Resolving WinCCOLEDBProvider E_FAIL 0x80004005 Alarm Access Error in SIMATIC WinCC 7.x

When a .NET, PowerShell, or VBScript application queries SIMATIC WinCC alarm logging archives through the WinCCOLEDBProvider (a component of the SIMATIC WinCC/Connectivity Pack, also exposed on the WinCC runtime station as winccoledbprovider.dll), the connection may fail with an HRESULT E_FAIL (0x80004005) and the message:

'WinCCOLEDBProvider.1' failed with no error message available, result code: E_FAIL(0x80004005).

This generic COM/OLE DB failure breaks unattended alarm export, dashboards, and reporting jobs. The two primary root causes that surface in WinCC V7.3 and later are (1) a renamed ALARMVIEW command namespace and (2) missing/mismatched Windows user credentials on the archive server. This reference covers the underlying mechanism, the exact syntax change, the credential model, and a field-proven diagnostic procedure.

1. Problem Details and Symptom Matrix

The error is observed when the OLE DB consumer executes a command of the form:

or any equivalent ALARMVIEW:SELECT ... FROM ALGVIEWEXEN:... style query against a SIMATIC WinCC alarm archive. The error string is generated by the OLE DB provider's catch-all IErrorInfo implementation; no sub-status, source, or native WinCC subsystem code is returned, which makes automated retry logic unreliable.

Note: E_FAIL (0x80004005) is a generic HRESULT surfaced by COM/OLE DB when a lower layer fails to produce a more specific status. Microsoft's HRESULT E_FAIL 0x80004005 KB article documents the same class of COM failure in unrelated subsystems, and Autodesk's HRESULT 0x80004005 troubleshooting note reinforces that the value carries no payload and is always sub-classified by the calling stack.

2. Root Cause Analysis

Two independent root causes produce this error in WinCC 7.x alarm archive access. Both must be checked.

2.1 Command Namespace Change at WinCC V7.3

Starting with SIMATIC WinCC V7.3, the alarm archive OLE DB command namespace was renamed. The provider now distinguishes between the historic ALARMVIEW namespace and the new ALARMVIEWEX namespace. The legacy namespace still resolves on archives that were created/migrated to the V7.2 schema; on a V7.3+ archive, the parser binds to the new schema and returns E_FAIL if the old prefix is supplied. The fix is purely textual.

Siemens documents this in the WinCC Information System under "OLE DB Provider for Access to Archive Data" and in the application example "Exporting Archive Data with the Aid of the SIMATIC WinCC/Connectivity Pack (OLE DB Provider)" (SIOS entry ID 62926454). The example C++ project ships command strings for both namespaces and is the canonical reference.

2.2 User Credential Model and DCOM Negotiation

WinCCOLEDBProvider is a DCOM server. The provider runs in-process of the WinCC Archive Server and reads the archive files under the identity of the calling user. The Windows user account that initiates the ICommand::Execute call must:

1. Exist as a local or domain account on the archive server with an identical password.
2. Be a member of the local SIMATIC HMI / SIMATIC WinCC user group, or otherwise granted read access to C:\<WinCCProject>\ArchiveManager\AlarmLog\ and the corresponding SQL/CC file shares.
3. Have administrator privileges on the archive machine for full alarm/text archive access. Non-admin accounts can read process value archives but will be denied on alarm archives in many configurations.

When the negotiation fails, the WinCC Archive Server returns a generic failure that the OLE DB layer wraps in E_FAIL. Because the underlying NTSTATUS / Win32 error is suppressed, no event log message is generated on the client. The only trace is a non-zero return from IErrorInfo::GetDescription.

3. Affected Versions and Build Matrix

For deployments that span mixed V7.0/V7.2 and V7.3+ archives, branch the command string at runtime by reading the project's @PROJECT_VERSION tag or by probing the provider with a metadata query before issuing the alarm query.

4. Step-by-Step Resolution Procedure

4.1 Prerequisites

• Local administrator rights on the WinCC archive server and on the client machine.
• Knowledge of the archive server's WinCC project name and the archive segment range (default: last 6 months rolling, configurable in Computer > Properties > Tag Logging / Alarm Logging).
• PowerShell 5.1+ or .NET Framework 4.7.2+ on the client (the WinCC OLE DB provider is a 32-bit COM component on most installations; the host process must be x86 or the assembly must be configured for WOW64).

4.2 Step 1 — Confirm the Provider is Registered

On the client machine, open an elevated cmd.exe and run:

Equivalently, instantiate the provider in PowerShell:

$conn = New-Object System.Data.OleDb.OleDbConnection
$conn.ConnectionString = "Provider=WinCCOLEDBProvider.1;Catalog=CC_OpenArch_<ProjectName>;Data Source=.<ServerName>\WinCC"
$conn.Open()

If $conn.Open() returns E_FAIL immediately, the credential issue (Cause 2.2) is dominant. If it opens but the ALARMVIEW command fails, the namespace issue (Cause 2.1) is dominant.

4.3 Step 2 — Apply the Command Prefix

For WinCC V7.3 and later, replace every command string of the form:

with the V7.3+ equivalent:

Reference: SIOS: Exporting Archive Data with the SIMATIC WinCC/Connectivity Pack.

4.4 Step 3 — Match the Windows Credentials

1. On the archive server, create a local user, e.g. WinCCOleUser, with a complex password that does not expire.
2. Add the user to the local group SIMATIC HMI\SIMATIC WinCC Users (or, where applicable, SQLServerMSSQLUser$<INSTANCE> for SQL-backed archives).
3. Grant the user Read & Execute on %ProgramFiles%\Siemens\Automation\WinCC\ArchiveManager\AlarmLog and Modify on the project's archive directory if the application must trigger archive segment rotation.
4. Promote the user to the local Administrators group on the archive server if alarm archive read access still fails after step 2 (this is the field-confirmed workaround; Siemens support also advises it in KB SIMATIC WinCC support portal entries on OLE DB access).
5. On the client machine, create an identical local account with the same username and password.
6. Log on interactively as that user (or use runas /user:WinCCOleUser cmd.exe) and run the .NET/PowerShell consumer.

4.5 Step 4 — Configure DCOM Endpoints

If the consumer and archive server are on different hosts:

1. Open dcomcnfg.exe on both machines.
2. Navigate to Component Services > Computers > My Computer > DCOM Config.
3. Locate WinCC OLE DB Provider and SIMATIC WinCC Archive Server.
4. On the Security tab, add the consumer user to Launch and Activation Permissions and Access Permissions with Allow.
5. On the Identity tab, choose The interactive user for the OLE DB provider if the consumer and archive server share a desktop session; otherwise choose This user and specify the matching local account.

4.6 Step 5 — Optional: Use the Connectivity Pack Explicitly

When the consumer is on a machine without WinCC installed (a dedicated reporting server), the SIMATIC WinCC/Connectivity Pack V7.x must be installed and licensed. The OLE DB provider then ships as WinCCOleDBProvider.dll in C:\Program Files (x86)\Siemens\Automation\WinCC Connectivity Pack\OleDb and the connection string uses Catalog=CC_<ServerName>_<ProjectName> syntax as documented in the Connectivity Pack manual (article ID 62926454 on SIOS).

5. Verification

Run the following PowerShell snippet from the matching local account. A successful run returns the first alarm record and prints a UTC timestamp without raising E_FAIL.

$conn = New-Object System.Data.OleDb.OleDbConnection
$conn.ConnectionString = "Provider=WinCCOLEDBProvider.1;Catalog=CC_OpenArch_MyProject;Data Source=.\WinCC"
$conn.Open()
$cmd = $conn.CreateCommand()
$cmd.CommandText = "ALARMVIEWEX:SELECT TOP 1 MsgNr, T$TIME, T$TEXT FROM ALGVIEWEXEN:ORDER BY T$TIME DESC"
$reader = $cmd.ExecuteReader()
while ($reader.Read()) {
    "MsgNr: {0}  Time: {1}  Text: {2}" -f $reader["MsgNr"], $reader["T$TIME"], $reader["T$TEXT"]
}
$reader.Close()
$conn.Close()

For a quick negative test, run the same script with the legacy prefix:

On a V7.3+ archive this must still return E_FAIL (0x80004005); that confirms the prefix change is the real fix and that the credentials are correctly aligned. If both prefixes fail, the credentials branch in step 4.4 has not been completed.

Additional verification points:

• Event Viewer on the archive server: Application log should contain no WinCC Archive Server errors during the query.
• DCOMCNFG: Right-click the OLE DB provider > Properties > Security; the launch and access ACLs must show the consumer user.
• Process Monitor (procmon) trace filtered for CC_OpenArch_<Project>: open/read operations on *.LDF/*.MDF files should succeed for the local user SID.

6. Diagnostic Flowchart

7. Field-Proven Edge Cases

8. Automation and Operational Notes

When deploying the consumer as a scheduled task or Windows service:

• Use a managed service account (gMSA) only if every target WinCC server is joined to the same AD forest and has been configured for managed service authentication in DCOM. Otherwise, a fixed local account is more portable.
• Set the task to Run whether user is logged on or not and store the password in the Windows Credential Manager to avoid plaintext in XML.
• Log $Error[0].Exception.InnerException and the full ConnectionString (with credentials redacted) on every failure; this is the only forensic trail when E_FAIL carries no payload.
• Schedule an archive integrity check (WinCC menu Archive > Check & Repair) before the first consumer run each day. A corrupted segment produces the same E_FAIL with no other indication.

9. Related Commands and Catalog Constants

10. Safety and Licensing Notes

Reading alarm and tag archives through the OLE DB provider requires a valid SIMATIC WinCC RT license on the archive server and, for the dedicated Connectivity Pack installation, a Connectivity Pack license on the consumer. A consumer-only installation without a license returns the same E_FAIL (0x80004005) on first query; verify with Automation License Manager on both ends.

11. Frequently Asked Questions