Preventing Antivirus Memory Leaks and OS Server RAM Crashes (Symantec Endpoint Protection) in SIMATIC PCS 7 WinCC

Gradual memory consumption on a SIMATIC PCS 7 WinCC OS Server leading to 98% RAM exhaustion and crash after deploying Symantec Endpoint Protection (SEP) is caused by real-time file-system scanning and network inspection intercepting WinCC database transactions and shared memory files. To prevent this, apply mandatory Siemens antivirus exclusions: whitelist WinCC SQL databases (.mdf, .ldf), project directories, and Siemens binaries (C:\Program Files (x86)\Siemens\*), and disable Network Threat Protection (NTP) packet filtering on terminal and plant bus network adapters.

Root Cause of Antivirus Memory Leaks in Industrial SCADA Servers

In SIMATIC PCS 7 (v8.0 SP2, v8.1, v8.2, v9.x), WinCC OS Servers execute thousands of high-frequency SQL transactions, archive writes, and inter-process shared memory updates every second:
* The Filter Driver Conflict:
When Symantec Endpoint Protection (SEP) is installed with default corporate policies, its real-time file system filter driver (sysplant.sys or srpts.sys) intercepts every file read, write, and handle creation.
* The Memory Leak Mechanism:
1. WinCC's database manager (CCDataMgr.exe) and SQL Server (sqlservr.exe) continuously modify short-term circular log files, alarm databases, and temporary swap buffers.
2. The antivirus filter driver holds locks on these memory-mapped files to inspect signatures.
3. Because WinCC cannot release locked database pages, memory allocations accumulate in non-paged kernel pools and SQL server private working sets.
4. Physical RAM climbs steadily day over day until reaching 98%, at which point Windows encounters non-paged pool exhaustion, freezing the OS and triggering a blue-screen crash dump (BSOD).

WinCC Inter-Process Architecture and Antivirus Conflicts

Key WinCC services sensitive to antivirus interception include:
* Microsoft SQL Server: Houses Alarm Logging and Tag Logging runtime databases.
* Split Screen Manager / Graphic Engine (CCProjectMgr.exe, pdlrt.exe): Loads and unloads graphics files dynamically.
* Simatic Shell / RPC: Communicates across the redundant terminal bus using UDP/TCP broadcasts.
* Network Threat Protection (NTP):
SEP's Network Threat Protection acts as a stateful software firewall. If NTP inspects industrial Ethernet broadcast frames on CP 1623 / CP 1628 or terminal bus adapters, packet queuing latency causes WinCC server-client redundancy timeouts and memory buffer growth.

Mandatory Antivirus Exclusion Directory and File Type Matrix

To ensure crash-free operation, the following exclusions must be configured in Symantec Endpoint Protection Manager (SEPM):

Exclusion CategoryFile / Path PatternPurpose / RationaleWinCC Project Root<Drive>:\<Project_Path>\*Prevents file locking on active plant runtime project filesSQL Database Files*.mdf, *.ldfPrevents corrupting SQL Server transactions and disk locksWinCC Temporary Cache*.dcf, *.dbf, *.locEliminates memory-mapped file locking between WinCC processesSiemens Program FilesC:\Program Files (x86)\Siemens\*Prevents interception of core PCS 7 and WinCC system binariesSiemens 64-bit DirectoryC:\Program Files\Siemens\*Excludes SQL Server components and 64-bit communicationsSiemens Common AppDataC:\ProgramData\Siemens\*Excludes license services, system telemetry, and diagnosticsProcess Exclusionsqlservr.exe, CC*.exePrevents real-time behavioral heuristic scans on core tasks

Siemens Compatibility Matrix for Symantec Endpoint Protection

Siemens publishes verified antivirus compatibility lists via the Siemens Kompatool (www.siemens.com/kompatool). For PCS 7 v8.0 SP2:
* Certified SEP Versions:
* Symantec Endpoint Protection V12.1.4
* Symantec Endpoint Protection V12.1.5
* Symantec Endpoint Protection V12.1.6
* Unapproved Versions:
Installing uncertified major releases (e.g., SEP V14.x on PCS 7 v8.0) frequently introduces undocumented kernel hook incompatibilities, resulting in unexplained server crashes. Always verify exact service pack compatibility before pushing corporate updates.

Step-by-Step Procedure to Configure Symantec Endpoint Protection for PCS 7

Access Symantec Endpoint Protection Manager (SEPM):
Log into the SEPM management console. Create a dedicated policy group named PCS7_Industrial_Servers.
Configure Exceptions Policy:
* Navigate to Policies -> Exceptions -> Add -> Windows Exceptions.
* Add Folder Exclusions for:
- C:\Program Files (x86)\Siemens\
- C:\Program Files\Siemens\
- C:\ProgramData\Siemens\
- All local drive paths where WinCC projects reside (e.g., D:\WinCC_Projects\).
- Add Extension Exclusions for: .mdf, .ldf, .dcf, .dbf, .pdl, .fct.
Configure File System Auto-Protect:
Under Virus and Spyware Protection Policy:
* Set scanning to Scan only files when modified (disable scan on access/open).
* Exclude network drives.
Disable Network Threat Protection (NTP):
Disable Network Threat Protection and Proactive Threat Scanning on OS Server and Client machines. Network isolation must be enforced by hardware perimeter firewalls (SCALANCE S) rather than host-based software packet filtering.
Assign and Verify Policy on OS Server:
Push the policy to the WinCC OS Server. Open the local SEP client on the server and confirm that the exclusions appear in the local policy status.
Reboot the Server:
Restart the OS Server to flush blocked kernel pools and re-initialize clean WinCC runtime operation.

Verification

To verify that the memory leak is resolved:
1. Launch WinCC OS Runtime.
2. Open Windows Performance Monitor (perfmon.msc) or Task Manager.
3. Track the Memory: Committed Bytes and Pool Nonpaged Bytes counters over a 72-hour period.
4. Verify that memory usage stabilizes at normal operational levels (typically 30% to 55% depending on physical RAM) without linear upward drift.
5. Verify in WinCC Alarm Logging that archive segments switch smoothly without disk write timeout errors.

Limitations and Operational Precautions

Never Disable Antivirus Completely: Do not eliminate endpoint security entirely. The requirement is strict exclusion of Siemens directories and databases, not disabling malware protection on external drives or operating system directories.
Manual Full Scans: Never schedule automated daily full-system antivirus scans during production operations. Full disk sweeps degrade database performance and can cause operator screen freeze. Schedule full scans during planned plant turnarounds.
Corporate IT Coordination: Ensure that corporate IT automated group policies (GPOs) do not overwrite the industrial SEPM policy group with standard office IT policies.