Resolving WinCC V6.2 Runtime Permission Check Failure on Windows

Problem Overview

When migrating a Siemens WinCC V6.2 project to a new Windows XP SP2 station (such as the Dell OptiPlex 3010 platform), operators may encounter a runtime fault in which:

• All area buttons display a question mark (?) instead of the configured graphics.
• No process alarms are updated in the Alarm Logging runtime.
• The driver diagnostics (Channel Diagnosis / Status) report that every connected PLC is healthy and the network send/receive is normal.
• The previous station prompted for a log-in/password at runtime; the new station does not prompt at all.

Network IP addressing, S7 / TCP channel state, and STEP 7 / WinCC component installation all check out as nominal, yet User Administrator rights for the WinCC project appear to be missing in the new OS image. The fault is not a driver, PLC, or cabling issue - it is an OS-level permission / registry assignment that the WinCC installer performs only when the user explicitly accepts the dialog.

Affected Environment

Root Cause: Missing WinCC OS Registry Entries

During the WinCC V6.2 installation the setup program detects the platform and prompts the operator with an OS Settings dialog titled "Apply project settings - WinCC V6.2". The dialog states that Windows Registry values, DCOM/COM security, DCOM port ranges, and User Rights (e.g., SeLockMemoryPrivilege, SeBatchLogonRight, Act as part of the operating system) must be granted to the logged-on administrator account so that the WinCC Message service, Alarm Logging, and Graphics Runtime can run unattended.

If the user clicks Skip, or installs WinCC from an account that does not have local administrator rights, the registry tree

HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\WinCC\RT

is left without the runtime-side permissions required for the new computer name. When the project is then copied in (via WinCC Explorer > Project > Copy) and renamed, the Graphics Runtime can resolve the picture names (\*.pdl) but the Authorization / User Administrator lookup fails for the current Windows user. The picture contains a placeholder field that is rendered as the ? glyph, and Alarm Logging returns an empty result set because no authorization context is available for the @100% default user.

Key missing registry / policy values:

Secondary Causes to Rule Out

1. Regional settings mismatch - if decimal separator, language for non-Unicode programs, and short-date format differ between the source station and the new XP SP2 station, Alarm Logging may fail to parse date/time stamps and silently suppress entries. Compare Control Panel > Regional and Language Options > Regional Options on both machines.
2. Missing WinCC User Administrator - the WinCC internal user database (UserAdmin) ships with an account named Administrator, password winccadmin. If the user logs in with a different Windows login, the runtime never receives an authorization token.
3. Computer name change without re-assignment - WinCC stores the computer name in the project file <Project>.pck under [Computers]. The copy procedure must be followed by Project > Properties > Computer > Rename so the runtime knows which computer is starting.
4. DCOM / COM security not relaxed - if the WinCC installer was launched with limited rights, the DCOM defaults for WinCC OPC Server, WinCC Channel Diagnosis, and WinCC Graphics Runtime are not configured.
5. Firewall blocking internal WinCC ports - although XP SP2 includes Windows Firewall, the WinCC installer normally adds an exception. Verify Control Panel > Windows Firewall > Exceptions.

Solution A - Apply OS Settings via WinCC Installer (Recommended)

This is the procedure that resolved the original fault:

1. Log in to Windows XP SP2 as a member of the Administrators group (local, not domain-restricted for first run).
2. Insert / mount the WinCC V6.2 installation media.
3. Launch Setup.exe from the root of the media (not from inside Programs).
4. Follow the wizard up to the OS Settings prompt. The dialog appears once and reads approximately: "WinCC requires modifications to the operating system (registry, DCOM, user rights). Do you want to apply these settings now?"
5. Click Yes. Do not click No, Skip, or close the dialog.
6. Allow the installer to register WinCC services and add firewall exceptions.
7. Reboot the station when prompted.
8. Re-open WinCC Explorer, load the copied project, and start runtime.

Solution B - Manual Registry / DCOM Repair

When the installer is no longer available or the project must be deployed silently, the same OS settings can be re-applied manually. Save the text below as wincc_os_fix.reg and merge it on the target station while logged in as Administrator.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\WinCC\RT]
"UserFullAccess"="BUILTIN\\Administrators"
"ProjectPath"="C:\\WinCC\\Project"

[HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\Automation\WinCC\RT]
"WinCCVersion"="6.2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"EnableDCOM"="Y"
"AuthenticationLevel"=dword:00000002
"LegacyAuthenticationLevel"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MachineAccessRestriction]
"DefaultLaunchPermission"=hex:01...
"DefaultAccessPermission"=hex:01...
"DefaultLaunchPermission"=...

Then re-grant WinCC services local user rights via secpol.msc:

• Log on as batch job - add NT AUTHORITY\SYSTEM and the local WinCC operator account.
• Log on as service - add the account that runs CCAgent.exe, CCAlarmServer.exe, CCAlg.exe.
• Adjust memory quotas for a process - required for large tag archives.

Finally, re-register the WinCC DCOM components:

cd %ProgramFiles%\Siemens\Automation\WinCC\bin
regsvr32.exe "<WinCC>.ChannelDiagnosisServer.exe"
regsvr32.exe "CCAlg.exe"
regsvr32.exe "CCArchive.exe"
regsvr32.exe "CCReporter.exe"

Solution C - Replicate the Source Station's Regional Settings

1. On the original (working) station, open Control Panel > Regional and Language Options.
2. Note every value on the Regional Options, Languages, and Advanced tabs.
3. On the target XP SP2 station, apply the same settings exactly.
4. Pay particular attention to:
   • Decimal symbol (. vs ,)
   • List separator (; vs ,)
   • Short-date format (yyyy-MM-dd is preferred for WinCC archive imports)
   • Language for non-Unicode programs (must match the WinCC language pack)
5. Reboot the station.

Solution D - Confirm WinCC Project Authorization

1. Open WinCC Explorer on the new station.
2. Open the User Administrator editor (right-click > Open).
3. Confirm that the built-in user Administrator exists, with group @100% (full authorization).
4. If missing, create the user manually and assign the @100% group.
5. Verify the authorization for the runtime computer: select Authorizations > Tag Logging, Alarms, Picture Change, and ensure the runtime's computer name is in the Selection column.

Verification Procedure

After applying the corrective actions above, run through this checklist:

1. Start WinCC Runtime from WinCC Explorer (Ctrl+R).
2. The log-in dialog must appear at startup. Default credentials: Administrator / winccadmin.
3. Click any area button. The picture must load the configured PDL file, not display a ?.
4. Trigger an alarm from the PLC. Confirm that the Alarm Logging window updates within 1-2 seconds and the entry has a timestamp matching the WinCC station clock.
5. Open WinCC Explorer > Tools > Channel Diagnosis. Every configured channel should show OK / Connect.
6. Open Start > Programs > Siemens Automation > WinCC > Diagnosis and confirm zero red entries.
7. Reboot the station. WinCC runtime should start automatically via the configured autostart entry in AutoStartRT.ini.

Diagnostic Commands

Preventive Checklist for New WinCC V6.2 Stations

1. Always install WinCC while logged in as the dedicated WinCCOperator administrator account that will run the runtime.
2. Accept the Apply OS settings dialog without exception.
3. Install the latest hotfix pack (HF14 minimum, HF17 recommended where licensing permits) before copying any project.
4. Use WinCC Explorer > Project Duplicator or Project Migrator rather than file-system copies where possible - this re-assigns computer names correctly.
5. Image the configured station once runtime is validated and store the image under version control.
6. Document the regional settings on the master image; ship the configuration to every new deploy.
7. Disable Simple File Sharing on Windows XP SP2 to allow explicit per-user NTFS rights on C:\WinCC\<Project>.

Related Issues That Mask the Same Symptom

Standards and Documentation References

The WinCC V6.2 installation manual contains the OS settings checklist in chapter "Installation Notes - Operating System Settings". Operators should consult the official Siemens SIMATIC WinCC V6.2 documentation set and the WinCC V6.2 Update / Hotfix readme for the exact HF-level required by their license. The Siemens Industry Online Support portal (entry ID 21537592 - WinCC V6.2 installation manual) lists the precise registry values and DCOM adjustments documented above.

Microsoft baseline settings for Windows XP SP2 deployment, including DCOM and firewall defaults that interact with WinCC runtime services, are documented in the Windows XP Service Pack 2 Security Guide and Microsoft Knowledge Base article KB842242. Although Windows XP has reached end of life, isolated WinCC V6.2 runtime stations remain common in brownfield plants and continue to be supported per the Siemens WinCC V6.2 product lifecycle notice (see Siemens Support entry 109750459).

FAQ