Troubleshooting Simatic Net OPC Scout Connection Errors

Troubleshooting Simatic Net OPC Scout V10 "Could Not Connect to Server" Errors

Intermittent "Could not connect to server" faults in SIMATIC NET OPC Scout V10 against a SIMATIC NET OPC Server V14 SP1 on Windows Server 2016 Standard are almost always DCOM/OPC Classic (DA 2.05a/3.0) lifecycle problems, not network faults. This reference documents the symptom matrix, root-cause analysis using the Station Configurator, and a hardened remediation procedure that restores session stability without rebooting the host.

1. Affected Environment and Component Identification

2. Symptom Matrix

3. Root-Cause Analysis

The reported behavior — "works most of the time," "first client still reachable," "restarting the second client kills both," "server recovers only after reboot" — is a classic DCOM Classic OPC lifecycle issue, not a transport outage. Investigate, in order:

3.1 DCOM Endpoint Resolution Failure (CoCreateInstanceEx)

OPC DA uses CoCreateInstanceEx on the remote server. The COM catalog must be able to resolve OPC.SimaticNET to the configured AppID. The DCOM resolver cache (HKLM\SOFTWARE\Microsoft\Rpc\RpcProxy, plus the AppIDs branch) can become inconsistent after identity/password changes, Windows updates, or after the SIMATIC NET service account password is rotated without restarting the COM catalog. Once the cache is poisoned, only a restart flushes it.

2.2 SIMATIC NET Station Not in "Configured Mode"

Open Station Configurator (Start → Siemens Automation → SIMATIC → Station Configurator). The right pane must show the station as Configured and the S7CP service as Running. If the S7CP service is stopped, the OPC Server is registered but not bound to the PC interface — every client (including OPC Scout) receives "could not connect." This is the single highest-probability root cause for intermittent failures, and it is the first thing the source conversation asks the user to check.

3.3 DCOM Hardening on Windows Server 2016

Beginning with Windows Server 2012 R2 and tightened further in 2016, Microsoft reduced the DCOM attack surface. Default RPCSS hardening and tightened COM+ impersonation/launch permissions frequently block legacy OPC DA clients that worked unchanged on Windows Server 2008 R2. The result is the same error string: "Could not connect to server." Verify the machine-wide DCOM defaults with dcomcnfg.

3.4 Identity Change Without Service Restart

OPC DA spawns server processes under a configured identity. If the SIMATIC NET service account password is changed in Active Directory but the SIMATIC NET OPC Server service is not restarted, the running process holds a stale Kerberos ticket. The next CoCreateInstance from a new client fails authentication silently. Restarting the client worsens it because the failed launch is cached in the COM+ application instance table.

3.5 Connection Loss That Does Not Auto-Restart

After a transient TCP/RPC drop, the OPC DA session object in OPC Scout is not automatically re-established. The client object must be reconnected from the UI or programmatically. Unlike OPC UA, DA has no automatic reconnection semantics in the standard. This is the source of the "intermittent" perception: the server is fine, the client session is dead.

4. Pre-Flight Verification (Before Changing Anything)

1. Open Station Configurator. Confirm PC station state = Configured and S7CP = Started.
2. Open Services (services.msc). Confirm SIMATIC NET OPC Server and S7CP are Running and startup type = Automatic.
3. From a second PC, run opcEnum browse or use OPC Scout's Server Browser with the explicit \SERVERNAME\OPC.SimaticNET path.
4. Capture the Windows Event Viewer — System and Application — for DCOM errors (event IDs 10001, 10004, 10005, 10006, 10010, 10016) at the exact minute the fault occurs.
5. Run dcomperm or open dcomcnfg on the server and dump the Default Properties tab: Enable Distributed COM, Default Authentication Level, Default Impersonation Level.

5. Resolution Procedure

5.1 Restore the SIMATIC NET Station

1. Open Station Configurator → select your PC station → Station → Station Configurator → Diagnostics.
2. If the S7CP service is stopped, right-click → Start.
3. If the station shows Not Configured, click Configure and restart the SIMATIC NET OPC Server service.
4. Re-test OPC Scout. The error should clear within 10 seconds.

5.2 Fix DCOM Defaults on the OPC Server PC

1. Run dcomcnfg on the OPC server PC.
2. Console Root → Component Services → Computers → right-click My Computer → Properties.
3. Default Properties tab: set Enable Distributed COM on this computer = checked.
4. Set Default Authentication Level = Connect (minimum for legacy OPC DA). Raise to Packet Integrity if your clients support it.
5. Set Default Impersonation Level = Identify (default) or Impersonate (recommended for OPC DA 3.0).
6. Apply. Restart the COM+ System Application and RPCSS services, not the whole PC.

5.3 Fix Launch and Access Permissions on the OPC.SimaticNET AppID

1. dcomcnfg → Component Services → Computers → My Computer → DCOM Config.
2. Locate OPC.SimaticNET (or the SIMATIC NET OPC Server ProgID) → right-click → Properties.
3. General tab: confirm Authentication Level = Default (inherits your setting above).
4. Location tab: enable Run application on the following computer and check Run application on this computer.
5. Security tab: under Launch and Activation Permissions, choose Customize and add the SIMATIC NET service account and the OPC Scout user (and the second client PC's service account).
6. Under Access Permissions, add the same accounts with Local + Remote allowed.
7. Under Configuration Permissions, ensure Everyone has at least Read.
8. Click OK. Restart the SIMATIC NET OPC Server service.

5.4 Restart the OPC Server Cleanly (Without Reboot)

The exact escalation observed in the source — "restarting the second client makes everything fail, only reboot recovers it" — is resolved by reaping the poisoned COM+ application instance:

1. Close all OPC clients (Scout + secondary client).
2. Run cmd.exe as Administrator on the OPC server.
3. Stop the service: net stop "SIMATIC NET OPC Server"
4. Wait for COM+ System Application dependent services to stop.
5. Force the COM+ instance table to flush: net stop "COM+ System Application" && net start "COM+ System Application"
6. Start the service: net start "SIMATIC NET OPC Server"
7. Wait for the S7CP service to bind (check Station Configurator).
8. Reopen OPC Scout. Connections should restore without a reboot.

5.5 Eliminate RPC Port Exhaustion

1. Open netsh int ipv4 show dynamicportrange tcp. Note the dynamic port range.
2. Open Windows Firewall with Advanced Security → Inbound Rules → enable the pre-defined COM+ Network Access (DCOM-In), COM+ Remote Administration, and Remote Service Management rules for the OPC server profile.
3. Widen the dynamic range if needed: netsh int ipv4 set dynamicport tcp start=49152 num=16384 (reboot required).

5.6 Recover OPC Scout from a Stuck Session

If the server is healthy but OPC Scout refuses to connect, the Scout process is holding a dead session object:

1. In OPC Scout V10, File → Disconnect (if available) or close all open group windows.
2. Close OPC Scout.
3. Kill stale COM objects: taskkill /im opcscout.exe /f on the client PC.
4. Clear the COM object cache for the user profile: delete %LOCALAPPDATA%\Temp\OPCScout10\*.cache.
5. Reopen OPC Scout and add the server again with the fully qualified \SERVERNAME\OPC.SimaticNET string.

6. Verification Checklist

7. Prevention and Hardening

• Keep SIMATIC NET at the latest V14 SPx update (Update 7 minimum). Each update ships DCOM/OPC fixes against current Windows builds.
• Pin the SIMATIC NET service account in AD and rotate its password during a planned service restart window — never silently.
• Add the OPC client PC service accounts to the SIMATIC NET OPC Server's Launch and Access ACLs before the first connection attempt.
• Disable SMBv1 and NetBIOS on the OPC server VLAN. They can interfere with DCOM name resolution and prolong the resolver cache flush.
• Schedule a monthly COM+ System Application and SIMATIC NET OPC Server service restart during a maintenance window to clear latent state.
• Where possible, migrate to OPC UA with the SIMATIC NET OPC UA Server. UA uses TCP 4840 (configurable) and removes the entire DCOM attack surface. If you do, use the OPC UA Scout or a UA-capable client — OPC Scout V10 is DA-only.

8. When to Escalate

Escalate to Siemens Industrial Support via the official entry points if:

• Event Viewer shows DCOM 10016 "application-specific permission settings do not grant Local Activation permission for the COM Server application" with AppID = SIMATIC NET and the corrective ACL change does not survive a reboot.
• The SIMATIC NET OPC Server service crashes (event ID 7034) within minutes of every start.
• Station Configurator reports an S7CP binding error after a SIMATIC NET update.

Use the official Siemens Industry Online Support portal: support.industry.siemens.com and reference the SIMATIC NET PC Software V14 SP1 entry ID 109768616. Request the latest hotfix package and have your current SET_PG_PC.INI, Station Configurator export, and Event Viewer export attached.

9. Quick Reference: OPC Classic vs. OPC UA Connect Strings

10. Diagnostic Flow (SVG)