WinCC 7.0 SP3 User Rights Error on Windows 7 64-bit: Field-Troubleshooting Guide

Symptom: A WinCC 7.0 SP3 runtime/station installed on a Windows 7 64-bit (x64) system reports "The user does not have the rights to perform this action! Please check the assignment of the current user of the user groups in Windows" when the operator attempts to open a project originally engineered on a 32-bit (x86) Windows 7 workstation, and IM151-8 PN/DP (ET 200S) communication does not come up. This document collects the verified root causes, the corresponding Siemens documentation cross-references, the registry / DCOM / user-group remediation steps, and the clean-uninstall procedure required when the directory is installed under C:\Program Files (x86) instead of C:\Program Files.

1. Problem Description and Field Symptoms

The error string is emitted by the WinCC project manager when the operating-system user account that launched WinCC Explorer is missing one or more required Windows security group memberships, or when the project file set was created on a different OS platform (x86 vs x64) and the registry hive for the runtime user was not preserved.

2. Root-Cause Analysis

WinCC 7.0 SP3 enforces an explicit Windows security model. Each WinCC component runs under a Windows user, and the OS-level groups SIMATIC HMI, SIMATIC HMI\Administrator, SIMATIC NET, and (for distributed stations) SIMATIC HMI\User must contain the active login. When the project was originally built on a 32-bit machine, the user-rights configuration (the Security Editor User Administrator of WinCC) and the file ownership of the project directory are written against the SID of the 32-bit user. Copying the project to a 64-bit host with a different SID triggers the access-denied dialog the first time any WinCC component tries to enumerate the project file set.

The communication fault against the IM151-8 PN/DP is typically a secondary symptom: when WinCC refuses to load the project, the configured S7 connection is never instantiated, so the WinCC channel SIMATIC S7 PROTOCOL SUITE logs Channel DLL: Cannot connect to partner. The remediation is therefore two-pronged: (a) repair the OS-level group membership and DCOM launch rights, then (b) re-verify the PG/PC interface assignment for the active CP.

3. WinCC 7.0 SP3 – Supported Platforms and Installation Path Rules

Per the WinCC 7.0 SP3 release notes (entry ID 44029153 on the Siemens Support portal), the following Windows variants are released for the WinCC 7.0 base plus SP3 line:

4. OS-Level User Group Configuration

WinCC 7.0 SP3 enumerates four Windows security groups during project open. Membership must be granted before the user attempts to start the WinCC Explorer, and the local group policy Access this computer from the network must include the same account.

1. Open Computer Management → Local Users and Groups → Groups (lusrmgr.msc).
2. Confirm the following groups exist. If they do not, the WinCC installation was incomplete or corrupted.
   • SIMATIC HMI
   • SIMATIC HMI\Administrator
   • SIMATIC HMI\User
   • SIMATIC NET
3. Add the active Windows user (e.g. WINCCOP) to:
   • SIMATIC HMI – mandatory for all users
   • SIMATIC HMI\Administrator – engineers who need to edit the project
   • SIMATIC HMI\User – runtime-only operators
   • SIMATIC NET – required when S7 channels are used (IM151-8 PN/DP is one such case)
4. Force a re-evaluation: log off, log on, then start WinCC Explorer via right-click → Run as administrator on the first launch only.

5. DCOM and COM Security Adjustments

The SIMATIC HMI channel DLLs and the WinCC Graphics Runtime use out-of-process COM calls. Windows 7 x64 enforces stricter default DCOM permissions than Windows XP, which causes "access denied" dialogs that resemble user-rights failures but originate in the COM security descriptor.

1. Launch dcomcnfg → Component Services → Computers → My Computer.
2. Right-click My Computer → Properties → Default Properties tab:
   • Enable Distributed COM on this computer: checked
   • Default Authentication Level: Connect
   • Default Impersonation Level: Identify
3. Switch to the COM Security tab:
   • Access Permissions → Edit Limits: add the local group SIMATIC HMI with Local Access = Allow and Remote Access = Allow.
   • Launch and Activation Permissions → Edit Limits: add the same group with Local Launch, Remote Launch, Local Activation, and Remote Activation = Allow.
4. Locate the WinCC-specific DCOM applications under DCOM Config and apply the same ACL to the listed application IDs:
   • {EtherNet/IP - WinCC RT} entries
   • CCAlgRtServer.exe (Alarm Logging Runtime)
   • CCArchiveManager.exe (Tag Logging Runtime)
   • CCMsgServer.exe
5. Reboot the station. A restart is required because the DCOM service host caches the SD at process start.

6. PG/PC Interface Configuration for IM151-8 PN/DP

The IM151-8 PN/DP is an ET 200S head-end module that exposes a PROFINET interface (PN) and a PROFIBUS-DP slave interface. To reach it from WinCC, the host CP and access point must be assigned correctly. The PG/PC Interface tool (SIMATIC NET → Communication Settings, or Start → Siemens Automation → SIMATIC → SIMATIC NET → Communication Settings) is the only tool that writes the registry keys WinCC reads.

For the IM151-8 PN/DP, point S7ONLINE at the network interface that has physical link to the device and verify the IP/subnet matches the IM151 default of 192.168.0.1 / 255.255.255.0. Set the IM151's PROFINET device name (e.g. im151-8) either from Step 7 HW Config → PLC → Ethernet → Edit Ethernet Node or from the device's web front-end at port 80.

1. Open Set PG/PC Interface, select CP_HMI_1 → .IE General.
2. Click Properties → Ethernet Address → IP Protocol: enter the host IP, subnet mask, and (optionally) router. Disable DHCP for the IE General entry unless the host is DHCP-managed.
3. From a command prompt, ping the IM151:

   ping 192.168.0.1 -n 4

   A reply confirms Layer 3; an ARP-only response suggests a switch port is administratively down.
4. From Step 7, choose PLC → Online → Accessible Nodes. The IM151-8 should appear with its PROFINET device name and MAC address 00-0E-8C-....
5. In WinCC Explorer, add a SIMATIC S7 PROTOCOL SUITE driver, choose TCP/IP connection, and enter the IM151's IP and rack/slot (0 / 2 for the integrated CPU of the IM151-8 PN/DP).

7. Project Migration from x86 to x64

A project authored on a 32-bit Windows 7 host can be opened on a 64-bit host without conversion, provided the destination is running the same WinCC version and SP level (here, 7.0 SP3). The error in the symptom report is not a binary format mismatch — it is a security-token mismatch. Carry out the migration as follows:

1. On the 32-bit host, perform a File → Make Backup of the project to a removable medium. Do not copy the live project directory while WinCC Runtime is running — the .ldf log file will be inconsistent.
2. Copy the .zip backup to the x64 host into a path without spaces, e.g. D:\WinCC_Projects.
3. Confirm the user performing the restore is a member of SIMATIC HMI\Administrator on the x64 host.
4. Open WinCC Explorer → File → Retrieve, browse to the backup, and restore. WinCC will create a new project directory and re-bind the local SQL Server (WinCC_CC_ProjectDB_<timestamp> instance).
5. Open the restored project, re-enter the WinCC User Administrator password store, and re-assign the runtime user.

8. Step 7 / Simatic Manager Coexistence

Step 7 (Simatic Manager) can be installed on the same x64 host as WinCC 7.0 SP3, but the order matters and the version range is restricted. The accepted coexistence on Windows 7 x64 is:

If the Step 7 install was performed first, it creates the SIMATIC NET group, which WinCC reuses. If WinCC was installed first, the Step 7 installer reuses the existing group. In both cases, run the Set PG/PC Interface tool from the Simatic Manager tree (not from the WinCC tree) to keep the registry writes consistent.

9. Clean Uninstall of WinCC 7.0 SP3

A clean uninstall is required whenever the install path is wrong, the user-rights groups are missing, or the project cannot be opened even after the user-group remediation. The procedure removes all registry keys, the CC-prefixed services, and the SQLANY / WinCCInstance databases.

1. Stop all WinCC services from services.msc:

   CCAgent.exe
   CCEServer.exe
   CCLicenseServer.exe
   CCMsgServer.exe
   CCAlgRtServer.exe
   CCArchiveManager.exe
   CCRTProxy.exe

2. Run the official uninstaller first:

   "C:\Program Files (x86)\Siemens\Automation\WinCC\Setup\Setup.exe" /uninstall

3. If the uninstaller hangs or aborts, fall back to the Programs and Features entry "SIMATIC WinCC 7.0 SP3".
4. Remove leftover files — delete the install tree and project tree manually:

   rmdir /S /Q "C:\Program Files (x86)\Siemens"
   rmdir /S /Q "C:\Siemens\WinCC\Projects"
   rmdir /S /Q "C:\WinCC_Projects"

5. Clean the registry. Back up the hive first:

   reg export HKLM\SOFTWARE\Wow6432Node\Siemens HKLM_Siemens_backup.reg /y
   reg delete HKLM\SOFTWARE\Wow6432Node\Siemens /f
   reg delete HKLM\SOFTWARE\Siemens\Automation /f

6. Drop any orphaned WinCCInstance services and the SIMATIC WinCC CC_ProjectDB SQL instance from regedit → HKLM\SYSTEM\CurrentControlSet\Services and from the SQL Server Configuration Manager.
7. Reboot, then re-install into the default 32-bit path C:\Program Files (x86)\Siemens\Automation\WinCC.

10. Verification Matrix

Run the checks below in the order shown. Each step is binary; if it fails, stop and remediate before moving on.

11. Troubleshooting Matrix

12. Frequently Asked Questions