C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Migrating SIMATIC PCS 7 OS Servers and Engineering Stations to a New Active Directory Domain

Migrating SIMATIC PCS 7 OS Servers and Engineering Stations to a New Active Directory Domain

To migrate SIMATIC PCS 7 OS Servers, Clients, and Engineering Stations to a new Active Directory domain without breaking communication, you must execute the 'SimaticRights.exe' utility from the PCS 7 installation media immediately following domain rejoining. Rejoining a domain generates new Security Identifiers (SIDs) for all user accounts and machine trusts, which invalidates local DCOM access rights, SQL Server service account logins, and shared folder permissions. Additionally, disable Simatic Shell encryption prior to domain unjoining, update SIMATIC Logon domain controller references, and reassign WinCC project folder NTFS permissions.

Table of Contents

Executive Summary

When corporate IT infrastructure upgrades or network restructurings require changing the Active Directory domain of a SIMATIC PCS 7 plant, industrial control networks face severe disruption if security contexts are improperly migrated. Even if username strings remain identical on the new domain controller, Windows assigns completely new SIDs to all domain users and computer accounts. Consequently, WinCC project shares, SQL Server database instances, SIMATIC Logon role assignments, and Simatic Shell security certificates fail. This guide provides an end-to-end migration procedure, covering pre-migration preparation, execution of SimaticRights.exe, reconfiguration of Simatic Shell and SIMATIC Logon, and validation of multi-station communication.

Architectural and System Mechanics

SIMATIC PCS 7 relies heavily on Windows security architecture, DCOM, and local user groups:

  • Local User Groups: Crucial groups such as SIMATIC HMI, SIMATIC NET, SQLServer2014WinCCOnlineStandard, and SIMATIC Management Users grant precise Windows privileges to engineering and runtime processes.
  • Security Identifiers (SIDs): Access Control Lists (ACLs) on project network shares (e.g., <ProjectName>.WinCC) store SIDs, not plain-text usernames. Moving to a new domain breaks existing share permissions because the old domain SIDs become unresolved orphan SIDs.
  • Simatic Shell Encryption: In PCS 7 V9.0 and higher, Simatic Shell supports encrypted multicast communication using local certificates and pre-shared keys. If domain trust changes, certificate validation across terminal bus nodes will fail unless encryption is disabled or certificates are regenerated.
  • SimaticRights.exe: A specialized tool provided on PCS 7 DVD 2 (under Support/SimaticRights) that resets and reapplies mandatory local DCOM security policies, user group privileges, and firewall exception rules.

Step-by-Step Engineering and Implementation Procedure

Step 1: Pre-Migration System Preparation

  1. Close all active PCS 7 projects and exit WinCC Runtime on all OS Servers and OS Clients.
  2. Open Windows Explorer on each station, navigate to Simatic Shell, right-click, select 'Settings', and set Encrypted Communication to 'No'. Apply and reboot if prompted.
  3. If WinCC OS Server runs in ServiceMode under a domain user account, change the service startup account temporarily to 'LocalSystem' or a local administrative account.

Step 2: Unjoin Old Domain and Join the New Active Directory Domain

  1. In Windows System Properties, switch the station from the existing domain to a temporary local Workgroup, rebooting as required.
  2. Join the station to the new Active Directory domain using a Domain Administrator credential.
  3. Ensure the station's Primary DNS Suffix and NetBIOS computer name align with the new domain hierarchy.

Step 3: Execute SimaticRights.exe Utility

  1. Mount the PCS 7 installation media or navigate to the extracted DVD directory: Support/SimaticRights/.
  2. Right-click SimaticRights.exe and select 'Run as administrator'.
  3. The tool audits local security templates, assigns the necessary operating privileges to SIMATIC HMI and SIMATIC NET, and updates local DCOM security limits for the newly joined domain context.
  4. Reboot the operating system.

Step 4: Reassign NTFS Share Permissions and Service Accounts

  1. Navigate to the WinCC project directory on each OS Server. Right-click the project folder, open 'Properties' -> 'Sharing' and 'Security'.
  2. Remove orphan SID entries (indicated by Account Unknown S-1-5-...).
  3. Grant Full Control to the local group SIMATIC HMI and ensure domain users requiring engineering access belong to SIMATIC HMI on the local machine.
  4. In WinCC Explorer, open Project Properties -> ServiceMode, and assign the new domain service user account and password.

Step 5: Update SIMATIC Logon and Simatic Shell

  1. Open SIMATIC Logon Admin Tool on the Engineering Station and OS Servers. Update the target domain controller name to the new Active Directory domain.
  2. Open Simatic Shell on each station, confirm that all partner OS Servers and Clients appear in the network tree, and re-enable Encrypted Communication if plant security guidelines mandate it.

Verification

Verify successful domain migration through the following steps:
1. Open Simatic Shell on the Engineering Station: verify that remote OS Servers appear with blue/green computer icons and project shares are browsable.
2. Perform a test OS Compilation and Delta Download from the ES to the OS Server over the terminal bus.
3. Start WinCC Runtime on OS Server 1 and OS Server 2; verify that @RM_SERVER_STATE reaches 2 (Master) and 3 (Standby) respectively.
4. Log in to an OS Client using a new domain account via SIMATIC Logon and verify process control permissions.

Limitations and Operational Precautions

Operational precautions:
- Do not change machine hostnames and the domain name simultaneously; execute hostname adjustments first, reboot, and verify PCS 7 operation before changing the domain.
- Never change domain controllers while OS Runtime is active in production.
- Always verify that local Windows accounts (e.g., local administrator) remain functional on all nodes prior to unjoining the old domain to avoid lockout in the event of domain trust resolution issues.

Engineer FAQ

Q: Why did WinCC runtime fail to start after joining the new domain?

A: WinCC runtime relies on SQL Server services and DCOM permissions linked to local groups. Running SimaticRights.exe restores these privileges after domain SID changes.

Q: Where can I find SimaticRights.exe?

A: It is located on SIMATIC PCS 7 DVD 2 (or installation setup media) under the path Support/SimaticRights/SimaticRights.exe.

Q: Can PCS 7 stations operate across multiple untrusted domains?

A: No. All PCS 7 stations (ES, OS Servers, OS Clients, Maintenance Station) must belong to the same Active Directory domain or have two-way transitive trusts established.

Q: Does changing the domain affect AS controller IP addresses or plant bus communication?

A: No. The automation plant bus and CPU S7 connections operate independently of Windows Active Directory domains.

Q: Why are SIMATIC Logon user groups not displaying domain users?

A: The SIMATIC Logon configuration must be updated in the Admin Tool to query the new domain controller LDAP/Active Directory service.

Technical References

Related Articles

Related Tags

Active Directory, SimaticRights.exe, Simatic Shell, SIMATIC Logon, Domain Migration

20 respuestas