Enforcing Account Lockout and Invalid Logon Attempt Limits in SIMATIC PCS 7

SIMATIC Manager and SIMATIC PCS 7 do not contain an internal authentication engine to configure invalid password attempt thresholds or lockout timers. Instead, access control and project protection rely on SIMATIC Logon, which delegates user authentication directly to the Windows Operating System. To enforce an account lockout after a specific number of consecutive invalid access attempts, administrators must configure the Windows Account Lockout Policy in the local security policy (secpol.msc) or via Active Directory Group Policy (GPO).

Executive Summary

Regulatory frameworks and industrial cybersecurity standards (such as IEC 62443, FDA 21 CFR Part 11, and NIS2) require industrial automation systems to enforce robust user authentication safeguards. A fundamental requirement is account lockout: automatically locking a user account after a predefined threshold of consecutive failed login attempts to prevent brute-force password attacks.

Automation engineers searching within SIMATIC Manager (e.g., V5.5 SP2 in PCS 7 V8.0, or V5.6 in PCS 7 V9.0 / V9.1) frequently attempt to locate account lockout thresholds within the 'Access Protection' or 'Project Password' settings. Because SIMATIC Manager and WinCC are client applications that offload identity verification to SIMATIC Logon and the underlying Windows operating system, lockout policies must be enforced at the Windows domain or local security level. This guide explains how SIMATIC Logon interfaces with Windows authentication and details the exact procedures to configure enterprise-grade lockout policies.

Architecture and Fundamental Mechanics

The security architecture of SIMATIC PCS 7 relies on a centralized authentication model:

Role of SIMATIC Manager: Within SIMATIC Manager, security is administered through 'Access Protection' (which prompts for credentials when opening projects or modifying CFC charts) and the 'Change Log' (which records engineering modifications). SIMATIC Manager itself does not store user hashes or manage login retry counters.
Role of SIMATIC Logon: SIMATIC Logon serves as the unified security middleware across all PCS 7 components (SIMATIC Manager, WinCC Explorer, WinCC Runtime, SIMATIC BATCH, and Route Control). When a user attempts to log on, SIMATIC Logon intercepts the username, password, and domain name, packaging them into standard Windows Local Security Authority (LSA) authentication requests.
Windows Security Subsystem (LSA / Kerberos / NTLM): The Windows OS evaluates the credentials against the Local Security Account Database (SAM) or Active Directory Domain Controllers (via Kerberos or NTLMv2). The Windows security subsystem maintains the internal retry counters and enforces security policies:
- Account Lockout Threshold: The number of consecutive failed logon attempts before an account is locked (e.g., 3 or 5 attempts).
- Account Lockout Duration: The number of minutes a locked account remains unavailable before automatically unlocking (e.g., 30 minutes, or 0 for manual administrator unlock).
- Reset Account Lockout Counter After: The time window after which failed attempt counters reset to zero.

When a user exceeds the configured threshold in SIMATIC Manager or a WinCC faceplate, Windows flags the account as locked. Subsequent login attempts via SIMATIC Logon are immediately rejected with the message: 'The referenced account is currently locked out and may not be logged on to.'

Step-by-Step Implementation Procedure

Follow these steps to configure consecutive invalid access attempt limits and account lockouts for SIMATIC PCS 7:

Determine Authentication Topology (Domain vs Workgroup):
- If PCS 7 engineering and operator stations belong to an Active Directory Domain: configure the policy centrally on the Domain Controller via Group Policy Management (gpmc.msc).
- If PCS 7 stations operate in a standalone Workgroup: configure the policy locally on each physical PC station using the Local Security Policy editor.
Configure Account Lockout Policy in Windows:
- On the target Windows computer (or Domain Controller), press Win+R, type secpol.msc, and press Enter to launch 'Local Security Policy'.
- In the left navigation pane, expand: Security Settings > Account Policies > Account Lockout Policy.
- Configure the three core policy settings:
- Double-click 'Account lockout threshold': Set the value to 3 or 5 invalid logon attempts (setting to 0 disables lockout).
- Click 'OK'. Windows automatically suggests default values for duration and reset windows.
- Double-click 'Account lockout duration': Set the lockout time (e.g., 30 minutes, or 0 if an administrator must manually unlock the account).
- Double-click 'Reset account lockout counter after': Set to match or exceed the lockout duration (e.g., 30 minutes).
- Click 'Apply' and 'OK'.
Enforce Policy Update:
- Open a Windows Command Prompt as Administrator and execute:
gpupdate /force
- Confirm that the computer and user policies refresh successfully.
Verify SIMATIC Logon Integration:
- In Windows Control Panel, open 'SIMATIC Logon'.
- In the 'Configuration' tab, ensure 'Working Environment' is set to 'Windows' or your Active Directory Domain.
- Ensure the 'Authentication' tab is configured to prompt for Windows credentials.
Test Account Lockout Behavior in SIMATIC Manager:
- Launch SIMATIC Manager.
- Attempt to open an access-protected multiproject or execute an action requiring SIMATIC Logon.
- Intentionally enter an incorrect password repeatedly until the configured threshold (e.g., 5 times) is reached.
- On the 6th attempt, confirm that SIMATIC Logon rejects the attempt with an explicit account locked error.

Verification

In Windows 'Computer Management' (compmgmt.msc) under Local Users and Groups > Users, inspect the test user account. Confirm that the checkbox 'Account is locked out' is active.
In Windows Event Viewer under Windows Logs > Security, search for Event ID 4740 (A user account was locked out). Verify that the event log captures the target account name, client workstation name, and timestamp.
Log on to an OS Client WinCC Runtime session using the locked account: confirm that SIMATIC Logon blocks entry and records the failed attempt in the WinCC Alarm Logging audit trail.
Have an administrator unlock the account in Windows (or wait for the configured lockout duration to expire) and confirm that successful login is immediately restored.

Limitations and Operational Precautions

Ensure that plant-critical emergency operator accounts (e.g., generic shift accounts) have appropriate operational override procedures; if an operator locks out an account during an active process emergency, plant visibility could be impaired. For 24/7 continuous operations, configure an automated lockout duration (e.g., 15 to 30 minutes) rather than indefinite lockouts requiring manual administrator intervention. Validate all cybersecurity policies and SIMATIC Logon licensing with an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

Can I configure lockout thresholds directly in SIMATIC Manager without Windows GPO?

No. SIMATIC Manager does not possess an internal user credential store. Authentication is handled by SIMATIC Logon delegating directly to the Windows operating system.

Does SIMATIC Logon require a separate software license?

Yes. SIMATIC Logon requires a valid engineering and runtime license key (SIMATIC Logon) installed via Automation License Manager on the authenticating station.

What Windows Event ID records account lockouts?

Windows Security Event ID 4740 records when a user account is locked out following consecutive failed logon attempts.

Can an operator account be unlocked from WinCC faceplates?

No. Account unlocking must be performed within Windows Computer Management / Active Directory Users and Computers, or wait for the configured timeout to elapse.