Resolving WinCC Unified Runtime V17 HTTP 503 Error in IIS

Resolving WinCC Unified Runtime V17 HTTP Error 503 in IIS

After upgrading a WinCC Unified PC Runtime from V16 to V17 (or V17 to V18), the integrated web server hosted by Microsoft Internet Information Services (IIS) frequently returns HTTP Error 503 — Service Unavailable on every browser request. The root cause is that the IIS application pools DefaultAppPool and WebRHPool stop as soon as the first request reaches the WinCC Unified web site. The condition is reproducible across clean installs and in-place upgrades, and is officially documented by Siemens Support under entry 109995988 — Fix HTTP error when accessing WinCC Unified PC Runtime. This reference covers the full diagnostic workflow, the four independent remediation paths (certificates, IIS module, SCADA site reconfiguration, and clean reinstallation), and the verification steps that confirm a successful repair.

1. Problem Definition

Symptom cluster reported on V17 and V18 PC Runtime installations:

• Browser request to https://<host>/ or https://<host>/Siemens/... returns HTTP/1.1 503 Service Unavailable within milliseconds.
• In IIS Manager (inetmgr.exe) the application pools DefaultAppPool and WebRHPool display a status of Stopped.
• Manually starting the pools from the IIS Manager action pane causes the pool to start but stop again on the next request, often within 1–5 seconds.
• Windows Event Viewer — System log shows IIS-W3SVC-WP event IDs 2268, 2275, or 5189 generated by the worker process terminating unexpectedly.
• Windows Event Viewer — Application log shows a .NET Runtime error (event ID 1026) referencing Siemens.UserManagement.ServiceLayer.dll or an unhandled access violation in w3wp.exe.
• The Simatic Runtime Manager shows the WinCC Unified RT instance in state Running, masking the web-layer failure.

The browser-displayed HTTP 503 has no body content; it is the IIS-generated default response triggered when no healthy worker process can service the request.

2. Root Cause Analysis

HTTP 503 in this scenario is produced by IIS when a worker process crashes during initialization or during request handling. For WinCC Unified Runtime V17 onward, four distinct trigger conditions have been confirmed in the field:

The official Siemens Support entry 109995988 classifies these as missing Windows functions or permissions; the specific remediation paths differ per trigger.

3. Affected Versions & Environment

4. Diagnostic Procedure

Perform these checks in order before applying any remediation. The diagnostic order moves from least to most invasive and protects against unnecessary reinstallation.

1. Verify pool state. Open %windir%\System32\inetsrv\iis.msc. Expand the local server, click Application Pools. Confirm the status of DefaultAppPool and WebRHPool. Note any pool that is Stopped.
2. Capture the recycle reason. Right-click the stopped pool → Advanced Settings → Recycling > Rapid-Fail Protection. Confirm Enabled is True. Right-click the pool → View Applications; the offending application is listed under the SCADA site.
3. Read the Application event log. Run eventvwr.msc, navigate to Windows Logs > Application. Filter for source .NET Runtime and Application Error. Capture the Faulting module name; Siemens.UserManagement.ServiceLayer.dll indicates trigger R1.
4. Inspect the SCADA site binding. In IIS Manager, expand Sites, right-click WinCC Unified SCADA, choose Edit Bindings. Confirm port and SSL certificate. An empty binding or missing certificate indicates trigger R2.
5. List registered HTTP modules. Open an elevated command prompt and execute:
   %windir%\System32\inetsrv\appcmd.exe list module
   Look for UserManagementServiceLayer and record whether its preCondition is empty or set to managedHandler.
6. Verify Windows features. Run Get-WindowsFeature -Name Web-Server, Web-Asp-Net45, Web-Http-Activation, Web-WebSockets, Web-Windows-Auth, Web-Mgmt-Console in PowerShell. Any Removed or Available entry signals trigger R4.
7. Reproduce the failure. Issue curl -v https://localhost/ (or use a browser in private mode) and capture the failing request's Server header and timing. A sub-second 503 confirms the worker process crash, not a downstream application error.

5. Resolution Method 1 — Uninstall the Stale UserManagementServiceLayer Module

This is the Siemens-recommended primary fix for trigger R1, originally issued by Siemens Technical Support and validated for V17 and V18 upgrades.

1. Open Notepad as Administrator.
2. Type the following commands on separate lines (do not let the editor auto-wrap):

@echo off
REM WinCC Unified V17/V18 HTTP 503 remediation
REM Removes the stale HTTP module that survives an upgrade.
%windir%\System32\inetsrv\appcmd.exe uninstall module UserManagementServiceLayer
REM Restart IIS to clear in-memory references
iisreset /restart
REM Bring both pools back online
%windir%\System32\inetsrv\appcmd.exe start apppool /apppool.name:"DefaultAppPool"
%windir%\System32\inetsrv\appcmd.exe start apppool /apppool.name:"WebRHPool"
echo Remediation complete. Re-test the web client.
pause

3. Save the file as WinCCUnified_Fix503.bat (ensure the file is not saved with a hidden .txt extension; verify with dir /x in the containing folder).
4. Right-click the file → Run as administrator.
5. Open an elevated command prompt first and run the batch from the command line so that any ERROR (message:Unknown module "UserManagementServiceLayer".) responses are visible. If the module name does not exist, the pool stop is caused by a different trigger (proceed to Method 2 or 3).
6. Verify that appcmd.exe responds with Successfully uninstalled module "UserManagementServiceLayer". and that iisreset reports Internet services successfully restarted.

6. Resolution Method 2 — Recreate and Re-import the Web Server Certificate

Trigger R2 is the most common cause when the Runtime PC has been renamed, joined to a domain, or migrated across hardware. The original self-signed certificate no longer matches the host identity and the WinCC Unified bootstrap aborts.

1. Close all IIS and WinCC Unified tools.
2. Open WinCC Unified Certificate Manager from the Windows Start menu (or %ProgramFiles%\Siemens\Automation\WinCCUnified\Bin\WinCCUnifiedCertMgr.exe).
3. Select the entry corresponding to the local PC runtime instance, then click Create new certificate.
4. Choose the certificate template WinCC Unified Web Server, set a validity of 5 years (default), and click Create.
5. Right-click the new certificate row and select Export to file; save the .pfx to the desktop (or a known secure location). Supply the password required by the export dialog.
6. Open SIMATIC Runtime Manager and select the WinCC Unified Runtime project; click Certificate → Import; browse to the exported .pfx and import.
7. Open WinCC Unified Configuration, select the project, navigate to Web Server > Certificate; select the freshly imported certificate and click Apply.
8. In IIS Manager, edit the bindings of the WinCC Unified SCADA site; assign the new certificate to the https binding on port 443. Restart the DefaultAppPool and WebRHPool.

7. Resolution Method 3 — Reconfigure the SCADA Site from IIS

If Methods 1 and 2 do not stop the pool crashes, the SCADA site definition itself is corrupt (trigger R3). The Siemens recommended procedure is to remove the site and let the WinCC Unified Configuration tool rebuild it.

1. Stop the Runtime service from SIMATIC Runtime Manager.
2. Open IIS Manager as Administrator. Right-click the site WinCC Unified SCADA → Remove. Confirm.
3. Delete the physical path directory if the installer does not clean it:
   rmdir /S /Q "%ProgramData%\Siemens\WinCCUnified\WebRH"
4. From the Start menu launch WinCC Unified Configuration. The Configuration tool detects the missing site and offers to recreate it; click Reconfigure site.
5. Enter the original port (default 443 for HTTPS, 80 for HTTP), the host name, and the certificate. Click Apply; the tool regenerates the WebRH folder, the application pool, and the HTTPS bindings.
6. Restart the Runtime from SIMATIC Runtime Manager.
7. Confirm both pools remain in the Started state for at least 60 seconds before testing the browser.

The detailed reconfiguration flow mirrors the steps documented for the SwacLogin: error during component creation troubleshooting path in the WinCC Unified V16 manual (still valid for V17+ SCADA site regeneration).

8. Resolution Method 4 — Manual Pool Start and Clean Reinstallation

If the pools stop again immediately after each manual start, the worker process is failing on initialization. Use this escalation path.

1. Manual pool start. In IIS Manager, select DefaultAppPool, click Start in the Actions pane. Repeat for WebRHPool. If they remain running for 60 seconds, proceed to Verification (§9). If they stop again, continue.
2. Disable Rapid-Fail Protection. Right-click the pool → Advanced Settings → Rapid-Fail Protection → set Enabled to False. This prevents IIS from disabling the pool after consecutive failures and gives time to capture the crash details.
3. Enable Failed Request Tracing. In IIS Manager, select the SCADA site → Failed Request Tracing → Enable. Set the trace directory to %SystemDrive%\inetpub\logs\FailedReqLogFiles.
4. Re-enable Windows features. From PowerShell:
   Install-WindowsFeature -Name Web-Server, Web-Asp-Net45, Web-Http-Activation, Web-WebSockets, Web-Windows-Auth, Web-Mgmt-Console -IncludeManagementTools
   Restart the server if the command reports Restart needed.
5. Uninstall and reinstall Runtime. Use Control Panel > Programs and Features; uninstall SIMATIC WinCC Unified Runtime V17 (or V18). Manually delete residual folders:
   %ProgramFiles%\Siemens\Automation\WinCCUnified
%ProgramData%\Siemens\WinCCUnified
   then reinstall from the original media, making sure to select Web Server and WinCC Unified Certificate Manager as install options.
6. After the reinstall, re-run Method 1 (the UserManagementServiceLayer removal) before transferring any projects.

9. Verification

After each remediation method, validate the fix using the following sequence. Stop the validation on the first failure and re-open the diagnostic procedure (§4).

1. Pool stability. In IIS Manager confirm DefaultAppPool and WebRHPool are both Started. Wait 60 seconds and confirm they have not transitioned to Stopped.
2. Local HTTP probe. From the Runtime PC, run:
   curl -k -v https://localhost/ --max-time 10
   A successful response returns HTTP 200 OK with an HTML body referencing Siemens.
3. Remote HTTP probe. From an engineering station on the same subnet, run the same command substituting the Runtime PC's hostname or IP. The certificate warning is expected for self-signed certificates; the 200 OK confirms the web layer.
4. SwacLogin. In the browser, navigate to https://<host>/. The WinCC Unified home page (SwacLogin) must load without browser console errors. According to the TIA Portal V20 documentation on the Web Client for RT Unified, a SwacLogin error during or immediately after project download indicates a different condition (RT still downloading) and does not imply HTTP 503.
5. Pool under load. Open five concurrent browser tabs to different WinCC Unified screens. The pool must remain Started for at least five minutes.
6. Event log scan. Confirm no new event IDs 2268, 2275, 5189 (IIS) or 1026 (.NET Runtime) have been logged in the last ten minutes.

10. Troubleshooting Matrix

11. Prevention and Best Practices

• Always uninstall the previous WinCC Unified Runtime before installing a newer version. Side-by-side installations of V16 and V17 Runtime on the same PC frequently leave orphaned UserManagementServiceLayer modules.
• Apply Method 1 (module uninstall) proactively after every major version upgrade, even if the pools appear healthy, to prevent the failure from surfacing mid-production.
• Maintain a single certificate per Runtime host. After any hostname change, domain change, or hardware migration, run Method 2 immediately.
• Lock the IIS Manager: production Runtime PCs should not allow operators to stop pools. Use Feature Delegation in IIS to deny Application Pool > Stop actions to non-administrators.
• Export the Runtime project backup before every TIA Portal upgrade. Use the Backup function inside SIMATIC Runtime Manager, not a file copy.
• Subscribe to Siemens ProductCERT notifications for SIMATIC WinCC Unified to receive early warning of new HTTP 503 variants in future versions.

12. Frequently Asked Questions