How to Change Windows User Passwords in PCS 7 Workgroup and Domain Environments Without Disrupting OS Client-Server Communication

In PCS 7 Windows Workgroup environments, systems rely on pass-through NTLM authentication, meaning a user account must possess the identical username and password across all stations. Changing a password on only one station breaks DCOM and RPC security handshakes, causing remote OS servers and clients to reject connection requests. To prevent communication disruption, you must either update the password simultaneously across all OS Servers, Clients, and Engineering Stations, or migrate the architecture to a Windows Active Directory Domain with SIMATIC Logon, which manages credentials and role-based access centrally from a single domain controller.

Authentication Mechanisms in PCS 7: Workgroups vs Active Directory Domains

SIMATIC PCS 7 relies heavily on Microsoft Windows operating system security architecture. All cross-station communication between the Engineering Station (ES), Operator Station (OS) Servers, OS Clients, Maintenance Stations (MS), and Web Servers uses Microsoft Remote Procedure Calls (RPC), Server Message Block (SMB) file sharing, and Distributed Component Object Model (DCOM).

PCS 7 architectures are implemented in one of two Windows network configurations:
1. Windows Workgroup (Peer-to-Peer):
* Suitable only for small, standalone plants (e.g., 1 ES and 1-2 OS stations).
* There is no central security database. Every computer maintains its own local Security Accounts Manager (SAM) database.
* Authentication relies on "pass-through NTLM": when User Operator1 on the ES attempts to connect to Server 01, Server 01 checks its local SAM database to verify whether a user named Operator1 exists with the exact same password.
2. Windows Active Directory Domain (Client-Server Domain):
* Recommended by Siemens for all medium to large PCS 7 installations.
* A central Domain Controller (DC) maintains an enterprise-wide user directory.
* Authentication is performed via Kerberos tickets. When a user password changes, the update is replicated instantly across the domain, and all member stations recognize the new credentials immediately without individual reconfiguration.

Why Workgroup Password Changes Break WinCC OS Client-Server Communication

When an engineer changes the Windows login password on the Engineering Station in a Workgroup environment:
* The ES updates its local SAM database with the new password hash.
* However, OS Server 01 and OS Server 02 still retain the previous password hash in their local SAM databases.
* When the combined ES/OS Client launches WinCC Runtime and requests graphic pictures (.PDL files) or tag values from Server 01, Windows initiates a network authentication handshake across the terminal bus.
* Server 01 compares the incoming NTLM authentication token against its local database. Because the password hashes do not match, Windows rejects the request with an Access Denied error.
* Consequently, WinCC faceplates fail to load, graphic screens show grey invalid fields, and the message Cannot connect to server or Loss of connection is logged.

To restore functionality, the exact same user account on all other participating stations must be updated with the identical new password.

Step-by-Step Password Rotation Procedure for Windows Workgroups

When operating in a Workgroup environment, follow this structured procedure to change user passwords without causing unexpected operational outages:

Pre-Change Preparation:
* Schedule the password change during a scheduled maintenance window.
* Identify all PCS 7 stations participating in the multi-project: ES, OS Server Master, OS Server Standby, OS Clients, and BATCH/Route Control servers.
* Verify that you have an auxiliary local administrator account on each machine to recover access if a lockout occurs.
Synchronized Password Update:
* Log on to each machine locally using Windows Administrative privileges.
* Open Computer Management (compmgmt.msc) > Local Users and Groups > Users.
* Right-click the service or operational user account (e.g., SimaticUser) and select Set Password....
* Enter the exact same new password on every station.
Verify Mandatory User Group Memberships:
* Confirm that the user remains a member of SIMATIC HMI, SIMATIC NET, and Administrators (or Power Users on legacy Windows XP/Server 2003 installations).
Restart Windows Services or Reboot:
* Cached Windows network credentials can linger in memory (Kerberos/NTLM credential cache).
* Open a command prompt and execute net use * /delete /y to flush existing SMB sessions, or reboot the OS Clients and ES to establish clean network sessions.
Recompile / Download Server Data (If Applicable):
* If station access rights were modified in SIMATIC Manager, generate server data and execute an OS Changes-Only download to propagate project authorizations.

Centralizing User Management with SIMATIC Logon and Active Directory

To eliminate the operational burden and risk of manual Workgroup password synchronization, plants should implement SIMATIC Logon integrated with a Windows Active Directory Domain.

Key benefits of SIMATIC Logon:
* Single Sign-On (SSO): Plant operators log in once using their domain credentials.
* Role-Based Access Control: Domain user groups (e.g., Operators, Shift_Supervisors, Maintenance_Engineers) are mapped directly to WinCC authorization levels inside WinCC User Administrator.
* FDA 21 CFR Part 11 Compliance: Enforces password expiration policies, minimum password complexity, account lockout after failed attempts, and comprehensive electronic audit trails.
* Zero Node-by-Node Maintenance: When an employee changes their password via Ctrl+Alt+Del, the change takes effect immediately across all OS clients, servers, and web stations without restarting runtime.

Comparison of Workgroup vs Domain Architecture in PCS 7

The table below outlines the operational differences and administrative requirements between Windows Workgroup and Active Directory Domain architectures in SIMATIC PCS 7.

Architecture ParameterWindows WorkgroupActive Directory DomainCentral DatabaseNone (Independent local SAM per machine)Centralized Active Directory on Domain ControllerPassword ManagementManual update required on every PC stationUpdated once at Domain Controller; instant propagationAuthentication ProtocolNTLM pass-through authenticationKerberos ticket-based authenticationRecommended Plant SizeSmall test benches or 1-2 standalone stationsProduction plants, multi-server distributed architecturesSIMATIC Logon IntegrationLocal Windows user groups onlyFull enterprise domain user group mappingRisk of DisconnectsHigh (mismatched password breaks DCOM)Low (centralized single identity provider)

Verification

To verify that password synchronization is successful and communication is restored:
1. From the ES, attempt to access the network share of the OS Servers: Open Windows File Explorer and navigate to \\OS_SERVER01\WinCC_Project. The shared directory must open immediately without prompting for credentials.
2. Launch WinCC Runtime on the ES (OS Client mode). Navigate through process graphics and confirm that all faceplates, trends, and alarm views display live data without grey invalid indications.
3. Open Windows Event Viewer (eventvwr.msc) on the OS Servers. Check the Security log under Event ID 4624 (Successful Logon) and confirm no Event ID 4625 (Failed Logon / Bad Password) entries exist for the SIMATIC user.
4. Verify that SIMATIC Shell displays all partner stations with status Available or Good across the terminal bus.

Limitations and Operational Precautions

Never change passwords while critical batch operations or active plant maneuvers are underway, as brief RPC reconnection delays can interrupt client alarm notifications.
Avoid setting Windows passwords to expire automatically in Workgroup configurations; unexpected password expiration on an unattended OS server will block client access without warning.
In PCS 7 V7.1 legacy environments running Windows Server 2003 and Windows XP, ensure that LM and NTLMv2 compatibility levels (LMCompatibilityLevel in registry) match across all stations.
Do not rename user accounts; renaming breaks internal WinCC User Administrator GUID references and requires rebuilding project authorizations.

Engineer FAQ

Why did changing only the ES password prevent accessing pictures on OS Server 01?

When the ES runs an OS Client, it accesses graphic pictures (.PDL files) and tag archives directly from the OS Server via SMB file sharing and DCOM. In a Workgroup, Windows compares the login password on the ES against the password stored on Server 01. Because the passwords were no longer identical, Server 01 rejected the network file sharing and DCOM connection requests.

What Windows user groups are mandatory for PCS 7 operation?

The active Windows user must be a member of SIMATIC HMI (for WinCC graphics, tags, and database access) and SIMATIC NET (for network driver and CP communication). In addition, on engineering and server stations, the user typically requires membership in the local Administrators group.

Can I run an ES in a Domain while OS Servers remain in a Workgroup?

No. Mixing domain members and workgroup computers within the same PCS 7 project is strongly discouraged. Cross-boundary authentication fails due to different security tokens and missing Kerberos trust relationships, causing unpredictable DCOM communication failures.