How to Launch Windows Explorer from WinCC Runtime Buttons Using C and VBS Scripts in PCS 7

In SIMATIC PCS 7 WinCC, engineers can open Windows File Explorer to a designated folder (such as an export or report directory) directly from a runtime button click using either ANSI C or VBScript. In ANSI C, use the standard system function ProgramExecute('explorer.exe C:\temp'); in VBScript, instantiate the Windows Script Host shell using CreateObject('WScript.Shell') and execute objShell.Run 'explorer.exe C:\temp', 1, False. However, in production industrial control systems, launching Windows Explorer bypasses WinCC kiosk security, so access should be strictly protected using SIMATIC Logon user authorizations.

Use Cases and Architectural Context for External File Access

In SIMATIC PCS 7 Operator Stations (OS), operators and laboratory technicians occasionally require access to external file repositories generated during plant operation:
* Reviewing exported batch quality reports (.pdf or .csv files generated by SIMATIC BATCH or Information Server).
* Accessing maintenance calibration certificates or equipment operating manuals stored on a local or shared network drive.
* Inspecting local troubleshooting data dumped into scratch directories (e.g., C:\temp\audit_logs).
Rather than minimizing WinCC Runtime or forcing operators to switch out of the SCADA shell, engineers configure push buttons in Graphics Designer to open Windows Explorer directly focused on the target directory.

Implementing Folder Launching via ANSI C Scripts

In WinCC Graphics Designer, ANSI C provides straightforward, native execution through the standard ProgramExecute function:

Place a Push Button:
* Drag a Windows Button object from the Standard palette onto the process picture.
* Label the button Open Reports Folder.
Configure C-Action on Mouse Click:
* Open Object Properties > Events > Mouse > Mouse Click.
* Select C-Action and enter:
```c
#include "apdefap.h"

void OnClick(char lpszPictureName, char lpszObjectName, char* lpszPropertyName)
{
// Verify operator authorization level before executing
if (PASSCheckLevelPermission(6)) // Level 6: Higher-ranking control
{
// Open Windows Explorer to the specified directory
ProgramExecute("explorer.exe C:\temp\reports");
}
else
{
printf("Access Denied: Insufficient authorization to open file explorer.\r\n");
}
}
`` * Note the double backslashes (\`): in ANSI C, a single backslash is an escape character.

Implementing Folder Launching via VBScript (WScript.Shell)

For projects standardized on VBScript, the Windows Script Host (WSH) shell object provides advanced window state and process synchronization controls:

Sub OnClick(Byval Item)
    Dim objShell, strPath
    strPath = "explorer.exe C:  emp
eports"

    On Error Resume Next
    Set objShell = CreateObject("WScript.Shell")

    If Err.Number = 0 Then
        ' Parameters: 1 = Normal window, False = Do not wait for process completion
        objShell.Run strPath, 1, False
    Else
        HMIRuntime.Trace "Error launching Windows Explorer: " & Err.Description & vbCrLf
    End If

    Set objShell = Nothing
End Sub

This script creates an asynchronous process that launches Windows Explorer in a normal window without freezing or blocking the WinCC graphics execution thread.

Industrial Cybersecurity and Kiosk Mode Lockdown Risks

While launching Windows Explorer provides operational convenience, it represents a significant cybersecurity hazard in mission-critical DCS environments:

Bypassing Kiosk Mode: Production PCS 7 OS Clients typically operate in kiosk mode with Windows Explorer shell disabled (WinCC Startup > Disable Windows Keys, Disable Desktop).
Unauthorized File System Access: Opening Windows Explorer allows an operator to browse root drives, access system configuration files (C:\Windows), manipulate .ini settings, or insert unapproved USB thumb drives, violating IEC 62443 industrial security principles.
Mitigation Best Practices:
1. Restrict button visibility: Use dynamic dialogs to ensure the button is visible only when an authorized Maintenance Engineer or Administrator logs in via SIMATIC Logon.
2. Implement an in-screen document viewer: Instead of launching full Windows Explorer, embed a WinCC Microsoft Web Browser ActiveX control to display documents inside a sandboxed faceplate window.

Comparison of WinCC External Execution Methods

The table below compares the mechanisms available for launching external tools and folders from WinCC Runtime.

Execution MethodScript LanguageWindow ControlBlocks WinCC Thread?Security RiskProgramExecuteANSI CDefault OS WindowNo (Asynchronous)High (Full Explorer access)objShell.RunVBScriptFull (Minimized, Normal, Hidden)Configurable (WaitOnReturn)High (Full Explorer access)Windows API ShellExecuteANSI C via P/InvokeFull window managementNo (Asynchronous)High (Full Explorer access)ActiveX / Web ControlEmbedded in .PDLSandboxed in WinCC frameNoLow (Recommended Secure)

Verification

To confirm that the folder launching script operates properly:
1. In WinCC Runtime, log in with an operator account possessing appropriate privileges.
2. Click the configured button.
3. Verify that Windows File Explorer opens immediately with focus on the target folder (e.g., C:\temp\reports).
4. Confirm that the WinCC graphics runtime continues updating process animations and alarms in the background without hesitation.
5. Log out or switch to an unauthorized operator account: confirm that clicking the button displays an 'Access Denied' message and blocks Explorer execution.

Limitations and Operational Precautions

Never execute blocking commands (such as WaitOnReturn = True in VBScript) when launching external applications, as freezing the script thread freezes all WinCC graphic animations on that station.
Ensure the target folder path exists on the local machine; passing a non-existent path will cause Windows Explorer to default to the user's My Documents folder.
In multi-client architectures, verify whether the target folder resides locally on the client or on a network share; use UNC paths (e.g., \\OS_SERVER\Reports) for network repositories.
Verify that corporate group policies (GPO) or endpoint protection software do not block WScript.Shell execution.

Engineer FAQ

Why did ProgramExecute fail with 'File not found' when opening a path with spaces?

If the folder path contains spaces (e.g., C:\My Reports\Daily), Windows command parsing splits the arguments. In ANSI C, enclose the path in escaped quotation marks: ProgramExecute("explorer.exe \"C:\\My Reports\\Daily\"");.

Can I open a specific PDF file directly rather than a folder?

Yes. Passing the path of a PDF file to ProgramExecute (e.g., ProgramExecute("AcroRd32.exe C:\\docs\\manual.pdf");) or using ShellExecute opens the default PDF reader directly to that document.

How do I prevent operators from opening Windows Explorer?

In WinCC Explorer, configure Computer Properties > Parameters and enable 'Disable Windows Keys' and 'Disable Task Switching'. In addition, restrict button visibility using SIMATIC Logon authorization levels.