Resolving Network Sharing, Security Permissions, and Station Configuration Errors for Remote OS Servers in PCS 7

When an engineering station cannot access a remote SIMATIC PCS 7 OS Server to transfer Station Configuration settings or download a WinCC project, the failure is caused by mismatched Windows security credentials, omitted Siemens user groups, or disabled network file sharing. In PCS 7, remote station access requires that both machines reside in the same Windows Workgroup or Active Directory domain with an identical local administrator account and password. Furthermore, the user must belong to the SIMATIC HMI, SIMATIC NET, and SIMATIC Management Users local groups, the project folder must be shared with full control permissions, and the Siemens Security Controller (Secon.exe) must be executed to open necessary firewall ports.

Windows Security Architecture and User Group Requirements in PCS 7

In SIMATIC PCS 7 (including V7.1, V8.2, and V9.0), distributed client-server communication relies on standard Microsoft Windows networking mechanisms, specifically Server Message Block (SMB/CIFS) file sharing, Remote Procedure Call (RPC), and Distributed Component Object Model (DCOM).

To safeguard industrial networks while permitting automated engineering workflows, Siemens installs dedicated local Windows security groups during setup:
- SIMATIC HMI: Mandatory for opening, compiling, and downloading WinCC projects.
- SIMATIC NET: Grants access to communication processor settings, PC Station configuration, and NetPro downloads.
- SIMATIC Management Users: Enables centralized asset management and remote software deployment via SIMATIC Management Console (SMMC).

If the engineering user account logged onto the ES does not exist on the target OS Server with an identical username and password, Windows rejects remote RPC/SMB handshakes with access denied errors.

Station Configuration Editor and Remote Deployment Prerequisites

Deploying configuration settings from SIMATIC Manager to a remote PC Station (such as an OS Server or OS Client) involves two distinct engineering phases:

Station Configuration Transfer (PLC -> Configure... and PLC -> Download):
- Sends the virtual rack configuration (CP 1623, WinCC Application, OPC Server) to the remote Station Configuration Editor (StationManager).
- Requires the Station Configurator Service running on the remote machine and target hostname resolution via DNS or NetBIOS.
WinCC Project Path Access (OS Project Download):
- Copies the compiled runtime database to the remote server over a network share.
- Requires the target project directory to be shared with write permissions granted to the SIMATIC HMI group.

Comparison of Access Symptoms and Underlying Security Faults

The following table compares typical access failure symptoms with their root causes and remediation actions:

Error SymptomFaulting SubsystemUnderlying Root CauseCorrective Action'Target station cannot be found' in Configure dialogStation Configurator / NetProComputer name mismatch or DNS/NetBIOS resolution failureAlign PC station name with Windows hostname; update hosts file'Access Denied' when browsing remote computerWindows SMB / File SharingUser account mismatch between ES and OSCreate identical username & password on both stationsRemote station does not appear in Network NeighborhoodWindows Network DiscoveryNetwork Discovery and File Sharing disabled in WindowsEnable 'File and Printer Sharing' in Network & Sharing CenterOS Download fails: 'Cannot write to project directory'WinCC Project DuplicatorShared folder permissions lack SIMATIC HMI write rightsGrant Full Control to SIMATIC HMI on shared project directoryCommunication timeout during Station DownloadWindows Firewall / RPCDCOM port 135 or dynamic RPC ports blockedRun Siemens Security Controller (Secon.exe) and repeat

Step-by-Step Procedure to Establish Remote OS Server Access

Follow this procedure to configure remote network access and permissions between ES and OS Server:

Align User Accounts and Group Memberships:
- On both the ES and OS Server, open Computer Management (compmgmt.msc).
- Navigate to Local Users and Groups -> Users.
- Ensure an administrator account with the identical username and identical password exists on both machines.
- Under Groups, add this user account to the following local groups on both machines:
- Administrators
- SIMATIC HMI
- SIMATIC NET
- SIMATIC Management Users
Configure Windows Network Sharing and Discovery:
- Open Windows Network and Sharing Center -> Advanced sharing settings.
- For the active network profile (Private / Domain), select:
- Turn on network discovery
- Turn on file and printer sharing
- Under 'All Networks', ensure password-protected sharing is enabled.
Share Target Project Directory on OS Server:
- On the OS Server, create or locate the target folder for WinCC projects (e.g. D:\WinCC_Projects\).
- Right-click the folder, select Properties -> Sharing -> Advanced Sharing.
- Check Share this folder. Click Permissions.
- Add group SIMATIC HMI (or Everyone) and grant Full Control.
- In the Security tab of folder properties, ensure SIMATIC HMI also possesses Full Control NTFS permissions.
Execute Siemens Security Controller:
- On both ES and OS Server, open the Windows Start Menu and launch Security Controller (Secon.exe).
- Click Repeat Settings to automatically configure all Windows Firewall exceptions, DCOM permissions, and registry keys required for PCS 7.
Execute Station Configuration and OS Download from SIMATIC Manager:
- In SIMATIC Manager Component View, highlight the PC Station of the OS Server.
- Select PLC -> Configure.... In the dialog, verify the target computer name matches the remote Windows hostname, then click Configure.
- Once configured, execute PLC -> Download to load the PC station components.

Verification

Verify network and station accessibility from the ES:
1. On the ES, open Windows Explorer and type \\<OS_Server_Name>\ into the address bar. Confirm that shared folders open instantly without credential prompts.
2. Create a test text file inside the shared project folder from the ES to verify write permissions.
3. In SIMATIC Manager, select PLC -> Display Accessible Nodes. Verify that the remote OS Server and its communication processors appear in the list.
4. Right-click the OS project object in SIMATIC Manager and select Target System -> Download. Confirm that the WinCC project transfer executes to completion without permission errors.

Limitations and Operational Precautions

Never Map Shares as Permanent Drive Letters with Reconnect on Logon: Using persistent mapped network drives (e.g. Z:) can cause WinCC Project Duplicator or SQL Server to lose connection if user sessions log off. Always use Universal Naming Convention (UNC) paths (\\Server\Share\).
Host Name Character Constraints: Windows computer names for PCS 7 stations must not exceed 15 characters, must contain only uppercase letters, digits, and hyphens, and must not include spaces or special characters.
Workgroup vs Domain Considerations: In a Windows Workgroup environment, passwords for the shared engineering account must be updated manually on every physical IPC whenever password policies enforce changes.

Engineer FAQ

Why does Windows ask for a password when accessing the OS Server from ES?

Windows prompts for credentials when the user account logged onto the ES does not exist on the target OS Server with the exact same username and password. Setting identical credentials on both machines eliminates the prompt.

What does the Siemens Security Controller do?

The Siemens Security Controller (Secon.exe) automatically configures Windows operating system settings, local security policies, DCOM access permissions, and Windows Firewall exceptions necessary for PCS 7 communication without requiring manual port editing.

Can I just share the entire C: drive to make OS downloading easier?

Sharing entire operating system system drives (e.g. C:\) is an extreme cybersecurity violation under IEC 62443. Only dedicated project subdirectories (e.g. D:\WinCC_Projects\) should be shared with access restricted to the SIMATIC HMI group.