Resolving WinCC DataMonitor DatView Cross-Domain Security Error

Affected products: SIMATIC WinCC V7.x, WinCC DataMonitor (WebNavigator/DataWorkbench client), Microsoft Internet Explorer 8/9/10/11. Symptom: When selecting Tags on a table or Tags on a trend inside the DataMonitor DataView page, the browser raises a script debug dialog with the text "A Runtime error is occurred. Do you wish to debug? Line: 1459 Error: Safety settings on this computer prohibit accessing a data source on another domain." The DataView page never reaches the result table and the user cannot query any archived tag data.

1. Problem Description and Field Signature

The reported failure mode is reproducible and consistent across field installations. The operator or engineer opens the DataMonitor start page, navigates to DataView, chooses Tags > on a table, sets a query time window, and presses Start query. Immediately the page returns a modal dialog:

A Runtime error is occurred.
Do you wish to debug?
Line: 1459
Error: Safety settings on this computer prohibit accessing a data source on another domain.

Three operational conditions are typically observed together:

1. The same error also occurs on the Tags on a trend page, but reports and DataWorkbook regenerations work correctly.
2. Connecting from a second computer causes the browser to hang on the loading screen, indicating the issue is not strictly client-side.
3. The IE status bar reports the DataMonitor server URL (for example http://10.10.1.55) as a Local Intranet site, not as Trusted Sites.

Together these confirm the failure is not a DataMonitor server defect, a missing SQL database, or a runtime licensing error; it is a browser security-policy refusal to issue a cross-zone data-source request.

2. DataMonitor Architecture Relevant to the Fault

WinCC DataMonitor is the read-only web client family for WinCC V7 projects. It exposes four roles on the IIS host: DataMonitor Server, DataMonitor Client, WebCenter, and Reports. The DataView page is served as an ASPX application from the IIS virtual directory DataView under the WinCC web site. The page embeds the DataWorkbench ActiveX control, which in turn loads WinCC DataWorkbench OCX to query the tag logging and alarm logging runtime databases through a DCOM/RPC channel back to the WinCC runtime.

When the user issues a query, the following chain of cross-zone requests is fired:

If the originating page (Zone A) and the data source (Zone B) are not the same zone, and the user-agent has not been granted the Access data sources across domains privilege for Zone A, the JScript runtime aborts the data request at the engine level. This is exactly the line-1459 throw reported in the field.

3. Root Cause Analysis

The error string "Safety settings on this computer prohibit accessing a data source on another domain" is produced by the Microsoft Scripting engine when the XMLHTTP / IXMLDocument request issued by an in-page ActiveX or script attempts to read a payload from a host that is not in the same IE security zone as the host page. In the WinCC DataMonitor case the in-page ActiveX is the DataWorkbench control and the cross-domain target is the WinCC Web service. Two independent gates have to be open:

Reference: Microsoft docs, Internet Explorer security zones registry entries and IE Enhanced Security Configuration. For Siemens side, see the WinCC DataMonitor V7.4 SP1 System Manual and the DataMonitor installation and security configuration entry on the Siemens Industry Online Support portal.

4. Prerequisites Before You Begin

1. The Windows user performing the configuration must be a member of the local Administrators group, because Trusted Sites custom-level changes are stored in HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap and per-user customisations sit under HKCU.
2. Close all Internet Explorer windows; the security settings are read at process start.
3. Have ready the FQDN, NetBIOS name, and IP address of the DataMonitor server (e.g. http://datamonitor, http://10.10.1.55, http://datamonitor.local). All three are added to the Trusted Sites list.
4. Make sure the DataMonitor client is installed on the DataMonitor server itself for the first test pass, to remove network hops as a variable.
5. Confirm the DataMonitor server URL responds on port 80 (HTTP) or 443 (HTTPS) with https://<server>/WebView/ returning the WinCC web login page.

5. Step-by-Step Resolution

5.1 Add the DataMonitor server to the Trusted Sites zone

1. Open Internet Explorer on the client machine.
2. Press Alt+X then O (or use the gear icon) to open Internet Options.
3. Select the Security tab.
4. Click the green checkmark icon Trusted sites to select that zone.
5. Click Sites.
6. Uncheck Require server verification (https:) for all sites in this zone only if you are using plain HTTP for the DataMonitor intranet deployment.
7. Type each of the following and click Add:

   http://10.10.1.55
   http://datamonitor
   http://localhost
   http://127.0.0.1

8. Click Close, then OK.

5.2 Enable Access data sources across domains

1. Still in Internet Options → Security → Trusted sites, click Custom level....
2. Scroll to the section ActiveX controls and plug-ins.
3. Locate the option Access data sources across domains and set the radio button to Enable.
4. Also set the following to Enable for the initial commissioning pass:
   • Initialize and script ActiveX controls not marked as safe for scripting
   • Script ActiveX controls marked safe for scripting
   • Run ActiveX controls and plug-ins
   • Download signed ActiveX controls
   • Download unsigned ActiveX controls
5. Under Scripting, set Active scripting to Enable and Scripting of Java applets to Enable.
6. Click OK, accept the warning, click Apply, then OK again.

5.3 Disable script debugging

To prevent the modal dialog from masking the actual functional result, suppress script debug prompts:

1. Internet Options → Advanced tab.
2. Under Browsing, clear the boxes Disable script debugging (Internet Explorer) and Disable script debugging (Other).
3. Confirm Display a notification about every script error is also cleared so the dialog does not block navigation.
4. Click Apply and close the dialog.

The DataView page will still log the cross-zone failure into the JScript console, but the user can read the table content underneath.

5.4 Verify the Windows user account has a password

DataMonitor uses Windows authentication to issue the DCOM call back into WinCC runtime. A blank password causes the data-source wrapper to throw an authentication exception that surfaces as the same cross-domain error string.

1. Open Control Panel → User Accounts → Manage another account.
2. Select the operator account, choose Create a password and provide a non-blank value that meets complexity policy.
3. Log off and log back on so the Kerberos/NTLM ticket is rebuilt.

5.5 Do not attach WinCC archive databases from the project folder

Many engineers instinctively right-click a .mdf in the <WinCC_Project>\ArchiveManager folder in SQL Server Management Studio and choose Attach. The DataMonitor runtime already has those databases mounted via the WinCC ArchiveManager; re-attaching them under a second name is what triggers the second-instance access error and effectively doubles the cross-zone data requests.

• Verify in SQL Server Management Studio that the CC_<Project>_R and CC_<Project>_A databases are mounted once, owned by the WinCC runtime user, and read-only from the DataMonitor account.
• The Attach and Detach commands in the WinCC Alarm Logging and Tag Logging editors are reserved for restoring archives from the Backup tab destinations. They must not be used to manipulate the live ArchiveManager folder.

5.6 Validate IIS configuration

1. Open IIS Manager on the DataMonitor server and select the Default Web Site.
2. Confirm the application pools DataViewAppPool and WinCCWebAppPool are started and running under the WinCCUser identity.
3. Open Authentication on the DataView virtual directory and enable Windows Authentication; disable Anonymous Authentication for that path.
4. Open HTTP Response Headers on the same node and confirm X-Frame-Options is either absent or set to SAMEORIGIN (DataWorkbench loads its data into the same origin via frame). A DENY value re-creates the cross-domain block.

6. Verification Procedure

1. Close every Internet Explorer window; the new security zone settings do not apply to live processes.
2. Re-open Internet Explorer as the operator user (not as SYSTEM or as a service account).
3. Navigate to http://<datamonitor-server>/DataView/. The IE status bar must read Trusted sites.
4. Log in, choose Tags on a table, enter a one-hour query window, and press Start query.
5. Confirm that the result table is rendered with at least one row of values; the JScript error dialog should no longer appear.
6. Switch to Tags on a trend and confirm the trend curve is drawn.
7. Open Reports, publish a sample Excel workbook, and use the right-click DataWorkbook → Regenerate option to ensure round-trip server-side rendering still works.

7. Extended Troubleshooting Matrix

For deeper diagnosis enable the WinCC DataMonitor trace by creating or extending the registry value [HKLM\SOFTWARE\Siemens\WinCC\WebNavigator\Diagnostics] "TraceLevel"=dword:0x00000004 and reviewing C:\Program Files (x86)\Siemens\Automation\WinCC\WebNavigator\Diagnostics\DataMonitor.log. Reference: Siemens KB entry DataMonitor trace configuration.

8. Hardening the Configuration for Production

Once the DataView page is functional, the aggressive Enable settings can be reduced to a minimum that still permits the DataWorkbench ActiveX to operate. The hardened target is:

Push the configuration to all engineering and operator clients by exporting the registry hive HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 (where 2 is the Trusted Sites zone identifier per Microsoft security zone ID list) and the Trusted Sites list under ZoneMap\Domains into a GPO preference or a Microsoft Endpoint Manager configuration profile.

9. Common Operator-Workstation Pitfalls

• Connecting via the IP address only. If the operator types http://10.10.1.55 but the DataMonitor server is bound to a host name with a DNS suffix, IE will assign the page to Local intranet only if the URL matches the bypass-proxy rules. Add the IP explicitly to Trusted Sites as shown in section 5.1.
• Using a Chrome or Edge (Chromium) browser. DataMonitor V7.x is engineered for Internet Explorer and the DataWorkbench ActiveX. Chromium-based Edge does not host the OCX. The error then presents as a missing-ActiveX message rather than the cross-domain dialog and requires no security fix; the user must switch to Internet Explorer 11 in IE-mode if Edge is mandated by corporate policy.
• ActiveX filtering enabled in the IE toolbar. The blue ActiveX icon in the IE address bar, if pressed, disables all ActiveX for the page. The cross-domain error dialog will then appear because the DataWorkbench OCX is no longer initialised and the script falls through to the XMLHTTP path.
• Server clock skew greater than 5 minutes. Kerberos authentication fails silently and the DataMonitor web page is served with HTTP 401, which the JScript engine reports as the same line-1459 cross-domain abort.

10. Edge Cases and VMware-Specific Notes

When the DataMonitor server is hosted inside a VMware vSphere / Workstation virtual machine, three additional failure modes can re-create the symptom:

1. Network type NAT. The WinCC runtime is reachable from the host as http://localhost but the VM-internal IP is not. Add http://localhost as a Trusted Site in addition to the VM IP.
2. Host-only networking. No DNS resolution exists. Either add a static entry to the client hosts file or use the IP literal in the Trusted Sites list.
3. Snapshot revert with new IP address. The original IP is still in Trusted Sites, the new IP falls into the Internet zone, and the cross-domain error returns. Re-add the new IP literal.

Verify with nslookup <datamonitor-server> from the operator client before adding zone entries; the FQDN must resolve to the same address that the browser will use for the second hop.

11. Frequently Asked Questions