WinCC VBScript Launch External EXE Troubleshooting File Path

Overview

Calling an external executable from a WinCC picture button, menu toolbar button, or event handler is a common runtime requirement for legacy WinCC (TIA Portal predecessor, SIMATIC WinCC V7.x) projects. The typical implementation uses a VBScript action attached to the OnMTClick event of a user-defined toolbar item, the Click event of a button, or a global script C-/VBScript action triggered by a tag change.

The canonical implementation uses the Windows Script Host shell automation object to spawn the process:

Sub OnMTClick_Report(Item)
  Dim objWshShell
  Set objWshShell = CreateObject("Wscript.Shell")
  objWshShell.Run "OVEN.exe"
End Sub

When the runtime is started, the configured picture is loaded, and the operator clicks the toolbar entry, the script fails with a generic WinCC runtime dialog reading "not possible to open file" (German: "Datei kann nicht geöffnet werden"). The same script, when executed from a Windows command prompt or from a stand-alone .vbs file, runs without errors. This article documents every known cause, the diagnostic procedure, and verified fixes for WinCC 7.0 SP1, SP2, SP3, and SP4.

Problem Details

The reported case originated on a SIMATIC WinCC 7.0 SP1 station. A custom menu bar was configured with a Report entry. The OnMTClick_Report(Item) VBScript event was wired to instantiate Wscript.Shell and invoke Run "OVEN.exe". Clicking the toolbar entry produced the error dialog "not possible to open file" and the executable did not start.

Root Cause Analysis

WinCC runtime is not a stand-alone process; it runs as CCExplorer.exe with its own working directory and security context. The WinCC VBScript engine resolves relative paths against the project's startup directory (<Project>\GraCS\ or the runtime working folder), not the folder containing OVEN.exe. The most common root causes ranked by frequency in the field are:

1. Relative path resolution. objWshShell.Run "OVEN.exe" is resolved against the WinCC runtime working directory. The executable is therefore not found and the shell returns a path-not-found error which WinCC surfaces as "not possible to open file".
2. Whitespace or special characters in the path. Run parses its argument as a command line. A path such as C:\Program Files\My Oven\OVEN.exe is split at the first space and the shell tries to launch C:\Program as the program with the rest as arguments.
3. File association hijack. Per Microsoft: Running an .exe file starts a different program, a corrupted or redirected exefile association causes the shell to launch a different program, fail silently, or return access denied.
4. Malware infection / blocked execution. Per Microsoft Q&A: I can't open .exe files, an antivirus policy, AppLocker rule, Software Restriction Policy, or SRP can block the executable from starting even though the file exists.
5. Session 0 / interactive desktop mismatch. On Windows Server with the WinCC runtime installed as a service under CCAgent, the shell launches the process in a non-interactive session and the GUI window never reaches the operator's desktop.
6. Missing dependency (DLL, runtime). The executable depends on a side-by-side assembly, a Visual C++ runtime, or a third-party DLL that is not on the path of the WinCC service account.
7. Working directory not set. WshShell.Run with no third argument inherits the runtime working directory, which is the WinCC project directory and not the folder of the executable.
8. UAC elevation requirement. The target executable is marked requireAdministrator in its manifest; the WinCC runtime is not elevated, so the launch fails with E_ACCESSDENIED (HRESULT 0x80070005).

Solution 1: Use an Absolute, Fully Qualified Path

Always pass a full, absolute path. Relative paths are explicitly not supported by WshShell.Run in the WinCC runtime because the working directory is not the project folder of the called program.

Sub OnMTClick_Report(Item)
  Dim objWshShell
  Set objWshShell = CreateObject("Wscript.Shell")
  objWshShell.Run """C:\Program Files\Sequent\Reports\OVEN.exe""", 1, False
End Sub

The outer triple-quoting pattern ("""...""") is required by VBScript syntax to embed a single " character around the executable path. The second argument 1 requests a normal window; the third argument False returns control to the script immediately without waiting for the spawned process to exit.

Solution 2: Use a Project Tag for the Path

Hard-coding paths makes the project non-portable. Store the path in an internal WinCC tag and resolve it at runtime. This also allows the operator to change the path from the picture without recompiling the project.

' In WinCC tag management: create internal tag "ReportPath" (Text tag, length 255)
' Initial value: C:\Program Files\Sequent\Reports\OVEN.exe

Sub OnMTClick_Report(Item)
  Dim objWshShell, sPath
  Set objWshShell = CreateObject("Wscript.Shell")
  sPath = HMIRuntime.Tags("ReportPath").Read
  objWshShell.Run """" & sPath & """", 1, False
End Sub

Function ReportFileExists(ByVal sPath) As Boolean
  Dim fso
  Set fso = CreateObject("Scripting.FileSystemObject")
  ReportFileExists = fso.FileExists(sPath)
End Function

Solution 3: Set the Working Directory Explicitly

If OVEN.exe requires its companion files (INI, log, license) to be in the current directory, set the working directory using WshShell.CurrentDirectory before the call. WshShell.CurrentDirectory is writable inside the WinCC runtime process but does not affect the WinCC working directory itself.

Sub OnMTClick_Report(Item)
  Dim objWshShell
  Set objWshShell = CreateObject("Wscript.Shell")
  objWshShell.CurrentDirectory = "C:\Program Files\Sequent\Reports"
  objWshShell.Run """C:\Program Files\Sequent\Reports\OVEN.exe""", 1, False
End Sub

Solution 4: Repair the Windows .exe File Association

If the executable starts but a different program opens, or it does nothing at all, the HKCR\exefile shell\open\command key may be hijacked. Verify and repair using the procedures documented in Microsoft: Running an .exe file starts a different program:

1. Open regedit as Administrator.
2. Navigate to HKEY_CLASSES_ROOT\exefile\shell\open\command.
3. Confirm the default value is exactly: "%1" %*
4. Verify HKEY_CLASSES_ROOT\.exe default value is exefile.
5. Reboot the WinCC runtime station.

Microsoft's sfc /scannow procedure (run from an elevated command prompt) restores the original file association from the component store if the keys are missing or have been replaced by a malware payload. Refer to the linked KB article for the complete reg command-line restoration procedure.

Solution 5: Scan for Malware and Verify AV Exclusions

Many WinCC 7.0 SP1 stations are deployed on long-running Windows 7 / Server 2008 R2 installations that have accumulated years of policy drift. A virus or worm that rewrites exefile associations is a documented root cause per Microsoft Q&A: I can't open .exe files.

1. Run a full offline scan with the corporate antivirus boot media.
2. Add the WinCC project directory, the bin folder, and the target executable path to the AV exclusion list.
3. Review gpedit.msc > Computer Configuration > Windows Settings > Security Settings > Software Restriction Policies and remove any deny rule that matches OVEN.exe.
4. On managed desktops, also check AppLocker > Executable Rules and SRP Designated File Types for .exe tampering.

Solution 6: Verify Security Token and UAC Manifest

For applications built with the Visual Studio requireAdministrator linker option, the WinCC runtime process must be elevated. The WshShell.Run call does not invoke UAC; it fails with access denied. Two options exist:

1. Launch WinCC Runtime as Administrator: edit the WinCC Runtime shortcut on the engineering station, set Properties > Compatibility > Run as administrator. On production stations use the same setting in the scheduled task that starts CCExplorer.exe.
2. Replace WshShell.Run with ShellExecuteEx via an out-of-process COM wrapper that triggers UAC. This is rarely needed and is not supported in stock WinCC V7.x.

Solution 7: Reinstall or Repair WinCC

On a fresh installation the symptom can be a corrupted WinCC script host. Repair the install from the SIMATIC WinCC V7.0 SP1 setup:

1. Insert the WinCC V7.0 SP1 installation media.
2. Run Setup.exe and select Repair / Update.
3. Alternatively, upgrade to WinCC 7.0 SP2 to match the sample project referenced in the WinCC Information System.

Code Reference: Complete Working Templates

The following templates cover the three most common deployment patterns. All assume an internal text tag ReportPath and an internal binary tag ReportResult for diagnostic feedback.

Template A: Synchronous Launch with Path Validation

Sub OnMTClick_Report(Item)
  Dim objWshShell, objFso, sPath, iRC
  Set objFso = CreateObject("Scripting.FileSystemObject")
  sPath = HMIRuntime.Tags("ReportPath").Read
  If Not objFso.FileExists(sPath) Then
    HMIRuntime.Trace "Report: file not found - " & sPath & vbCrLf
    Exit Sub
  End If
  Set objWshShell = CreateObject("Wscript.Shell")
  iRC = objWshShell.Run("""" & sPath & """", 1, True)
  HMIRuntime.Tags("ReportResult").Write iRC
End Sub

Template B: Launch with Arguments

Sub OnMTClick_ReportWithArgs(Item)
  Dim objWshShell, sPath, sArgs
  sPath = """C:\Program Files\Sequent\Reports\OVEN.exe"""
  sArgs = """" & sPath & """ /batch /output:\"C:\Reports\today.pdf\""
  Set objWshShell = CreateObject("Wscript.Shell")
  objWshShell.Run sArgs, 1, False
End Sub

Template C: Launch Hidden for Output Capture

Sub OnMTClick_ReportHidden(Item)
  Dim objWshShell
  Set objWshShell = CreateObject("Wscript.Shell")
  objWshShell.Run "cmd /c """""""C:\Program Files\Sequent\Reports\OVEN.exe"""""" > """C:\Reports\oven.log""" 2>&1""", 0, True
End Sub

Diagnostic Procedure

Use the following sequence to isolate the failure on a production station without disrupting the running project.

1. Confirm the script fires. Enable the WinCC script diagnostic by setting the registry value HKLM\SOFTWARE\Siemens\WinCC\ScriptDiagnostic = 1. Open the GDI diagnostic tool (ApDiag.exe) and observe the trace line. If the trace is empty, the action is not wired correctly; double-check the toolbar editor mapping under Project Properties > User-defined toolbar.
2. Capture the exact error. Wrap the Run call in an On Error Resume Next block and write Err.Number and Err.Description to a tag or to the trace log.
3. Test from a stand-alone VBScript. Save the same Run line to C:\Temp\test.vbs and double-click. If it fails identically, the problem is in the path, the security context, or the file association. If it succeeds, the problem is the WinCC working directory.
4. Check the working directory. Add a trace line HMIRuntime.Trace CreateObject("Wscript.Shell").CurrentDirectory and observe the path. It typically points to C:\Program Files\Siemens\Automation\WinCC\bin on a default install.
5. Check Task Manager. When the script fires, sort Task Manager by Command Line and look for the executable. If it appears and immediately disappears, the executable is failing at startup (missing DLL, UAC, AV block).
6. Check Windows Event Log. Open eventvwr.msc > Windows Logs > Application and filter for Application Error source. The faulting module name is usually the missing dependency.
7. Enable Process Monitor. Capture a ProcMon trace filtered to Process Name is CCExplorer.exe and Operation is CreateFile. The last NAME NOT FOUND result before the script returns is the missing executable or DLL.

Troubleshooting Matrix

WinCC Version Compatibility

For TIA Portal-based WinCC Professional, the equivalent of the OnMTClick handler is a button Click event in VB or C# with System.Diagnostics.Process.Start. The Wscript.Shell approach documented above applies only to SIMATIC WinCC V7.x and the legacy WinCC flexible Runtime.

Verification

After applying any fix, run the following end-to-end verification:

1. Save the project, close the WinCC Explorer, and relaunch the Runtime in simulation mode (Start Runtime).
2. Click the configured toolbar entry. The external application window must appear within two seconds.
3. Close the external application normally. Confirm that no orphaned OVEN.exe process remains in Task Manager.
4. Re-click the toolbar entry. The process must launch again without error.
5. Stop the WinCC Runtime. Confirm that the launched process does not terminate (WinCC runtime does not own the child process unless bWaitOnReturn = True).
6. Check the ScriptLog.txt in the project directory for any residual Err.Number entries.

FAQ