WinCC 7 Runtime on VMs: RDP Console Session and Domain Setup

WinCC 7 Runtime on Virtual Machines: RDP Console Session, Automatic Logon, and Active Directory Privilege Delegation

Siemens WinCC V7.0 (and later V7.x service packs through V7.5 SP2) was designed originally to run on a dedicated, locally-attended operator station. The HMI/SCADA suite uses several privileged Windows mechanisms — SeLockMemoryPrivilege, SeDebugPrivilege, DCOM service control of the WinCC CCAS/CCES/CCRuntime services, and winsta0\default interactive access — that behave differently when the runtime is moved to a virtual machine (VMware vSphere, Hyper-V, or VirtualBox) and reached over Remote Desktop Protocol (RDP). Operators who are intentionally given limited (non-administrator) domain credentials in the Active Directory lose the ability to relaunch the "Active Graphics Runtime" from the taskbar after an RDP session is dropped, the link is restored, or the VM console is disconnected. This reference describes the full, defensible configuration of WinCC runtime inside a VM with non-elevated operator accounts, RDP console-session discipline, automatic Windows logon, and a least-privilege Active Directory model.

1. Problem Statement and Symptoms

The classical failure pattern, replicated on every WinCC V7.x installation that has been virtualized without the configuration steps below, is:

1. WinCC V7.0 SP3 (or later) is installed on a Windows 7 / Windows Server 2008 R2 (or later) virtual machine joined to an Active Directory domain.
2. Operators sit at a thin client or workstation and connect to the VM through Microsoft Remote Desktop Client (mstsc.exe) or VMware Horizon RDP client.
3. The operator domain account is intentionally a member of the Users group only — explicitly not a member of local Administrators, Power Users, or Remote Desktop Users.
4. WinCC Graphics Runtime is launched in the RDP session and runs normally.
5. The network is briefly interrupted, the thin client sleeps, or the operator closes the RDP window by clicking the X instead of Log Off.
6. When the RDP link is restored, the operator's domain account is locked out by the domain controller because the cached credential is exhausted, or the RDP session is reconnected to Session 0 while the WinCC processes are still bound to Session 1.
7. The operator is forced to log off and log on again. WinCC Graphics Runtime is no longer running, but the operator cannot right-click the WinCC taskbar icon and select Active Graphics Runtime because the limited account lacks the required DCOM launch and SC_MANAGER_ALL_ACCESS rights on the CCRuntime, CCAlgServer, and CCArchiveServer services.
8. The operator also cannot restart the VM from a shutdown command. The HMI screen is dead until an administrator intervenes.

2. Architectural Overview of the WinCC Runtime in a VM

WinCC V7.x is implemented as a coordinated set of Windows services plus an interactive process. The interactive process is the WinCC Graphics Runtime (PDLRT.exe), which must run on WinSta0\Default of an active interactive session. Under RDP, that means Session 1 or higher, never Session 0 (the services-only session that exists from Windows Vista onward).

The split between services (Local System, always running) and the Graphics Runtime (interactive operator context) is the source of almost every virtualization problem. When the RDP session drops, only the Graphics Runtime dies; the seven background services keep running but become orphaned, and a fresh operator logon cannot restart PDLRT.exe without the rights listed in §5.

3. Prerequisites

• Siemens WinCC V7.0 SP3 or later (current as of writing: V7.5 SP2 Update 14, see Siemens entry ID 109760458).
• Windows 7 SP1, Windows 10 LTSC 2019/2021, or Windows Server 2016/2019/2022 on the VM (x64). Windows XP as the host OS — referenced in legacy installations — is out of mainstream support and must be migrated; see the Windows lifecycle policy at Microsoft Lifecycle Policy.
• Active Directory domain functional level 2008 R2 or higher.
• A dedicated WinCC Service Account (e.g. [email protected]) — a managed service account (gMSA) is preferred on Windows Server 2012 or later; see Group Managed Service Accounts overview.
• A dedicated WinCC Operator Account (e.g. [email protected]) — non-administrator, password-never-expires, logon-hours-restricted.
• RDP client on the operator workstation (mstsc.exe version 10.0.19041 or later) or VMware Horizon Client 2306 or later.
• Hypervisor: VMware vSphere 7.0 U3 or later, or Hyper-V 2019 or later. Configure the VM with Reserve all guest memory (locked) and Enable 3D graphics if the operator station will use hardware-accelerated graphics, per vSphere 7 virtual machine administration.

4. Create the WinCC Local Groups on the VM

WinCC V7.x installs two local groups that govern who may interact with the runtime. Verify they exist on the VM:

1. Log on to the VM console as a local administrator.
2. Open Computer Management → Local Users and Groups → Groups.
3. Confirm the presence of SIMATIC HMI and SIMATIC HMI Viewer. If absent, the WinCC installation is incomplete or the SIMATIC HMI license is missing.
4. Add the operator account (or, preferably, a domain security group DOMAIN\WinCC-Operators) to SIMATIC HMI only. Do not add it to SIMATIC HMI Viewer; that group exists for read-only web clients.

5. Delegate DCOM and Service Rights to the WinCC Service Account

Before the operator account can relaunch PDLRT.exe, the service account that runs CCRuntime must be allowed to impersonate, and the operator must be allowed to start and stop the CCRuntime service. WinCC's setup grants this automatically when the SIMATIC HMI is configured for the correct user, but a virtualized install often loses these rights when the VM is sysprepped or cloned. Re-apply them as follows.

5.1 Configure service logon

1. Open services.msc on the VM.
2. For each of CCRuntime, CCAlgServer, CCArchiveServer, CCMessageServer, CCConnectivityServer, CCEsgServer, open Properties → Log On tab.
3. Select This account and enter DOMAIN\svc-wincc with its password, or browse to the gMSA.
4. Click OK; restart each service.

5.2 Grant service start/stop rights to operators

Use sc.exe sdset to add an ACE that allows the operator group SERVICE_START and SERVICE_STOP on each WinCC service without giving the operator group SERVICE_ALL_ACCESS. The security descriptor string for a typical install is:

sc sdset CCRuntime D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;BA)(A;;RPWP;;;DOMAIN\WinCC-Operators)

Repeat for CCAlgServer, CCArchiveServer, CCMessageServer, CCConnectivityServer, and CCEsgServer. The trailing ACE (A;;RPWP;;;DOMAIN\WinCC-Operators) grants the RP (SERVICE_START) and WP (SERVICE_STOP) rights only. Reference: Microsoft service permissions reference.

5.3 Configure DCOM launch permissions for WinCC

1. Open dcomcnfg.exe → Component Services → Computers → My Computer → DCOM Config.
2. Locate CCAlgClass, CCArchiveClass, CCChannelAttach, CCConnectivityClass, CCEsgClass, CCMessageClass, and CCPDLClass.
3. Right-click each → Properties → Security tab.
4. Under Launch and Activation Permissions, click Edit. Add the operator group DOMAIN\WinCC-Operators and tick Local Launch and Local Activation only. Do not grant Remote Launch or Remote Activation — those would allow cross-network code execution and violate the Siemens WinCC hardening guide.

6. RDP Console Session Discipline

This is the single most important configuration in the entire solution. Operators must always connect to the VM's console session, not to a numbered virtual session. Microsoft documents this under "Connecting to the console session" in Terminal Services overview.

6.1 Why console-only

When two RDP users (e.g. an engineer at Session 2 and an operator at Session 3) connect to the same VM, they each receive an independent desktop. The CCRuntime service cannot arbitrate which session owns PDLRT.exe, and the WinCC alarm logging subsystem can become inconsistent. By forcing every user to the console (Session 1), only one interactive session exists, and the WinCC runtime cannot be desynchronized from the services.

6.2 Connecting with mstsc.exe

From the operator workstation, open a command prompt and execute:

mstsc.exe /v:<vm-fqdn> /console /f

The /console switch is the legacy syntax used in Windows XP and Windows Server 2003. On Windows Vista and later, the equivalent switch is /admin:

mstsc.exe /v:<vm-fqdn> /admin /f

Save the connection as an .rdp file in the operator's startup folder so it launches automatically. The /f flag opens the session full-screen, hiding the Windows desktop from the operator — recommended on a plant-floor thin client.

6.3 Connecting with VMware Horizon Client

If the thin client uses VMware Horizon 2306 or later, create a desktop pool with the following settings:

• Connection Server restrictions → Restrict to single session per user = ON.
• Display protocol = VMware Blast or PCoIP (do not use RDP through Horizon when the underlying VM is also reachable by mstsc, because the two protocols fight over Session 1).
• Logoff after disconnect = Never — instead, use the GPO in §7.4 to enforce a 60-minute idle session timeout with no forced logoff.

Reference: VMware Horizon desktop and application pool configuration.

7. Automatic Logon and Automatic Runtime Start

The operator's environment must be fully hands-off. Two mechanisms are required.

7.1 AutoAdminLogon on the VM

1. On the VM, open regedit.exe and navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
2. Set the following REG_SZ values:
   • AutoAdminLogon = 1
   • DefaultUserName = DOMAIN\op-wincc-01
   • DefaultDomainName = DOMAIN.LOCAL
   • DefaultPassword = (encrypted value, see note)
   • AutoLogonCount = 0 (re-arm every boot)
   • ForceAutoLogon = 1 (Windows 7 / Server 2008 R2 and later)
3. Encrypt the password using Sysinternals Autologon.exe, which writes the encrypted DefaultPassword directly. The plain-text password is never stored. Reference: Windows Sysinternals Autologon.

7.2 Auto-launch WinCC Graphics Runtime at logon

Place a shortcut in the operator's startup folder that targets the project-specific runtime executable:

"C:\Program Files (x86)\Siemens\Automation\WinCC\WinCCProjects\<project>\<computer>\PDLRT.exe" -project <project> -computer <computer>

Alternatively, configure the WinCC project so that Graphics Runtime is started by the CCRuntime service via the project property Computer → Startup → Start WinCC Runtime automatically. This second method is preferred because it survives RDP session loss: the service brings the runtime back up at the next interactive logon without operator intervention.

7.3 Disable shutdown / restart from the operator desktop

Apply the following GPO at the OU that contains the WinCC VM computer object:

User Configuration → Administrative Templates → Desktop → Start Menu and Taskbar

• Remove and prevent access to the Shut Down command = Enabled
• Remove Logoff on the Start Menu = Enabled (WinCC 7.0 only; on WinCC 7.4 and later leave this as Not Configured and instead use §7.4)

This guarantees the operator cannot accidentally reboot the VM by clicking the wrong corner.

7.4 Idle-session Group Policy

Apply the following GPO to the DOMAIN\WinCC-Operators group:

• Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Session Time Limits
  • Set time limit for disconnected sessions = Enabled, 5 minutes
  • Set time limit for active sessions = Enabled, 12 hours
  • Set time limit for idle sessions = Enabled, 60 minutes
• Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Connections
  • Restrict Remote Desktop Services users to a single Remote Desktop Services session = Enabled

Reference: Microsoft Terminal Services Group Policy reference.

8. Active Directory Account Hardening

Two Active Directory accounts (or groups) participate in the runtime: the WinCC Service Account and the WinCC Operator Account. Their configuration must follow the Active Directory privileged accounts and groups guide.

9. VMware vSphere Layer

The hypervisor layer introduces two issues not present on a physical WinCC station.

9.1 Time skew

WinCC license checking and Kerberos tickets require the VM clock to be within 5 minutes of the domain controller. On vSphere, configure NTP from the host:

1. In vCenter, select the ESXi host → Configure → Time Configuration → Edit.
2. Set NTP servers: ntp1.domain.local, ntp2.domain.local.
3. Start the ntpd service and enable ntpTimeProvider in /etc/ntp.conf on the host. Reference: vSphere timekeeping best practice.
4. On the Windows guest, disable the Windows Time service's VMIC time provider and point to the host via w32tm /config /syncfromflags:domhier /reliable:YES /update.

9.2 vCenter permission to start the VM

When the WinCC VM is powered off (for example after a graceful shutdown initiated by the WinCC redundancy software), an operator with only RDP access cannot power it back on. Delegate the minimum vCenter permission to the operator group:

1. In vSphere Client, navigate to Administration → Roles → New Role.
2. Name: WinCC-VM-Operator.
3. Privileges: VirtualMachine.Interact.PowerOn, VirtualMachine.Interact.PowerOff, VirtualMachine.Interact.ConsoleInteract, VirtualMachine.Interact.DeviceConnection — and explicitly not VirtualMachine.Config.AdvancedConfig or VirtualMachine.Inventory.Remove.
4. Assign the role to DOMAIN\WinCC-Operators at the VM object level (propagate = no). The role should not be granted at the datacenter, cluster, or folder level. Reference for permission structures: vSphere role-based access control.

10. Verification Procedure

After applying the configuration, validate the result with the following checklist. Every step must pass before the system is handed over to operations.

1. Session test. Connect from the operator thin client with mstsc /v:vm-fqdn /admin /f. Verify in Task Manager → Users tab that the session ID is 1 and the session name is Services (i.e. console).
2. Service test. Open services.msc as the operator and confirm the operator can start, stop, and restart the CCRuntime service without elevation. If a UAC prompt appears, the §5.2 ACL was not applied correctly.
3. Disconnection test. Pull the network cable from the thin client for 30 seconds. Restore. The operator account must not be locked. The WinCC runtime must reconnect automatically within 60 seconds; if it does not, §7.2 is misconfigured.
4. Restart test. From the operator account, attempt Start → Shutdown. The shutdown command must be absent. Then attempt to start the VM from the vSphere Client — the operator must have Power On permission only on this VM, not on the datacenter.
5. Privilege escalation test. From the operator account, run whoami /priv. The output must not contain SeDebugPrivilege enabled, SeTakeOwnershipPrivilege enabled, or SeLoadDriverPrivilege. If any of these appear, the operator account is effectively a local administrator and §4 and §5 must be re-checked.
6. Archive test. Trigger a process value archive segment close (or wait one minute) and verify CCArchiveServer writes to the configured archive directory. The operator account does not need write access to the directory — only the service account does, and the gMSA already has it via §5.1.

11. Common Failure Modes and Diagnostic Matrix

12. Shell Replacement and Kiosk-Mode Hardening (Optional)

For installations where the WinCC VM is a dedicated operator station with no engineering access, replace the Windows shell so the operator sees only the WinCC runtime and cannot escape to Explorer. Apply the GPO:

User Configuration → Administrative Templates → System → Custom User Interface

• Custom User Interface = Enabled, UI file: "C:\Program Files (x86)\Siemens\Automation\WinCC\WinCCProjects\<project>\<computer>\PDLRT.exe"

This GPO corresponds to the registry value HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell. The operator can no longer reach Ctrl+Alt+Del → Task Manager. To preserve the ability to relaunch the runtime after a hang, create a Windows shortcut bound to Ctrl+Alt+F12 in the WinCC project that re-executes PDLRT.exe. Reference: Microsoft kiosk-mode shell policy.

13. Field-Commissioning Checklist

Use this checklist during Site Acceptance Test (SAT):

• ☐ WinCC Service Account is a gMSA with auto-rotated password.
• ☐ WinCC Operator Account cannot log on to any workstation except the WinCC VM (verified with Get-ADUser op-wincc-01 -Properties LogonWorkstations).
• ☐ Operator account is a member of SIMATIC HMI local group on the VM only.
• ☐ Operator account is not a member of local Administrators, Power Users, Backup Operators, or Remote Desktop Users at the domain level.
• ☐ sc sdset applied to all six CC* services with (A;;RPWP;;;DOMAIN\WinCC-Operators).
• ☐ DCOM launch permissions on the seven WinCC classes allow operator group Local Launch and Local Activation only.
• ☐ RDP client on every operator workstation is configured with /admin and full-screen.
• ☐ Idle session limit set to 60 minutes; disconnected session limit set to 5 minutes; single-session restriction enforced.
• ☐ Remove and prevent access to the Shut Down command GPO enabled.
• ☐ AutoAdminLogon configured via Autologon.exe (no cleartext password in registry).
• ☐ WinCC project property Start WinCC Runtime automatically = ON.
• ☐ NTP from ESXi host to PDC emulator verified with w32tm /monitor.
• ☐ vCenter role WinCC-VM-Operator assigned at the VM object only.
• ☐ Verification procedure in §10 executed and signed off.