Resolving ES to OS Download Failures and Security Rights in SIMATIC PCS 7

ES-to-OS download failures in SIMATIC PCS 7—manifesting as database opening errors, permission denied dialogs, or aborted file transfers—are predominantly caused by incorrect Windows user group memberships, misconfigured network share security, or mismatched Simatic Shell network adapter bindings. To resolve these failures, confirm that the logged-in Windows user account exists identically on both the Engineering Station (ES) and Operator Station (OS) with identical passwords, and belongs to the Administrators, SIMATIC HMI, and SIMATIC NET local user groups. Execute the Siemens SIMATIC Rights tool (or run Security Controller) to enforce required DCOM and file system access policies on both stations.

Core Prerequisites for Successful ES-OS Downloads

In SIMATIC PCS 7, downloading an Operator Station (OS) from the Engineering Station involves complex cross-network remote procedure calls (RPC), distributed COM (DCOM) authorization, Windows shared network folder file transfers, and remote SQL Server database attachment. If any security boundary, name resolution service, or communication port is blocked, the download aborts with cryptic errors such as 'Cannot open project', 'Permission denied', or 'Database context does not exist'.

Siemens publishes comprehensive preconditions (documented in SIOS Entry ID 33123686) that govern the relationship between the Engineering Station and remote target stations. Adhering to these strict configuration baselines ensures smooth delta and full OS downloads throughout the engineering life-cycle.

Windows User Groups and SIMATIC Rights Requirements

Windows operating systems enforce strict local and domain security policies. In workgroup or domain environments, the user initiating the download from the ES must possess administrative and SIMATIC-specific privileges on the remote OS station.

Three mandatory local user groups must be populated on both the ES and all target OS stations:
1. SIMATIC HMI: Authorizes access to WinCC project files, runtime databases, SQL Server instances, and graphic picture files.
2. SIMATIC NET: Grants permissions to configure communication channels, S7 protocol stacks, and Simatic Shell daemons.
3. Administrators: Required for low-level service configuration, remote process management, and network interface manipulation.

If user permissions become corrupted, running the SIMATIC Rights utility or re-applying policies via the PCS 7 Security Controller restores missing DCOM launch, activation, and access permissions.

Checklist of Mandatory ES-OS Download Preconditions

The table below summarizes the mandatory technical preconditions required for seamless ES to OS project downloads.

Engineering DomainPrecondition RequirementVerification MethodCommon Failure SymptomUser AccountsIdentical username and password on ES and OSCheck lusrmgr.msc on both machines'Access denied' or prompt for network credentialsGroup MembershipsUser must belong to SIMATIC HMI, SIMATIC NET, AdministratorsCheck local group propertiesOS download starts but aborts during file copyNetwork ShareTarget OS folder shared with Full Control for SIMATIC HMIInspect folder Sharing and NTFS Security tabs'Cannot create directory' or 'Access is denied'Simatic ShellTerminal Bus network adapter selected with matching multicastRight-click Simatic Shell -> SettingsRemote station does not appear in Simatic ShellName ResolutionBidirectional ping by name and ping -a [IP] succeedsCommand Prompt ping [StationName]Timeout or unable to contact target PC stationSecurity ControllerSiemens Security Controller executed after updatesLaunch Security Controller -> Repeat SettingsDCOM error 0x80070005 (E_ACCESSDENIED)

Step-by-Step Procedure to Diagnose and Resolve Download Errors

Follow this structured troubleshooting workflow to eliminate ES-OS download errors:

Execute SIMATIC Security Controller:
- On both ES and OS stations, open Start -> Siemens Automation -> Security Controller.
- Click Repeat Settings to re-register all firewall exceptions, registry keys, and DCOM access rights.
Reconcile User Accounts and Groups:
- Open Computer Management (compmgmt.msc) -> Local Users and Groups.
- Confirm that the active logged-in user is an explicit member of SIMATIC HMI, SIMATIC NET, and Administrators.
- Log off and log back in to apply updated Windows security tokens.
Verify Network Share and Folder Permissions:
- On the target OS, navigate to the project storage directory (e.g., D:\WinCC_Project).
- Open Properties -> Sharing -> Advanced Sharing: confirm folder is shared, with permissions set to 'Full Control' for group SIMATIC HMI.
- Open Security tab: confirm SIMATIC HMI has 'Full Control' NTFS permissions.
Validate Bidirectional Communication via Simatic Shell:
- Open Windows Explorer on the ES, expand Simatic Shell.
- Confirm that the target OS station name appears in the right-hand pane.
- If absent, open Settings in Simatic Shell, select the Terminal Bus NIC, and click OK to reinitialize the daemon.

Verification

Verify download readiness and execution through the following checks:
1. From the ES command prompt, run net view \<OS_Computer_Name>: verify that the target OS network shares are enumerated without errors.
2. In SIMATIC Manager, select the target OS, choose PLC -> Download: ensure the download dialog connects and displays target path.
3. Complete the download: verify that the transfer progress bar finishes with 100% completion and no error dialogs.
4. On the OS, open WinCC Explorer: confirm that the newly downloaded project opens cleanly and runtime activates.

Limitations and Operational Precautions

Never disable Windows User Account Control (UAC) or disable local firewalls arbitrarily without using the PCS 7 Security Controller. Disabling firewalls entirely can violate industrial cybersecurity baselines and cause communication daemons to misinterpret network profiles. Always keep passwords synchronized; changing a domain or local password on the ES without updating the OS instantly severs background DCOM download channels.

Engineer FAQ

What is SIOS Entry ID 33123686?

It is the foundational Siemens FAQ detailing all mandatory preconditions, network configuration rules, and troubleshooting steps for downloading from a WinCC/PCS 7 Engineering Station to an Operator Station.

Why does Simatic Shell show a red cross on the remote station?

A red cross indicates that the remote computer is detected on the physical network but DCOM communication or security handshake failed, typically due to mismatched user credentials or mismatched encryption settings.

Can I download an OS over a Wi-Fi connection?

No. Siemens does not release or support ES-to-OS project downloads over wireless networks due to latency spikes and packet loss risks that corrupt SQL database attachments.