Configuring Compatible Antivirus Software and Network Exclusions in SIMATIC PCS 7

In SIMATIC PCS 7 distributed architectures, installing uncertified antivirus software or deploying standard commercial endpoint security profiles can severely degrade system performance, freeze Windows workstations, and block S7 Named Connections and plant bus communications. Resolving these disruptions requires verifying antivirus software versions against the official Siemens Compatibility Tool (kompatool), disabling personal firewall and network threat protection components that intercept industrial Ethernet traffic, configuring mandatory file and folder exclusions for WinCC and SQL databases, and restricting full disk scans to maintenance windows.

Impact of Commercial Endpoint Protection on Industrial Systems

Operating industrial control systems in modern plants requires robust defense against malware and ransomware. However, applying off-the-shelf commercial antivirus packages (such as Symantec Endpoint Protection, McAfee, or Trend Micro) with default corporate IT policies can cause severe operational disruptions:
- Communication Interruption: Endpoint firewalls and Network Threat Protection (NTP) modules intercept ISO-on-TCP (Port 102), RPC (Port 135), and multicast discovery, blocking S7 Named Connections and disconnecting OS Servers from automation systems.
- Database Lockups: Real-time file scanning engines attempting to inspect active Microsoft SQL Server database files (*.mdf, *.ldf) cause database deadlocks, freezing WinCC alarm processing and historical trending.
- Workstation Freezing: Excessive CPU and I/O consumption by background on-access scanners causes high latency in operator faceplates and graphics updates.

Certified Antivirus Solutions and Compatibility Rules

Siemens rigorously tests and certifies specific releases of leading enterprise antivirus engines for each PCS 7 version. Engineers must verify software compatibility via the Siemens Compatibility Tool (kompatool):

Certified Vendors: Typically includes Symantec Endpoint Protection (SEP), McAfee VirusScan Enterprise / Endpoint Security (ENS), Trend Micro OfficeScan / Apex One, and Microsoft Defender.
Version Compatibility: For legacy releases like PCS 7 V7.1 SP4, certified versions include Symantec Endpoint Protection V11.0 and V12.1 (up to V12.1.6). Installing newer uncertified versions (e.g. SEP V14 on PCS 7 V7.1) introduces unvalidated kernel drivers that cause system instability.
Client-Server Architecture: Deploy a dedicated Antivirus Management Server (such as SEP Manager) located in the perimeter network (DMZ) to manage virus definition updates without connecting control room PCs directly to the Internet.

Configuring Critical File, Folder, and Process Exclusions

To prevent antivirus scanners from locking active process control files, the following directory and file type exclusions must be configured in the central antivirus policy:

WinCC Project Directories: Exclude all project paths containing .mdf, .ldf, .dcf, and .pdl files:
- <Project_Path>\...\wincproj\*.*
SQL Server Database Folders:
- C:\Program Files\Microsoft SQL Server\MSSQL*\Data\*.*
Siemens Installation Directories:
- C:\Program Files (x86)\SIEMENS\*.*
- C:\Program Files\SIEMENS\*.*
SIMATIC Archive and Temporary Folders:
- All swap directories designated for Tag Logging and Alarm Logging archives.
- Windows Temp directories: C:\Windows\Temp and %TEMP%.
Process Exclusions: Exclude active real-time executables from inspection, including CCDataMgr.exe, CCProjectMgr.exe, SCRIPT.exe, and sqlservr.exe.

Disabling Network Intrusion Filters on Plant Interfaces

Endpoint protection suites typically install a network packet inspection driver (e.g. Symantec Network Threat Protection / Teefer driver). On PCS 7 stations, Network Threat Protection must be deactivated or uninstalled:

In the local network adapter properties, uncheck any third-party firewall filter drivers attached to the Plant Bus (CP 1623 / CP 1613) and Terminal Bus network cards.
Rely on industrial perimeter firewalls (such as SCALANCE S) at the boundary between the control network and corporate IT, rather than host-based software firewalls on real-time operator stations.

Antivirus Configuration and Exclusion Matrix

The following table summarizes recommended antivirus configuration settings for SIMATIC PCS 7:

Antivirus ComponentRecommended SettingRationaleReal-Time File Scanner (On-Access)Enabled with mandatory folder exclusionsProtects against infected USB media and files while protecting SQL databasesWinCC Project & SQL DirectoriesCompletely Excluded from scanningPrevents database deadlocks and disk I/O bottlenecksNetwork Threat Protection / Personal FirewallDisabled / Uninstalled on Plant/Terminal BusPrevents blocking of S7 Named Connections, RPC, and multicast discoveryHeuristic Behavioral ScanningSet to Moderate / StandardHigh heuristic sensitivity flags legitimate Siemens scripts as false positivesScheduled Full Disk ScansScheduled during planned maintenance onlyFull scans during plant production cause unacceptable CPU and disk latencyPattern Definition UpdatesManaged via central staging server in DMZEliminates need for direct Internet connections from control room workstations

Note: For complete implementation details, consult the official Siemens PCS 7 Compendium Part F - Industrial Security.

Verification

Verify antivirus deployment and industrial communication health:
1. Open Windows Task Manager on the OS Server; verify that antivirus process CPU consumption remains below 5% during normal operations.
2. In WinCC Explorer, verify that runtime operates smoothly and faceplates open instantaneously without disk queue latency.
3. Open WinCC Channel Diagnosis; verify that all S7 Named Connections to the automation systems show active 'OK' status.
4. Check the central antivirus management console; verify that pattern definition updates distribute successfully from the DMZ server to all PCS 7 clients.

Limitations and Operational Precautions

Key industrial cybersecurity rules:
- Never leave a PCS 7 system completely unprotected; modern air-gapped systems remain vulnerable to malware introduced via infected maintenance laptops or USB storage drives.
- Do not allow automatic reboot policies after antivirus definition updates; unexpected workstation reboots can disrupt continuous plant control.
- Always validate new antivirus client engine upgrades in an offline test environment or staging system prior to rolling them out across active plant servers.

Engineer FAQ

Why did Symantec Endpoint Protection block my Named Connections?

SEP installs a Network Threat Protection firewall driver that blocks uncertified network protocols and ports. Deactivate the NTP component on the industrial network adapters to restore S7 communication.

Can I use Microsoft Windows Defender on PCS 7?

Yes, in modern PCS 7 releases running Windows 10 Enterprise / Windows Server 2016/2019, Windows Defender is tested and supported, provided recommended file and folder exclusions are configured.

How often should antivirus virus definitions be updated in a plant?

Virus definitions should be updated periodically (e.g. weekly or monthly) using a staged distribution model where updates are verified on an offline test machine before deployment.