Resolving WinCC V7.3 User Administrator Crash on Startup

Problem Summary

Symptom: In Siemens WinCC V7.3 running on Windows 7 Professional SP1 (and later Windows releases), the User Administrator dialog launches for a fraction of a second, then disappears without prompting, leaving the WinCC Explorer workspace blank or returning focus to the project tree. The WinCC runtime itself continues to operate, but no operator can be assigned, no new user created, and no group permission edited from the configuration tool.

This is a configuration-database corruption symptom, not an installer problem. Re-installing WinCC, copying the project to another PC, or restoring a registry image will not fix it when the underlying dbo.PWUser / dbo.PWGroup rows are already poisoned inside the project database.

The most common observable signatures of the condition are:

• User Administrator window paints, then self-terminates (no error dialog).
• WinCC event log records no matching message (the tool closes cleanly from Windows' perspective).
• The same project copied to a second engineering station reproduces the failure identically.
• Recent edits to a different language of the same project (e.g. switching between English, French, German runtime) have occurred prior to the failure.

Root Cause Analysis

WinCC V7.3 stores its user administration inside an embedded Microsoft SQL Server database (Microsoft SQL Server 2008 R2 is the minimum supported engine; SQL Server 2012 is also officially supported on WinCC V7.3 SP3 and later). The configuration-side Runtime database is created automatically the first time a project is opened in WinCC Explorer and is named according to the pattern:

CC_<ProjectName>_<ComputerName>_R

User, group, and rights information lives in the dbo.PW* schema. The most relevant tables are:

Three classes of defect inside these tables force the User Administrator executable (CCUserAdmin.exe) to crash on LoadUserList():

1. NULL name on a user or group row. A row with ID > 0 but Name IS NULL (or empty string) is rendered into a listview that calls into a NULL-pointer-sensitive Win32 API. The dialog aborts before its first paint cycle completes.
2. A user row with ID = 0 or a duplicate ID. The User Administrator treats ID 0 as a sentinel and a duplicate primary key breaks the list ordering routine.
3. Stale password digest with mismatched Password binary length (after a WinCC Service Pack migration or a manual copy of a project across a major SQL Server boundary, e.g. 2008 R2 → 2014). The dialog validates the digest length at load and silently exits when it finds the wrong size.

Field observation also shows that switching the WinCC Editor language (Tools → Language... in WinCC Explorer) of an open project between two locales whose default authorization templates differ (English, French, German) can leave half-migrated rows where a name slot has been emptied. This is the underlying trigger reported by operators who saw the dialog vanish the morning after switching to a translated project copy.

Diagnostic Procedure

Perform these checks in order. Each step is non-destructive — you only read the database until the last section.

Prerequisites

• The WinCC project must be closed in WinCC Explorer on the engineering station before opening SQL Server Management Studio, otherwise the SQL connection will be refused or you will read locked data.
• Run Microsoft SQL Server Management Studio (SSMS) as the same Windows user that owns the WinCC project, or as a Windows administrator. The configuration database is ACL-protected.
• Know the SQL Server instance. For WinCC V7.3, it is normally the local default instance WINCC or, in single-user engineering setups, the user instance attached as .\SQLEXPRESS. Verify with SQL Server Configuration Manager → SQL Server Services.

Step 1 — Confirm the database exists and is online

SELECT name, state_desc, recovery_model_desc
FROM sys.databases
WHERE name LIKE 'CC[_]%[_]R';

Compare the result with the project name in WinCC Explorer (right-click project → Properties → General). If no row is returned, the project has not been opened in WinCC Explorer at least once on this machine, and the User Administrator crash is a different issue (missing license, DCOM misconfiguration, or UAC). Investigate Windows Application event log for CCUserAdmin.exe errors first in that case.

Step 2 — Inspect the user table

USE [CC_YourProject_YourPC_R];   -- substitute real name
GO

SELECT  [ID],
        [Name],
        DATALENGTH([Password]) AS PwdLen,
        [Rights],
        [CreateDate],
        [LastPasswordChange]
FROM    dbo.PWUser
ORDER BY [ID];

Flag every row that matches any of:

• Name IS NULL or LTRIM(RTRIM(Name)) = ''
• ID <= 0 (a valid administrator must be ID = 1 and named Administrator)
• More than one row with the same ID (duplicates indicate a failed merge during a service pack upgrade)
• PwdLen <> 16 for an unsalted legacy row, or PwdLen <> 32 for a SHA-256 row from WinCC V7.3 SP3 onwards. Mixed lengths in the same table are a known corruptor.

Step 3 — Inspect the group table

SELECT  [ID],
        [Name]
FROM    dbo.PWGroup
ORDER BY [ID];

The default group set on a fresh English WinCC V7.3 project is:

Any of the first four rows (1001..1004) showing Name IS NULL is a confirmed crash trigger. Custom project groups are expected to start at ID 2001; anything below that should not exist.

Step 4 — Check the join table

SELECT  ug.UserID, ug.GroupID, u.Name AS UserName, g.Name AS GroupName
FROM    dbo.PWUserGroup ug
LEFT JOIN dbo.PWUser u  ON u.ID  = ug.UserID
LEFT JOIN dbo.PWGroup g ON g.ID  = ug.GroupID
WHERE   u.Name IS NULL OR g.Name IS NULL;

Any row returned by this query points to an orphan mapping. The group row may exist with a NULL name, or be missing entirely. The User Administrator walks this join to build the left pane and aborts on the first unresolved mapping.

Step-by-Step Repair

1. Close WinCC Explorer and WinCC Runtime on every node of the project. Confirm via Task Manager that CCExplorer.exe and CCUserAdmin.exe are not running.
2. Make a SQL-level backup of the database before any edit. In SSMS: right-click the CC_YourProject_YourPC_R database → Tasks → Back Up. Choose FULL, default destination, name the file PreRepair_YYYYMMDD.bak. Do not skip this step.
3. Set the database to single-user mode for the duration of the edit so the WinCC service cannot grab a connection mid-update:

   ALTER DATABASE [CC_YourProject_YourPC_R]
   SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
   GO

4. Delete the bad user rows (replace ID values with the actuals found in Step 2):

   DELETE FROM dbo.PWUser        WHERE ID = 0;
   DELETE FROM dbo.PWUser        WHERE Name IS NULL OR LTRIM(RTRIM(Name)) = '';
   DELETE FROM dbo.PWUserGroup   WHERE UserID NOT IN (SELECT ID FROM dbo.PWUser);
   GO

5. Repair the group table. If a default group such as 1004 has a NULL name, give it a non-empty ASCII name directly in the table (the field-tested approach that resolves the dialog crash):

   UPDATE dbo.PWGroup SET Name = 'Administrators' WHERE ID = 1001 AND (Name IS NULL OR LTRIM(RTRIM(Name)) = '');
   UPDATE dbo.PWGroup SET Name = 'Operators'       WHERE ID = 1002 AND (Name IS NULL OR LTRIM(RTRIM(Name)) = '');
   UPDATE dbo.PWGroup SET Name = 'Configuration'    WHERE ID = 1003 AND (Name IS NULL OR LTRIM(RTRIM(Name)) = '');
   UPDATE dbo.PWGroup SET Name = 'Remote Access'    WHERE ID = 1004 AND (Name IS NULL OR LTRIM(RTRIM(Name)) = '');
   GO

   If you renamed a default group in the live project previously, substitute the project-specific name instead of the defaults above.
6. Re-open the database to multi-user mode:

   ALTER DATABASE [CC_YourProject_YourPC_R]
   SET MULTI_USER;
   GO

7. Re-validate by re-running the Step 2 and Step 3 SELECT queries. All Name columns must be non-NULL and non-empty, and the only row with ID = 0 should not exist.
8. Launch WinCC Explorer and open the User Administrator. The dialog should now remain open.

Alternative Workarounds

When the engineering environment is on a tight schedule and no SSMS change is permitted, three non-invasive workarounds have been confirmed by field engineers:

Workaround 1 — Switch WinCC Editor language

Open WinCC Explorer, choose Tools → Language..., and toggle the editor to a different locale (English ↔ French ↔ German). This forces the configuration tool to re-resolve all localized default group names from the shipped *.dll resources, which can refill the NULL Name slot for the affected group without touching SQL directly. Restart the explorer after the change. This fix is cosmetic and only works when the corruption is limited to a single default group row.

Workaround 2 — Build a clean reference user administrator

On a second engineering station that does not exhibit the symptom, export the contents of dbo.PWUser and dbo.PWGroup to CSV. After the SQL delete/update above, re-import the rows that are missing on the broken station using:

BULK INSERT dbo.PWUser
FROM 'C:\Temp\PWUser_ok.csv'
WITH (FIELDTERMINATOR = ';', ROWTERMINATOR = '\n', FIRSTROW = 2);

This is the path used when the project was opened on a different machine with a freshly created CC_... database — the comparison between the "notok" and "ok" PWUser screenshots is exactly this scenario.

Workaround 3 — Recreate the configuration database

Last-resort path: detach the broken CC_..._R database, let WinCC Explorer recreate a fresh one on the next project open, then re-import the runtime-side User Administrator export (File → Export User Administration) from the original project. This loses any custom passwords not backed up, so use only when a project-level credential reset is acceptable.

Verification

After the repair, run the following acceptance checks before signing the work order off:

1. Dialog persistence test: Open User Administrator five times in a row. Each instance must remain open until the operator clicks the close button.
2. Login round-trip: Log into WinCC Runtime with the built-in Administrator account (default password is empty, but is project-specific if previously changed) and confirm that the four default groups all appear in the user assignment drop-down.
3. SQL count parity: Run SELECT COUNT(*) FROM dbo.PWUser; SELECT COUNT(*) FROM dbo.PWGroup; and compare with the values from the working engineering station (Step 1 backup). The numbers must match.
4. No NULL defense: Run SELECT * FROM dbo.PWUser WHERE Name IS NULL; SELECT * FROM dbo.PWGroup WHERE Name IS NULL;. Both must return zero rows.
5. Event log clean: Open Windows Event Viewer → Application and confirm no further CCUserAdmin.exe errors in the last 30 minutes.

Prevention and Best Practices

• Always shut down WinCC Explorer before a Windows shutdown or a service pack installation. Force-killing the process while the CC_..._R database has an open transaction is the most common trigger for partially written Name columns.
• Schedule a daily SQL backup of every WinCC configuration database, retained for at least 30 days. WinCC V7.3 ships with a built-in Project Backup wizard that handles the user administration tables; combine it with a SQL-side BACKUP DATABASE ... WITH COMPRESSION job for redundancy.
• Never edit the CC_..._R database with SSMS while WinCC Runtime is active on a redundant pair. The WinCC redundancy service opens long-lived connections and will cause replication divergence if a row is removed out from under it.
• Avoid switching the editor language on an open project. If translation is required, do it on a project copy in a dedicated engineering branch.
• After every WinCC Service Pack upgrade (V7.3 → V7.3 SP1/SP2/SP3/SP4), run the supplied CCUpgradeTool and verify that the password digest length is uniform. Mixed-length digests cause the dialog to close silently.
• Document group IDs in the project folder. Custom groups starting at ID 2001 are safe; assigning custom groups at IDs 1001..1999 collides with the WinCC default group namespace and will crash the dialog when the duplicate-ID check fires during a later service pack migration.

Related Issues and Misdiagnoses

Field-Commissioning Checklist

For new projects, integrate the following SQL-side checks into the SAT (Site Acceptance Test):

1. After project creation, query SELECT * FROM dbo.PWGroup WHERE Name IS NULL; — must return zero rows.
2. Create one operator and one supervisor in the User Administrator, then re-query dbo.PWUser to confirm both rows have non-NULL Name and a 32-byte Password digest.
3. Stop and restart the SQL Server service while the project is closed. Re-open the User Administrator to confirm the dialog is still functional after a hard database reset.
4. Take a WinCC Project Backup and restore it to a separate engineering station. Re-open the User Administrator — this exercises the same code path that fails in the field corruption case.