Resolving SIMATIC NET OPC Server Remote Access from Excel

Resolving SIMATIC NET OPC Server Remote Access from Excel

Overview of the SIMATIC NET OPC Architecture

Siemens SIMATIC NET provides an OPC DA (Data Access) server that is registered under the programmatic identifier OPC.SimaticNET. When SIMATIC NET PC Software is installed on an industrial PC or a Field PG, the OPC service runs as a local DCOM (Distributed Component Object Model) object that can be consumed by any OPC DA 2.0/3.0 client, including the bundled OPC Scout V10 utility, third-party SCADA packages, and Microsoft Excel through the OPC Automation 2.0 wrapper.

The deployment in the original failure case is typical of a commissioning engineer setup:

• Field PG 1 (Siemens-lapp1): engineering station that successfully consumes OPC.SimaticNET on Field PG 2.
• Field PG 2 (Siemens-lapp2): the OPC server host, runs the full SIMATIC NET PC Software with an active S7 channel.
• Desktop PC: a plain Windows workstation that has SIMATIC NET "Networking for Industry PC / Software Edition 2005 + HF1" installed (the editor/client role, not a server role).

The reported symptom is that when OPC Scout on the desktop PC browses the network and expands the Siemens-lapp2 node, the OPC.SimaticNET entry never appears. The node shows the sand-clock (waiting cursor) for 10–15 seconds and then collapses. Only the local entry OPC.SIMATICNET (note the case difference) is visible on the desktop PC, which is the registered ProgID read from the local registry rather than the remote class factory.

Problem Details

Observed symptoms

1. Ping between desktop and Field PG 2 succeeds, all three PCs are members of the same Windows workgroup.
2. Windows Firewall is reported as disabled on all three machines.
3. Browsing from the desktop PC with OPC Scout: expanding the Siemens-lapp2 network node shows the sand-clock for 10–15 seconds, then collapses without displaying any server.
4. Expanding the Siemens-lapp1 node (which has SIMATIC NET installed identically) shows the same sand-clock, but the OPC.SimaticNET node becomes visible after the delay because the PC has a local SIMATIC NET installation that the local ProgID lookup reaches.
5. Following the procedure in Siemens Application Note C79000-G8976-C156-14, chapter 4.7 (Configuring OPC Server Access) does not resolve the issue.
6. OPC Scout on the desktop PC can read and write tag values against the local ProgID without problem.

Software configuration

Reference configuration from the Siemens Industry Online Support entry id 23829402, "SIMATIC NET – Commissioning PC Stations", and the OPC server commissioning section of manual C79000-G8976-C156-14 chapter 4.7: see Siemens Industry Online Support.

Root Cause Analysis

There are three layered causes that produce the exact symptom described. They must be addressed in order, because the slowest link in the chain is the one the client experiences first.

1. Local versus remote ProgID resolution

OPC Scout presents servers in two forms:

• Local – the registered ProgID is read from the registry of the client machine. Displayed as OPC.SIMATICNET (uppercase as registered by the SIMATIC NET installer). Lookup is in-process and immediate.
• Remote – the ProgID must be resolved on the server machine through DCOM, which means the COM subsystem on the server has to enumerate the running class factory, authenticate the call, and launch the object under the configured identity. The slow sand-clock and the collapse of the node are the typical fingerprint of DCOM authentication timing out or being denied.

If a user does not have the right to enumerate the class factory on the remote machine, the client waits for the DCOM default timeout (typically 8–15 seconds, depending on Windows version) and then abandons the call. This is exactly the 10–15 second sand-clock observed in the original case.

2. Default DCOM user identity is the interactive user

On a fresh Windows installation, DCOM objects are launched under the identity of the currently logged-on interactive user. If the desktop user logs in as DESKTOP\Engineer and tries to launch a DCOM object on Field PG 2 where the logged-on user is FIELDPG2\Admin, the launch will fail unless:

• Both accounts are domain accounts (the Kerberos/NTLM delegation path), or
• Matching local accounts exist on both PCs with the same username and password, or
• The COM Security "Launch and Activation Permissions" have been explicitly configured to grant anonymous launch and the server identity is set to The launching user.

3. Anonymous or "Everyone" removal after Windows XP SP2

Starting with Windows XP SP2 and carried forward into every later Windows version, the default COM Security policy on a workstation is to remove Everyone from the launch and access lists. The installer of SIMATIC NET adjusts the local DCOM policy to grant the local SIMATIC NET group, but it cannot do this on a remote machine. The remote launch is denied because the default access list is empty or does not include the desktop user.

Solution Strategy

The resolution requires three coordinated changes on Field PG 2 (the OPC server host) and one verification on the desktop client. The exact sequence is important – changing only the COM Security default is not sufficient, the class-specific identity must also be set.

1. Define explicit DCOM access and launch permissions for the user or group that the desktop PC will log in as.
2. Configure the COM Security default identity for OPC.SimaticNET to a known system account (typically The launching user for workgroup scenarios or The interactive user for single-user consoles).
3. On the desktop client, change the connection from Remote OPC.SimaticNET to Local OPC.SIMATICNET and let the SIMATIC NET channel subsystem forward the call to Field PG 2 through the configured S7 channel. This bypasses DCOM entirely.
4. Confirm with OPC Scout V10 from the desktop that tags are browsable and writable.

Prerequisites

Before changing the configuration, confirm each of the following on Field PG 2 and on the desktop PC. Each prerequisite is independently a failure point.

Step-by-Step DCOM Configuration on Field PG 2

Step 1 – Open Component Services

On Field PG 2, run dcomcnfg from the Start > Run dialog. This opens the Component Services MMC snap-in.

Step 2 – Set default COM Security

In the console tree, navigate to Component Services > Computers > My Computer. Right-click My Computer and select Properties. On the Default Properties tab:

• Enable Distributed COM on this computer: checked
• Default Authentication Level: Connect (acceptable for workgroup; use Packet Integrity for higher security)
• Default Impersonation Level: Identify

Switch to the COM Security tab. This tab has three sub-panels: Access Permissions, Launch and Activation Permissions, and Configuration Permissions. Edit each one as follows:

Click Apply then OK.

Step 3 – Tune the OPC.SimaticNET class identity

In the console tree, navigate to Component Services > Computers > My Computer > DCOM Config. Scroll to the application named OPC.SimaticNET (or SIMATIC NET OPC Server in the German localisation). Right-click and select Properties:

• General tab: confirm the Application ID matches the one shipped by SIMATIC NET.
• Location tab: Run application on the computer where the data is located must be checked; for an OPC server this is the same PC.
• Security tab: replace the default "Use default" with Customize, then:
  • Launch and Activation Permissions → Edit → add the desktop user or group with full rights.
  • Access Permissions → Edit → add the same user or group.
  • Configuration Permissions → leave at default or grant Administrators only.
• Identity tab:
  • Select The launching user if the desktop user account exists on Field PG 2.
  • Select The interactive user if a single interactive session is always running on Field PG 2.
  • Select This user with a dedicated service account for production deployments.
• Endpoints tab: leave defaults unless you have a specific RPC port restriction.

Click Apply then OK.

Step 4 – Confirm the SIMATIC NET service

Confirm the SIMATIC NET service is started and set to Automatic startup. With SIMATIC NET 2005 the service is typically S7DOS; in later editions it may be SIMATIC NET Configuration or a generic SIMATIC NET OPC service. Verify with:

sc query "S7DOS"
sc query "SIMATIC NET Configuration"

Open the SIMATIC NET Configuration Console and verify the OPC server slot is started. If the slot is stopped, the OPC.SimaticNET class is registered but its class factory is not running, which produces a similar collapse with a much shorter delay (sub-second).

Step 5 – Adjust the Windows Firewall

Even with the firewall reported as disabled, the deprecated DCOM ports (TCP 135 plus an ephemeral range allocated by the RPC endpoint mapper) may still be filtered by the Windows Firewall service if it is running. Two options:

1. Stop and disable the MpsSvc (Windows Firewall) and bfe (Base Filtering Engine) services.
2. Or create an inbound rule allowing TCP 135 and the application C:\Windows\System32\svchost.exe for the RPCSS service.

Step 6 – Re-test from the desktop

On the desktop PC, run OPC Scout V10 (bundled with SIMATIC NET 2005+). In the OPC Navigator, double-click Local. If the local entry shows OPC.SIMATICNET, click Connect. Confirm tags are browsable. Then create a new server connection and select Remote. Browse the network; expand Siemens-lapp2; the OPC.SimaticNET entry should now expand with the full tag tree.

Configuring the Excel Client

The desktop client in this scenario is Microsoft Excel. There are two supported paths to read and write SIMATIC NET tags from Excel.

Path A – OPC Automation wrapper (Excel VBA)

The SIMATIC NET installation provides the opcdaauto.dll and opcdaae.dll files. In Excel, open the VBA editor with Alt+F11, then Tools > References, and add:

• OPC Automation 2.0 (opcdaauto.dll)
• OPC DA Auto 2.0 (opcdaae.dll) – required for historical access

A minimum working snippet that connects to the local OPC.SIMATICNET and reads one tag every second:

Option Explicit

Dim WithEvents OPCServer As OPCAutomation.OPCServer
Dim WithEvents OPCGroup  As OPCAutomation.OPCGroup
Dim OPCItem As OPCAutomation.OPCItem

Sub ConnectToServer()
    Set OPCServer = New OPCAutomation.OPCServer
    ' Local ProgID: works for both local and SIMATIC NET remote channels
    OPCServer.Connect "OPC.SIMATICNET"

    Set OPCGroup = OPCServer.OPCGroups.Add("ExcelGroup")
    OPCGroup.IsActive = True
    OPCGroup.IsSubscribed = True
    OPCGroup.UpdateRate = 1000

    Dim ItemIDs(0) As String
    ' Symbolic SIMATIC NET item syntax (legacy S7 tag notation)
    ItemIDs(0) = "S7:[S7_Connection_1]DB1,W0"

    Set OPCItem = OPCGroup.OPCItems.AddItem(ItemIDs(0), 1)

    Range("A1").Value = OPCItem.Value

    ' To write back, use: OPCItem.Write 42
End Sub

For the channel S7_Connection_1 to be visible, the SIMATIC NET Configuration Console on the OPC server (Field PG 2) must contain an S7 channel named S7_Connection_1 with at least one configured connection to the target PLC, and the channel must be active. The S7:[connection]area,offset item syntax is the legacy S7 tag notation; in newer SIMATIC NET editions the symbolic SYM: syntax is preferred.

Path B – OPC Scout copy and paste

The simplest end-user path is the one most often used by engineers commissioning a panel and is the one referred to in Siemens Application Note 23829402 on the Siemens Industry Online Support portal:

1. Open OPC Scout V10 on the desktop PC.
2. Connect to OPC.SIMATICNET (local) or browse the network and connect to the remote server.
3. In the tag tree, drag a tag into the DaVinci watch window.
4. Right-click the watch value and select Copy.
5. In Excel, paste into a cell. To refresh, copy again or use a macro that re-reads.

Path C – Modern OPC UA alternative (planning only)

For new deployments, consider migrating from DCOM-based OPC DA to OPC UA. The SIMATIC NET OPC UA server is exposed at opc.tcp://<server>:4840 and does not require any of the DCOM configuration described above. OPC UA is the recommended long-term direction for any project commissioning after 2020, because Microsoft has officially deprecated DCOM configuration for OPC. Plan a parallel OPC UA channel alongside the existing DCOM channel during the transition period, then decommission the DCOM path once the UA clients are validated.

Verification Checklist

Use this checklist on both Field PG 2 and the desktop PC before declaring the issue resolved.

Troubleshooting Matrix

Security and Best-Practice Considerations

1. Avoid Everyone in production. The default above is acceptable for commissioning in a workgroup, but for a production line restrict the access list to a dedicated OPC-Operators group that is replicated on the server.
2. Use a domain. A Windows workgroup of more than two PCs that all consume the same OPC server is a maintenance hazard; migrate to a domain with Group Policy-driven DCOM settings.
3. Tie update rate to Excel refresh. Setting UpdateRate = 100 with 50 tags at 1 Hz produces 5 000 data-change events per second; this is enough to saturate the DCOM channel. For Excel dashboards, prefer polling the value from the cache on demand rather than using the subscription callback.
4. Use the SIMATIC NET Local ProgID whenever possible. It bypasses the DCOM launch sequence and uses the SIMATIC NET internal channel forwarding, which is faster and survives workgroup password changes. This is the technique recommended in the original case discussion and is also the default behaviour of OPC Scout when the connection is started by double-clicking a station that has a local SIMATIC NET installation.
5. Apply the latest Hotfix. SIMATIC NET 2005 + HF1 is no longer current; later cumulative hotfixes for SIMATIC NET 2008 and 2010+ resolve several DCOM-related issues that match the symptom described. Plan an upgrade during the next plant shutdown and confirm the Hotfix level on Field PG 1, Field PG 2, and the desktop PC are identical.
6. Plan the OPC UA migration. Microsoft has officially deprecated DCOM for cross-machine scenarios and recommends OPC UA for new deployments. Keep the DCOM path live during the transition but commission OPC UA in parallel.

Notes on the C79000-G8976-C156-14 Manual

Manual C79000-G8976-C156-14 is the "SIMATIC NET PC Software – S7 OPC Server – Configuration and Diagnostics" edition referenced in the original case. Chapter 4.7 covers the COM Security setup steps that were performed in the original attempt. The manual confirms that the local ProgID on a machine with SIMATIC NET installed is the recommended connection method for engineering clients, and the remote ProgID requires the DCOM configuration sequence shown in Steps 1–6 above. When following the manual on a non-domain workgroup, always replace "domain users" with a local group of identical name and identical password on both machines.

FAQ