Resolving WinCC Professional V17 ES-to-OS Download Path Failure

Resolving WinCC Professional V17 ES-to-OS Download Path Failure

Problem Overview

When performing a WinCC Runtime Professional V17 (Update 6) project download from a TIA Portal Engineering Station (ES) to a Runtime Operator Station (OS), the download target path appears red in the "Extended download to device" dialog and the OS computer is not enumerated under the network browser. Network-level connectivity checks all pass:

• Both PCs run SIMATIC WinCC Professional V17 Update 6 with matching build numbers.
• ICMP echo (ping) succeeds in both directions using IP address.
• ICMP echo (ping) by hostname succeeds (NetBIOS / DNS name resolution works).
• Both computers appear in the SIMATIC Shell under "Online partners" or local network browsers.
• Windows Firewall is reachable on TCP/UDP ports used by SIMATIC S7ONLINE and WinCC download services.

Despite the green connectivity indicators, the Online > Download to device path remains red, preventing the deployment of the compiled WinCC RT Professional runtime. The target system dialog cannot resolve the OS host even when typed manually using FQDN, short hostname, or IP.

Root Cause Analysis

The root cause is a mismatch in Windows security principals between the ES and OS. WinCC Runtime Professional relies on Windows authentication tokens, S7DOS helper services, and DCOM/RPCSS endpoints that are negotiated using domain or workgroup credentials. The TIA Portal download orchestrator requires a trusted principal context to:

1. Authenticate the ES user against the OS computer account.
2. Open the S7ONLINE remote service on the OS via named pipes / TCP port 102 (or configured alternative).
3. Push the compiled RT Professional project to the WinCC Runtime directory.
4. Trigger the RT loader process (CCLoadServer.exe) and write to the project registry hive.

When the ES is a member of an Active Directory domain (for example, a corporate IT-managed forest) and the OS is in a Workgroup (default RT installation), or vice-versa, the local SAM database on each machine stores independent user account credentials. The ES user token contains a domain SID that is unrecognized on the OS, and the OS lacks a corresponding local account. The download service therefore fails the access check, the path turns red, and the project cannot be transferred.

Siemens documentation states explicitly that the correct functioning of WinCC can only be guaranteed when all computers in a multi-user system are located in a common domain or working group. When WinCC is used in different domains or working groups, complications arise if the access rights and/or name utility are configured incorrectly.

Why Ping and SIMATIC Shell Succeed

ICMP echo and SIMATIC Shell browser enumeration use the lower-level NetBIOS browser service (browser) and UDP port 137/138 broadcasts. These services operate independently of SAM token validation. Browsing therefore succeeds even across domain boundaries, which can mislead the engineer into believing full connectivity is established.

Why the Download Path Turns Red

The red path is rendered by TIA Portal when the S7DOS discovery probe returns a non-zero result or a timeout when invoking the getTargetInfo RPC. This probe queries the OS for S7ONLINE service readiness, version handshake, and project slot availability. Authentication is mandatory at this stage, and a mismatched workgroup/domain context results in a fail-closed condition.

Prerequisites for a Successful ES-to-OS Download

Before initiating the download, validate the following checklist. Each item corresponds to a layer that the TIA Portal download stack inspects in sequence.

Solution 1: Align ES and OS to the Same Domain or Workgroup

This is the canonical and Siemens-recommended fix. The two computers must reside in a common Microsoft Active Directory domain or, alternatively, in the same Windows workgroup with mirrored local accounts.

Option A: Join Both PCs to the Same Active Directory Domain

1. On the OS, open Control Panel > System and Security > System > Advanced system settings > Computer Name.
2. Click Change, select Member of: Domain, enter the FQDN (e.g., plant.local), and provide domain administrator credentials.
3. Restart the OS PC.
4. Repeat the procedure on the ES if it is not yet joined to the target domain.
5. After restart, on the OS, log in with a domain user that has local Administrators rights.
6. On the ES, launch TIA Portal V17 with the matching domain user context.
7. Open the project and select Online > Download to device. The OS host should now enumerate as a target with a green path indicator.

Option B: Configure Both PCs in the Same Workgroup with Mirrored Users

When joining an Active Directory domain is not feasible (for example, due to corporate IT policy constraints on the ES), align both machines to the same workgroup name and create mirrored local accounts.

1. Set the workgroup name identically on both PCs (e.g., WORKGROUP).
2. On the OS, create a local user WinCCAdmin with password P@ssw0rd! and add to local Administrators and SIMATIC HMI groups.
3. On the ES, create the identical local user WinCCAdmin with the identical password.
4. Ensure the user has Log on as batch job rights on both machines via secpol.msc > Local Policies > User Rights Assignment.
5. Enable the Network access: Sharing and security model for local accounts to Classic on both PCs.
6. Reboot both machines.
7. Log in on the ES as WinCCAdmin, launch TIA Portal V17, and retry the download.

Solution 2: Offline Download to File System

When aligning the domain or workgroup membership is impossible (for instance, the ES is locked to a corporate managed domain that cannot include the OS), Siemens provides an offline download path through the TIA Portal "Download to file system" function. This transfers the compiled RT Professional runtime as a portable archive to a UNC path or removable media, which is then deployed manually on the OS.

Reference: Downloading the project to a file system (RT Professional) - TIA Portal Help (V20).

Procedure

1. In TIA Portal V17, open the target project.
2. Ensure the OS PC station in the project tree is selected with the correct target.
3. Navigate to Online > Download to file system.
4. In the dialog, select the storage path. A shared folder on the OS (e.g., \\OS-PC\RT_Transfer\ProjectName) is recommended, but a local folder on the ES can be used if the engineer will copy the file to the OS manually.
5. Confirm the target path and click Download.
6. TIA Portal compiles the project and writes the .srf RT bundle plus accompanying support files to the chosen directory.
7. On the OS, copy or mount the transfer directory and run the RT_Loader.exe (or use the WinCC RT Professional Configuration Studio's Project Migrator / Loader) to import the bundle into the runtime environment.

Limitations of the Offline Method

• No delta download support. The full project bundle is regenerated and transferred every time, even for trivial HMI tag changes.
• Operator station runtime must be stopped before import and restarted after import.
• Manual script orchestration (PowerShell or batch) is typically required for production environments to automate the load.
• License handling requires offline activation via the Automation License Manager (ALM) on each OS.

Solution 3: Virtual Machine Workaround

When the ES is administratively constrained to a corporate managed domain and cannot be re-imaged or re-joined, a virtual machine deployed on the same physical workstation or a dedicated hypervisor host provides a controlled boundary that can satisfy the same-domain requirement.

1. On the ES host (or a separate server), install a Type-2 hypervisor such as VMware Workstation, Hyper-V, or VirtualBox.
2. Create a VM with the same Windows build as the OS (Windows 10 IoT Enterprise LTSC 2021 / Windows Server 2019 / 2022).
3. Join the VM to the same domain or workgroup as the OS.
4. Install TIA Portal V17 Update 6 with matching build to the ES.
5. Open the project on the VM and perform the download to the OS via the host network interface (bridged mode).
6. For production deployments, persist the VM and snapshot the configuration for repeatability.

Network and Firewall Configuration

Domain alignment alone does not guarantee a successful download. The Windows Defender Firewall and any third-party endpoint security agent must permit the WinCC download traffic.

Required Ports

Recommended Firewall Rules (PowerShell, Run as Administrator)

# Allow S7COMM
New-NetFirewallRule -DisplayName "Siemens S7COMM 102 TCP" -Direction Inbound -Protocol TCP -LocalPort 102 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Siemens S7COMM 102 TCP Out" -Direction Outbound -Protocol TCP -RemotePort 102 -Action Allow -Profile Any

# Allow TIA Portal download orchestrator
New-NetFirewallRule -DisplayName "TIA Portal Download 4410" -Direction Inbound -Protocol TCP -LocalPort 4410 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "TIA Portal Download 4410 Out" -Direction Outbound -Protocol TCP -RemotePort 4410 -Action Allow -Profile Any

# Allow NetBIOS discovery
New-NetFirewallRule -DisplayName "NetBIOS NS 137" -Direction Inbound -Protocol UDP -LocalPort 137 -Action Allow
New-NetFirewallRule -DisplayName "NetBIOS Datagram 138" -Direction Inbound -Protocol UDP -LocalPort 138 -Action Allow

# Allow SMB
New-NetFirewallRule -DisplayName "SMB Direct 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -Profile Any

# Allow DCOM/RPC dynamic range
New-NetFirewallRule -DisplayName "DCOM Dynamic RPC" -Direction Inbound -Protocol TCP -LocalPort 49152-65535 -Action Allow -Profile Any

SIMATIC Shell Configuration

The SIMATIC Shell is the WinCC / TIA Portal file explorer that exposes the S7ONLINE peer discovery channel. To verify it functions:

1. On the OS, open SIMATIC Shell from the Start menu or by double-clicking the desktop icon. The default installation path is C:\Program Files\Siemens\Automation\SimaticShell\Bin\s7shelx.exe.
2. Navigate to Local network > [Your Workgroup or Domain] > <ES name>. The ES should be visible.
3. If the OS does not appear under the ES's SIMATIC Shell, confirm that the S7OLEConnector service (or CCAgent on V17) is running on the OS: sc query CCAgent.
4. If still missing, restart the SIMATIC Shell on the ES or refresh with F5.

User Account Configuration

When operating in a workgroup, account mirroring must extend beyond simple user creation. The following groups and rights must be configured on both ES and OS:

Verification Steps

After applying the fix, perform the following verification sequence to confirm the download path resolves correctly and the runtime loads cleanly.

1. On the ES, open TIA Portal V17 and load the project.
2. Select the WinCC RT Professional OS in the project tree.
3. Right-click and choose Download to device > Software (all).
4. In the "Extended download to device" dialog, verify the OS PC is enumerated in the "Select target device" dropdown.
5. Confirm the path indicator is green. A red path indicates remaining authentication or service issues.
6. Check the "Events" pane for any compilation warnings before download.
7. Click Load and accept the overwrite prompt.
8. On the OS, observe the CCLoadServer.exe process starting and writing the project to C:\Program Files\Siemens\Automation\WinCC RT Professional\<ProjectName>.
9. After load completion, verify the runtime starts cleanly. Open WinCC RT Professional Configuration Studio and check the project status (green) under Runtime.
10. Trigger a tag from the PLC and confirm it animates correctly on the OS HMI screen.

Common Errors and Diagnostic Codes

Field Commissioning Checklist

Before signing off the ES-to-OS download on a new installation, verify:

• Both PCs report identical systeminfo for OS Build, Domain, and Network adapters.
• TIA Portal version, including Update level and HSPs, is identical on ES and OS.
• The WinCC operator user is present on both PCs with matching password and group memberships.
• S7ONLINE and CCAgent services are set to Automatic and currently Running.
• Firewall rules for TCP 102, 4410, 135, and 445 are explicitly enabled.
• SIMATIC Shell on both PCs enumerates the other computer.
• An online download of a small test project completes with a green path and 100% progress.
• After load, the RT runtime initializes and the start screen paints without errors in the WinCC diagnostic viewer.
• Tag simulation from the PLC side produces live values on the OS HMI.

Notes on WinCC Unified V17 Migration

If the project is intended to migrate to SIMATIC WinCC Unified V17 in a subsequent phase, review the delivery release notes for the new platform to confirm licensing, runtime architecture, and download topology differences. The Unified RT runs as a Linux-based or containerized service on the OS, and the download topology uses the Unified Collaboration server. The same domain / workgroup alignment rule applies.

Reference: Delivery Release SIMATIC WinCC Unified V17 ES & RT - Siemens Industry Online Support.

Summary of Resolution Paths