Resolving SIMATIC Logon Failure After PCS 7 V9.1 SP2 UC04 Update

1. Problem Overview

After installing the SIMATIC PCS 7 V9.1 SP2 UpdateCollection 04 (UC04), distributed operator stations running on Windows Server 2019 and Windows 10 lose the ability to remote-authenticate user logins through SIMATIC Logon. The pre-configured remote servers disappear from the SIMATIC Logon drop-down server list and cannot be re-added. Subsequent attempts to register a remote authentication server fail silently, leaving the system in a state where WinCC Runtime no longer enforces centralized user administration.

The failure pattern is reproducible across both Siemens IPC hardware (e.g., SIMATIC IPC647E, IPC847E, IPC227G, IPC BX-39A) and non-Siemens industrial PCs that previously hosted PCS 7 V9.1 SP2 with UC03 cleanly installed. The behavior has been confirmed on installations of more than a dozen client and server nodes, with identical installation procedures and no variance between machines that fail and machines that succeed within the same batch.

The issue is documented in the official SIMATIC PCS 7 V9.1 SP2 Software Updates portal, where newly added update packages such as SIMATIC CFC V9.0 SP8 Upd9 and SIMATIC XML TRANSFER revisions are aggregated into the UC04 collection.

2. Affected Components and Versions

3. Root Cause Analysis

The UC04 installation procedure rewrites the system's DCOM (Distributed Component Object Model) security descriptor for the SIMATIC Logon service. Specifically, the NETWORK principal is removed from the Access Permissions and Launch and Activation Permissions lists under:

1. Component Services → Computers → My Computer → DCOM Config → SIMATIC Logon Service
2. Component Services → Computers → My Computer → DCOM Config → SIMATIC Logon Remote Service

Once the NETWORK principal is dropped, any remote SIMATIC Logon client (typically a WinCC Runtime on a different OS server) cannot perform a CLSCTX_REMOTE_SERVER activation against the affected host. The local drop-down server list consequently empties because the SCM (Service Control Manager) handshake required to enumerate the remote Logon service fails with 0x80070005 (E_ACCESSDENIED) at the DCOM layer.

Siemens Support has confirmed this behavior is not unique to UC04; previous UpdateCollections have produced similar side effects when the security controller portion of the installer is executed. However, UC04 is the first collection in the V9.1 SP2 line in which the issue is reproducible on the official factory restore image of the SIMATIC IPC family.

Independent verification has shown:

• The NETWORK principal is present immediately after the V9.1 SP2 factory restore image is applied.
• The NETWORK principal is present immediately after a clean UC03 install on a non-Siemens PC.
• The NETWORK principal is removed as soon as the UC04 setup completes — irrespective of whether a full or custom PCS 7 installation preceded it.

4. Confirmed Workarounds

Siemens Support has classified this as a known regression. Three workarounds are currently field-proven, ordered from most to least preferred.

4.1 Workaround A — Restore the official factory image first, then apply UC04

On a Siemens IPC (e.g., SIMATIC IPC647E, IPC847E, IPC227G, IPC BX-39A, or Field PG M6), use the official PCS 7 V9.1 SP2 Restore DVD / USB stick delivered with the device. The factory image is built with the correct DCOM security descriptor (NETWORK principal present). Apply the image, boot into Windows, and then run the UC04 setup with the default options. Under this path, SIMATIC Logon continues to function correctly post-update.

1. Boot from the SIMATIC IPC restore media (USB or DVD).
2. Select Restore entire disk; do not choose custom partitioning.
3. Wait for the Windows and PCS 7 base image to write to the boot drive.
4. Reboot; complete Windows OOBE (region, keyboard, administrator password).
5. Apply the latest Windows cumulative update and any out-of-band fixes.
6. Run the UC04 setup from the Siemens update medium or from the downloads referenced in entry ID 109812242.
7. Confirm that the SIMATIC Logon remote server is reachable from a second OS client.

4.2 Workaround B — Selective component install from UC04 contents

For non-Siemens hardware, the field-proven alternative is to extract the UC04 collection, then run the individual update packages without the trailing SIMATIC Security Controller step. The Security Controller is the routine that strips the NETWORK principal from the DCOM descriptor.

1. Copy the UC04 ISO to a network share or local drive.
2. Mount or extract the ISO contents with 7-Zip / native Windows mount (Mount-DiskImage).
3. Navigate to the Updates folder and inventory the .exe installers (e.g., SIMATIC_CFC_V9_SP8_Upd9.exe, SIMATIC_S7PLCSIM_V5_6_Upd.exe, WinCC_DataMonitor_V7_5_Upd.exe).
4. Install only the components required by the project, double-clicking each .exe in administrative context.
5. When prompted, decline any step labeled SIMATIC Security Controller, Update DCOM security, or Apply security template.
6. Reboot and validate SIMATIC Logon functionality.

4.3 Workaround C — Re-add the NETWORK principal manually (post-install repair)

If UC04 has already been installed with the default settings, the DCOM descriptor can be repaired on each affected node without reinstalling the OS.

1. Open an elevated command prompt.
2. Launch the DCOM configuration: dcomcnfg
3. Navigate to Component Services → Computers → My Computer → DCOM Config.
4. Right-click SIMATIC Logon → Properties → Security tab.
5. Under Launch and Activation Permissions, click Edit → Add → enter NETWORK → Check Names → OK.
6. Grant Local Launch and Local Activation rights.
7. Under Access Permissions, click Edit → Add → NETWORK → OK; allow Local Access.
8. Repeat for SIMATIC Logon Remote Service and any other SIMATIC Logon-related CLSID under DCOM Config.
9. Restart the SIMATIC Logon Service and the WinCC Runtime on the affected node.

Validate the fix by opening the SIMATIC Logon configuration tool on a remote OS client and confirming the server reappears in the drop-down list. Test a real login with a domain-credentialed user to confirm end-to-end authentication.

5. OPC UA Certificate Renewal (Mandatory After UC04)

The UC04 download page contains an Important note stating:

After installing the UpdateCollection 04, you must renew the OPC UA certificates of WinCC, otherwise an OPC UA connection can no longer be established.

This is a separate but related requirement. The two Siemens KB articles governing the procedure are:

• No connection to the OPC UA server after WinCC update (entry ID 109826043)
• Create a new CA certificate for OPC UA with WinCC SCADA (entry ID 109765628)

5.1 OPC UA certificate renewal procedure (summary)

1. On the WinCC server, stop the WinCC Runtime and the SIMATIC WinCC OPC UA Server service.
2. Open the WinCC Certificate Manager (SIMATIC → WinCC → Tools → Certificate Manager) or the WinCC Unified / Classic Certificate Configuration tool, depending on the project topology.
3. Delete the existing Server Certificate, CA Certificate, and any issued Client Certificates for OPC UA endpoints.
4. Generate a new self-signed CA Certificate with a validity of at least 5 years (Siemens recommendation: 10 years to align with plant lifecycle).
5. Issue a new Server Certificate signed by the new CA.
6. Re-distribute the new CA certificate (PEM / DER export) to every OPC UA client and add it to the trusted certificate store.
7. Restart the WinCC Runtime and the OPC UA Server service.
8. Validate the endpoint URL opc.tcp://<server>:<port> with the OPC UA client test tool.

6. SIMATIC Logon V1.6 Update 8 — LDAP Configuration

SIMATIC Logon V1.6 Update 8 (referenced in the V9.1 SP2 updates family) introduces a new authentication backend that can be configured to talk to LDAP directly. The relevant sections of the SIMATIC Logon manual (paragraphs 5.7 and 5.8) describe:

• Section 5.7 — Authentication via Windows domain: Default mode, requires a domain controller and the SIMATIC Logon computer account to be a member of the domain.
• Section 5.8 — Authentication via LDAP: Allows SIMATIC Logon to query an LDAP directory (Active Directory, OpenLDAP, or Siemens-specific schemas) without requiring a domain join.

When auditing a UC04 installation that exhibits broken remote authentication, verify which backend is configured:

1. Open SIMATIC Logon → Configuration.
2. Select the Authentication tab.
3. Confirm the Authentication type setting. If LDAP is selected, ensure the LDAP server FQDN, port (389 LDAP / 636 LDAPS), base DN, and bind credentials are populated and reachable.
4. Click Test connection. A successful test should return the user list limit and a sample user DN.

7. Workgroup vs. Domain Considerations

8. Installation Best Practices for UC04 and Beyond

1. Image before you update. Take a sector-level or Veeam/Acronis image of every OS server and client before applying UC04. The restore option in section 4.1 depends on having a known-good baseline.
2. Stage in a non-production cell. Replicate the production architecture (same OS build, same domain, same hardware family) in a test cell. Apply UC04 there and exercise SIMATIC Logon from at least three remote clients before promoting to production.
3. Snapshot the DCOM descriptor. Before running UC04, export the DCOM security descriptor for the SIMATIC Logon CLSID using reg export on the keys under HKCR\AppID\{<CLSID>} and a screenshot of the Security tab in dcomcnfg. After UC04, diff and re-apply as needed.
4. Subscribe to the Siemens update portal. Bookmark entry ID 109812242. Each new collection (UC05, UC06) has historically brought a fresh set of security-template changes; review the Important note block before deploying.
5. Document the Security Controller skip. If you use workaround 4.2, record it in the plant's PCS 7 change log. Include the exact component list installed, the timestamp, and the engineer who performed the deviation.
6. Run a post-update verification script. Use the matrix in section 9 to confirm every server passes the test suite before returning the system to operations.

9. Verification Matrix

10. Troubleshooting Matrix

11. Field-Proven Cautions

• Do not run UC04 across the fleet in parallel. Stage on one server, validate, then proceed. The DCOM regression can take 10–15 minutes to manifest as a UI-level failure, hiding the root cause during rapid rollouts.
• Watch for re-occurrences on existing UC03 nodes. The regression is not strictly limited to fresh UC04 installs. A small percentage of UC03 installations in the field have exhibited the same NETWORK principal drop after months of stable operation, often correlated with a Windows cumulative update resetting the DCOM cache.
• Re-arm the WinCC alarm logging service. In several reported cases, the alarm logging service retains a stale handle to the broken DCOM endpoint. Restart the CCAlarmLoggingService after the DCOM repair.
• Validate against the latest PCS 7 V9.1 SP2 list. Before applying any new collection, re-read the Important note block on entry ID 109812242. Siemens has historically updated the collection to a newer UC without bumping the base version, and the security controller behavior has changed between collections.
• Keep an offline copy of the DCOM security template. Export the Default DCOM Security settings via dcperm or the Security Configuration Wizard before UC04. The resulting .inf file can be reapplied with scwcmd if a full image restore is impractical.