Resolving SIMATIC NET 8.2 OPC DA Remote Connection Failures

1. Problem Definition

When deploying SIMATIC NET 8.2 as an OPC DA (Classic, COM/DCOM-based) server across two SCADA hosts, a common failure pattern is:

• The OPC server works locally on each of the two hosts (server-to-self).
• The OPC server works server-to-server between the two SCADA hosts.
• A third client PC — same domain, same Windows user, identical DCOM permissions — cannot enumerate or connect to the OPC server list.
• Other services (e.g. Microsoft SQL Server, file shares) on the same hosts are reachable from the third PC.

This isolation is the fingerprint of a DCOM / COM Security boundary problem, not a network outage, and it is amplified by SIMATIC NET's tightly coupled PC station architecture and its dependency on the SIMATIC NET Configuration Console and the S7DOS Help Service. The symptom is identical on SIMATIC NET 8.1, 8.2, and the V8.2 SP1 update (HF17 and later); the same SIMATIC NET communication settings utility (SimaticComSettings.exe) is used to correct it.

2. SIMATIC NET 8.2 OPC DA Architecture

SIMATIC NET 8.2 implements OPC DA on top of COM/DCOM with two cooperating services per PC station. Understanding them is mandatory before changing permissions.

The OPC server registers its CLSID under HKEY_CLASSES_ROOT\CLSID and HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\SIMATIC NET\OPCSrv. A remote OPC client first contacts the S7DOS service on UDP/TCP to resolve the station name, then opens an authenticated DCOM channel to the OPC server CLSID. If any of the four layers below fails, the remote client silently reports "Cannot connect to OPC server" while local enumeration still succeeds.

3. Root Cause Analysis

The "works server-to-server, fails from third PC" pattern has five independent causes, each with its own diagnostic fingerprint. Walk them in this order before changing anything.

4. Solution A — Run the SIMATIC NET Communication Settings Helper

The Siemens-shipped helper configures DCOM, the firewall, and the SIMATIC NET service logon in one pass. Use it on the OPC server PC first, then re-test.

1. Log in to the OPC server with a Windows account that has local administrator rights.
2. Launch Start → Siemens Automation → SIMATIC → SIMATIC NET → Communication Settings.
3. Click Apply. The tool performs five sub-steps:

• Registers SIMATIC NET OPC server CLSIDs ({B6EACB30-9D4F-11D1-A80A-006008A74BFA} and {B6EACB40-9D4F-11D1-A80A-006008A74BFA}).
• Sets RPC_C_AUTHN_LEVEL_PKT_PRIVACY (encrypt) on the OPC server CLSID — required for DA 3.0.
• Adds ANONYMOUS LOGON, EVERYONE, and the configured SCADA user to the DCOM Access and Launch ACLs.
• Opens Windows Firewall inbound rules for OPCEnum.exe, S7DoS_serv.exe, and the SIMATIC NET OPC server executable.
• Starts the S7DOS Help Service in auto-start mode.

4. Repeat the helper on the client PC (third SCADA node) so its own DCOM outbound ACLs match.
5. Reboot both machines when prompted. SIMATIC NET 8.2 requires a restart for the COM security cache to flush.

5. Solution B — Manual DCOM Hardening for SIMATIC NET

When the helper is unavailable (locked-down corporate image, missing installation media) or when granular audit is required, perform these steps manually. All changes are on the OPC server unless noted.

5.1 Default COM Security Properties

1. Component Services → My Computer → right-click → Properties → Default Properties tab.
2. Enable Enable Distributed COM on this computer.
3. Set Default Authentication Level to Connect for legacy DA 2.0 clients or Packet Privacy for DA 3.0 clients (Scout, WinCC 7.4 SP1, TIA Portal V14+).
4. Set Default Impersonation Level to Identify.

5.2 COM Security ACLs

Edit My Computer → Properties → COM Security tab.

• Access Permissions → Edit Limits: add EVERYONE Allow Local + Remote. For hardened environments, replace with the explicit SCADA service account.
• Launch and Activation Permissions → Edit Limits: add EVERYONE Allow Local Launch, Remote Launch, Local Activation, Remote Activation.
• Access Permissions → Edit Default: identical scope, plus ANONYMOUS LOGON.
• Launch and Activation Permissions → Edit Default: identical scope.

5.3 SIMATIC NET OPC Server CLSID Permissions

1. In DCOM Config locate SIMATIC NET OPC Server (CLSID {B6EACB30-9D4F-11D1-A80A-006008A74BFA} for DA 3.0, {B6EACB40-9D4F-11D1-A80A-006008A74BFA} for DA 2.0).
2. Right-click → Properties → Security tab → customize all three sections as in §5.2.
3. Identity tab: keep The launching user for service accounts or This user with the SIMATIC NET runtime account for unattended operation.
4. Endpoints tab: leave default unless a custom static port is required (e.g. 5000-5020 TCP for Siemens S7 routing).

5.4 OPCEnum and S7DOS Registration

SIMATIC NET 8.2 ships its own OPCEnum.exe (Siemens-internal build, version 8.2.x.y) and S7DOS help service. Re-register on the server with administrative command prompt:

cd "C:\Program Files\Siemens\Automation\SIMATIC.NET\opc2\bins\opcenum"
regsvr32 /u opcenum.exe
regsvr32 opcenum.exe

sc stop S7DoS
sc start S7DoS
sc query S7DoS

6. Solution C — Firewall, RPC, and Network Configuration

DCOM negotiates dynamic TCP ports (1024-65535) via the RPC endpoint mapper on TCP/135. Both Windows Firewall with Advanced Security (WFAS) and any intermediate L3 firewalls must allow:

For a deterministic rule set, restrict the DCOM range with the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Internet:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc]
"EnableAuthEpResolution"=dword:00000001
"RestrictRemoteClients"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Internet]
"Ports"="5000-5020"
"PortsInternetAvailable"="N"
"UseInternetPorts"="N"

This binds SIMATIC NET OPC to TCP 5000-5020 only. Then create one inbound rule on the server allowing that exact range from the third client IP.

7. Solution D — Authentication, User Rights, and Kerberos Delegation

Identical Windows user accounts are necessary but not sufficient. The third PC must also have:

• Membership in the local group Distributed COM Users on the server (or the configured OPC group).
• Log on locally (or Access this computer from the network) right granted to the user account on the server — default for Domain Users.
• If the SIMATIC NET OPC server runs under a dedicated service account (recommended for production), the SPN HOST/<server-fqdn> must be registered to that account for Kerberos to succeed.

Register the SPN with administrative command prompt on a domain controller:

setspn -S OPCSIMATIC/<server-fqdn> <DOMAIN\service-account>
setspn -L <DOMAIN\service-account>

Then, on the third client PC, force Kerberos delegation for the OPC server name in Setspn + Active Directory Users & Computers → service account → Delegation tab → Trust this user for delegation to specified services → add HOST and cifs against the server SPN.

NTLM vs Kerberos Failure Codes

8. Solution E — SIMATIC NET PC Station Mode on the Client

A subtle SIMATIC NET requirement: the client PC must have the SIMATIC NET Configuration Console installed with a PC station of its own, even if it has no S7 connection. The OPC client uses the local PC station index to negotiate the channel. Without it, server browsing succeeds but CoCreateInstance on the OPC server CLSID returns 0x80040154 (CLASS_NOT_REGISTERED) on the client side, masquerading as a server fault.

Install SIMATIC NET 8.2 in Client mode on the third PC. Open Station Configuration Editor, add a new station matching the host name, save, and close. The OPC Scout will then enumerate servers across the network.

9. OPC UA Migration Path

DCOM-based OPC DA is deprecated. SIMATIC NET 8.2 supports OPC UA server on the S7-1200, S7-1500, and WinAC side and OPC UA client on the PC station side. Migration removes every layer covered above.

To enable OPC UA on SIMATIC NET 8.2:

1. Open SIMATIC NET Configuration Console → OPC UA.
2. Activate the OPC UA Server for the configured S7 connection.
3. Import or auto-generate the server certificate (CN=SIMATIC NET OPC UA).
4. Add an Endpoint on opc.tcp://<server>:4840 with SecurityPolicy = Basic256Sha256 and MessageSecurityMode = SignAndEncrypt.
5. Distribute the server certificate to the client's trusted peers (%ProgramData%\Siemens\Automation\OPCUAServer\pki\trusted).
6. From the third PC, point OPC Scout or any OPC UA client to opc.tcp://<server>:4840 and authenticate with a user token.

10. Verification Procedure

After applying any of the solutions above, run this checklist from the third PC. Each step has a pass/fail criterion.

11. Troubleshooting Matrix

12. Frequently Asked Questions