Managing Windows User Accounts and Password Complexity in Virtualized PCS 7 Environments

In virtualized SIMATIC PCS 7 environments operating under VMware vSphere or Microsoft Hyper-V, modifying Windows user accounts or enforcing strict IT password complexity policies requires synchronizing credentials across the virtualization host, guest operating systems, and SIMATIC services. Changing credentials without updating service logons disrupts internal PCS 7 inter-process communication, SQL Server instances, and Automation License Manager, requiring coordinated account administration.

Architecture of User Authentication Across Virtualized PCS 7 Infrastructure

In modern virtualized process automation facilities, Engineering Stations (ES), redundant OS Servers, and SIMATIC BATCH nodes run as virtual machines (VMs) on dedicated hypervisors (such as VMware vSphere ESXi):
* Hypervisor Management: Governed by VMware vCenter or ESXi host credentials.
* SIMATIC Management Console (SMMC): Centrally manages software updates, license inventories, and hardware diagnostics across all VMs.
* Windows Domain / Workgroup Layer: User accounts reside either in a centralized Active Directory domain controller or in synchronized local Windows accounts across each VM.
* SIMATIC Logon: Interfaces with Windows user databases to enforce electronic signatures, FDA 21 CFR Part 11 audit compliance, and role-based operator privileges.

Impact of IT Password Complexity and Account Modifications

Corporate IT cybersecurity policies frequently mandate periodic password rotations and complex character rules. In an industrial DCS environment, applying these policies without planning introduces substantial operational risks:
* Service Account Lockouts: Core PCS 7 background services (e.g., SQL Server, WinCC Redundancy synchronization, Automation License Manager) that run under specific Windows service accounts will fail to start if passwords expire.
* Terminal Bus Communication Starvation: WinCC OS Clients authenticate against OS Servers using Windows security tokens. Password mismatches cause client faceplates to freeze or display disconnect banners.
* SIMATIC Management Console Access Loss: SMMC agent services on remote VMs fail to authenticate if administrative credentials change without updating the console connection profile.

Critical SIMATIC Services Dependent on Windows Service Accounts

When planning account modifications, engineers must audit dependencies across three critical software tiers:
1. Microsoft SQL Server (WINCC Instance): The SQL Server engine service requires specific account privileges. In modern PCS 7, it logs on as a dedicated virtual service account (NT Service\MSSQL$WINCC) or local system account, but relies on the local Windows security group SIMATIC HMI.
2. Automation License Manager (ALM): The ALM service (almsrvx.exe) exchanges license tokens across the network; modifying system accounts requires verifying ALM communication rights.
3. SIMATIC BATCH Launch Coordinator: In batch production, the launch coordinator requires authenticated user rights across all participating batch server and client nodes.

Step-by-Step Procedure to Update Credentials and Re-apply Security Rights

To safely execute credential updates in a virtualized PCS 7 plant:
1. Plan Maintenance Outage: Schedule credential rotations during a planned unit shutdown or maintenance window.
2. Update Domain / Local Account Passwords:
* Modify the password in Active Directory Users and Computers (or Windows Computer Management on standalone VMs).
* Ensure user accounts remain explicit members of: SIMATIC HMI, Siemens TIA Engineer, SIMATIC BATCH, and local Administrators.
3. Update Windows Service Logons:
* Open Windows Services (services.msc).
* For any Siemens or SQL service configured with a specific user logon, update the stored password on the Log On tab.
4. Execute SIMATIC Security Controller:
* On every virtual machine, launch SIMATIC Security Controller as Administrator.
* Click Repeat Settings to re-align DCOM access permissions, folder access control lists (ACLs), and firewall rules with the updated user tokens.
5. Reboot Virtual Machines Sequentially:
* Reboot redundant OS servers one at a time, verifying archive synchronization before restarting the partner.

Verification

Log into the Engineering Station using the updated credentials: confirm that SIMATIC Manager launches without administrative permission warnings.
In WinCC Explorer, verify that the OS project opens cleanly and connects to the local SQL Server instance.
On OS Client VMs, verify that runtime process screens populate with dynamic controller tags.
Open SIMATIC Management Console on the administration PC: execute a health query and confirm that all remote VM agents respond with green status.

Limitations and Operational Precautions

Never configure automatic password expiration policies on dedicated service accounts; set service account passwords to "Password Never Expires".
Avoid using special characters that conflict with command-line parsers (e.g., ", ', &, %, ^) in service passwords.
Always snapshot virtual machines in VMware vCenter prior to executing major domain-wide credential updates.

Engineer FAQ

What Windows security group is mandatory for all WinCC operators and services?
The local Windows security group SIMATIC HMI.
Can IT password expiration policies cause WinCC runtime to freeze?
Yes, if service accounts or internal communication accounts expire, database queries and terminal bus handshakes fail.
What utility restores default Siemens DCOM and folder permissions after account changes?
The SIMATIC Security Controller application.
How does SIMATIC Logon handle Windows domain account changes?
SIMATIC Logon authenticates against Active Directory; changes in domain credentials apply immediately to operator logins.
Does changing a Windows user password require recompiling the PCS 7 project?
No, user authentication is managed by the operating system and SIMATIC Logon; no AS or OS compilation is required.
What happens if the SQL Server (WINCC) service fails to log on?
WinCC Explorer will fail to open projects, generating errors stating "Cannot connect to SQL Server".
What is the recommended practice for service account passwords in PCS 7?
Configure dedicated service accounts with strong passwords set to "Password Never Expires" and restricted interactive login rights.
How do redundant OS servers authenticate with each other?
Via synchronized local Windows accounts with identical usernames and passwords, or through a unified Active Directory domain.
Can virtualized PCS 7 VMs be members of a corporate corporate Active Directory domain?
Yes, but Siemens recommends placing automation VMs in a dedicated automation domain or Organizational Unit (OU) with tailored group policies.
Where are SIMATIC Management Console agent credentials configured?
In the SIMATIC Management Console under Options -> Settings -> Agent Communication.

Technical References

SIMATIC PCS 7 Virtualization - Configuration Guide (VMware vSphere)
SIMATIC PCS 7 PC Configuration and Installation Manual
Siemens Industry Online Support Entry: Windows User Account Management in PCS 7 (Entry ID 299593)
SIMATIC Security Controller User Manual