Deprecation and Removal of SimaticRights Tool in SIMATIC PCS 7 V9.0 SP1

The standalone SimaticRights utility has been permanently deprecated and removed from SIMATIC PCS 7 V9.0 and V9.0 SP1 installation media. In legacy versions (PCS 7 V7.x through V8.2), SimaticRights was distributed on DVD 2 under the Additional_Products folder to assign DCOM security settings, Windows user rights, and registry permissions. In PCS 7 V9.0+, these security assignment mechanisms have been fully superseded by the SIMATIC Security Controller (SecController.exe) and standard Windows security group memberships (e.g., SIMATIC HMI, SIMATIC NET, SIMATIC Management Users). References to SimaticRights have been removed from modern documentation, as permission hardening is now applied automatically during setup.

Evolution of User Rights Management in PCS 7

In legacy versions of SIMATIC PCS 7 (V7.0, V7.1, V8.0, V8.1, V8.2), configuring Windows workstations to participate in a DCS plant network required running the SimaticRights.exe command-line utility from DVD 2. This tool granted necessary Windows local policies—such as 'Log on as a service', 'Access this computer from the network', and DCOM launch permissions—to local and domain user accounts.

Starting with the release of SIMATIC PCS 7 V9.0 and V9.0 SP1, Siemens re-engineered the security architecture. The SimaticRights folder was permanently eliminated from DVD 2, and all corresponding sections in the PCS 7 Compendium Part A and Security Guidelines were revised to reflect the modernized native architecture.

Why SimaticRights Was Deprecated in PCS 7 V9.0+

The deprecation of SimaticRights was driven by operating system modernization and centralized policy management:

AspectLegacy Architecture (PCS 7 V7.x - V8.2)Modern Architecture (PCS 7 V9.0 / V9.0 SP1+)Primary Configuration UtilityStandalone SimaticRights.exe on DVD 2Native SIMATIC Security Controller (SecController.exe)Execution TriggerManual post-installation command executionAutomatic execution during PCS 7 setup and updatesGroup ManagementManual script-driven privilege assignmentAutomatic creation of Windows groups (SIMATIC HMI, SIMATIC NET)DCOM & Firewall PolicyBasic DCOM permissions applied via batchGranular Windows Defender Firewall rules and DCOM limitsOS Support CompatibilityWindows XP, Windows 7, Server 2008 R2Windows 10 Enterprise LTSB/LTSC, Windows Server 2016

Modern Security Hardening with SIMATIC Security Controller

To configure user rights and network security in PCS 7 V9.0 SP1 without SimaticRights:

1. Assign Standard Windows User Groups

In Windows Computer Management (compmgmt.msc), add the required engineering, maintenance, or operator accounts to the pre-created local or domain groups:

Mandatory PCS 7 User Groups:
- SIMATIC HMI:              Required for WinCC OS runtime, graphics design, and alarm logging.
- SIMATIC NET:              Required for Industrial Ethernet communications and ALM access.
- SIMATIC Management Users: Required for SIMATIC Management Console (SMMC) remote administration.
- Administrators:           Required during engineering, software installation, and initial commissioning.

2. Execute SIMATIC Security Controller

If network settings change, a domain controller policy is refreshed, or DCOM permissions require re-initialization:
1. Open Windows Start Menu -> Siemens Automation -> Security Controller.
2. Click Repeat Settings.
3. The tool validates and enforces all DCOM permissions, Windows Firewall rules, registry access control lists (ACLs), and user group policies in a single automated pass.

Verification

To verify that user rights and DCOM policies are properly configured in PCS 7 V9.0 SP1:

Open Windows Command Prompt and execute: whoami /groups.
Verify that SIMATIC HMI and SIMATIC NET are listed under active group memberships.
Launch SIMATIC Security Controller and verify that all configuration items display a green checkmark status OK.
Test cross-station communication: from an Engineering Station, open SIMATIC Manager and monitor an online block in an AS 410 controller.
Open WinCC Explorer on an OS Client: confirm that the client connects to the OS Server package without DCOM access denied errors.

Limitations and Operational Precautions

Operational boundaries for PCS 7 V9.0 security:

Domain Group Policy Overrides: If the plant participates in an Active Directory domain, ensure Corporate Domain Group Policies (GPO) do not overwrite local DCOM security or Windows Firewall rules configured by the Security Controller.
Reboot Requirement: After assigning domain user accounts to local SIMATIC groups, the user must log off or reboot the workstation for group token changes to take effect.
Do Not Copy Legacy DVD Files: Attempting to copy and execute SimaticRights.exe from an older PCS 7 V8.2 DVD onto a Windows 10 or Server 2016 system can corrupt registry permissions and break the Windows Security Subsystem.

Engineer FAQ

Why was SimaticRights on DVD 2 in PCS 7 V8.x but missing in V9.0?

In PCS 7 V9.0+, Siemens fully integrated user rights and DCOM permission provisioning into the SIMATIC Security Controller, rendering the legacy standalone SimaticRights utility completely obsolete.

Do I need to run any manual security script after installing PCS 7 V9.0 SP1?

No. The PCS 7 installer automatically launches the Security Controller at the conclusion of installation to apply all necessary system hardening and DCOM rules.

What should I do if an OS Client experiences DCOM access denied errors?

Verify that the client Windows user is a member of SIMATIC HMI on both client and server, then run SIMATIC Security Controller -> Repeat Settings on both stations.