Resolving WinCC Flexible Account Lockout After Failed Logins

Siemens WinCC Flexible (Engineering System runtime 2005, 2007, 2008 and the SP updates of each) ships with a built-in user administration that silently locks the local user database after a fixed number of consecutive failed logins. Because the lock is enforced by the runtime panel and not by the engineering station, the fault cannot be cleared by editing the project offline; the operator panel physically refuses authentication until the operator unlocks it through a recovery path. The most important behavior is that the lock applies to every account, including the configured Administrator account. A locked Admin means no user (even the original developer) can authenticate from the panel face until the recovery action is executed on the panel itself. This article documents the root cause, the exact lock threshold observed in the field, the recovery options ordered from least invasive to most invasive, the configuration changes that became available in WinCC Flexible 2008, and the forward-compatibility notes for WinCC Unified panels that inherit the same behavior.

1. Problem Description

Symptom signature observed on SIMATIC Mobile Panel 277, MP 277, TP 177, OP 277 and the PC Runtime variants:

• Operator enters correct username and password at the login screen; login is rejected.
• All configured users, including Admin, refuse to authenticate.
• The login screen itself remains functional (the panel is not crashed), but every action that calls LogonUser() / AuthenticateUser() from a script or returns the user level required for a configured button returns 0 (no rights).
• Restarting the panel by power cycling the 24 V supply does not always clear the lock. Field reports from mobile panels confirm intermittent recovery; some panels recover, some do not.
• The Engineering Station (ES) project still compiles and downloads; the lock is not visible from WinCC Flexible Explorer or from the project tree.

The reported customer-impacting event was a complete plant stop because the change-over recipe button required authorization level 5 (Administrator). The panel accepted the login but stripped access rights on every secured object, which in WinCC Flexible terminology is the same condition as "user is locked."

2. Root Cause

WinCC Flexible stores local user accounts in a runtime file on the panel (typically under /active/user or /backup/user depending on the panel file system). The user administration object maintains a per-account failed-attempt counter in volatile memory and a locked flag that is written to the persistent user database when the threshold is crossed.

Engineers who attended the official Siemens WinCC Flexible course confirm that the lock threshold and the Admin-not-exempted behavior are not covered in the standard curriculum; the feature is documented only in the runtime help file under User Administration - Notes.

The flag persists in the panel file system. On some panel file systems (notably the Mobile Panel 277 with the older Windows CE 5.0 image), the flag is held in volatile memory and is therefore lost on power-down. On the MP 277 10" Touch and on PC Runtime, the flag is written through to the user database immediately when the threshold is crossed, so a power cycle does not clear it. This explains the inconsistent field reports.

3. Affected Versions and Devices

The lockout behavior is present in every WinCC Flexible runtime version that exposes the local user administration editor (Runtime > User Administration). The behavior has been confirmed on:

• WinCC Flexible 2005 SP1 / SP2 / SP3 - threshold hard-coded to 3, no setting exposed.
• WinCC Flexible 2007 SP1 / SP2 - threshold hard-coded to 3, no setting exposed.
• WinCC Flexible 2008 SP1 / SP2 / SP3 / SP4 / SP5 - threshold configurable from Runtime Settings > User Administration > Number of allowed login attempts. SP2 and later also expose an Off option that disables the lock entirely.
• WinCC Flexible PC Runtime - same behavior; lock state stored in %ProgramData%\Siemens\Automation\WinCCFlexible\Runtime\UserDB.
• WinCC Unified V15.1 and later - inherits the same model. The Siemens SiePortal article on WinCC Unified user administration confirms the same password-protection workflow with local user storage.

4. Recovery Option A - Relocate the Backup/Restore Button Outside Secured Area

This is the recommended on-site recovery for projects still on WinCC Flexible 2005 or 2007 (no configurable threshold).

4.1 Prerequisites

• WinCC Flexible ES of the same version and service pack as the panel runtime.
• The compiled .hmi project file matching the panel firmware generation.
• Ethernet or MPI/PROFIBUS cable plus the configured transfer channel.

4.2 Procedure

1. Open the project in the ES.
2. Create a new screen named Recovery.
3. Drop a button onto the screen and assign the system function "Restore (from backup)" in the Events tab (Button > Press).
4. Do not place the button inside an area that has an Authorization attribute configured. A button placed on a screen with no secured objects can be pressed without authentication.
5. Compile the project. From the WinCC Flexible 2008 onward the compile warning W0069 - Unsecured function on this screen can be suppressed per object.
6. Transfer the project to the panel (Transfer > Runtime > Start with settings from the project).
7. On the panel, navigate to the new Recovery screen. Because the screen has no secured objects, the button is reachable without login.
8. Press the button. The runtime restores the user database from the most recent backup file (/backup/user). The locked flag is overwritten by the backup copy that was written before the lock event.

4.3 Verification

1. Cycle to a normal operating screen and attempt to log in as Admin.
2. Confirm that the login succeeds and the access-rights-dependent objects (change recipe, parameter write, etc.) become active.
3. Open the runtime diagnostic file (Panel > Start Center > Settings > OP > Diagnosis) and verify the message User authentication OK appears in the log.

5. Recovery Option B - Project Re-transfer

Use when no recent backup of the user database is available or the backup itself contains the lock flag.

5.1 Procedure

1. Open the project in the ES.
2. Connect to the panel via Transfer mode. WinCC Flexible 2007 uses Transfer > Transfer Settings > Ethernet; WinCC Flexible 2008 uses the same path with the additional Delta Transfer option.
3. Select Transfer > Runtime. The ES will prompt Overwrite user administration? Answer Yes.
4. The runtime stops, the new project is unpacked, and the user database is rewritten from the ES source. The locked flag is removed because the source project never contained it.
5. After transfer, the panel reboots. The new (clean) user database is active.

5.2 Caveats

• Any password changes made at the panel after the last download are lost. Document them before re-transfer.
• Recipe data and process values held in /active are not affected.
• Audit trails configured to write to the panel are not affected.

6. Recovery Option C - Power Cycling (Intermittent)

Power-down the panel for at least 30 seconds, then restore 24 V. Behavior depends on the panel file system:

Use this option only on confirmed volatile platforms (legacy Mobile Panel 277). For all other targets, do not rely on a power cycle as the recovery plan.

7. Permanent Fix in WinCC Flexible 2008 SP2 and Later

WinCC Flexible 2008 (with Hotfix SP2, May 2009) added two configuration switches that eliminate the problem at design time. The Siemens SiePortal thread on user administration in WinCC Flexible 2008 confirms the workflow.

7.1 Change the failed-login threshold

1. Open the project in WinCC Flexible 2008 SP2 (or later).
2. Project tree > Runtime Settings > User Administration.
3. Set Maximum number of failed login attempts to a value between 1 and 99. Siemens recommends 10 for operator-facing panels and 5 for panels in hazardous areas where deliberate probing should be detected.
4. Compile and transfer.

7.2 Disable the lock entirely

1. Same path as above.
2. Select Do not lock account after failed login attempts.

8. Step-by-Step Commissioning Hardening Procedure

Apply the following checklist to every new WinCC Flexible project before the first transfer:

1. Open Runtime Settings > User Administration. Configure the failed-login threshold or disable the lock explicitly. Do not leave the default 3-attempt behavior in place.
2. Add a Recovery screen containing a single button wired to Restore (from backup). Place the screen outside any secured area so the button is reachable without authentication.
3. Add a second button on the same screen wired to Save (to backup) so a clean backup can be taken before any password change.
4. Set the Start Center to display the Recovery screen as a service screen. In WinCC Flexible 2008 this is done with Device Settings > Start Center > Service Screen.
5. Add a scheduled task (Scheduler > Trigger every 24 h) that calls Save (to backup) so the backup file is always within 24 hours of the live data.
6. Document the panel file system behavior in the maintenance manual: volatile vs persistent.
7. If migrating to WinCC Unified, repeat steps 1 to 6 using SIMATIC Runtime Manager > User Administration.

9. Troubleshooting Matrix

10. Migration Notes - WinCC Flexible to WinCC Unified

Projects migrated with the WinCC Unified Migration Tool carry the WinCC Flexible user database forward. The lockout state is preserved during migration unless the tool is forced to regenerate the user database (Project > Migrate > Options > Reset User Administration). The SiePortal sample on WinCC Unified user administration walks through the modern equivalent configuration.

Set the following before the first production transfer of a migrated project:

• SIMATIC Runtime Manager > Security > User Administration > Lockout Policy = 5 (recommended).
• Audit Log > Log Failed Login Attempts = Enabled.
• Recovery Screen added with the same Restore function as documented for WinCC Flexible.

11. Field-Proven Caveats

• The password input field in WinCC Flexible does not echo characters. Operators cannot see that the Num Lock key is engaged on an external USB keyboard attached to a Mobile Panel 277 - the single most common cause of three consecutive failures in the field.
• The Admin password is case-sensitive but the panel does not differentiate a deliberate Caps Lock from a Shift-key combination; both produce identical logged failure events.
• On PC Runtime, the user database file is updated synchronously when the threshold is crossed. A clean shutdown (Task Manager > End Task) does not prevent the write; the lock is committed before the shutdown is processed.
• The WinCC Flexible help text states "The account is locked until a user with administrator rights unlocks it." Because the locked Admin cannot authenticate, the only way to satisfy this sentence is via the recovery screen described in section 4.
• Some third-party user administration libraries (e.g. custom SIMATIC Logon integrations) bypass the WinCC Flexible lock counter entirely and will not exhibit the symptom. Confirm the library version before assuming the issue is in WinCC Flexible.

12. Frequently Asked Questions