Resolving TIA Portal V14/V15.1 Installation Errors on Windows 10

Resolving TIA Portal V14/V15.1 Installation Errors on Windows 10

Step 7 / TIA Portal V14 and V15.1 installations on Windows 10 (build 16299) and Windows 11 (build 22000) occasionally abort with three families of error: SecurityControl (LicenseManager) Failed raised by the Siemens Secon worker, AdsWorkerForeignExe::GetInstallResult(): -777: FILE_NOT_FOUND from the post-install Application Start step, and CONFSQL2014EXP failures during SQL Server 2014 Express configuration. This reference documents the captured installer logs, the underlying root causes (Microsoft CryptoAPI MachineKeys corruption, Automation License Manager (ALM) encryption handshake failure, and SQL 2014 Express configuration database errors), and the verified field procedures that restore a clean install.

1. Problem Summary and Affected Versions

The error pattern documented here was reproduced on the following combinations:

The installer is invoked through the Siemens Installer Assistant:

C:\Program Files (x86)\Common Files\Siemens\Automation\Siemens Installer Assistant\406\SIA2.exe /l1036 /starter /bundlepath=C:\Users\<user>\AppData\Local\Temp\<BundleName>\InstData

Target install directory is fixed at C:\Program Files\Siemens\Automation. Setup always writes a session log under %TEMP%\SIA2_Log_<timestamp>\LogFiles\Setup.log in addition to the per-product SIA2.log.

2. Captured Error Log Excerpt (V14 SP1)

10:05:56 | ERROR  SeconWorker::ExecuteSeconWork():  - Secon call has been finished with errors
10:05:56 | FAIL!                     SecurityControl (LicenseManager), Failed;After
10:06:40 | ERROR  AdsWorkerForeignExe::GetInstallResult():  - -777: FILE_NOT_FOUND. Please check the corresponding log file for more detailed information
10:06:40 | FAIL!                     StartApplAfter (TIAP14::[INSTALLDIR]BIN\SIEMENS.AUTOMATION.GENERATOR.FRAMEWORK.EXE), Failed

Three distinct failure units are visible:

1. SeconWorker::ExecuteSeconWork – the Secon (Siemens Security Component) failed to encrypt the ALM registration blob.
2. SecurityControl (LicenseManager), Failed;After – the Automation License Manager post-installation security check aborted.
3. AdsWorkerForeignExe::GetInstallResult(): -777 – the post-install Application Start step (here invoking SIEMENS.AUTOMATION.GENERATOR.FRAMEWORK.EXE) could not locate a file referenced by the package.

3. Captured Error Log Excerpt (V15.1) – SQL Path

09:33:56 | ERROR  AdsWorkerClassicProduct::OnWorkerCompleted():  - ClassicProduct setup result: 0: Configuring the database failed. You will find more information in the log file.
09:33:56 | FAIL!                     SetupUnit               (CONFSQL2014EXP)         Failed    ClassicProductReinstall
09:33:56 | FAIL!                     Checkpoint              (E)                       Complete
09:33:56 | ERROR  ExecutionEngine::StartNextStepAsync():  - Execution has been cancelled. Probably because of some process(es) running on the machine

Setup Units involved in the V15.1 chain that can be inspected for SQL-related failures:

4. Root Cause #1 – Secon and ALM MachineKeys Corruption

The Siemens Security Component (Secon) encrypts the ALM license fingerprint using the Microsoft CryptoAPI. On Windows 10 / 11 the API stores machine-level RSA and DSS keys under:

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18

The S-1-5-18 subdirectory holds the LocalSystem account keys. When any of these folders contains a malformed or zero-byte key container (often a remnant of a Windows update, an aborted prior install, or a third-party disk-imaging restore), Secon's call to CryptAcquireContext / CryptGenKey returns NTE_BAD_KEYSET (0x80090016) or NTE_KEYSET_NOT_DEF (0x80090019). The installer logs this generically as SecurityControl (LicenseManager), Failed and continues only to fail again at the StartApplAfter step with -777: FILE_NOT_FOUND because the ALM service never registered its DLL.

5. Root Cause #2 – SQL Server 2014 Express Database Configuration

TIA Portal V14 and V15.1 install SQL Server 2014 Express (build 12.0.x) locally to host the project archive, symbol library, and WinCC configuration databases. The default instance is SQLEXPRESS (named instance, not default). CONFSQL2014EXP runs T-SQL scripts that create the TIA_Portal, ALM, and WinCC databases and assigns the local NTAUTHORITY\SYSTEM and the interactive user dbo.

Common failure triggers:

• A pre-existing SQLEXPRESS instance from Visual Studio, an earlier TIA version, or a third-party product uses port 49172 (dedicated admin connection) or Named Pipes \\.\pipe\MSSQL$SQLEXPRESS\sql\query.
• The Windows account running the installer is not a local administrator and cannot grant sysadmin to the SQL service account.
• The SQL 2014 Express media downloaded from the bundle hash is missing setup.exe in the extracted ...\1033_ENU_LP\x64\setup\ folder, which surfaces as -777: FILE_NOT_FOUND downstream.
• Another process holds the SQL MDF/LDF files open (anti-virus real-time scan, VSS writer, OneDrive sync).

6. Root Cause #3 – Foreign Exe -777 FILE_NOT_FOUND

The V14 SP1 log AdsWorkerForeignExe::GetInstallResult(): -777: FILE_NOT_FOUND is not a missing Windows DLL but a missing file the install package referenced via a relative path inside C:\Users\<user>\AppData\Local\Temp\<BundleName>\InstData. Windows Defender or a system cleanup utility may have pruned the temp tree mid-install. The -777 return code is part of the AdsWorker internal error mapping (negative values are foreign-exe propagation; absolute value is the propagated exit code from the foreign setup).

7. Solution A – Reset the ALM MachineKeys (Verified Field Procedure)

This is the manufacturer-prescribed manual repair for Secon / SecurityControl failures and is also reported to resolve a wider class of TIA install symptoms not obviously related to ALM.

1. Close every Siemens application, including TIA Portal, Automation License Manager, and the SIMATIC Automation Tool.
2. Stop the Automation License Manager Service via services.msc (set Startup type to Manual temporarily).
3. In Windows Explorer, navigate to C:\ProgramData\Microsoft\Crypto.
4. Rename the following folders (do not delete yet):

   DSS\MachineKeys       →  DSS\MachineKeys_old
   RSA\MachineKeys       →  RSA\MachineKeys_old
   RSA\S-1-5-18          →  RSA\S-1-5-18_old

5. Reboot the workstation.
6. Open services.msc, set Automation License Manager Service back to Automatic (Delayed Start), and start it.
7. Launch the Automation License Manager UI and confirm all license keys are listed correctly.
8. Only after successful verification, delete the _old folders. Do not delete any original Microsoft-named key containers.

8. Solution B – Resolve SQL Server 2014 Express Configuration Failure

1. Open services.msc and stop any pre-existing SQL Server (SQLEXPRESS) and SQL Server VSS Writer services.
2. Launch cmd.exe elevated and inspect the named instance via:

   sc query MSSQL$SQLEXPRESS
   sc qc MSSQL$SQLEXPRESS

3. Check for port conflicts with:

   netstat -ano | findstr ":1433"
   netstat -ano | findstr ":49172"

4. Verify the SQL setup bootstrap folder exists with at least these files:

   C:\Users\<user>\AppData\Local\Temp\<BundleName>\InstData\SQL2014\x64\setup\setup.exe
   C:\Users\<user>\AppData\Local\Temp\<BundleName>\InstData\SQL2014\x64\setup\sqlsetup.dll

   If either is missing, the bundle was extracted incompletely — delete the temp folder, run SIA2.exe with the /starter switch again, and ensure Windows Defender does not quarantine the extraction directory.
5. Add the install user account explicitly to the local SQLServerMSSQLUser$COMPUTERNAME$SQLEXPRESS group via lusrmgr.msc if it is missing.
6. Add SQL Server and TIA Portal install directories to the antivirus exclusion list. Recommended exclusions for Windows Defender:

   C:\Program Files\Siemens\Automation
   C:\Program Files (x86)\Siemens\Automation
   C:\Program Files\Microsoft SQL Server
   %ProgramData%\Microsoft\Crypto

7. Re-run the TIA Portal setup. Verify that CONFSQL2014EXP completes with Complete in the log.
8. If the configuration still fails, run sqlcmd -S .\SQLEXPRESS -E manually and execute the SQL scripts that the installer would have run, located under [INSTALLDIR]\SQL\Scripts.

9. Solution C – Licence Sharing With a Virtual Machine

If the engineering workstation is a VM and the licence dongle or licence server runs on the VM host, configure licence sharing as follows:

1. On the host: install Automation License Manager and transfer the licence into it (either from a USB dongle or by activating the licence). Confirm the service listens on TCP 4410.
2. Allow inbound TCP 4410 on the host firewall for the Host-Only subnet only:

   New-NetFirewallRule -DisplayName "ALM 4410 HostOnly" -Direction Inbound -LocalPort 4410 -Protocol TCP -Profile Any -Action Allow -RemoteAddress <HostOnlySubnet/CIDR>

3. On the VM, configure the virtual network adapter as Host-Only in the VM settings.
4. Launch Automation License Manager inside the VM.
5. Choose Connect computer, enter the host's IP or NetBIOS name, and click Add to Favorites.
6. Select the host in the favorites list and click Search. The license entries should appear.

10. SQL Server 2014 Express: Service Account and Permission Matrix

The TIA Portal installer grants the local interactive user db_owner on each TIA database. If User Account Control (UAC) is enabled, the installer must be launched by an elevated SIA2.exe or via Run as administrator on the setup shortcut.

11. Verification Checklist

1. Open Automation License Manager. The previously stored licences are listed and the green status icon is shown in the status bar.
2. Launch TIA Portal. The start screen shows STEP 7 Professional V14 SP1 / V15.1 without a licence warning banner.
3. Create a new project, add an S7-1500 device, and attempt to go online against a simulator. Online operations succeed — this proves both the ALM handshake and the SQL archive database are functional.
4. Check that C:\ProgramData\Microsoft\Crypto now contains a regenerated MachineKeys folder. Confirm only the _old folders are present from your manual rename.
5. Run sc query "Automation License Manager Service" and confirm STATE : 4 RUNNING and START_TYPE : 2 AUTO_START (DELAYED).
6. Run sqlcmd -S .\SQLEXPRESS -E -Q "SELECT name FROM sys.databases" and confirm TIA_Portal, ALM, and (if WinCC installed) WinCC databases are listed.

12. Preventive Hardening for Re-Imaging and Re-Install Scenarios

• Always uninstall prior TIA Portal versions through Control Panel → Programs and Features or SIA2.exe /uninstall before re-imaging. The installer does not reliably clean CryptoAPI keys.
• Exclude the TIA install and SQL directories from antivirus real-time scanning and from Windows Search indexer.
• Disable Windows Defender Credential Guard during the install (it intercepts CryptoAPI calls used by Secon). Re-enable after the install.
• Use a dedicated local administrator account (not a roaming domain account) for the first install and license activation.
• Do not enable Controlled Folder Access (ransomware protection) during installation; it blocks Secon writes to ProgramData.
• For Windows 11, confirm the OS build is 22000 or later and that the Desktop Experience feature is present; Server Core editions are not supported by the TIA Portal GUI.

13. Installer Log Locations and How to Read Them

To enable verbose Secon tracing, set the user environment variable and restart the installer:

setx SECON_LOGLEVEL 3 /M
setx SECON_LOGPATH "C:\ProgramData\Siemens\SeconLogs" /M

14. Cross-Reference: Siemens Knowledge Base Entry Points

The Siemens Industry Online Support portal hosts the canonical entry points for TIA Portal installation troubleshooting. Always consult the latest Siemens support pages before applying procedures, because build numbers and bundle hashes change with each service pack:

• Siemens Industry Online Support — TIA Portal entry
• TIA Portal V14 installation and authorization notes (search for entry ID 109751605 on the Siemens support portal)
• Automation License Manager — troubleshooting manual (search for entry ID 109769720)
• Readme TIA Portal V15.1 — installation notes (search for entry ID 109758684)
• SIMATIC TIA Portal V14 SP1 readme (search for entry ID 109772562)

15. FAQ