Resolving WinCC V7 Project Open Errors After OS Reinstallation

Problem Description

Engineers who rebuild their engineering station and then attempt to open a pre-existing SIMATIC WinCC V7 project frequently encounter the following dialog immediately after WinCC Explorer launches:

The message originates from the WinCC User Administrator / Authorization Check layer. When the project was originally an integrated PC Station inside a STEP 7 project, the failure reproduces on a freshly installed OS even though the same engineer account is a local Administrator and a member of SIMATIC HMI. The identical error appears inside SIMATIC Logon when the user attempts to sign in, and the Project Duplicator may fail separately with "Project cannot be copied to local disk". Projects that were created as standalone WinCC projects after the new OS install are unaffected. That narrows the cause to the STEP 7 / SIMATIC Manager integration layer rather than to base WinCC permissions.

Affected Versions and Environment

Refer to the SIMATIC WinCC V7.0 system manual for the supported OS matrix and prerequisites: SIMATIC WinCC V7.0 - System Manual.

Root Cause Analysis

An integrated WinCC project does not live as a free-standing project directory only. At integration time, the SIMATIC Manager (STEP 7) writes configuration references both into the STEP 7 project database and into the Windows registry so that:

1. The PC Station name, the WinCC project name, and the S7 connection configuration are tied together.
2. The WinCC OS becomes addressable from the SIMATIC Manager right-click menu Open HW Config and Open OS.
3. The WinCC runtime discovers its partner PLC and OPC configuration from the STEP 7 PC Station descriptor embedded in the S7 project.

When the operating system is reinstalled, the following resources are lost even when WinCC itself is reinstalled onto the same partition and the same Windows username is reused:

• The local user group SIMATIC HMI is rebuilt by the WinCC setup, but its members are not migrated from the old OS.
• The local user group SCRIPT and any custom SIMATIC groups (for example SIMATIC NET, CCALMUser) must be recreated.
• The registry branch HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\AUTSW and the project-link subkeys under HKLM\SOFTWARE\Siemens\WinCC\RTOnly are reset and no longer match the on-disk project's signature.
• The WinCC Computer Name bindings stored inside the TagLogging RT database and the AlarmLogging event database reference the OS hostname of the previous install.
• The Compartment Rights File held under [ProjectFolder]\GraCS or [ProjectFolder]\Library holds an ACL that references the previous machine SID. The current user SID is no longer matched, so WinCC's user-rights check fires.

The visible dialog is a user rights message, but the underlying source is an integrity mismatch between the on-disk project and the rebuilt Windows security / registry world. WinCC opens only after the project has been re-bound to that rebuilt world.

Prerequisites and Tooling

Confirm the following before applying the resolution below. Any missing item will reproduce the error or trigger a follow-on fault during the recovery.

1. Local Administrator account on the engineering station. Verify with net localgroup Administrators | find /i "%username%".
2. The local groups SIMATIC HMI and SCRIPT exist. Verify with net localgroup "SIMATIC HMI". Recreate if missing either from the WinCC setup task Configure WinCC Users or with net localgroup "SIMATIC HMI" /add.
3. The engineering account is a member of SIMATIC HMI: net localgroup "SIMATIC HMI" %username% /add.
4. STEP 7 (same major version as the original) is reinstalled. WinCC alone does not restore the SIMATIC Manager / PC Station integration layer.
5. SIMATIC NET is installed if the project uses S7 or OPC channels. See SIMATIC NET Installation Manual.
6. SIMATIC Logon is installed if the project uses Logon roles.
7. The WinCC project folder is intact at the original path (for example D:\WinCCProjects\Plant_OS).
8. The WinCC license keys are re-transferred. License keys are bound to the host SID and are not preserved across OS reinstall. Use Automation License Manager > Move License to reassign them.
9. The Windows Firewall service is set to Automatic even if a corporate firewall is in front of the machine. Disable the service only after SIMATIC Security Control > Make Settings has completed.

Resolution Path A - Open the Integrated OS from SIMATIC Manager (Primary Fix)

This is the recovery path that resolves the symptom in the widest number of reported cases and is the recommended route for any integrated WinCC OS.

1. Launch SIMATIC Manager from Start > SIMATIC > SIMATIC Manager.
2. Open the STEP 7 project that contains the WinCC PC Station.
3. In the project tree, expand the SIMATIC PC Station branch and select the WinCC OS object.
4. Right-click and select Open Object. The first opening triggers WinCC to write the missing integration entries into the new registry, re-bind the ACL files to the new SID, and rebind the computer name inside TagLogging / AlarmLogging to the new OS hostname.
5. Confirm the project opens. Close SIMATIC Manager.
6. Re-launch WinCC Explorer directly. The project must now open with no user-rights dialog and no Logon pop-up.

Variants of the menu item that achieve the same effect:

• Right-click PC Station > Open WinCC Explorer.
• Project tree > right-click OS > Open OS.
• PCS 7 V7/V8: master data library > Open OS in WinCC Explorer.

This same flow applies to PCS 7 V7 / V8 where the OS is the engineering object inside the master SIMATIC project.

Resolution Path B - Repair User Group Membership (Stand-Alone Projects)

If the project is not integrated (open it from File > Open > Open Project in WinCC Explorer) but the rights error still fires, the cause is local Windows group membership or DCOM. Apply the corrections below in order.

1. Open Computer Management > System Tools > Local Users and Groups > Groups.
2. Add the engineering account to SIMATIC HMI and, if the project uses C / VB scripting, to SCRIPT.
3. Confirm SIMATIC HMI retains the default rights. The list of expected rights and the canonical WinCC user/role administration flow are described in the SIMATIC WinCC V7 Configuration Manual section User Administration at SIMATIC WinCC V7 - Configuration Manual: User Groups.
4. Open SIMATIC Security Control (Start > SIMATIC > SIMATIC Security Control) and click Make Settings. This rewrites DCOM endpoint ACLs, COM security descriptors, and firewall rules needed by WinCC.
5. If the Windows Firewall service was disabled, enable it, then run Make Settings again. WinCC uses DCOM endpoints added to the firewall ruleset only by Security Control. Disabling the firewall service silently skips the rule creation, which surfaces as a rights error and as Logon failures.
6. Log off / on (or restart) and retry the project open.

Resolution Path C - Re-Import the OS via "Import OS Station"

When the SIMATIC Manager project is missing, corrupted, or only the WinCC side is recoverable, an alternative is to import the OS into a fresh STEP 7 shell project.

1. Create a new STEP 7 project at the same path the original project used (for example D:\STEP7\MyPlant).
2. Select Options > OS > Import OS Station from SIMATIC Manager.
3. Browse to D:\WinCCProjects\Plant_OS and select the project file. SIMATIC Manager reconstructs the PC Station and stores the binding in the new STEP 7 project.
4. Open the OS once from SIMATIC Manager using Resolution A to finalize the binding.

Import OS Station is also the preferred cross-machine migration tool because it avoids the Project Duplicator failure mode entirely.

SIMATIC Security Control and DCOM Configuration

SIMATIC Security Control writes the ACLs that WinCC, SIMATIC Logon, and the runtime services expect on the local DCOM endpoints and on the COM applications. Each Make Settings pass:

• Re-applies the launch and access permissions on CCAlgRtServer.exe, CCTextServer.exe, and CCRtsServer.exe.
• Refreshes the firewall rules for the same executables and for WINCC_ComputerName RPC ports.
• Updates the local group memberships for the services' logon accounts in SIMATIC HMI.

When Make Settings is run while the Windows Firewall service is stopped or disabled, the firewall rule block is silently skipped. The next runtime start fails with RPC server unavailable or with the user-rights dialog. The corrective sequence is therefore:

1. sc config MpsSvc start= auto && sc start MpsSvc
2. Re-run SIMATIC Security Control > Make Settings.
3. Restart the machine and re-open the WinCC project.

SIMATIC Logon Error Resolution

The Logon error uses the same wording because WinCC and SIMATIC Logon share the same DCOM security check configured by SIMATIC Security Control.

1. Confirm SIMATIC Logon Service is running: sc query "SimaticLogon".
2. Confirm the service logon account is in SIMATIC HMI and has the Log on as a service right: secpol.msc > Local Policies > User Rights Assignment > Log on as a service.
3. If Logon still shows the rights dialog, repeat SIMATIC Security Control > Make Settings with the firewall service running.
4. Restart the Logon service: net stop "SimaticLogon" & net start "SimaticLogon".
5. If logging uses Active Directory groups, verify the WinCC project User Administrator still imports the same groups: User Administrator > Group > Add > Import from Windows.

Project Duplicator "Project Cannot Be Copied" Resolution

Project Duplicator (Start > SIMATIC > WinCC > Project Duplicator) fails separately with "Project cannot be copied to local disk". The cause is typically not ACL but filesystem / AV interference.

1. Open WinCC Explorer > Project > Duplicator; do not launch the stand-alone tool from outside WinCC.
2. Disable any anti-virus on-demand scanner, write-filter (LMS, TDS, UWF), or backup agent on the project folder before duplicating.
3. Choose a destination on the same partition as the source for the first verification. Cross-partition copies occasionally fail on FAT-to-NTFS transitions or on ReFS paths.
4. If the project includes TagLogging / AlarmLogging archives, expect Project Duplicator to rewrite the computer name field. Always review the CC_AlgRtDatabase.rtdb archive configuration after duplication.
5. For migrations across machines, prefer Options > OS > Import OS Station in SIMATIC Manager; it sidesteps the duplicator entirely.

Registry and ACL Deep Dive

The WinCC project integration state lives in three places; corrupted state in any one of them triggers the user-rights dialog.

Manual registry edits should be the last resort. Always export the original branch before any edit: reg export "HKLM\SOFTWARE\Siemens\WinCC" C:\WinCC-backup.reg.

Hostname Migration in TagLogging and AlarmLogging

If the new OS hostname differs from the original, WinCC will record the new hostname in TagLogging / AlarmLogging only on the first open through SIMATIC Manager. Verify the rebinding succeeded:

1. Activate runtime briefly and inspect <ProjectFolder>\Diagnostics\TagLogging.log for warnings like Computer name mismatch.
2. Open Tag Logging > Archive > Properties > Computer Name. Confirm it equals the current host.
3. Open Alarm Logging > Archive > Properties > Computer Name. Confirm the same value.
4. From WinCC Channel Diagnosis, exercise the S7 / OPC channel. A connected state confirms the PC Station descriptor is correctly written.

Backup Strategy Before OS Reinstall

This entire failure class is avoidable by capturing project state before re-imaging.

1. Close all projects in SIMATIC Manager and WinCC Explorer before re-imaging the partition.
2. Run Project Duplicator to a network share to capture a consistent copy. Duplicator atomically closes the runtime databases, so the copy is consistent.
3. Export the WinCC user administration from WinCC Explorer > User Administrator > Export. The export contains role assignments and password hashes that are not recoverable from a raw file copy.
4. Export the STEP 7 program sources (Options > Manage Station > Export) to a network share.
5. Back up the Automation License Manager keys via ALM > Move License to USB or to a license server.
6. Photograph the Windows user list (Computer Management > Groups > SIMATIC HMI) so the new build matches exactly.

Verification Checklist

After applying any of the resolutions above, run the following end-to-end verifications. Each item must pass before sign-off.

FAQ