Configuring Dedicated Windows Limited Operator Accounts for SIMATIC PCS 7 OS Runtime

Operating SIMATIC PCS 7 OS Runtime does not require Windows Administrator privileges. Industrial cybersecurity policies mandate replacing administrative workstation logins with dedicated limited operator accounts. In SIMATIC PCS 7 V7.1/V7.2, an operator account is created as a standard Windows user (Users group) and assigned to the local SIMATIC HMI Windows group. This grants necessary rights for WinCC runtime execution, graphics rendering, and local SQL access without granting administrative system privileges. Granular process control authorizations are managed independently within WinCC User Administrator or SIMATIC Logon, ensuring compliance with industrial control system (ICS) cybersecurity standards.

Cybersecurity Principles for Operator Workstations

In legacy industrial automation deployments, engineering teams frequently configured operator workstations to log into Windows using the built-in Administrator account. Under modern ICS cybersecurity frameworks (e.g., IEC 62443, NIST SP 800-82), this practice is strictly prohibited because administrative sessions permit operators or malicious actors to modify system binaries, install unauthorized software, alter firewall rules, or disable antivirus agents.

SIMATIC PCS 7 OS (WinCC) was explicitly architected to execute process monitoring and supervisory control under standard, non-administrative Windows user accounts. Administrative privileges are only required during software installation, hardware commissioning, and project downloads.

Windows User Group Assignment Architecture

The table below details Windows user rights separation for PCS 7 OS workstations:

Windows GroupMembership RoleRequired Operating PrivilegesCybersecurity AuthorizationUsers (Standard User)Operator / Plant Floor UserStandard desktop execution; no system file modification rights.Compliant with least-privilege policies.SIMATIC HMIMandatory for all WinCC UsersFull access to WinCC runtime databases, shared memory, and graphics engines.Essential operational requirement.AdministratorsSystem Integrator / Lead EngineerFull control over operating system, device drivers, and network adapters.Restricted strictly to maintenance.

Step-by-Step Operator Account Configuration

To establish a secure limited operator account on a PCS 7 V7.1 / V7.2 OS station:

Step 1: Create Standard Windows User

Open Computer Management (compmgmt.msc) -> navigate to Local Users and Groups -> Users.
Right-click Users -> select New User....
Set username (e.g., Operator1), assign a strong password, and select Password never expires.
In the user properties -> Member Of tab, remove Administrators and ensure the user is a member of Users.

Step 2: Assign SIMATIC HMI Group Membership

Still in the Member Of tab, click Add....
Enter SIMATIC HMI and click Check Names -> click OK.
On multi-station client/server systems, ensure an identical account (same username and password) exists on the OS Server, or deploy domain accounts.

Step 3: Configure WinCC User Administrator

Open WinCC Explorer on the OS Server -> open User Administrator.
Configure authorization levels for operators: e.g., Level 5 (Process controlling), Level 6 (Higher process controlling).
If using SIMATIC Logon, assign Windows user groups directly to WinCC authorization profiles.

Step 4: Lock Down Windows Shell via WinCC Autostart

Configure AutoStartRT.exe in Windows Startup so WinCC Runtime launches automatically upon Windows login, and disable task switching (Ctrl + Alt + Del, Alt + Tab) in WinCC Computer Properties to restrict operators to HMI screens.

Verification

To verify that the limited operator account functions securely:

Log out of Windows and log in as the newly created Operator1 user.
Launch WinCC OS Runtime (or verify automated launch via Autostart).
Verify that WinCC Runtime activates completely without database connection faults or DCOM access denied errors.
Test process control: operate a valve or change a setpoint to confirm operational authorizations function.
Attempt to launch an unauthorized administrative task (e.g., opening Device Manager or modifying Windows Services): confirm Windows prompts for administrative credentials, validating least-privilege enforcement.

Limitations and Operational Precautions

Operational boundaries for limited user accounts:

SQL Server Rights: Never attempt to manually alter Microsoft SQL Server instance permissions. Adding the user to SIMATIC HMI automatically delegates appropriate SQL database rights via Windows authentication.
Engineering Station Exception: Engineering Stations (ES) running SIMATIC Manager, CFC, and HW Config require administrative rights during hardware configuration compilation and controller downloads.
OS Client Server Synchronization: In workgroup environments (non-domain), passwords for the operator account must remain identical across all OS clients and redundant OS servers.

Engineer FAQ

Why was WinCC Runtime failing to open under the limited Windows user?

The limited Windows user account was not added to the local SIMATIC HMI group, preventing it from accessing WinCC shared memory, runtime databases, and communication channels.

Does the operator user need to belong to the Power Users or Administrators group?

No. Belonging to standard Users and SIMATIC HMI is fully sufficient for complete OS Runtime operation.

Can operators shut down Windows from WinCC Runtime?

WinCC can be configured with an explicit 'Exit Runtime and Shutdown PC' button that leverages WinCC system APIs to safely close databases and shut down the operating system without admin privileges.

What role does SIMATIC Logon play in operator management?

SIMATIC Logon centralizes user credentials via Windows Active Directory or local OS groups, enforcing password aging, lockout policies, and electronic signatures (FDA 21 CFR Part 11).