate every Audit/ChangeControl update in a staging environment before deploying to production.
• Add an automated check that verifies @CurrentUser is populated within 30 seconds of runtime start. An empty tag value is the early warning that the Audit back-end has not registered the session.
• Periodically export the AuditRestart.log and alert when the daily restart count exceeds zero. A healthy Audit back-end should not restart at all during normal operation.

FAQ