Microsoft IIS Requirements and Offline Installation in SIMATIC PCS 7 and WinCC Stations

In SIMATIC PCS 7 and WinCC, Microsoft Internet Information Services (IIS) is strictly required ONLY on stations configured as web application servers—specifically WinCC WebNavigator Server, WinCC DataMonitor Server, WinCC WebUX Server, Process Historian/Information Server web reporting, and SIMATIC Management Console (SMC) agents. Pure Engineering Stations (ES), standard OS Single Stations, and OS Clients do NOT require IIS, and omitting it has no negative operational impact on control, automation, or runtime alarm logging. If IIS is required and setup prompts for installation media, point the installer to an offline repository folder (such as C:\i386 on legacy systems or use DISM / PowerShell on modern Windows) or adjust the Windows Setup SourcePath registry key.

Role of Microsoft IIS in SIMATIC PCS 7

Microsoft Internet Information Services (IIS) is a Windows-based web server platform used to host web pages, REST endpoints, and ASP.NET applications. Within the SIMATIC PCS 7 ecosystem, Siemens leverages IIS exclusively for web-based remote operator interfaces, reporting tools, and administrative management services.

IIS is not an underlying requirement of the SIMATIC PCS 7 core real-time architecture. The fundamental communication channels between AS controllers (S7-400), Engineering Stations, OS Servers, and OS Clients rely on Siemens proprietary protocols, S7 Named Connections, Microsoft Message Queuing (MSMQ), and standard Microsoft SQL Server client/server mechanisms—none of which utilize IIS.

Stations that mandatorily require IIS include:
- WinCC WebNavigator Server: Hosts ActiveX and HTML5 web clients that monitor and control plant pictures remotely over LAN/WAN.
- WinCC DataMonitor Server: Provides web-based viewing of process archives, trends, and automated Excel reporting.
- WinCC WebUX Server: Delivers cross-platform, responsive HTML5 process visualization to tablets and mobile browsers.
- SIMATIC Information Server: Hosts the web reporting portal connecting to the Process Historian archive.
- SIMATIC Management Console (SMC): Utilizes web communication services for remote software inventory and automated package deployment.

Impact of Omitting IIS on Standard PCS 7 Nodes

A widespread misconception among control engineers is that PCS 7 setup prerequisites require IIS on every computer node.

If an engineer configures an Engineering Station (ES), a Standard OS Server (without WebNavigator), a Standard OS Single Station, or an OS Client, omitting IIS has zero adverse consequences:
1. AS Download and Monitoring: CFC, SFC, and HW Config compile and download to S7 controllers normally.
2. WinCC Runtime: Graphics runtime, faceplates, trend logging, and Alarm Logging operate completely unaffected.
3. Redundancy and Archiving: OS Server redundancy synchronization and local tag logging function without IIS.
4. Enhanced Cyber Security: Omitting IIS on production control nodes eliminates a substantial attack surface, removing vulnerabilities associated with unpatched web server components, HTTP ports, and ASP.NET execution engines.

If PCS 7 setup displays a prerequisite warning for IIS during installation of an ES/OS package, the engineer can deselect the optional Web components (e.g., uncheck WebNavigator Server and DataMonitor Server in the setup selection tree) to proceed without installing IIS.

Activating IIS Without Installation Media

When a system legitimately requires IIS (such as configuring a dedicated WebNavigator server) and Windows prompts for installation media (e.g., requesting the Windows CD or i386 folder), use the following methods to activate IIS offline:

Method 1: Local Source Path Redirection (Legacy Windows XP / Server 2003)

Extract or copy the Windows installation files (specifically the i386 directory) from a recovery partition, ISO image, or network share to the local hard drive (e.g., C:\i386).
Open the Windows Registry Editor via regedit.
Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup.
Modify the string value SourcePath to point to the local path: C:\.
Modify the string value ServicePackSourcePath to: C:\.
Open Control Panel > Add or Remove Programs > Add/Remove Windows Components.
Check Internet Information Services (IIS) and click Next. The installer will load the necessary files directly from C:\i386 without prompting for a physical disc.

Method 2: Offline Deployment Image Servicing (Windows 7 / Server 2008 R2 / Server 2012 / Server 2016)

On modern Windows platforms, component binaries reside in the Windows side-by-side store (WinSxS). IIS can be enabled without external media using DISM:

dism /online /enable-feature /featurename:IIS-WebServerRole /featurename:IIS-WebServer /featurename:IIS-CommonHttpFeatures /featurename:IIS-StaticContent /featurename:IIS-DefaultDocument /featurename:IIS-DirectoryBrowsing /featurename:IIS-HttpErrors /featurename:IIS-ApplicationDevelopment /featurename:IIS-ASPNET /featurename:IIS-NetFxExtensibility /featurename:IIS-ISAPIExtensions /featurename:IIS-ISAPIFilter /featurename:IIS-Security /featurename:IIS-WindowsAuthentication /featurename:IIS-RequestFiltering /all /norestart

Method 3: PowerShell Module Installation (Windows Server)

On Windows Server 2012 R2, 2016, or 2019, execute:

Import-Module ServerManager
Install-WindowsFeature -Name Web-Server -IncludeManagementTools -IncludeAllSubFeature

Component Compatibility and Requirements Matrix

The following matrix outlines IIS requirements across various SIMATIC PCS 7 software roles:

PCS 7 Station RoleIIS Required?Required IIS FeaturesImpact if IIS is Not InstalledEngineering Station (ES)NoNone (unless SMC Agent / Web test server installed)None; full engineering functionality intactStandard OS ServerNoNoneNone; runtime, alarm logging, and tag archiving unaffectedOS ClientNoNoneNone; multi-client operations run via WinCC Runtime clientWebNavigator ServerYesWeb Server, ASP.NET, Windows Authentication, Static ContentSetup blocks installation; remote Web clients cannot connectDataMonitor ServerYesASP.NET, IIS Management Console, Default DocumentsWeb center and Excel report publishing unavailableInformation ServerYesASP.NET 4.5, Windows Authentication, HTTP RedirectionReporting portal web service fails to initializeProcess HistorianNoNone (database server only; web portal resides on Info Server)None; long-term data storage operates independently

Verification

To confirm whether IIS is properly installed and required services are functioning:
1. Open a web browser on the server node and enter http://localhost.
2. Verify that the default IIS welcome page or Siemens WebNavigator portal appears.
3. Open Internet Information Services (IIS) Manager from Windows Administrative Tools.
4. Verify that the Default Web Site is started and binding ports (HTTP 80, HTTPS 443) are properly assigned.
5. In the Windows Services console (services.msc), ensure the World Wide Web Publishing Service (W3SVC) status is Running and Startup Type is Automatic.
6. For stations that do not require IIS, verify via services.msc that W3SVC is either absent or set to Disabled to conform to industrial cybersecurity hardening guidelines.

Limitations and Operational Precautions

Observe the following engineering precautions regarding IIS deployment:
- Port Conflicts: Do not install third-party web servers (such as Apache, NGINX, or embedded instrument web tools) on a WinCC WebNavigator node, as they compete for TCP port 80 and port 443.
- Cybersecurity Hardening: If IIS is installed, it must be hardened according to Siemens Security Guidelines: disable unused HTTP verbs, enforce HTTPS via valid TLS certificates, and place the WebNavigator server in a Demilitarized Zone (DMZ) rather than directly on the Plant Bus.
- Windows Updates: Do not allow unmanaged Windows Automatic Updates to upgrade IIS components or .NET Framework versions beyond the tested PCS 7 compatibility matrix.

Engineer FAQ

Will my PCS 7 installation fail if I do not install IIS on my ES?

No. The core PCS 7 Engineering Station installer will complete successfully without IIS. Simply uncheck any optional web options (such as WebNavigator or DataMonitor) in the setup package selection dialog.

Can I activate IIS after PCS 7 is already installed?

Yes. You can install IIS at any time using Windows Add/Remove Features or DISM. After installing IIS, run the PCS 7 setup in 'Modify' mode to install the WebNavigator Server or WebUX components.

Why did Windows XP prompt for the i386 folder when activating IIS?

Legacy Windows XP and Server 2003 do not maintain all optional installation cab files on the local drive by default. Copying the i386 directory from the installation media to C:\i386 and updating the registry SourcePath resolves the prompt permanently.