Resolving WinCC Unified WCCILScsService ODBC Connection Failures to Remote Databases

When a WinCC Unified PC Runtime project attempts to read or write a relational database (SQL Server, SQLite, MySQL) on a remote workstation, the connection almost always fails because the script runtime executes under a hidden, non-interactive system account named NT SERVICE\WCCILScsService. This account is invisible in the standard Windows login dialog, has no profile path, and is unknown to most ODBC data sources, SQL Server logins, or NTFS share permissions. The result is a generic ODBC error string that obscures the real permission problem. This reference documents the exact error signatures, the required security group memberships, and the proven remediation steps verified on TIA Portal V18 Update 3 and V19 Update 1.

1. Problem Summary and Symptoms

A WinCC Unified PC Runtime V18/V19 project executes a JavaScript VBScript-equivalent or C# script that opens an ADO/ODBC connection to a database that is not local to the Runtime PC. The connection is attempted using one of three paths:

1. An absolute UNC path or IP address embedded in the connection string.
2. A system or file DSN that references the remote database.
3. A mapped network drive that points at a UNC share on the remote database host.

All three paths fail with the same ODBC driver manager error captured in the WinCC Unified trace viewer and in ScriptContext: HMI_RT_1::<screen_name> log entries. When the target is SQL Server, a secondary error is returned from the server side identifying the offending principal as NT SERVICE\WCCILScsService.

2. Environment and Tested Versions

3. Exact Error Strings Captured

The trace buffer in the WinCC Unified diagnostics view returns the following ODBC state and message. The literal text must be used when searching Siemens KB and Microsoft ODBC documentation.

Generic ODBC failure (any driver, any remote target):

Message: "connect failed [Microsoft][ODBC Driver Manager] Driver's SQLSetConnectAttr failed
         [Microsoft][ODBC Driver Manager] The driver doesn't support the version of ODBC
         behavior that the application requested (see SQLSetEnvAttr)."
State : "0100"

SQL Server specific failure (ODBC Driver 18 for SQL Server):

session  : 0002
trace    : Trace(): Errors
Message  : [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Login failed for user
           'NT SERVICE\WCCILScsService'.
           [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Cannot open database
           "xxxxxxDB" requested by the login. The login failed.
ScriptContext: HMI_RT_1::04_Settings
Module   : /screen_modules/HMI_RT_1::04_Settings/Events.js
Function : Button_2_OnUp (callback)

4. Root Cause: Who Runs the Script?

The WinCC Unified PC Runtime service hosts all HMI scripts inside a managed script runtime. This runtime is launched by the SIMATIC WinCC Unified SCADA Service and runs every event handler, scheduled task, and tag-triggered function under the virtual service account NT SERVICE\WCCILScsService. Unlike LocalSystem, this principal cannot authenticate across the network with default NTLM credentials because it has no machine-bound password that a domain controller will accept and it does not have a roaming profile path.

Confirmed security group memberships for WCCILScsService on a standard installation:

• PlcSimUsers
• RTIL Tracing Users
• SIMATIC HMI
• umcd_domain_manager
• umcd_dsso
• umcd_um
• UM_CONFIG

None of these groups provide outbound network identity or database privileges. The user is intentionally hidden from the Windows login screen (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList sets its DWORD value to 0) so an interactive session cannot be launched with this principal.

5. Why All Three Connection Methods Fail Identically

The proof point is that SQLiteStudio running under the engineer's interactive Windows account can read and modify the same remote database without error. The failure is purely an identity / session-isolation problem, not an ODBC driver or firewall problem.

6. Solution A: Grant the Remote Resource Access to WCCILScsService

The simplest and most maintainable solution is to grant the script runtime's identity explicit permission on the target system. Three sub-tasks are required.

6.1 Locate WCCILScsService on the Runtime PC

1. Open compmgmt.msc (Computer Management) on the WinCC Unified PC Runtime host.
2. Navigate to System Tools → Local Users and Groups → Users.
3. Enable View → Hidden Users from the menu bar. WCCILScsService appears with a downward arrow icon.
4. Double-click to confirm the full name: NT SERVICE\WCCILScsService.

6.2 NTFS Share Permissions on the Database Host

1. On the remote PC that hosts the database, create or identify the share (for example \\REMOTEPC\Data$).
2. Open Computer Management → System Tools → Shared Folders → Shares on the database host.
3. Edit the share's permissions and add the principal exactly as REMOTEPC\WCCILScsService if workgroup, or as DOMAIN\WCCILScsService if domain joined. Grant Read (read-only access) or Change (read/write) per project needs.
4. Also edit the NTFS permissions on the underlying folder and add the same principal with at least Read & Execute and List folder contents.

6.3 SQL Server Login Mapping

For SQL Server targets the SQL error Login failed for user 'NT SERVICE\WCCILScsService' must be resolved by creating a server login and mapping it to a database user.

1. Open SQL Server Management Studio on the SQL Server host and connect with a sysadmin account.
2. Security → Logins → New Login:

Login name       : [DOMAIN\RuntimePC$]   -- if domain joined, use the Runtime PC machine account
                  : [NT SERVICE\WCCILScsService]   -- only valid on the local machine
Authentication   : Windows authentication
Default database : xxxxxxDB

3. On the User Mapping page tick xxxxxxDB, set the default schema to dbo, and grant db_datareader and db_datawriter for full read/write.
4. Click OK. The connection string that worked in the field is:

Driver={ODBC Driver 18 for SQL Server};
Server=tcp:SQLSERVERHOST,1433;
Database=xxxxxxDB;
Trusted_Connection=Yes;
Encrypt=Yes;
TrustServerCertificate=Yes;

5. If the Runtime PC and SQL Server are not domain joined, replace step 2 with a SQL Server authentication login, embed the credentials in the connection string (UID=...;PWD=...), and store the connection string in a secured WinCC Unified tag or external file referenced by the script.

7. Solution B: Run the Script Under a Different Identity

If Solution A cannot be applied (locked-down plant network, vendor restrictions on service accounts), change the identity under which the script runtime executes.

1. Open services.msc on the Runtime PC.
2. Locate SIMATIC WinCC Unified SCADA Service (service name WCCILScsService) and SIMATIC WinCC Unified Runtime Service.
3. Stop both services.
4. Open the Log On tab and select This account. Provide a domain user (for example DOMAIN\svc_wincc_unified) that has known password, interactive logon disabled, and the required share / SQL permissions.
5. Restart both services and confirm scripts now execute under the new identity.

8. Solution C: Local Caching with a Polling Service

For environments where neither permissioning the remote system nor changing the service identity is acceptable, decouple the database hop from the script runtime by using a small Windows service or scheduled task that runs under an interactive domain account and writes a local SQLite snapshot. The WinCC Unified script then reads C:\ProgramData\Siemens\Automation\WinCCUnified\cache.db, a fully local file that the script runtime can open without any network identity.

1. Create a dedicated service account DOMAIN\svc_wincc_dbpoller.
2. Deploy a .NET 8 Worker Service that connects to the remote SQL Server every N seconds and writes a compact SQLite file to the Runtime PC.
3. Grant the poller service account Modify on the cache folder; the WinCC Unified script only needs read access.
4. From the HMI script, open the SQLite file with connectionString = "Data Source=C:\\ProgramData\\Siemens\\Automation\\WinCCUnified\\cache.db;Version=3;". This works without any ODBC configuration and avoids the WCCILScsService network problem entirely.

9. Verification Procedure

1. Open the WinCC Unified project in TIA Portal, compile, and download to the Runtime PC.
2. Start the runtime and trigger the script that opens the database.
3. Open the WinCC Unified Diagnostics → Trace Viewer and filter for HMI_RT_1.
4. Confirm absence of SQLSetConnectAttr failed and Login failed for user 'NT SERVICE\WCCILScsService'.
5. From the Runtime PC, run sqlcmd -S SQLSERVERHOST -E -Q "SELECT SUSER_NAME(), DB_NAME()" under the configured identity (use psexec -s -i cmd for the service session). It must return a row, not an error.
6. Open the HMI screen with the script's button. The button event handler must complete without raising a trace error and the bound tag must display the queried value.

10. Common Pitfalls and Field Notes

• Mapped drives are invisible to services. A drive mapped in the engineer's interactive session does not exist in the service session that runs scripts. Always use UNC paths in connection strings.
• SQL Server browser and dynamic ports. When SQL Server uses a non-default port, the ODBC driver requires Server=tcp:host,port. Omitting the comma-separated port produces a silent timeout that is sometimes misreported as the 01000 state error.
• ODBC Driver 18 forces encryption. Encrypt=Yes is the default. If the SQL Server certificate is self-signed, add TrustServerCertificate=Yes or install a trusted CA cert on the Runtime PC.
• SQLite file locking over SMB. SQLite is not designed for concurrent writers over a network share. Use Mode=ReadOnly in the connection string and design the writer to be a single local process.
• TCP/IP Auto for PG/PC interface. Per the Siemens WinCC Unified notes on use, the PG/PC interface setting TCP/IP Auto must not be used when connecting to a remote database. Select a fixed TCP/IP entry that matches the Runtime PC's network adapter to avoid the driver manager losing the route after a Windows network change.
• Antivirus exclusions. Real-time AV scanning on the WCCILScsService file reads from \\REMOTEPC\<share> can stall the connection long enough to trigger ODBC timeout. Exclude the database file extension and share path on both endpoints.

11. Quick Reference Checklist

• [ ] Confirm Runtime PC and database host are domain joined or share a compatible local account model.
• [ ] Grant NT SERVICE\WCCILScsService (or the configured domain account) NTFS + share permissions.
• [ ] Create SQL Server login for the same principal; map to db_datareader / db_datawriter.
• [ ] Set PG/PC interface to a fixed TCP/IP, not TCP/IP Auto.
• [ ] Use UNC paths; never rely on mapped drives from interactive sessions.
• [ ] Add Encrypt=Yes;TrustServerCertificate=Yes; when using ODBC Driver 18 for SQL Server against self-signed certs.
• [ ] Verify with the trace viewer and a direct sqlcmd run under the service identity.

FAQ