Configuring Microsoft Defender Antivirus and File Exclusions for SIMATIC PCS 7 V9.1

In SIMATIC PCS 7 V9.1 on Windows 10 Enterprise LTSC 2019 and Windows Server 2019, Microsoft Defender Antivirus is officially supported as an endpoint security solution when configured according to Siemens PCS 7 Compendium Part F. To prevent operational freezes, SQL database corruption, and WinCC archive failures, administrators must configure real-time scanning exclusions for Siemens installation directories, WinCC project and archive folders, critical executables (including sqlservr.exe, SCRIPT.EXE, and CCProjectMgr.exe), and database file extensions (.mdf, .ldf, .dcf, and .pck).

Executive Summary

Securing industrial control systems against malware requires robust antivirus protection that does not compromise real-time process automation performance. In SIMATIC PCS 7 V9.1, Microsoft Defender Antivirus (built into Windows 10 Enterprise LTSC 2019 and Windows Server 2019) is formally validated and approved by Siemens for Engineering Stations (ES), OS Servers, OS Clients, and Process Historian nodes.

However, leaving Microsoft Defender in its default out-of-the-box configuration introduces severe risks to plant availability. Real-time file inspection can lock high-frequency WinCC SQL database tables, delay time-critical inter-process communications, and trigger false-positive quarantines of industrial automation binaries. This guide details the mandatory exclusions, cloud protection constraints, and signature update methodologies defined in Siemens PCS 7 Compendium Part F (Industrial Security) to ensure compliant and reliable operation.

Architecture and Fundamental Mechanics

The real-time protection engine of Microsoft Defender Antivirus utilizes an inline file-system filter driver (WdFilter.sys) that intercepts file I/O operations prior to completion. In a PCS 7 environment, several high-concurrency subsystems interact continuously with the local file system:

Microsoft SQL Server (WinCC Instance): The WinCC SCADA engine writes rapid, sub-second telemetry and alarm records into primary database data files (*.mdf) and transaction log files (*.ldf). If Defender attempts to inspect these files during active transactions, file locking conflicts occur, resulting in WinCC runtime freezes and alarm logging storage drops.
Scripting and Faceplate Engines: The WinCC C-scripting engine (SCRIPT.EXE) and Basic Process Control subsystems compile and execute local function files (*.fct) and screen descriptors (*.pdl). File-system scan latencies cause noticeable delays in faceplate pop-up opening times on OS Clients.
Package and Archive Exchange: OS Clients periodically read server data packages (*.pck) and cache directory structures. Antivirus locking of these files manifests as client-server communication dropouts.
Cloud-Delivered Protection in Isolated OT Networks: Microsoft Defender defaults to querying cloud servers for suspicious telemetry. In air-gapped industrial control networks lacking internet access, these query attempts cause connection timeouts and sluggish application startup unless cloud-based protection and automatic sample submission are explicitly managed via Group Policy.

Step-by-Step Implementation Procedure

Follow these steps to configure Microsoft Defender Antivirus exclusions for SIMATIC PCS 7 V9.1 using Windows Group Policy or PowerShell:

Open Local Group Policy Editor or Active Directory GPO:
- Log on to the PCS 7 station with administrative privileges.
- Press Win+R, type gpedit.msc, and press Enter.
- Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus (or Windows Defender Antivirus).
Configure Mandatory Path Exclusions:
- Navigate to Exclusions > double-click 'Path Exclusions' > set to 'Enabled' > click 'Show...'.
- Add the following standard directory paths:
- C:\Program Files (x86)\Siemens\*
- C:\Program Files\Siemens\*
- C:\ProgramData\Siemens\*
- C:\Program Files (x86)\Common Files\Siemens\*
- C:\Program Files\Common Files\Siemens\*
- C:\Users\Public\Documents\Siemens\*
- All project and storage drives hosting Step 7 multiprojects and WinCC projects (e.g., D:\WinCCProjects\*, D:\PCS7_Projects\*, E:\Storage\*).
- Process Historian archive volumes (e.g., E:\PH_Data\*, F:\PH_Log\*).
Configure Mandatory File Extension Exclusions:
- In Exclusions, double-click 'Extension Exclusions' > set to 'Enabled' > click 'Show...'.
- Add the following extensions:
- mdf (SQL Server Database Data File)
- ldf (SQL Server Database Transaction Log)
- dcf (WinCC Project Configuration File)
- pck (WinCC Server Data Package)
- pdl (WinCC Picture File)
- fct (WinCC C-Script Function File)
- s7p / s7s (Step 7 Project and Symbol Files)
Configure Process Exclusions:
- In Exclusions, double-click 'Process Exclusions' > set to 'Enabled' > click 'Show...'.
- Add critical Siemens and SQL background processes:
- sqlservr.exe
- CCProjectMgr.exe
- CCConfigStudio.exe
- CCArchiveManager.exe
- SCRIPT.EXE
- WinCCExplorer.exe
- s7tgtopx.exe
- S7epaImp64.exe
- CCPerfMon.exe
Adjust Cloud Protection for Isolated Industrial Networks:
- In Microsoft Defender Antivirus > MAPS, set 'Join Microsoft MAPS' to 'Disabled'.
- Set 'Send file samples when further analysis is required' to 'Never send'.
Establish Virus Definition Update Mechanism:
- In non-internet-connected plants, deploy Windows Server Update Services (WSUS) on an update server located in the DMZ, or utilize Siemens Automation Security Updates (ASU) to stage verified virus definition signatures.

Verification

Launch Windows PowerShell as Administrator and run the command:
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Verify that all configured Siemens and project directories appear in the output list.
Run Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess and confirm that sqlservr.exe and SCRIPT.EXE are listed.
Open SIMATIC Manager and WinCC Explorer, perform an AS-OS compile, and activate WinCC Runtime. Confirm that CPU utilization remains low and no file access errors appear in Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.
Verify that faceplate open times on OS Clients remain sub-second without hesitation.

Limitations and Operational Precautions

Antivirus exclusions should be restricted strictly to verified industrial automation directories and processes; never disable the antivirus shield entirely or configure blanket drive-root exclusions (C:\*). Offline definition updates must be applied on a regular, scheduled basis. Antivirus deployment must be coordinated with overall cybersecurity defense-in-depth strategies. For formal compliance audits and plant security consulting, contact an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

Is Microsoft Defender fully approved by Siemens for PCS 7 V9.1?

Yes. Starting with PCS 7 V9.0 SP1 and fully consolidated in V9.1, Microsoft Defender Antivirus is officially tested and approved by Siemens alongside traditional enterprise packages like Symantec and Trend Micro.

Where can I find the official list of antivirus exclusions for PCS 7?

The comprehensive list of tested exclusions is published in the Siemens manual 'SIMATIC Process Control System PCS 7 Compendium Part F - Industrial Security'.

Why does WinCC SQL Server fail if database extensions are not excluded?

SQL Server requires non-interrupted direct asynchronous I/O to .mdf and .ldf files. If an antivirus scanner locks a database page to scan it, SQL Server reports I/O timeouts and may detach the database.

How do I update Defender signatures in an isolated plant without internet?

Use a local Windows Server Update Services (WSUS) server in the plant DMZ, or download the Microsoft Defender offline signature update files (mpam-fe.exe) manually and distribute them via scheduled script.

Does Microsoft Defender require a separate paid license on Windows 10 Enterprise LTSC?

No. Microsoft Defender Antivirus is an integrated, native component of Windows 10 Enterprise LTSC 2019 and Windows Server 2019, requiring no supplementary licensing.