WinCC Service Mode Fails on Domain Controller: Root Cause and Fix

When deploying a WinCC V15 (or current TIA Portal V20) Runtime Professional client/server configuration, engineers frequently attempt to host the WinCC Server on a Windows Server 2012 R2 host that simultaneously acts as an Active Directory Domain Controller. The WinCC configuration tool appears to accept a service-mode logon of the form DOMAIN\wincc-server, but on the next dialog the checkbox clears itself or the dialog reports "password or user account is wrong," even when the account exists, is unlocked, and is a member of the local Simatic HMI group.

The root cause is not a credential, a group-policy, or a service-pack issue. Siemens does not release any version of TIA Portal (including V15, V15.1, V16, V17, V18, V19, or V20) for installation on a Microsoft Active Directory Domain Controller. The Service Mode logon fails because the operating-system role is unsupported, regardless of whether the supplied credentials are valid.

1. Affected Products, Versions, and Operating Systems

The unsupported-Domain-Controller rule applies across the following product matrix as published in the Siemens TIA Portal installation notes and the WinCC Runtime Professional system manuals:

Both single-station and distributed (client/server) configurations inherit the restriction. The Domain Controller limitation is independent of WinCC being used as a client, server, or redundant pair.

2. Symptom Matrix: How the Failure Presents

Although the underlying cause is the same, the WinCC Configuration Studio / WinCC Explorer surfaces the problem in three different ways depending on the OS build, the UAC setting, and the cumulative update level. Use the table below to triage quickly in the field.

3. Why Service Mode Fails on a Domain Controller

WinCC Runtime Professional uses the Windows Service Control Manager (SCM) to launch its data-manager, redundancy-sync, SQL-Express (WinCC_DB) and web-navigator services under a non-interactive logon. The SCM call chain is:

1. WinCC Configuration Studio writes the credential pair to HKLM\SOFTWARE\Wow6432Node\Siemens\WinCCRT\ServiceMode via the CCConfigStudio.exe process.
2. SCM opens a service-principal handle and validates the supplied domain account against Active Directory using LogonUser.
3. On a Domain Controller, the SeServiceLogonRight policy is applied through the Default Domain Controllers Policy, which removes the user right from regular user accounts and re-assigns it to the built-in Domain Admins and Authenticated Users groups in a way that conflicts with the SCM API WinCC uses.
4. Because CCConfigStudio.exe cannot confirm the right, it either silently clears the checkbox or returns a generic "wrong user / password" error string.

In addition, the installer's prerequisite check (Siemens.TIA.SetupPrerequisiteCheck.dll) explicitly probes for the registry value HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters. If the value Install From Media is present (which it is on every DC) the install either aborts or installs without registering the WinCC service hooks, leaving the operator to discover the failure post-install.

4. Pre-Flight Checklist Before Redeploying

Before changing the production topology, verify the following items on the affected host. Capture screenshots of each so they can be attached to the change-management ticket.

1. Open cmd as Administrator and run netdom query fsmo to confirm whether the host currently owns any FSMO role. If the output is non-empty, the host is a DC.
2. Run dsregcmd /status on Windows Server 2016+ to confirm the DomainRole line reports BackUp or Primary.
3. Check Control Panel > Programs > Programs and Features for any TIA Portal or WinCC entries that are already installed on the DC. These must be removed with the Siemens uninstaller (Start > Siemens Automation > Uninstall) before demotion.
4. Confirm the AD account wincc-server is created in Active Directory Users and Computers, the password is set to Never Expire, and the account is a member of the Simatic HMI local group on the target member server (the group is created automatically by the WinCC installer).
5. Verify the secure channel between any existing DCs and the new member server is healthy. Use the procedure from the Microsoft knowledge base for repairing a broken secure channel if nltest /sc_query:<domain> reports STATUS_TRUSTED_DOMAIN_FAILURE.

5. Workaround Architecture: Split the Roles

The supported way to deliver the same logical architecture (WinCC clients → WinCC server → SQL backend) is to keep the DC and the WinCC Server on different physical or virtual machines. The minimum topology that satisfies the Siemens release is:

The account DOMAIN\wincc-server then lives in the regular user container of AD, is added to the local Simatic HMI group on WCCSVR01, and is granted the Log on as a service right through the default domain policy (no special handling required).

6. Configuring Service Mode on a Member Server (TIA V15 / V20)

Once the WinCC Server is running on a member server, the service-mode configuration follows the standard Siemens procedure. The exact dialog path differs slightly between TIA V15 and the current TIA V20 cloud documentation; both flows are reproduced below.

6.1 TIA Portal V15 / V15.1 (WinCC RT Professional)

1. Open the WinCC project in the TIA Portal and compile it.
2. From the project tree, right-click the RT Professional device and choose Load preview > Load to target system.
3. In the Load preview dialog, check Enable service mode.
4. Enter DOMAIN\wincc-server in the User field and the corresponding password in the Password field.
5. Click Apply and then Load. The runtime starts in service mode and persists across reboots.

6.2 TIA Portal V20 (WinCC RT Professional)

Per the Siemens TIA Portal V20 cloud manual — Configuring service mode (RT Professional), the path is:

1. Open the WinCC Explorer on the WinCC Server.
2. Right-click the project node and choose Properties.
3. Switch to the Operating mode tab.
4. Select the Start as service check box.
5. Enter the logon data in the Operating mode area (user: DOMAIN\wincc-server, password, password confirmation).
6. Click Apply and confirm with OK.
7. Restart the WinCC data-manager service (CCDataMgr.exe) to apply the change immediately without a full OS reboot.

The credential pair is written to HKLM\SOFTWARE\Wow6432Node\Siemens\Automation\WinCCRT\Runtime\ServiceMode and is also reflected in the SIMATIC WinCC RT Professional service Log On tab.

7. AD Account Requirements for the WinCC Service Logon

The following attributes must be set on the wincc-server AD user object. They are not optional; omitting any one of them causes the same credential error seen on the DC host.

8. Optional: Promoting the Member Server Without Re-installing WinCC

If the project is already live, the lowest-risk migration path is:

1. Stop the WinCC services: net stop "SIMATIC WinCC RT Professional" and net stop "CCDataMgr".
2. Back up the WinCC project folder, the WinCC_DB SQL databases, and the registry hive HKLM\SOFTWARE\Wow6432Node\Siemens to a network share.
3. Open Server Manager > Manage > Remove Roles and Features and remove the Active Directory Domain Services role. The host demotes automatically to a member server and reboots.
4. After reboot, re-join the host to the domain if it was dis-joined automatically, and add DOMAIN\wincc-server to the local Simatic HMI group with net localgroup "Simatic HMI" /add DOMAIN\wincc-server.
5. Restore the registry backup and re-launch WinCC Explorer. Re-enter the service-mode credentials as in Section 6.
6. Start the WinCC services and confirm a client logon.

If the host must remain a DC (for example, in a small single-server pilot), the only other option is to install WinCC on a separate member server and use the Siemens support entry 78346833 — Installation and operation of WinCC in a Microsoft domain environment as the reference architecture.

9. Verification Steps After Re-Configuration

Run the following checks in order. Any failure should be cleared before bringing the HMI screens back online for operators.

1. Open services.msc and confirm SIMATIC WinCC RT Professional and CCDataMgr show Running with Log On As = DOMAIN\wincc-server.
2. Open the Application event log and look for Event ID 100 from source WinCCRT stating "Runtime started in service mode." Absence of this event indicates the runtime is still in interactive mode.
3. From a WinCC client, launch the client runtime. Connection should complete in < 5 s on a LAN and the client should reconnect automatically after a forced reboot of the server.
4. Trigger a tag change in the PLC and confirm it is archived in WinCC_DB.dbo.MSG_archive within the configured acquisition cycle.
5. Reboot the server and confirm the WinCC service starts before any operator is logged in to the console. This is the defining characteristic of a working service-mode deployment.

10. Common Pitfalls and How to Avoid Them

11. Related Microsoft-Side Checks

If the WinCC service is now starting on a member server but still fails on reboot, the failure may be on the AD side, not on the WinCC side. The two Microsoft knowledge-base articles below cover the most common companion failures:

• ISMServ.exe does not start when a domain controller starts — relevant when the WinCC server boots at the same time as a DC and the Intersite Messaging service stalls, blocking replication-dependent logon.
• Identify and repair a broken secure channel on an Active Directory domain controller — the procedure applies equally to member servers; run nltest /sc_query:<domain> first to confirm the channel is healthy before troubleshooting WinCC.

12. Summary

WinCC Runtime Professional will not run as a Windows service on a host that is an Active Directory Domain Controller. The "wrong user name or password" error and the self-clearing Enable service mode checkbox are not credential problems; they are a direct consequence of an unsupported installation. The fix is to demote the host to a member server (preferred) or to move the WinCC Server role to a separate, domain-joined member server. Once the host is a non-DC member server, the standard TIA V15/V20 service-mode configuration completes in under five minutes and the runtime starts cleanly across reboots.