Enabling Remote Deactivation of OS Clients in SIMATIC Shell for PCS 7 Systems

In SIMATIC PCS 7 multi-station systems, the 'Deactivate' option for an OS Client is grayed out in SIMATIC Shell on remote computers when the WinCC project setting 'Allow Remote Deactivation' is unchecked in the client project properties. By default, PCS 7 disables remote deactivation to prevent accidental plant shutdowns. To enable remote deactivation, open the OS Client project in WinCC Explorer, navigate to Project Properties > Options, check 'Allow Remote Deactivation', and ensure your Windows account has full DCOM launch and activation permissions on the client.

SIMATIC Shell Remote Management Architecture

SIMATIC Shell is the administrative terminal bus communication manager integrated into Windows Explorer on all SIMATIC PCS 7 and WinCC stations. It enables discovery, interconnectivity diagnostics, redundancy synchronization, and remote lifecycle control across Engineering Stations, OS Servers, and OS Clients.

Through SIMATIC Shell, an administrator can right-click a remote station in the network tree and execute administrative commands:
* Open Project: Opens the remote project database in WinCC Explorer.
* Activate: Remotely launches WinCC Runtime on the destination node.
* Deactivate: Remotely shuts down WinCC Runtime cleanly on the target machine.

However, if safety and security parameters are not explicitly aligned, context menu actions such as Deactivate remain grayed out and inactive.

Why Remote Deactivation is Disabled by Default

The deactivation lockout is an intentional design safeguard enforced by Siemens industrial cybersecurity principles:
* Process Operational Integrity: In an active industrial facility, accidentally shutting down an operator client from a remote engineering station can blind field operators during critical plant sequences.
* Two-Tier Verification Guardrail: Remote deactivation requires both a project-level configuration flag (Allow Remote Deactivation) and operating-system-level DCOM authorization. If either gate is closed, SIMATIC Shell grays out the command.

Configuring Project Properties to Allow Remote Deactivation

To permit remote deactivation of a client runtime from an ES or OS Server:

Open Client Project on the Local Client or via ES:
* Open the OS Client project in SIMATIC WinCC Explorer.
Access Project Properties:
* Right-click the top-level project name in the left navigation tree and select Properties.
Enable Remote Deactivation Option:
* Switch to the Options tab.
* Locate the checkbox labeled Allow Remote Deactivation (or Remote Deactivation Allowed).
* Check the box to enable it.
* (Optional): Check Allow Remote Activation if remote startup is also required.
* Click OK to save the changes.
Restart Client Project:
* Close and reopen the project in WinCC Explorer, or cycle runtime once to apply the updated configuration flags.

DCOM and Windows Security Permissions for Remote Commands

Even when enabled in project properties, remote deactivation will remain grayed out if Windows DCOM permissions are blocked across the terminal bus:

Security ComponentRequired Setting on OS ClientDiagnostic ImpactUser AuthenticationIdentical Windows account in SIMATIC HMI group on all nodes.Cross-station RPC connection rejected without matching user.DCOM Launch PermissionsGroup SIMATIC HMI granted Remote Launch & Remote Activation.Command blocked by Windows Security; option grayed out.SIMATIC Security ControllerSettings repeated successfully on ES, Server, and Client.Firewall port 135 (RPC) and dynamic DCOM ports open.SIMATIC Shell SettingsCorrect Network Adapter selected for Terminal Bus.Yellow exclamation badge or missing remote nodes.

Table 1: Security and network prerequisites for SIMATIC Shell remote control.

Verification

To confirm that remote deactivation is enabled and functional:

On the Engineering Station or OS Server, open Windows Explorer and navigate to SIMATIC Shell.
Expand the terminal bus network tree and locate the target OS Client computer.
Right-click the OS Client computer name:
* Verify that the context menu option Deactivate is now bold and active (not grayed out).
Click Deactivate:
* Confirm that a verification prompt appears asking for confirmation.
* Click Yes.
Observe the target OS Client station: verify that WinCC Runtime closes gracefully, background processes terminate, and the client returns to the desktop without error prompts.

Limitations and Operational Precautions

Only enable remote deactivation on stations where remote maintenance is strictly necessary and protected by physical or network access controls.
Never remotely deactivate an OS Server while it is actively controlling plant processes unless its redundant partner is fully operational and synchronized.
If remote deactivation is executed while an operator is actively adjusting a process setpoint, the unacknowledged transaction may be lost.

Engineer FAQ

Can I remotely deactivate an OS Server from an OS Client?

Technically yes, if enabled in the server project properties and the user has administrative privileges. However, this is strongly discouraged and typically restricted by plant cybersecurity policies.

Why is SIMATIC Shell showing other computers with a red cross or question mark?

A red cross or question mark indicates a terminal bus communication breakdown, mismatched encryption keys, or incorrect network adapter binding in SIMATIC Shell settings.

Does remote deactivation work if the client user is locked?

Yes. SIMATIC Shell executes via background Windows services (CCProjectMgr.exe) running under system/DCOM credentials, independent of the interactive desktop lock state.