Resolving WinCC Unified Error 273: Login Failure on MTP Panels

1. Problem Description

On a first-time commissioning of Siemens WinCC Unified Runtime, the system displays the error dialog Unexpected problem. Please contact an Administrator. (273) when the operator attempts to log in at the runtime login screen. The login page is served either by a physical Unified Comfort Panel (e.g., MTP1000) or by the WinCC Unified PC Runtime simulation. Regardless of the target device, the dialog blocks authentication and the runtime remains inaccessible, even when the credentials match a TIA Portal user that was downloaded to the device.

Error code 273 is a generic authentication/authorization fault that the Unified Runtime generates when the user store, the role mapping, or the certificate/connection chain between TIA Portal and the runtime is inconsistent. It is commonly observed on:

• Brand-new PC Runtime installations that have never received a project download.
• Unified Comfort Panels (MTP400, MTP700, MTP1000, MTP1200, MTP1500, MTP1900, MTP2200) flashed from delivery state.
• Projects migrated from WinCC Professional V7 to WinCC Unified where the user database format is incompatible.
• First downloads after a TIA Portal major-version upgrade (e.g., V17 → V18 → V19 → V20).

2. Root Cause Analysis

Error 273 is raised by the UMC (User Management Component) service inside WinCC Unified Runtime. It indicates that the runtime could not validate the supplied credentials against the locally stored user database. The most common root causes, in descending order of frequency, are:

1. Missing or out-of-sync local user store — The runtime was compiled/downloaded but the user/role database was not transferred, or the existing database on the target still references users from a previous project.
2. "Reset users and roles" not selected on first download — TIA Portal will not overwrite a pre-existing user store unless the engineer explicitly forces a reset. This is the single most common field fix.
3. Empty or malformed "Users and Roles" configuration in the project — A TIA Portal project can be compiled and downloaded even when no Unified users have been defined; the runtime then has nothing to authenticate against.
4. Smart App Control (Windows 11) blocking the UMC service — Microsoft's Smart App Control (SAC) in Evaluation or Enabled mode will quarantine unsigned or newly downloaded executables, including UMC.exe, breaking authentication on a fresh WinCC Unified PC Runtime install.
5. Certificate/secure-channel mismatch — When the project is downloaded over a TLS-protected route, an out-of-sync device certificate on the PC Runtime or panel will cause the UMC handshake to fail with a 273-equivalent error.
6. Wrong runtime context — Trying to access a Unified Comfort Panel's web login page from a generic browser tab using a direct URL can return 273 because the panel's HTTPS context is panel-internal, not browser-internal.

3. Affected Versions and Components

4. Pre-Diagnostic Checklist

Before changing the project, run through the following five checks. They take less than two minutes and resolve the majority of 273 errors in the field.

1. Open TIA Portal → Project tree → Runtime settings → Users and roles. Confirm that at least one user exists. If the list is empty, error 273 is guaranteed.
2. Open Runtime Manager on the PC Runtime host. Verify the project status is Running (green dot), not Configuration error or License missing.
3. Check the runtime log directory: C:\ProgramData\Siemens\Automation\WinCCUnified\LogFiles. Open the most recent UMC_*.log file and search for 273 or Authentication failed.
4. On Windows 11 hosts, run msinfo32 → Software Environment → Security Providers or check Windows Security → App & browser control → Smart App Control. Record the SAC state.
5. On the engineering station, confirm the TIA Portal project version matches the firmware on the panel/PC Runtime within the same major line (V18 project → V18 PC Runtime).

5. Solution Path A — Reset Users and Roles on First Download

This is the most reliable field fix and should be the first action attempted when the runtime has never been configured or has inherited a stale user store from a prior project.

Step-by-step

1. In TIA Portal, select the WinCC Unified device in the project tree (e.g., PC-RT_1 or MTP1000_1).
2. Right-click → Download to device → Software (all) (or Download to device → Configuration if you want to keep firmware).
3. In the Download to Device dialog, expand Options (or the Select target pane in V20).
4. Check the box labeled "Reset users and roles" (German: "Benutzer und Rollen zurücksetzen").
5. Click Download. The TIA Portal will erase the local UMC database on the runtime and write the new user/role table from the project.
6. After the download completes, restart the WinCC Unified Runtime service or power-cycle the panel.
7. Test login with one of the users defined under Users and roles.

6. Solution Path B — Verify and Repair "Users and Roles" Configuration

If Solution A does not resolve the error, the project itself is missing a valid user/role definition. A project can be compiled and downloaded with no users, in which case error 273 is by design.

1. In the project tree, navigate to Runtime settings → Users and roles.
2. Confirm at least one user is defined (e.g., admin, operator).
3. Confirm each user is assigned at least one role. WinCC Unified ships with the built-in roles HMI Administrator, HMI Operator, HMI Monitor, and HMI Service. Add a custom role if your screens use named authorizations such as Auth_Level_2.
4. Define a runtime password of at least 8 characters for each user. The UMC service rejects empty passwords on first launch even if the project is in development.
5. Recompile the project (Project → Compile → Software (rebuild all)) and re-download with Reset users and roles enabled.

For environments using SIMATIC Logon or an external LDAP/Active Directory source, ensure the SIMATIC Logon runtime component is installed and the central user administration is configured in Runtime settings → User administration. A misconfigured SIMATIC Logon connector will also surface as 273 because the UMC cannot reach the directory service.

7. Solution Path C — Communication and Certificate Settings (FAQ Point 8)

Siemens' own "Notes on use — WinCC Unified" documentation and the TIA Portal help topic "Which settings do I have to make for the communication with WinCC Unified Runtime on the runtime device?" define eight mandatory configuration points. Point 8 in particular addresses the secure-channel handshake that breaks the UMC login when mismatched.

If point 8 fails with a certificate error, import the device certificate into the engineering station's Trusted People store using TIA Portal → Options → Support → Install device certificate. A broken TLS chain at this stage will surface to the end user as 273 because the UMC handshake aborts before credential evaluation.

8. Solution Path D — Disable Smart App Control on Windows 11 Hosts

The Siemens TIA Portal documentation (Notes on use — WinCC Unified PC Runtime) states explicitly that "If you are using Unified Runtime on a PC running on Windows 11, make sure that 'Smart App Control' is disabled." Smart App Control, when set to Evaluation or Enabled, can quarantine WinCC Unified executables that lack an established reputation, breaking the UMC service and producing error 273 at login.

Procedure to disable Smart App Control

1. Open Windows Security (Win + S → "Windows Security").
2. Navigate to App & browser control → Smart App Control.
3. If the state is Evaluation or On, select Off.
4. Reboot the PC.
5. Re-launch WinCC Unified PC Runtime and retest the login.

9. MTP1000 Panel Simulation Specifics

A common misunderstanding on first-time use of WinCC Unified is the relationship between a Unified Comfort Panel, a web browser, and the PC Runtime. The correct architecture is:

1. Unified Comfort Panel (MTP) runs the runtime locally. The browser is not required to operate the panel; it is only used during engineering for the web-based administration interface.
2. WinCC Unified PC Runtime is a separate product that emulates the panel on a Windows host. It is required to simulate a Unified Comfort Panel because the panel firmware does not run on a PC.
3. Web access to a real MTP panel is provided by the panel's embedded web server, accessible at https://<panel-ip>/ for diagnostic pages and at https://<panel-ip>:8443/ for the UMC login.

To simulate an MTP1000 on a PC, install the WinCC Unified PC Runtime package and use the RT Manager to start the project. The simulation host will listen on the same ports (default 8443) and present the identical login page. Error 273 reproduces identically in the PC Runtime because both environments share the UMC service architecture.

Quick simulation setup

1. Install SIMATIC_WinCC_Unified_PC_Runtime_V20.exe (or matching V17/V18/V19 build) on the engineering PC.
2. Download the project with the Reset users and roles option enabled.
3. Open RT Manager, confirm the project shows Running.
4. Open Chrome/Edge → https://localhost:8443 and log in.

10. Verification Steps

After applying any of the solutions above, perform the following five checks in order. If any fails, return to the appropriate solution path.

1. Login test: From the panel's local screen and from a remote browser (engineering PG), log in with each defined user. Both paths must succeed.
2. Log review: Inspect UMC_<timestamp>.log in C:\ProgramData\Siemens\Automation\WinCCUnified\LogFiles. No 273 entries should be present.
3. Role enforcement: Log in as a non-administrative user (e.g., Operator). Confirm restricted screens show the proper lock/visibility states. This validates the role table, not just the user table.
4. Audit log: Open the runtime's audit trail (Runtime → Logs → Audit) and confirm the login event is recorded with timestamp, user, and result.
5. Failover test: Power-cycle the panel or restart the WinCC Unified Runtime service. The login page must re-render within the configured timeout (default 30 s) and accept the same credentials.

11. Troubleshooting Matrix

12. Field-Engineer Notes and Common Pitfalls

• The Reset users and roles checkbox only appears on a full software download, not on incremental Configuration download. Engineers on fast iteration cycles often forget this and conclude that "TIA Portal does not push user changes."
• The UMC service binds to port 8443 by default. If another application (e.g., a corporate web service) is squatting on that port, the UMC service starts but rejects all logins with 273. Use netstat -ano | findstr 8443 to verify.
• Passwords are encrypted using the project-specific certificate. Migrating a project to a new PG without that certificate will produce 273 on every user. Either back up the certificate in Project properties → Protection or re-define all passwords after migration.
• WinCC Unified does not share its user store with WinCC Comfort/Professional. A migration from those products requires re-creating users in the Unified user management.
• On multi-user engineering, only the last downloader with the Reset users and roles flag wins. Subsequent downloads without the flag will leave the user store intact, which is usually desired for production but traps first-time commissioning.
• The Automatic Login feature in the Runtime Manager bypasses UMC entirely and is intended only for kiosk-mode simulation. Do not enable it on production panels; it masks underlying 273 issues and creates a security gap.