Preconditions and Installation Guidelines for Antivirus Software on SIMATIC PCS 7 Systems

Before installing antivirus software on SIMATIC PCS 7 servers and clients, you must verify that the endpoint protection suite is explicitly released for your exact PCS 7 version in the Siemens Compatibility Tool. Configure all mandatory real-time scanning exclusions for WinCC project directories, Microsoft SQL Server database files (.mdf, .ldf), and critical runtime processes (CCDataServer.exe, CCProjectMgr.exe, sqlservr.exe). The antivirus client must be managed centrally via an enterprise management server rather than updating autonomously from the internet. Disable automatic system reboots, scheduled background disk scans during active production, and heuristic behavioral blocking on industrial process communications.

Siemens Antivirus Certification and Compatibility Architecture

Industrial control systems require rigorous cyber security protection without compromising real-time process control, alarm delivery, or historical data logging. In SIMATIC PCS 7, deploying unapproved or incorrectly configured antivirus software can lock active SQL transaction logs, delay WinCC C-scripts, or sever inter-node communications, causing OS client freezes and redundant server desynchronization.

Siemens tests and releases specific antivirus client-server suites for each PCS 7 version. Antivirus clients must operate under strict operational constraints: pattern updates must be staged centrally via an on-premise update server (e.g., Symantec Endpoint Protection Manager, Trend Micro Apex Central, or McAfee ePolicy Orchestrator) after testing, network traffic heuristics must be disabled, and real-time on-access scanning must never intercept DCS runtime files.

Mandatory Antivirus Exclusion Rules for PCS 7 and WinCC

The core principle of industrial antivirus administration is preventing the scanner from intercepting or locking active database files and runtime executable binaries. Scanning locks introduce millisecond latencies that trigger database transaction timeouts in Microsoft SQL Server and WinCC Tag Logging.

Three categories of exclusions must be configured across Engineering Stations, OS Servers, Batch Servers, and OS Clients:
1. Directory Exclusions: All WinCC project directories, project shared network paths, SQL Server data directories, and PCS 7 installation trees (C:\Program Files (x86)\Siemens\... and C:\Program Files\Microsoft SQL Server\...).
2. File Extension Exclusions: High-frequency database, script, and project files: *.mdf, *.ldf, *.dbf, *.dbt, *.pdl, *.fct, *.s7p, *.mcp, *.rcv, and *.dcf.
3. Process Exclusions: Active runtime executables must run without real-time file-hook monitoring.

Released Antivirus Suites and Mandatory Process Exclusions

The table below lists officially released antivirus products for PCS 7 environments along with mandatory directory and process exclusions.

Antivirus Product SuiteReleased PCS 7 VersionsMandatory Directory ExclusionsMandatory Process ExclusionsTrend Micro OfficeScan V11.0 / Apex OnePCS 7 V8.1, V8.2, V9.0, V9.1<WinCC_Path>\*, ArchiveManager\*, Step7\s7proj\*CCDataServer.exe, CCProjectMgr.exe, sqlservr.exeSymantec Endpoint Protection V12.1 / V14PCS 7 V8.0, V8.1, V8.2, V9.0<Siemens_Path>\*, *.mdf, *.ldf, *.dbt, *.pdlScriptHost.exe, CCAlgServer.exe, S7tgtopx.exeMcAfee VirusScan Enterprise V8.8 / ENSPCS 7 V8.1, V8.2, V9.0Database\*, CommonFiles\Siemens\*, *.fctAlarmLoggingServer.exe, TagLoggingServer.exeMicrosoft Defender AntivirusPCS 7 V9.0 SP1+, V9.1+System-wide SIMATIC paths, SQL databases, OS project shareCCClient.exe, CCPerfMon.exe, S7jcomx.exe

Step-by-Step Antivirus Deployment and Verification Procedure

Follow this rigorous engineering procedure when deploying antivirus protection in a SIMATIC PCS 7 installation:

Pre-Installation Validation:
- Verify OS and PCS 7 version compatibility using the Siemens Online Compatibility Tool.
- Perform a complete full-system disk image backup of the OS Server or Client prior to software installation.
- Confirm that Windows accounts belong to the mandatory Siemens user groups (SIMATIC HMI, SIMATIC NET).
Install Antivirus Client Without Active Scanning:
- Install the client package configured to connect exclusively to the local on-premise Antivirus Management Console.
- Ensure the installer does NOT immediately perform an initial full hard disk scan upon setup completion.
Configure Central Scanning Exclusions:
- Add directory exclusions: exclude the entire WinCC project root folder (including all network shares) and Siemens\*.
- Add file extensions: exclude *.mdf, *.ldf, *.pdl, *.fct, *.s7p, *.dbf, *.dbt.
- Add process exclusions: exclude sqlservr.exe, CCDataServer.exe, CCProjectMgr.exe, CCAlgServer.exe, TagLoggingServer.exe.
- Disable local autonomous scheduled scans, heuristic behavior monitoring, and local software firewalls.
Update Strategy and Reboot Control:
- Configure virus definition distribution to occur silently without operator prompts.
- Explicitly disable automatic reboots under all policy conditions; reboots must occur only during scheduled plant maintenance windows.

Verification

Verify antivirus client configuration through the following operational tests:
1. Confirm policy application: open the local antivirus client GUI and verify that real-time file exclusions match the central policy.
2. Verify SQL Server performance: open Windows Performance Monitor (perfmon) and observe SQLServer:Databases -> Transactions/sec; ensure transaction rates are stable without micro-delays.
3. Perform an OS delta download from the Engineering Station: confirm that project transfer completes cleanly without locked file errors.
4. In redundant OS configurations, verify server health: confirm that WinCC Redundancy internal tags (@RM_MASTER, @RM_SERVER_STATE) remain steady and synchronized.

Limitations and Operational Precautions

Never connect PCS 7 servers or clients directly to the internet to download virus definitions. Definition updates must be downloaded to an intermediate staging server in a DMZ, tested against an offline staging environment, and pushed via the enterprise management console. Furthermore, never execute on-demand or full-disk antivirus scans while the plant is in active production, as intense disk I/O competition can cause WinCC Tag Logging queue overflows and trigger redundant server failovers.

Engineer FAQ

Will installing antivirus block WinCC network project sharing?

No, provided the network sharing ports and Siemens services are excluded. If the antivirus suite includes an active third-party firewall, it must be completely disabled or configured to mirror the Windows Firewall rules configured by the PCS 7 Security Controller.

Can I install Microsoft Office on a PCS 7 OS Server?

No. Installing Microsoft Office on OS Servers or Engineering Stations is not supported by Siemens and can corrupt shared OLE DB components and SQL Server instances. If Excel is needed for reporting, install Microsoft Office only on a dedicated OpenPCS 7 office client.

What should I do if an antivirus scanner quarantines a WinCC runtime file?

Immediately restore the file from quarantine, add the containing directory to the permanent exception list, and report the false-positive signature to your IT security administrator for policy whitelisting.