Deploying Windows Server 2012 R2 and 2016 Domain Controllers in PCS 7 V8.0 SP1 and V8.1 Environments

Dedicated Active Directory Domain Controllers (DCs) running Windows Server 2012 R2 or Windows Server 2016 can be deployed in SIMATIC PCS 7 V8.0 SP1 and V8.1 SP1 environments. Siemens operating system compatibility matrices apply strictly to computers hosting PCS 7 software components (OS Servers, Clients, ES). Because a dedicated Domain Controller hosts zero PCS 7 software and provides only Active Directory / DNS services, it can run newer Windows Server releases. To ensure flawless authentication via SIMATIC Logon, update SIMATIC Logon on all PCS 7 stations to V1.5 SP3 Update 2 or later, and adhere to the strict Siemens rule prohibiting DC installation on OS Servers or Engineering Stations.

Operating System Compatibility Scope: PCS 7 Nodes vs Infrastructure Servers

When designing or expanding plant-wide IT infrastructure for SIMATIC PCS 7, systems engineers frequently encounter questions regarding the scope of Siemens official operating system compatibility releases. For SIMATIC PCS 7 V8.0 SP1 and V8.1 SP1, the compatibility matrix authorizes Windows 7 SP1 64-bit and Windows Server 2008 R2 SP1 64-bit for runtime and engineering stations.

However, a critical distinction exists between PCS 7 Nodes and Core Network Infrastructure Servers:

PCS 7 Nodes: Computers running SIMATIC software (OS Server, OS Client, Engineering Station, Process Historian, BATCH, Route Control) must strictly conform to the exact Windows releases certified by Siemens.
Dedicated Domain Controllers: A server configured purely as an Active Directory Domain Controller (AD DC) hosts zero PCS 7 software packages. It functions purely as a Microsoft enterprise identity provider (LDAP, Kerberos, DNS). Therefore, the DC operating system is governed by Microsoft backward compatibility rules rather than Siemens PCS 7 software releases.

Hardware Constraints and the Phaseout of Windows Server 2008 R2

Industrial facilities expanding brownfield PCS 7 V8.0/V8.1 systems frequently face hardware procurement challenges. Modern industrial servers (such as Dell PowerEdge 13th/14th Generation equipped with Intel Xeon v5/v6 processors) lack chipset and storage controller drivers for legacy Windows Server 2008 R2, offering factory pre-installations only for Windows Server 2012 R2 or Windows Server 2016.

Deploying these modern servers as dedicated Domain Controllers in a PCS 7 V8.0 SP1 or V8.1 SP1 plant is fully supported, provided the Active Directory domain functional level allows legacy Windows 7 / Server 2008 R2 member stations to join the domain and authenticate smoothly.

SIMATIC Logon Integration and Active Directory Compatibility

The primary interface between PCS 7 stations and the Active Directory Domain Controller is SIMATIC Logon:

Role of SIMATIC Logon: When an operator logs into a WinCC faceplate or engineering station, SIMATIC Logon queries the domain controller via encrypted LDAP / Kerberos queries to validate user group memberships (e.g., Operators_Unit_A, Shift_Supervisors).
Software Patch Prerequisite: To ensure seamless communication between PCS 7 V8.0/V8.1 member stations and a Windows Server 2012 R2 / 2016 Domain Controller, update SIMATIC Logon to V1.5 SP3 Update 2 (or higher) across all engineering and operator stations. This update ensures full compatibility with modern Microsoft NTLMv2 and Kerberos cryptographic cipher suites.

Mandatory Separation Rules: Prohibited Domain Controller Roles

Siemens PCS 7 security guidelines (Compendium Part F - Industrial Security) establish absolute prohibitions regarding Domain Controller placement:

PROHIBITED on OS Servers: Never install the Active Directory Domain Controller role on a PCS 7 OS Server (Single or Redundant). The DC role modifies local Windows security descriptors, disables local user accounts, and can deadlock WinCC SQL Server runtime services during network partitions.
PROHIBITED on BATCH / Route Control Servers: Installing AD DC on SIMATIC BATCH or Route Control servers introduces severe IPC delays and violates Siemens system architecture standards.
PROHIBITED on Engineering Stations: Domain Controllers must never run on an ES.
MANDATORY: Domain Controllers must run on dedicated physical servers or dedicated virtual machines (VMs) isolated from PCS 7 runtime nodes.

Active Directory Domain Controller Deployment Architecture Matrix

The following matrix outlines station roles, approved operating systems, and licensing boundaries:

Station NodePermitted Operating SystemPCS 7 Software Present?Domain Controller Role Permitted?Primary Domain Controller (DC 1)Windows Server 2012 R2 / 2016No (Zero PCS 7 components)Yes (Dedicated Identity Provider)Secondary Domain Controller (DC 2)Windows Server 2012 R2 / 2016No (Zero PCS 7 components)Yes (Redundant Identity Provider)PCS 7 OS Server (SERV 1 / 2)Windows Server 2008 R2 SP1Yes (WinCC OS Runtime, SQL Server)STRICTLY FORBIDDENPCS 7 Engineering Station (ES)Windows 7 SP1 64-bitYes (STEP 7, CFC, SFC, WinCC)STRICTLY FORBIDDENPCS 7 OS Clients (OP 1 - 8)Windows 7 SP1 64-bitYes (WinCC OS Client Runtime)STRICTLY FORBIDDEN

Network Configuration and Group Policy (GPO) Hardening Rules

When integrating Windows Server 2012 R2/2016 DCs into a PCS 7 plant network:

DNS Architecture: Configure the Domain Controller as the primary DNS server on the Terminal Bus. Ensure reverse lookup zones (in-addr.arpa) are properly configured; WinCC multi-client communication relies heavily on fast reverse DNS name resolution.
Group Policy Restrictions: Do not apply standard corporate Active Directory Group Policy Objects (GPOs) to PCS 7 organizational units (OUs). Corporate GPOs that enforce automatic screen savers, forced reboots, or SMB packet signing can disrupt continuous WinCC runtime operation.
Time Synchronization: Ensure the Domain Controller synchronizes its clock to the plant master time source (e.g. SICLOCK TC 400) to keep Kerberos authentication tickets aligned within the standard 5-minute tolerance window.

Verification

Verify domain controller integration and authentication health through the following checks:

From an OS Server and OS Client, join the Active Directory domain managed by the Windows Server 2012 R2 / 2016 DC.
Execute nltest /dsgetdc:<DomainName> from an elevated command prompt on the OS Server; verify that the DC resolves cleanly.
Open SIMATIC Logon Configuration on the Engineering Station; browse the Active Directory tree and verify that domain user groups populate without LDAP errors.
In WinCC Runtime, log in using a domain user account; verify that the user's configured authorization levels (e.g. Level 5 Process Controlling) activate instantly on faceplates.

Limitations and Operational Precautions

Adhere to the following architectural precautions:

Redundant DC Deployment: Always deploy at least two Domain Controllers (Primary and Secondary) to prevent plant-wide authentication lockouts during single hardware failures.
Terminal Bus Isolation: The Domain Controller must be connected exclusively to the Terminal Bus; it must never be connected to the Plant Bus (Industrial Ethernet communicating with S7-400 controllers).
Domain Functional Level: Ensure the Active Directory Forest and Domain Functional Levels are set to Windows Server 2008 R2 or 2012 R2 to maintain compatibility with Windows 7 member workstations.

Engineer FAQ

Does Siemens officially certify operating systems for dedicated Domain Controllers?

Siemens compatibility guides explicitly state that OS release matrices apply only to stations hosting PCS 7 software. Dedicated DCs are governed by Microsoft Active Directory compatibility with client OS versions.

Which network bus should the Domain Controller connect to?

The Domain Controller must connect exclusively to the Terminal Bus (OS Servers, Clients, ES). It must never have an adapter on the Plant Bus communicating with automation controllers.

What happens to operator logins if the Domain Controller fails?

If redundant DCs are deployed, failover is automatic. If all DCs fail, SIMATIC Logon can use locally cached credentials on OS stations, but new domain logins cannot be authenticated until the DC is restored.