Resolving WinCC V7.2 WebNavigator Connection Error in IE 9

Resolving WinCC V7.2 WebNavigator Connection Error in Internet Explorer 9

Engineer field-notes for diagnosing and clearing the "Web navigator connection error" returned by the WinCC V7.2 WebNavigator client when launched from Internet Explorer 9. The procedure covers runtime activation, IIS / WebConfigurator re-configuration, WinCCViewerRT cross-check, browser hardening, and license verification.

1. Symptom Description

The reported failure is the WebNavigator client page (typically http://<server>/WebNavigator/default.htm) returning a dialog titled "Web navigator connection error" / "Web-Navigator – Verbindungsfehler" immediately after the user submits credentials. The runtime picture never loads and the WinCC process picture area remains blank. A typical line in the WinCC WebNavigator server diagnostics reads:

[WebNav] Connection attempt from <client-ip> failed: server not reachable or runtime inactive

The error is independent of the configured WinCC project on the server. Both local and remote clients fail, and rebooting the server does not clear it.

2. WinCC V7.2 WebNavigator Architecture

WebNavigator is a thin-client extension to WinCC that publishes the active runtime project over HTTP through a server-side IIS web application. The same project can be opened on the client either with Internet Explorer (rendering ActiveX-based WinCC web controls) or with the bundled WinCCViewerRT.exe standalone runtime, which connects using WinCC's own native protocol rather than HTTP.

The SVG below summarises the request flow. The two red marks indicate the most common points of failure when the "Web navigator connection error" is reported.

3. Required Components and Versions

4. Diagnostic Workflow

Run the following checks in order. Each step is independent — stop and apply the fix when the corresponding check passes.

1. Confirm WinCC Runtime is active on the server (Step 5).
2. Validate the IIS WebNavigator virtual directory and application pool (Step 6).
3. Re-run the WebConfigurator to rebuild the IIS configuration (Step 7).
4. Test the same project with WinCCViewerRT.exe from the client (Step 8).
5. Validate Internet Explorer 9 settings (Step 9).
6. Disable / rule out firewall and antivirus interference (Step 10).
7. Verify the WebNavigator server and client licenses (Step 11).

Document the result of each step. If Step 8 (WinCCViewerRT) succeeds but the browser-based client fails, the problem is isolated to the IIS layer. If both fail, the problem is at the WinCC Runtime / network layer.

5. Step 1 – Verify WinCC Runtime State

The WebNavigator server forwards the HTTP request to the WinCC Runtime. If the runtime is not active, every client request returns the connection error regardless of IIS state.

1. On the server, open the WinCC Explorer.
2. Right-click the active project name in the navigation tree.
3. Confirm that the entry Activate Runtime is greyed out (i.e. runtime is already active). If the entry reads Activate Runtime, click it and wait for the status line to show "Runtime active".
4. Alternative: from the command line, run net start "WinCC Runtime" (or the project-specific service if a multi-user project is used).
5. Inspect the WinCC diagnostics: <project>\diagnose\WinCC_SStart_<timestamp>.log — there must be a line Runtime started successfully within the last 10 minutes.

6. Step 2 – Validate the IIS WebNavigator Installation

The WebNavigator server installs the WebNavigator virtual directory under the default website. The expected layout is:

%SystemDrive%\inetpub\wwwroot\WebNavigator\
    default.htm
    WinCCWebControl.cab
    WebClient\  (per-language subfolders)
    WebViewer\

1. Open Internet Information Services (IIS) Manager (inetmgr.exe).
2. Expand the server node → Application Pools and confirm a pool named WinCCWebControl exists and is in the Started state. Its .NET CLR version should be v2.0 with pipeline mode Classic.
3. Expand Sites → Default Web Site → WebNavigator. Right-click → Manage Application → Browse. The browser should display the WinCC WebNavigator login page.
4. If the virtual directory is missing, run the WebConfigurator (Step 7).
5. Confirm the following Windows features are enabled: Control Panel → Programs → Turn Windows features on or off → Internet Information Services → World Wide Web Services → Application Development Features → ASP.NET, and Security → Windows Authentication.

From the server itself, open Internet Explorer and navigate to http://localhost/WebNavigator/. If the same error appears on the server's loopback address, the issue is in IIS, not in the network path. If the server's loopback page loads, the problem is on the network or on the remote client.

7. Step 3 – Re-run the WebConfigurator

The WebConfigurator is the supported utility for (re)creating the IIS configuration for the WebNavigator server. It must be run after every install, repair, or Windows update that resets IIS features.

1. Start → SIMATIC → WinCC → WebNavigator → WebConfigurator (or <install>\WinCC\WebNavigator\bin\WebConfigurator.exe).
2. Click Next on the introduction page.
3. Select the WinCC project to be published. Click Next.
4. Select Create a new standard configuration. Click Next.
5. Accept the default port (80) or specify a custom port. If you change the port, update the client URL accordingly (e.g. http://server:8080/WebNavigator/).
6. Click Configure. The tool reports each action: virtual directory creation, ASP.NET registration, NTFS permission assignment, DCOM permission, firewall exception.
7. When the wizard completes, click Finish and reboot the server.

If the WebConfigurator reports an error during step 6, capture the message. Common failures are: ASP.NET not installed (re-enable the feature in appwiz.cpl), IIS Admin Service not running (net start w3svc), and Port 80 already in use (netstat -ano | findstr :80).

8. Step 4 – Test with WinCCViewerRT

WinCCViewerRT.exe is the standalone WinCC runtime that opens a WinCC project directly. It is shipped in <install>\WinCC\bin\ on the same WinCC V7.2 media. It connects using WinCC's own protocol and does not pass through IIS. Use it to bisect the failure.

1. Copy WinCCViewerRT.exe to the client machine (or run it directly on the server's desktop).
2. Launch it. In the WinCC Explorer that appears, choose Open and enter the project name, for example \\<server>\WinCC\Project_<name> or the server's TCP/IP address.
3. Click Activate Runtime in the viewer.

9. Step 5 – Validate Internet Explorer 9 Settings

WebNavigator V7.2 ships ActiveX web controls (notably WinCC WebViewer Control and WinCC WebControl) that must be allowed in Internet Explorer 9. Default Windows security hardening blocks the control and yields the connection error dialog before the runtime can render.

1. Open IE9 → Tools → Internet Options.
2. Tab Security → select Trusted sites → click Sites. Add the WebNavigator server URL (e.g. http://server or http://server.domain). Uncheck "Require server verification (https:) for all sites in this zone" if you are using plain HTTP.
3. With Trusted sites still selected, click Custom level… and set: ActiveX controls and plug-ins → Download signed ActiveX controls → Enable; Run ActiveX controls and plug-ins → Enable; Script ActiveX controls marked safe for scripting → Enable.
4. Tab Privacy: set the slider to Medium or below so that the WebNavigator session cookie is accepted.
5. Tab Advanced: enable Use TLS 1.0 and disable Enable memory protection to help mitigate online attacks if it is on (some IE9 builds block the WinCC CAB install with this on).
6. Disable the IE9 pop-up blocker for the trusted site.
7. Close all IE9 windows and re-open the WebNavigator URL.

On Windows Server 2008 R2 the default Internet Explorer Enhanced Security Configuration (ESC) forces the Internet zone to High security, which silently blocks the WinCC ActiveX. Either disable ESC for administrators (Server Manager → Configure IE ESC) or move the server URL to the Trusted sites zone and lower the Trusted sites custom level as above.

10. Step 6 – Firewall and Antivirus

WebNavigator uses port 80 TCP by default; the WebConfigurator registers a Windows Firewall exception for it. If the exception is missing, the client request is dropped silently before IIS sees it.

1. On the server, open wf.msc → Inbound Rules. Confirm a rule named WebNavigator Server (TCP-In) (or equivalent) is enabled for port 80 / the custom port.
2. If the rule is missing, run the WebConfigurator again (Step 7). If the rule still does not appear, create a manual inbound rule for %SystemRoot%\System32\inetsrv\w3wp.exe on the chosen port.
3. If a third-party endpoint protection product is installed (Symantec, McAfee, Trend, Sophos, Kaspersky, etc.), temporarily disable its web-shield or HTTPS inspection and re-test. WebNavigator HTTP responses are sometimes flagged as suspicious by aggressive web shields because the WinCC picture stream uses long-lived polling.
4. From the client, run Test-NetConnection -ComputerName <server> -Port 80 (PowerShell) or telnet <server> 80 and confirm a successful TCP handshake. A failed handshake confirms the network path or firewall is the problem.

11. Step 7 – Licensing and User Rights

WebNavigator licensing has two parts: a single server-side licence (always required) and N client licences (counted per simultaneously connected client). Missing or expired client licences cause the connection error.

1. Open Automation License Manager on the server.
2. Locate the entry SIMATIC WinCC WebNavigator in the licence list. Confirm a green check mark and a non-zero remaining count.
3. Move the licence to the server (right-click → Transfer → …) if it currently resides on a licence dongle on a different host.
4. On the server, confirm the Windows user running the IIS Application Pool WinCCWebControl is a member of the local groups SIMATIC HMI and SIMATIC HMI VIEWER. The WebConfigurator normally adds these memberships; manual IIS edits can drop them.
5. On the client, the user logging in to the WebNavigator login page must also be a member of SIMATIC HMI VIEWER on the server (or be granted the equivalent right in the WinCC user administration). Without this group membership the user can authenticate at the IIS level but the runtime rejects the connection.

12. Verification Checklist

After applying the fix, run the following sequence and mark each as pass / fail before closing the case.

1. From the server desktop, http://localhost/WebNavigator/ opens the WebNavigator login page without any dialog box.
2. From a remote client on the same subnet, http://<server>/WebNavigator/ opens the same login page.
3. After login, the runtime picture loads within the timeout window. Per the TIA Portal v20 WebNavigator readme the WebNavigator client may take significantly longer than 20 seconds to recognise that the server is down or that the communication is faulty, so a slow first load is not by itself an error — wait at least 30 s before declaring failure.
4. The picture refreshes when a process tag in the project changes value.
5. A second concurrent client (browser or WinCCViewerRT) can open the same project without any one of them losing the connection — this verifies that the N-client licence count is correct.
6. Disconnecting the network on the client surfaces an "Unreachable" error within 30 s; reconnecting restores the session automatically.

13. Edge Cases and Field Notes

These are conditions that have produced the "Web navigator connection error" dialog in the field and that do not fall into the standard checklist above.

• WebNavigator installed on a Domain Controller. WinCC V7.2 does not officially support installation on a domain controller. The WebConfigurator can fail silently, leaving the IIS app pool in a stopped state. Move the WinCC installation to a member server.
• Project uses a custom .NET control. A .NET control compiled against .NET 4.x is not visible in a WebNavigator V7.2 client which uses ASP.NET 2.0. The picture area renders blank or returns the connection error. Rebuild the control against .NET 2.0 or upgrade the WebNavigator add-on to a version that supports .NET 4.0.
• Network address translation (NAT) and DNS round-robin. When the server is reached via a NAT, the WinCC picture control receives the server's internal IP in some responses. The client IE9 may then attempt to reach the internal IP and fail. Use the public DNS name consistently on both client and server.
• Browser back / forward cache. Pressing the browser Back button after a runtime disconnect can cache a stale HTML page that immediately throws the connection error on return. Force-reload (Ctrl + F5) before concluding the server is at fault.
• Internet Explorer 9 on Windows 10 / 11. IE9 is not natively available on Windows 10 / 11. Edge in IE Mode can render the HTML shell but does not support the WinCC ActiveX control. Stay on a Windows 7 / Server 2008 R2 client for WebNavigator V7.2.

For general information about how a browser exposes its network state to JavaScript — useful when triaging client-side network problems separately from the IIS server side — see the Navigator.connection property reference on MDN. For browser-compatibility questions affecting the WinCC WebNavigator client, see Microsoft Q&A — webnavigator browser not working.

14. FAQ