Permissible Windows Domain Controller Operating Systems in SIMATIC PCS 7 V9.0 SP1

In SIMATIC PCS 7 V9.0 SP1 environments, deploying dedicated Windows Domain Controllers running Windows Server 2016 is officially supported and certified according to the Siemens Compatibility Tool, even though the initial release readme listed Windows Server 2012 R2. Because dedicated Domain Controllers execute Active Directory Domain Services (AD DS) without hosting Siemens software packages (no WinCC or STEP 7), using Windows Server 2016 maintains a uniform operating system lifecycle alongside PCS 7 V9.0 SP1 OS Servers. Ensure Active Directory Domain Functional Levels match participating Windows 10 clients and verify that group policies do not restrict SIMATIC communication.

Architecture of Dedicated Domain Controllers in SIMATIC PCS 7

In industrial facilities operating SIMATIC PCS 7, a centralized Windows Domain architecture (Active Directory) is standard for plants with more than 3 to 5 operator stations. Dedicated Domain Controllers (DC), typically deployed as redundant virtual machines across VMware ESXi hosts, manage user authentication, password policies, Kerberos security tokens, and Domain Name System (DNS) resolution.

According to Siemens security guidelines, Domain Controllers must be dedicated strictly to infrastructure services and must never host PCS 7 engineering or runtime packages.

Discrepancy Between Delivery Readme and Siemens Compatibility Tool

When planning new installations of PCS 7 V9.0 SP1:

The printed delivery Readme (Liesmich) file for V9.0 SP1 reflected the baseline tested at the initial product freeze, which formally tested Windows Server 2012 R2 Standard Edition for the DC role.
However, the Siemens Compatibility Tool (Kompatibilitäts-Tool) at www.siemens.com/kompatool is continuously updated. It officially documents subsequent certification and release testing, confirming that Windows Server 2016 Standard / Datacenter is fully released and supported as a Domain Controller for PCS 7 V9.0 SP1.
Mixing obsolete Windows Server 2012 R2 DCs with modern Windows Server 2016 PCS 7 servers is unnecessary and creates avoidable OS maintenance overhead.

Why Dedicated Domain Controllers Do Not Host PCS 7 Software

Because a dedicated DC executes standard Microsoft server roles (AD DS, DNS, NTP time sync) and does not execute proprietary WinCC SQL Server instances or STEP 7 COM components:

The controller interacts with PCS 7 stations solely through standard Microsoft RPC, Kerberos, and LDAP network protocols.
As long as the domain functional level is compatible with Windows Server 2016 and Windows 10 Enterprise LTSB, the DC operating system revision has no direct software dependency on the PCS 7 software build.

Active Directory Functional Levels and Group Policy Precautions

When configuring Windows Server 2016 Domain Controllers for PCS 7:

Forest / Domain Functional Level: Set the domain functional level to Windows Server 2016 (or Windows Server 2012 R2 if legacy member servers exist).
Group Policy Objects (GPO): Siemens installations require specific network protocols. Ensure IT policies do NOT disable:
- NetBIOS over TCP/IP (required for WinCC station redundancy synchronization).
- DCOM remote execution permissions.
- Local user rights for SIMATIC HMI and SIMATIC NET.

Comparison of Windows Server Operating Systems for PCS 7 V9.0 SP1

The table below contrasts Windows Server revisions for PCS 7 V9.0 SP1 roles:

Windows Server ReleaseDC Role SupportOS Server / ES Role SupportSupport Status in PCS 7 V9.0 SP1Microsoft Support LifecycleWindows Server 2008 R2DeprecatedNot SupportedIncompatible with V9.0 SP1End of LifeWindows Server 2012 R2Fully SupportedSupported (Compatibility mode)Certified in initial ReadmeExtended support expiringWindows Server 2016Fully Supported & RecommendedStandard Primary PlatformFully Certified in Compatibility ToolMainstream corporate standardWindows Server 2019Supported with later UpdatesSupported in PCS 7 V9.1Requires verification on KompatoolActive Microsoft release

Verification

Verify domain controller integration and station authentication:

Join an Engineering Station and an OS Server running Windows Server 2016 to the Windows Server 2016 domain.
Log in using a domain user account; verify authentication succeeds rapidly.
In Command Prompt on an OS Server, execute nltest /dsgetdc:<DomainName>; verify the DC responds with status Success.
Check time synchronization; verify all PCS 7 stations synchronize time to the DC or plant NTP grandmaster within 10 ms.
Open SIMATIC Manager and WinCC Explorer; confirm all project permissions and DCOM services operate cleanly without security warnings.

Limitations and Operational Precautions

Adhere to the following infrastructure precautions:

Redundant DCs Mandatory: Deploy at least two independent Domain Controllers on separate physical hypervisors to prevent plant-wide logon lockout if one virtual machine crashes.
Never Install PCS 7 on the DC: Installing WinCC, STEP 7, or Microsoft SQL Server (WINCC) directly onto a Domain Controller is strictly prohibited and invalidates Siemens warranty.
Firewall Ports: Ensure all required Active Directory ports (TCP/UDP 53, 88, 135, 389, 445) are open across plant firewalls.

Engineer FAQ

Can Windows Server 2016 be used as a Domain Controller for PCS 7 V9.0 SP1 despite the Readme saying 2012 R2?

Yes. The Siemens Compatibility Tool officially certifies Windows Server 2016 as a permissible Domain Controller for PCS 7 V9.0 SP1. Readme documents reflect only initial release test dates.

Why must Domain Controllers be dedicated machines without PCS 7 software?

Microsoft Active Directory alters local security accounts, security policy structures, and RPC privileges in ways that conflict directly with WinCC SQL Server database instances and DCOM security models.

What happens to running PCS 7 OS stations if the Domain Controller goes offline?

Existing active WinCC runtime sessions continue operating without disruption because user credentials and security tokens are cached in local memory. However, new user logons and security changes will fail until the DC recovers.