Resolving WinCC V7 SQL Server Access Rights Error on New

Resolving "The SQL server cannot access database. Please Check access rights." in WinCC V7.0 SP3

The error "The SQL server cannot access database. Please Check access rights." is reported by WinCC Explorer at project open or new project creation time on a freshly installed WinCC V7.0 SP3 system. The dialog blocks opening of the WinCC project, even though the installer completed successfully and the project directory exists. The fault is not a corrupt installation by default: the dominant root causes on a new install are missing SQL Server instance permissions, the SQL Server (WINCC) service not running, the SIMATIC HMI user group membership, the project's .dcf configuration cache, or a domain/workgroup mismatch between the Windows logon and how WinCC registers the SQL Server instance. This reference walks through each layer with verification steps.

1. Problem Statement and Observed Symptoms

Reported environment: WinCC V7.0 SP3, SIMATIC Net V8.1 SP1, Windows 7 Professional 64-bit SP1. The user attempted to launch WinCC Explorer as an administrator and was blocked by the SQL access error on the very first start. A complete reinstall of WinCC did not clear the condition.

Symptom matrix:

2. Root Cause Analysis

WinCC V7 stores every project (including the alarm logging, tag logging, and user administrator databases) inside Microsoft SQL Server. WinCC uses its own named SQL Server instance called WINCC, which is installed side-by-side with whatever default SQL Server may exist on the workstation. When WinCC Explorer attempts to attach the project database, it connects to WINCC using the credentials of the logged-on Windows user, mapped against the SQL logins created during install.

The error "The SQL server cannot access database. Please Check access rights." fires when one of the following layers denies that connection:

1. The SQL Server (WINCC) Windows service is not started, has been disabled, or its startup account was changed.
2. The logged-on Windows user is not a member of the SIMATIC HMI local group, which WinCC installer provisions specifically for SQL access.
3. The project folder's NTFS permissions do not grant SIMATIC HMI full control, blocking the SQL data and log file (.mdf, .ldf) from being opened.
4. The machine is joined to a Windows domain and the SQL Server instance was registered under the local system account rather than a domain account, so the domain user has no SQL login.
5. The .dcf (Data Configuration File) of the project is corrupt or out of sync with the SQL database; WinCC treats the project as inaccessible.

Siemens documents the related ES-OS download behavior in the official WinCC FAQ at Siemens Support Entry 59216666, which enumerates the same user-rights, folder-share, and SQL-connection prerequisites that apply to a new local install.

3. Prerequisites Before Troubleshooting

Verify the following before touching services or permissions:

• WinCC V7.0 SP3 installed with administrator credentials (WinCC setup must be run elevated).
• SIMATIC Net V8.1 SP1 installed and licensed if industrial Ethernet or named connections are used by the project.
• Logged-on user is a member of the local Administrators group on the engineering station.
• SQL Server 2005/2008 instance WINCC was installed by WinCC setup and is visible under SQL Server Configuration Manager.
• Microsoft SQL Server Management Studio (SSMS) matching the WinCC SQL generation is available — WinCC V7.0 SP3 installs SQL Server 2008 R2 Express SP1 by default. If SSMS is missing, the WinCC setup disk under \InstData\SQL2008\...\Tools\Setup can add it.

4. Step-by-Step Resolution

4.1 Confirm the SQL Server (WINCC) Service Is Running

1. Press Win + R, type services.msc, press Enter.
2. Locate SQL Server (WINCC). Verify:
   • Status: Running.
   • Startup Type: Automatic (not Disabled, not Manual).
   • Log On As: Local System or NT AUTHORITY\SYSTEM.
3. If the service is stopped, right-click → Start. If startup fails, note the Windows Event Viewer error ID (commonly 7000, 7034, 1069) and continue to 4.2.

4.2 Validate SQL Connectivity With Management Studio

1. Launch SQL Server Management Studio from the Start menu.
2. In Server name, type WINCC or .\WINCC (period-backslash-WINCC is the local named instance shortcut).
3. Authentication: Windows Authentication.
4. Click Connect. If the connection succeeds, SQL itself is healthy and the WinCC-side issue is project- or rights-related. If it fails with error 233, -1, or 26, jump to the network protocols section below.

4.3 Enable SQL Server Protocols

WinCC requires named pipes and TCP/IP on the WINCC instance.

1. Open SQL Server Configuration Manager (Start → Programs → Microsoft SQL Server 2008 → Configuration Tools).
2. Expand SQL Server Network Configuration, select Protocols for WINCC.
3. Right-click Named Pipes → Enable. Right-click TCP/IP → Enable.
4. Right-click SQL Server (WINCC) service in SQL Server Services → Restart.
5. Retry the Management Studio connection.

4.4 Run the SIMATIC Rights Tool

The SIMATIC Rights utility (often labelled SimaticRights.exe on the WinCC DVD or already installed under C:\Program Files\Siemens\Automation\WinCC\bin\) applies the canonical rights profile to the local machine.

1. Insert the WinCC V7.0 SP3 DVD or mount the ISO. Locate the SimaticRights directory under \InstData\... or run it from the local bin folder.
2. Start SimaticRights.exe as administrator.
3. Select the project path or simply let the tool scan C:\Program Files\Siemens\Automation\WinCC\Projects.
4. Click Apply Rights. The tool grants:
   • Full control to SIMATIC HMI on the project directory.
   • Full control to Administrators.
   • SQL Server login provisioning on the WINCC instance for members of SIMATIC HMI.
5. Restart SQL Server (WINCC) and the WinCC Explorer.

4.5 Add the User to SIMATIC HMI Manually

If the SIMATIC Rights tool is not present, apply the same grants by hand:

1. Right-click Computer → Manage → Local Users and Groups → Groups.
2. Open SIMATIC HMI. If the group does not exist, the WinCC setup was incomplete — re-run setup with the Configure option and enable SIMATIC HMI user group creation.
3. Click Add, type the current Windows logon name (e.g., DOMAIN\ftems), confirm.
4. On the project folder (C:\Program Files\Siemens\Automation\WinCC\Projects\<ProjectName>): right-click → Properties → Security → Edit → Add. Add SIMATIC HMI with Full Control. Tick Replace all child object permissions.
5. If the project is on a network share, share the folder and grant SIMATIC HMI Change + Read. Set NTFS as above.

4.6 Confirm Domain vs Workgroup Configuration

WinCC V7 supports both workgroup and domain workstations, but the SQL Server WINCC instance must be told which. Open Computer Properties and check Domain or Workgroup:

• Workgroup: confirm the local account used to log on is a member of SIMATIC HMI. SQL logins will be resolved as MACHINE\Username.
• Domain: the SQL Server (WINCC) service must run with an account that can enumerate domain principals, or — the more common approach on WinCC V7 — the logged-on domain user must be added explicitly to SQL Server Security under WINCC\Security\Logins with the sysadmin server role on the WinCC instance.

4.7 Clear the .dcf File

For situations where the error appears on one specific project (typically a PCS 7 project opened in WinCC Explorer):

1. Close WinCC Explorer.
2. Open the project directory.
3. Locate the file <ProjectName>.dcf.
4. Rename to <ProjectName>.dcf.bak or delete it.
5. Reopen the project in WinCC Explorer. The configuration tool regenerates the .dcf against the SQL database.

4.8 PCS 7 Multi-Project Adjustments

If the failing project is a PCS 7 master or subordinate opened in the WinCC Explorer, the configuration database referenced by the master project stores the path to each subordinate. When that path or the subordinate's database name does not match the actual SQL Server content, WinCC reports the SQL access error at open. Repair:

1. Open WinCC Explorer on the master project; close without opening the subordinate.
2. Use SIMATIC Manager → Options → PCS 7 → Master Data Library tools, or edit the master project XML configuration to align subordinate paths.
3. Open the subordinate project independently in WinCC Explorer to validate its own SQL connectivity.
4. Re-link from the master.

5. Verification Procedure

After applying the corrective steps, validate end-to-end:

1. Log off and back on with the affected user so the new group memberships propagate.
2. Open SQL Server Management Studio and connect to .\WINCC with Windows Authentication.
3. Expand Databases; the WinCC runtime databases CC_<ProjectName>_ALG_<R>, CC_<ProjectName>_TLG_<R>, and user administrator database should appear with the logged-on user listed under Security → Logins.
4. Launch WinCC Explorer. The SQL access dialog must not appear. The project tree should populate within 5–15 seconds.
5. Activate the project. Runtime must reach the Activated state without re-prompting for SQL credentials.
6. Open User Administrator inside the project; existing operator logons should load without SQL errors.

Expected verification timings on Windows 7 SP1, 64-bit, with SQL Server 2008 R2 Express:

6. Field-Proven Diagnostic Matrix

7. Common Pitfalls on New Installations

• UAC silently stripping the SQL connection. On Windows 7 SP1, if WinCC Explorer is launched without Run as administrator from a non-elevated session, the SQL connection fails even though the user is in SIMATIC HMI. Always launch WinCC Explorer elevated on a new install until UAC behavior is verified.
• Antivirus blocking named pipes on WINCC. Endpoint security suites can quarantine sqlservr.exe or block \.\pipe\sql\query. Whitelist the SQL Server binary and the WinCC installation tree.
• SQL Server 2008 R2 Express instance already installed for another application. If a prior SQL Server installation already binds port 1433 or named pipes, the WinCC setup creates a different named instance but the conflicting instance can still interfere with SQL Browser service resolution.
• Folder redirection of Documents into a network share. When the user's profile path is redirected, the WinCC project path under the user profile becomes inaccessible to the SQL service account. Use only C:\Program Files\Siemens\Automation\WinCC\Projects\ on the local disk.
• Reinstall without uninstall. Running setup again without first using Control Panel → Programs and Features → Uninstall leaves the old WINCC SQL instance attached but unregistered, producing fresh access errors.

8. Safe Repair Procedure for a Bricked SQL Instance

If none of the above resolves the error and SSMS cannot connect to .\WINCC:

1. Stop SQL Server (WINCC) from services.msc.
2. From Programs and Features, uninstall Microsoft SQL Server 2008 R2 (WINCC). This removes only the named instance; the system databases are rebuilt on next WinCC setup.
3. Insert the WinCC V7.0 SP3 DVD. Run Setup → Configure → tick Microsoft SQL Server 2008 R2 + SIMATIC HMI user group.
4. After setup completes, reboot. The WINCC named instance returns with default credentials and the SIMATIC HMI group is created.
5. Re-run SimaticRights.exe on each existing project.
6. Open WinCC Explorer and test against a brand-new test project before opening the original.

9. Interaction With SIMATIC Net V8.1 SP1

SIMATIC Net V8.1 SP1 adds its own SQL footprint and S7DOS services. On a new installation where SIMATIC Net is installed after WinCC, the SIMATIC Net setup can reassign permissions on SIMATIC HMI to favor its own components and strip the SQL Server logins for WinCC users. If the error appears immediately after SIMATIC Net installation:

1. Open SQL Server Configuration Manager and verify the WINCC instance is still listed under SQL Server Services.
2. Run SimaticRights.exe from the WinCC DVD; this reasserts WinCC SQL logins.
3. Restart SQL Server (WINCC) and S7DOS in that order.

The official Siemens WinCC V7 installation manual recommends installing SIMATIC Net before WinCC to avoid this conflict.

10. Related Siemens Documentation

• Siemens Support Entry 59216666 — ES-OS Download FAQ
• Siemens Support Entry 109751596 — WinCC V7 Installation Notes
• Siemens Support Entry 109751603 — WinCC V7 Commissioning Manual
• Microsoft Learn — SQL Server 2008 R2 Components Reference

11. FAQ