WinCC Flexible 2005: Resolving 3-Strike User Password Lockout

WinCC Flexible 2005: Resolving 3-Strike User Password Lockout

SIMATIC WinCC flexible 2005 Runtime enforces a hard security policy: after three consecutive failed password entries, the affected user account is disabled and can no longer authenticate. There is no configuration switch in the engineering tool to disable this behavior, and there is no native method to add a warning dialog before the third attempt. Engineers who deploy WinCC flexible on PC Runtime or on operator panels (OP 77, TP 170, TP 177, MP 177, MP 277, MP 377, etc.) must therefore implement recovery procedures and operational discipline to avoid extended downtime when an account is locked.

This reference covers the underlying mechanism, the supported recovery paths for both PC Runtime and panel Runtime, an automation script for unattended restore, the User View re-enable procedure, the export/import workflow for user administration, the multi-admin operational pattern, the documented limitations, and a troubleshooting matrix keyed to the most common lockout scenarios in the field.

1. Problem Statement and Scope

When a user enters an incorrect password three times in a row in a WinCC flexible Runtime login dialog, the runtime engine sets the account status to disabled in its user administration database. Symptoms observed in production:

• The login button returns "User not authorized" or "Login failed" even when the correct password is typed immediately afterward.
• The account name still appears in the user list but is greyed out or marked inactive in the User View.
• If the only Administrator account is locked, the system is effectively unmanageable without a file-level restore.
• On panels, the lockout is more likely because of small touch targets and numeric input methods that invite typos.

Scope of this article:

2. Root Cause: Why WinCC Flexible Locks Accounts

WinCC flexible stores the user administration in a binary password file inside the Runtime project directory. The file is keyed against the project handle, and the runtime engine maintains a per-user failure counter. The lockout state machine is intentionally simple and not configurable:

1. Failed authentication: increment counter for the user name entered.
2. Successful authentication (any user): counters are not reset (counter is per-user, not global).
3. Counter reaches 3: set user status bit to disabled; persist to PDATA.pwl.
4. Disabled user attempts login: login is rejected without incrementing the counter (user is already disabled).

Because the counter is persisted, restarting the Runtime service or rebooting the panel does not clear a lockout. The state survives power cycles, which is by design: a brute-force attacker who simply reboots the device must not get a fresh attempt budget.

The relevant SIMATIC WinCC flexible 2005 System Manual describes the user administration model in chapter "User administration / Password protection". The runtime internal counter threshold is not exposed through the WinCC flexible engineering interface; it is a hard-coded constant in the runtime kernel.

3. PC Runtime Recovery via .pwl / .pwx File Restore

The PC Runtime stores the user administration in two related artifacts:

• <ProjectName>.pwx — the compiled runtime project, contains user list, group memberships, and passwords in encrypted form.
• PDATA.pwl — the persistent user data file that survives project reloads; this is the file that records the lockout state.

Every time the Runtime is started or a project is transferred, WinCC flexible also writes a copy of PDATA.pwl to the Backup subfolder of the project. This backup copy is the recovery anchor.

Default project paths (Windows XP / Windows 7 / Windows 10, 32-bit and 64-bit where supported):

C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2005 Runtime\Projects\<ProjectName>\<ProjectName>.pwx
C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2005 Runtime\Projects\<ProjectName>\PDATA.pwl
C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2005 Runtime\Projects\<ProjectName>\Backup\PDATA.pwl

On 64-bit Windows installations the path is unchanged because WinCC flexible 2005 installs into Program Files (x86). Verify the actual path with:

dir /s /b "C:\Program Files\Siemens\SIMATIC WinCC flexible" PDATA.pwl

3.1 Manual Recovery Procedure (PC Runtime)

1. Stop the WinCC flexible Runtime service. Open Start → Control Panel → Administrative Tools → Services and stop SIMATIC WinCC flexible Runtime, or close the Runtime window and confirm the background process has exited.
2. Open Windows Explorer and navigate to the project folder above.
3. Verify the backup file exists: ...\Projects\<ProjectName>\Backup\PDATA.pwl. If the backup is older than the current lockout, do not use it; obtain a more recent backup instead.
4. Copy the backup file over the live file:

   copy /Y "C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2005 Runtime\Projects\<ProjectName>\Backup\PDATA.pwl" ^
          "C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2005 Runtime\Projects\<ProjectName>\PDATA.pwl"

5. Restart the Runtime. The user administration is read from the restored PDATA.pwl and the locked account is once again active.

3.2 Restoring From a .pwx-Only Project Transfer

If the only available backup is a .pwx project file from the engineering system, transfer it back with WinCC flexible Explorer or the transfer tool. This will reset all Runtime-side changes (alarm logs, recipe data, user administration) to the engineering baseline. Use this only as a last resort, and capture the current live PDATA.pwl first:

copy "...\Projects\<ProjectName>\PDATA.pwl" C:\Temp\PDATA.locked.bak

4. Automated Recovery Using VBScript

For deployments where lockouts happen regularly — for example, a remote machine whose only operator is unfamiliar with the panel — the restore can be wrapped in a VBScript that is run by an Administrator from a shortcut or invoked over Remote Desktop. The script below copies the backup PDATA.pwl over the live file and then relaunches the Runtime:

' WinCC flexible 2005 - PDATA.pwl restore utility
' Run as Administrator. Adjust paths to match the local installation.
Option Explicit

Dim fso, projectDir, backupDir
projectDir = "C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2005 Runtime\Projects\"
backupDir  = projectDir & "Backup\PDATA.pwl"

Set fso = CreateObject("Scripting.FileSystemObject")

If Not fso.FileExists(backupDir) Then
    WScript.Echo "Backup PDATA.pwl not found at: " & backupDir
    WScript.Quit 1
End If

' Stop the Runtime (best-effort; ignore errors if it is not running)
On Error Resume Next
Dim shell
Set shell = CreateObject("WScript.Shell")
shell.Run "taskkill /F /IM CCAgent.exe /T", 0, True
shell.Run "taskkill /F /IM CCEServer.exe /T", 0, True
shell.Run "taskkill /F /IM WinCCflexibleRT.exe /T", 0, True
On Error Goto 0

' Brief delay to let file handles release
WScript.Sleep 2000

' Copy the backup over the live PDATA.pwl
On Error Resume Next
fso.CopyFile backupDir, projectDir & "PDATA.pwl", True
If Err.Number <> 0 Then
    WScript.Echo "Copy failed: " & Err.Description
    WScript.Quit 2
End If
On Error Goto 0

' Restart the Runtime
shell.Run Chr(34) & projectDir & "..\..\..\..\WinCC flexible 2005 Runtime\WinCCflexibleRT.exe" & Chr(34) & " " & _
             Chr(34) & projectDir & "<ProjectName>.pwx" & Chr(34), 0, False

WScript.Echo "PDATA.pwl restored from backup. Runtime restarting."
WScript.Quit 0

Usage notes for the script:

• Replace <ProjectName> with the actual project name; the .pwx file name matches the project name in the engineering system.
• The taskkill calls must come before the file copy; PDATA.pwl is held open by CCAgent.exe while the Runtime is active.
• Wrap the script in a scheduled task that runs as Administrator if you intend to trigger it remotely over PowerShell Remoting or PsExec.
• Schedule a schtasks /create job that exports PDATA.pwl to a known network share on every clean Runtime startup, so a recent backup is always available for restore.

5. Panel Runtime Recovery via Memory Card Backup

On operator panels the PDATA.pwl equivalent is stored in the panel's internal flash. The only supported recovery path is a full backup-restore of the panel image, which is performed with ProSave (bundled with WinCC flexible) or with the panel's own service menu.

5.1 ProSave Restore Procedure

1. Connect the engineering PC to the panel via MPI/PROFIBUS, Ethernet, or USB-PPI, matching the panel's transfer channel.
2. Launch ProSave from Start → SIMATIC → ProSave.
3. Select the device type and connection.
4. Switch to the Restore tab.
5. Select Complete restore with user administration. This option is what brings back the original PDATA.pwl state — a partial restore that excludes user data will not clear the lockout.
6. Click Transfer. The panel reboots into transfer mode, receives the image, and restarts Runtime with the original user list.

5.2 Memory Card Restore Procedure

For panels equipped with an MMC/CF card slot (MP 177, MP 277, MP 377, TP 177, TP 277, TP 377), the same image can be restored from a memory card:

1. Insert the memory card containing the panel backup into the slot.
2. Power on the panel while holding the Service or Control Panel button (refer to the panel's operating instructions for the exact button — on MP 277 it is the CF/SD button held at boot).
3. Select Restore from Card.
4. Confirm the restore; the panel writes the image back to internal flash and reboots.

6. Re-enabling a Locked Account from Runtime User View

If an Administrator account is still active, the lockout can be cleared without a file restore. This is the cleanest recovery path and the one to use whenever possible.

1. Log in to the Runtime as an Administrator.
2. Open the User View screen (added to the project by the engineer; typically named "User administration" or "User View").
3. The locked user is shown with status Disabled.
4. Select the user row and press Enable (or the equivalent toolbar button — the label varies between project localizations).
5. Confirm. The user is once again active; the internal failure counter is implicitly reset because the account transitions out of the disabled state.

This is the only operation that clears the lockout without restarting Runtime or restoring a file. The advantage is that no other session state is affected — recipes, alarm logs, and tags in progress are untouched.

If the only Administrator is locked out, the User View path is closed. The recovery reverts to the file-level restore procedures in Sections 3, 4, or 5.

7. User Administration Export/Import Workflow

For multi-machine fleets, hand-managing each panel's user list is brittle. WinCC flexible provides a built-in export/import of the user administration that can be reused across projects of the same template.

1. In the engineering project, open Project → User Administration.
2. Click Export and save to a .csv file with the columns: User name, Group, Password (hashed), Comment.
3. Distribute the .csv file to the target machine(s).
4. On the target, open User Administration and click Import. WinCC flexible prompts to confirm password reset and account activation.
5. Compile and transfer the project.

Important: the exported file does not contain lockout state. It always represents an "all-enabled, fresh attempt budget" baseline. Importing is therefore an effective global reset for every user in the project.

8. Multi-Admin Strategy and Operational Best Practices

The single biggest cause of "machine is bricked" calls on WinCC flexible deployments is a single Administrator who locks themselves out. The pattern below has been adopted in many production fleets and is recommended for every deployment:

1. Two Administrators, minimum. One for the customer, one for the integrator. Distribute credentials out-of-band; do not email them.
2. Keep a known-good backup of PDATA.pwl in a versioned location (for example \\fileserver\hmi-backups\<ProjectName>\<YYYY-MM-DD>\PDATA.pwl). Refresh on every project change.
3. Schedule a card backup on every panel after commissioning, and store the card in a labelled sleeve near the panel.
4. Use a long, machine-typed password for the customer Administrator. Avoid numeric-only passwords on numeric-only panels — the lack of alphabetic characters makes brute force possible if the lockout is removed, but a longer numeric password raises the entropy dramatically.
5. Train operators on the "three strikes" rule explicitly. The most common operator-side cause of lockout is re-typing what they think is the password with Caps Lock on, or with the panel in numeric mode when the password has letters.
6. Add a script to export PDATA.pwl on every clean Runtime startup, so the most recent good state is always one click away.
7. Document the recovery steps in a laminated card attached to the cabinet.

9. Confirmed Limitations: No Native Lockout Disable

Several workarounds are sometimes suggested in the field. Each has been investigated; the limitations are documented here to save time.

For sites where a softer lockout is essential, the supported migration is to SIMATIC WinCC (TIA Portal) / WinCC Unified, where the user administration has a configurable lockout policy. WinCC flexible 2005 cannot be modified to provide this.

10. Relationship to Windows OS Account Policies

WinCC flexible Runtime on PC is a Windows application, but the user administration dialog is implemented entirely inside the Runtime. It does not read or write to the Windows Security Account Manager (SAM) and is not affected by secpol.msc account lockout policies. Adjusting the OS account lockout threshold will not change the 3-strike behavior of the HMI login.

Conversely, an OS-level password policy (minimum length, complexity) does not apply to WinCC flexible users. The HMI password rules are configured under Project → User Administration → Password Policy in the engineering system.

11. Troubleshooting Matrix

12. Field-Proven Sequence: End-to-End Lockout Recovery

The procedure below has been validated on PC Runtime and on MP 277 panels. It is the recommended runbook for a first-line support engineer who is paged with a locked-out HMI.

1. Confirm the symptom. Try to log in as the locked user; confirm the error is "Login failed" or equivalent and not a tag / connection error.
2. Check Admin availability. If an Admin can log in, go to the User View, re-enable the user, and verify with one successful login as the recovered user. Done.
3. No Admin available on PC Runtime. Stop the Runtime service. As Administrator, copy the Backup\PDATA.pwl over the live file. Restart Runtime. Verify the recovered user can log in.
4. No Admin available on a panel. Insert the labelled card backup. Boot the panel into service mode. Restore the full image including user administration. Verify the recovered user can log in.
5. Post-recovery: capture a fresh backup. Once the user is active, immediately take a new card backup (panels) or copy PDATA.pwl to the network share (PC) so the next incident has a known-good starting point.
6. Post-recovery: operator retraining. Walk the operator through a successful login; reinforce the 3-strike rule.

13. Verification Checklist

Use this checklist before signing off a lockout recovery. Any unchecked item means the recovery is incomplete.

• [ ] Locked user can log in with the original password.
• [ ] Locked user's group membership and authorization levels are intact (not regressed to defaults).
• [ ] No other user is unexpectedly disabled (a too-old backup would have re-disabled recently active users).
• [ ] Recipes, alarm logs, and audit trails are unchanged (or their change is documented and accepted).
• [ ] A fresh backup has been taken and stored in the versioned location.
• [ ] The recovery event is logged in the site's HMI change log, with the operator, time, and method.
• [ ] The Administrator count is verified at two (or more) and credentials are stored in the password vault.

14. Related Siemens References

• SIMATIC WinCC flexible 2005 System Manual — chapter "User administration / Password protection".
• SIMATIC WinCC flexible 2005 Communication Manual — covers ProSave transfer and backup procedures.
• SIMATIC WinCC (TIA Portal) User Administration — relevant for migration planning; documents the configurable lockout policy in the newer platform.
• Siemens HMI Panel Operating Instructions index — per-panel service-mode button mapping for memory card restore.

FAQ