Resolving the TIA Portal HMI Simulation "Insufficient Rights" Error

When launching an HMI runtime simulation from TIA Portal (V12 and later through V18/V19), the RT loader or the WinCC Runtime Advanced simulator can abort immediately with a German-language dialog reading:

"Die Rechte für den angemeldeten Windows Benutzer sind nicht ausreichend. Die Anwendung wird beendet."

English equivalent:

"The rights for the logged-in Windows user are not sufficient. The application is being terminated."

The PLC simulation (PLCSIM / S7-PLCSIM / PLCSIM Advanced) keeps working on the same workstation, but only the HMI runtime side fails. The root cause is almost always a Windows access-control problem, not a TIA Portal project bug. This reference gives a field-proven diagnostic path, the exact user rights and NTFS ACLs required, and a verification matrix to confirm the fix.

1. Problem Details and Symptom Matrix

The error appears in %LOCALAPPDATA%\Siemens\AutomationLogfiles\RTLogs\ (WinCC Advanced) or in C:\ProgramData\Siemens\CoRtHmiRT\ (WinCC Professional). The Windows Event Log application channel records Event ID 1000 / 1026 from RT Loader.exe or HMIRTM.exe with a status code of 0xC0000022 (STATUS_ACCESS_DENIED) at the point the runtime tries to open its user-profile hive.

2. Root Cause Analysis

The WinCC runtime loader creates a per-user sandbox under %USERPROFILE%\AppData\Local\Siemens on every start. It also touches:

• C:\ProgramData\Siemens\ (machine-wide data)
• C:\Program Files (x86)\Siemens\Automation\ (program binaries)
• Registry keys under HKLM\SOFTWARE\Siemens\ and HKCU\SOFTWARE\Siemens\
• DCOM/COM+ components registered during TIA Portal installation (especially Siemens.Automation.ObjectStore and CoRtHmiRT.Central)

If the active Windows account cannot write to one of these locations, the loader bails out with the German "Rechte nicht ausreichend" dialog rather than a generic English error. The failure paths fall into three categories:

1. Missing group membership – the user is not a member of the local Siemens TIA Engineer group that the TIA Portal installer creates.
2. Insufficient NTFS rights – corporate image, Deep Freeze/Faronics, or anti-ransomware tools have stripped Modify from %PROGRAMFILES%\Siemens or %PROGRAMDATA%\Siemens.
3. UAC virtualisation redirect – the runtime is being launched from a non-elevated token, and a path it needs is not in the virtualised write-allowed list (this affects Windows 7 through Windows 10 LTSC; Windows 11 24H2 disables the redirector by default).

3. Required Windows User Rights and Groups

The TIA Portal setup routine (TiaSetup.exe) creates the following local groups on the engineering station:

Membership in Siemens TIA Engineer is the single most common fix. Without it, the user falls back to the standard Users group, which has only Read on %PROGRAMFILES% and limited Write on %PROGRAMDATA% — enough for PLC simulation, not enough for HMI RT startup.

4. Step-by-Step Resolution

4.1 Confirm the error context

1. Open Start → TIA Portal with a left click (no admin elevation).
2. Open a project containing an HMI device (e.g. KTP1200 or TP1500 Comfort) and click Start simulation on the HMI editor toolbar.
3. Note whether the German dialog appears before or after the WinCC RT loader splash.
4. Open Event Viewer → Windows Logs → Application and filter for Source = Application Error and Siemens HMI Loader. Capture Event IDs 1000, 1026, 7034 if present.

4.2 Add the user to Siemens TIA Engineer

1. Log in as a local administrator.
2. Open Computer Management → Local Users and Groups → Groups.
3. Double-click Siemens TIA Engineer → Add.
4. Type the engineering account (e.g. DOMAIN\john.doe or WORKSTATION\eng01) and confirm.
5. Log the engineer out and back in so the new group SID is applied to the access token.

Equivalent PowerShell, run as Administrator:

Add-LocalGroupMember -Group "Siemens TIA Engineer" -Member "DOMAIN\john.doe"
Get-LocalGroupMember -Group "Siemens TIA Engineer"

4.3 Launch TIA Portal elevated (single-user workaround)

Right-click the TIA Portal icon and choose Run as administrator. Re-attempt the HMI simulation. If the error disappears, the issue is purely a normal-token access problem; section 4.2 is still the recommended long-term fix so that scheduled tasks, TIA Portal automatic backup, and TIA Portal Help Server can run as a service account.

4.4 Repair NTFS ACLs on the Siemens folders

If the group membership is correct but the error persists, the folder ACL has been stripped. Reset it with the following command sequence in an elevated cmd shell:

icacls "C:\Program Files\Siemens" /reset /T /C
icacls "C:\Program Files (x86)\Siemens\Automation" /grant "Siemens TIA Engineer":(OI)(CI)M /T
icacls "C:\ProgramData\Siemens" /grant "Siemens TIA Engineer":(OI)(CI)M /T
icacls "%LOCALAPPDATA%\..\..\Users\%USERNAME%\AppData\Local\Siemens" /setowner "%USERNAME%" /T /C

After running the commands, recreate the user sandbox by deleting (or renaming) the folder %LOCALAPPDATA%\Siemens. The RT loader will rebuild it on the next start.

4.5 Adjust UAC and DCOM for locked-down images

Some corporate images have EnableLUA = 1 combined with a deny rule on Siemens program-data subfolders. Verify the following registry values, then reboot:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  EnableLUA = 1
  ConsentPromptBehaviorAdmin = 5
  EnableInstallerDetection = 1

For DCOM, open dcomcnfg → Component Services → Computers → My Computer → DCOM Config, locate Siemens.Automation.ObjectStore and CoRtHmiRT.Central, and on the Security tab add the Siemens TIA Engineer group with Launch and Activation = Local Launch and Local Activation.

4.6 Domain accounts without local admin

If the workstation is joined to Active Directory and the user receives the error despite being in Siemens TIA Engineer:

• Ask the domain administrator to extend the group's User Rights Assignment for Log on locally via a GPO under Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment.
• Make sure the workstation's SeInteractiveLogonRight includes the engineering group. You can verify with secpol.msc → Local Policies → User Rights Assignment.
• If a Kiosk/VDI environment is in use, ensure the profile is not a temporary profile (check HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList for a .bak suffix).

5. Verification

After applying any of the above steps, perform the following verification in order. Every check must pass before the workstation is released to the engineer.

6. Diagnostic Flowchart

The following decision tree is suitable for pasting into a maintenance runbook:

7. Related Errors and Cross-Reference

For a complete description of the WinCC Runtime Advanced error model, see the Siemens Knowledge Base entry 109755275 on runtime diagnostics.

8. Long-Term Hardening Recommendations

• Group-based deployment: Use an Active Directory group (e.g. GG-SIMATIC-Engineers) and nest it inside the local Siemens TIA Engineer group so the local group never has to be edited per user.
• Immutable images: If you are using UWF, Deep Freeze, or a non-persistent VDI, exclude the paths %LOCALAPPDATA%\Siemens and %PROGRAMDATA%\Siemens\CoRtHmiRT from the overlay. Otherwise the runtime cannot persist its licence cache and re-fails on every reboot.
• Anti-virus exclusions: Real-time scanners frequently lock the runtime's .log and .dat files. Add the TIA Portal install path and the two program-data folders to the AV exclusion list. The Siemens Anti-Virus Compatibility Guide lists recommended exclusions.
• Scheduled HMI RT: When a TIA Portal project is rebuilt nightly, deploy the compiled .fwx to a network share, not the local user profile. TIA Portal's Transfer → HMI Runtime Simulator tool can then be invoked by the build service account with the rights already in place.
• Audit: Enable auditing on the Siemens folders to detect when a hardening tool strips the inherited Modify ACE from Siemens TIA Engineer. Audit failures surface as 4656/4663 in the Security log.

9. Frequently Asked Questions