WinCC 7.x Server/Client Setup and Migration Configuration Guide

WinCC 7.x Server/Client Setup, User Administration, and Migration Guide

Siemens WinCC 7.x supports two distinct distributed HMI/SCADA architectures: the Multi-Client (a client that operates a downloaded server package and runs its own local project) and the Uni-Client (a thin client that connects to the server project without holding any local project). Selecting, identifying, and commissioning the correct topology is the foundation for any upgrade from WinCC 7.0 to WinCC 7.4 Update 1 or later, and it dictates whether the migration must touch one project or two. This reference walks through architecture selection, user-administration prerequisites (the equal-account rule), SIMATIC Shell Interconnect wiring, server-package generation, and field-verified remediation of the most common credential failures.

1. WinCC 7.x Distributed Architecture Overview

WinCC V7 is structured around a Server holding the master project (graphics, tags, archives, alarms, scripts, user administration) and one or more Clients that visualize runtime data. The WinCC Explorer on the server is the engineering entry point; clients either point at the server through a configured network share or download a copy of the server's runtime data and operate it locally.

The official configuration reference is the Siemens manual 109771695 - Client/Server Systems - Configuration WinCC V7.5. Although titled for V7.5, the architecture, dialogs, and naming conventions are unchanged from V7.0 through V7.4 SPx. The same document family covers WinCC V7.4 in entry 109772015 and the upgrade-path documentation in entry 89378679 - WinCC V7.4 Installation/Release Notes.

2. Multi-Client vs. Uni-Client: Identifying Your Topology

The single most important decision point before any upgrade or reconfiguration is identifying which client topology is currently deployed. Use the matrix below.

2.1 How to Identify Which Type You Have

1. On the client PC, open the WinCC project folder (typically C:\Program Files (x86)\Siemens\Automation\WinCC\WinCCProjects or the custom project path).
2. If a project *.mcp file exists and the WinCC Explorer opens it directly on the client, you have a Multi-Client (Type 1).
3. If no .mcp file exists on the client and WinCC RT launches into a server-selection dialog, you have a Uni-Client (Type 2).
4. Confirm by opening WinCC Explorer on the server: under Computer, if the client PC hostname is listed as a child node with "Standard Server" or "Preferred Server" reference, you are running Type 2.

3. WinCC 7.0 to 7.4 Update 1 Migration Path

The upgrade from V7.0 to V7.4 SP1 is an in-place major upgrade and must be performed on the server first. Each project must be opened and saved with the new version so that tag, archive, and script definitions are normalized to the V7.4 schema.

3.1 Supported Upgrade Matrix

Reference the release notes WinCC V7.4 - Service Pack & Release Notes for the exact SQL Server / Windows compatibility matrix (V7.4 SP1 supports Windows Server 2012 R2 / 2016 / 2019 and SQL Server 2014 / 2016 / 2017 depending on the patch level).

3.2 Pre-Migration Checklist

• Document the OS version (32 vs 64-bit), the installed WinCC version, and the SP/Update level of both PCs.
• Back up the full project folder, archive database folder, and the WinCC registry branch HKLM\SOFTWARE\Wow6432Node\Siemens\Automation\WinCC.
• Export the User Administrator table via WinCC Explorer -> User Administrator -> File -> Export.
• Verify that both PCs have a common local user with identical name and identical password (see Section 4).
• Ensure the server share hosting the project (default \\<SERVER>\WinCC_Projects\<ProjectName>) is reachable from the client and that both the share ACL and NTFS ACL grant Read/Write to the shared user.

4. The Equal-Account Rule (User Administration Prerequisite)

WinCC remote activation relies on the SIMATIC Shell mechanism, which in turn relies on the WinCC service running under a domain or local account that can authenticate against the project share. If the accounts differ between server and client, the SIMATIC Shell will prompt for credentials on every operation and will fail Interconnect with a generic WinCC RT error dialog.

4.1 Account Architecture

4.2 Configuring the Runtime User

1. Open WinCC Explorer on the server.
2. Open User Administrator.
3. Create or modify the runtime user. Set the Operating system logon to Yes and configure the same Windows account name and password as the local account on the client PC.
4. Assign the right Configure remote (number 1002 in WinCC right bitset) to this user. This right permits the Uni-Client to attach to and run the server project.
5. Repeat the same User Administrator configuration on the client if it is a Multi-Client (Type 1); user tables may differ but the OS logon account must match.

5. SIMATIC Shell Interconnect - The Server-Client Link

SIMATIC Shell is the Windows Explorer integration that lets a client PC browse WinCC servers on the network and trigger remote activation/deactivation. It is installed automatically with the WinCC client option and registers a COM object that WinCC Explorer uses for the project picker.

5.1 Configuring Interconnect on the Client

1. On the client PC, open Windows Explorer and navigate to SIMATIC Shell in the folder tree (it appears as a virtual folder under "Network" or as a top-level namespace item).
2. Double-click SIMATIC Shell. The right pane lists reachable WinCC servers.
3. Right-click the target server computer and select Interconnect.
4. When prompted, enter the WinCC User Administrator runtime user credentials (NOT the local Windows account unless the user was created with OS logon mode).
5. If the credentials are accepted, the server project appears under the server's SIMATIC Shell entry and can be activated from the client.

5.2 Verifying the Interconnect Result

• A successful Interconnect registers the server computer in the client's registry under HKCU\Software\Siemens\Automation\WinCC\Interconnect (or under HKLM on x64 deployments).
• After Interconnect, restarting the WinCC RT on the client should display the server project's start screen automatically (Uni-Client) or load the previously imported package (Multi-Client).
• If the client fails to start the server project after Interconnect, inspect the Windows Event Log (Application channel) for source "CCClient" messages - they contain the underlying error code.

6. Server Package Generation (Multi-Client Only)

A Multi-Client requires a "server package" - a snapshot of the server's compiled graphics, tag database, archive layout, and alarm configuration - to be loaded into the local client project. The package is generated on the server and copied to the client.

6.1 Generation Procedure

1. On the server, open WinCC Explorer and load the server project.
2. Right-click Server Data -> Create Package (or via menu Tools -> Server Data -> Create Server Package).
3. Select the target client computer name from the dropdown.
4. Choose the package scope: Complete (full project) or Delta (changes only).
5. Click Create. The package is written to <ProjectPath>\<ServerName>_<ClientName>.pck.
6. Copy the .pck file to the client PC and import it into the local client project via Server Data -> Load Package.

7. Migration Workflow Step-by-Step

1. Backup the existing V7.0 project on the server.
2. Uninstall WinCC V7.0 on the server. Reboot.
3. Install WinCC V7.4 SP1 (or later) including the Server option.
4. Open the project in V7.4 SP1. The Project Migrator dialog appears. Follow prompts to migrate tag database, archive database, and scripts.
5. Validate the migrated project by activating Runtime locally on the server.
6. Generate a fresh server package if any client is a Multi-Client.
7. On each Multi-Client PC, uninstall WinCC V7.0 and install V7.4 SP1 client option. Migrate the local client project using the new package.
8. On each Uni-Client PC, uninstall WinCC V7.0 client option and install V7.4 SP1 client option. The client project on disk is no longer required; the client will read the migrated server project directly.
9. Re-establish SIMATIC Shell Interconnect from each client. Use the WinCC User Administrator runtime user credentials (not the OS account unless OS logon is enabled).
10. Activate Runtime on the server, then verify that each client can launch and view live data.

8. Verification Checklist

9. Troubleshooting Matrix

10. Security and Hardening Notes

Leaving local administrator accounts with no password on production WinCC systems is unacceptable in modern OT environments. Siemens recommends the following hardening baseline for any V7.x server/client installation:

• Use domain accounts instead of local accounts so password policy (length, rotation, lockout) is enforced centrally via Active Directory.
• Disable interactive login for the WinCC service account on operator HMI panels.
• Restrict the WinCC project share to the specific service account; remove "Everyone" ACL.
• Enable Windows Firewall on both PCs; explicitly open only the WinCC ports (50523, 50524, 50525, 137/138/139 or 445 for SMB, 1433 for SQL Server if used).
• Encrypt the WinCC SQL archive database with a passphrase stored on a removable media or TPM, following Siemens recommendation in WinCC V7.4 Security Guidelines.
• Apply Microsoft security patches monthly; WinCC V7.4 SP1 is validated against Windows Server 2016 / 2019 cumulative updates through the dates noted in the Siemens compatibility tool.

11. Reference Links and Official Documentation

The following Siemens Knowledge Base and documentation entries are the authoritative sources for the procedures described above:

• Client/Server Systems - Configuration WinCC V7.5 (entry 109771695)
• WinCC V7.4 - Service Pack & Release Notes (entry 109772015)
• WinCC V7.4 Installation/Release Notes (entry 89378679)
• WinCC V7.4 SP1 - Working with WinCC Explorer
• SIMATIC HMI WinCC V7 - Migration