Resolving SeCon Has Stopped Working Error During PCS 7 Installation on Windows Server 2012

The error 'SeCon has stopped working' (SeCon_x64.exe - SIMATIC Security Controller) during the initial bootstrap phase of SIMATIC PCS 7 V8.2 installation on Windows Server 2012 indicates a failure in Microsoft .NET Framework runtime components or an unreleased operating system build. PCS 7 V8.2 requires Windows Server 2012 R2 Standard or Datacenter with Update (KB2919355); non-R2 Windows Server 2012 is not released. To resolve this error, verify that the operating system is Windows Server 2012 R2, install Microsoft .NET Framework 3.5 using Server Manager (specifying the installation media source path), apply required Windows servicing stack updates, and restart the PCS 7 installation.

Role of SIMATIC Security Controller (SeCon) During Installation

The SIMATIC Security Controller (SeCon, executable SeCon_x64.exe) is an integral Siemens system utility executed at the very start and conclusion of SIMATIC software installations (including SIMATIC PCS 7, STEP 7, and WinCC). Its role is to automatically configure Windows security policies, local user groups (e.g., SIMATIC HMI, Siemens TIA Engineer), DCOM permissions, Windows Firewall rules, and network registry keys required for industrial communications.

During installation bootstrap, SeCon_x64.exe analyzes the operating system environment to ensure required security privileges and base libraries are operational. If the process crashes immediately upon invocation before package extraction begins, the setup wizard halts because security baseline validation cannot complete.

Root Causes: Operating System Release and .NET Framework Dependencies

Two distinct technical factors trigger the crash of SeCon_x64.exe on Windows Server platforms:
1. Unreleased Operating System Version: SIMATIC PCS 7 V8.2 strictly requires Windows Server 2012 R2 (Standard or Datacenter Edition, 64-bit) with Update KB2919355. The original baseline Windows Server 2012 (non-R2, NT 6.2) is fundamentally incompatible with PCS 7 V8.2 and causes immediate system call exceptions within SeCon.
2. Missing Microsoft .NET Framework 3.5: SeCon_x64.exe depends on legacy .NET Framework 2.0/3.5 runtime libraries (mscorwks.dll). On Windows Server 2012 R2, .NET Framework 4.5 is installed by default, but .NET 3.5 is disabled. If the feature is missing and cannot be downloaded automatically, SeCon throws an unhandled System.IO.FileNotFoundException or access violation crash.

Compatibility Matrix and Installation Prerequisites

The table below details operating system compatibility, prerequisite rollups, and service dependencies for PCS 7 V8.2:

Operating System / ComponentPCS 7 V8.2 Release StatusRequired Service Packs / UpdatesInstallation Source / ActionWindows Server 2012 (non-R2)Not SupportedIncompatible kernel architectureMust upgrade OS to Windows Server 2012 R2.Windows Server 2012 R2SupportedStandard / Datacenter 64-bit with KB2919355Baseline supported server OS for PCS 7 V8.2.Microsoft .NET Framework 3.5MandatoryIncludes .NET 2.0 and .NET 3.0 runtimesEnable via Server Manager using sources\sxs path.Microsoft .NET Framework 4.5.2 / 4.6MandatoryInstalled automatically by PCS 7 setupManaged via OS rollups and PCS 7 prerequisites.Windows Servicing StackRecommendedLatest Servicing Stack Update (SSU)Install prior to running Siemens setup.Visual C++ RedistributablesMandatoryVC++ 2008, 2010, 2012 x86 and x64Provided on PCS 7 media under Setup\Prerequisites.

Step-by-Step Remediation and Diagnostic Procedure

Verify Operating System Version: Open a command prompt and run winver. Verify that the OS is 'Windows Server 2012 R2'. If it reports Windows Server 2012 (build 9200), the operating system must be upgraded to Server 2012 R2 before proceeding.
Enable Microsoft .NET Framework 3.5 via Server Manager:
- Insert or mount the Windows Server 2012 R2 installation ISO (e.g., drive D:).
- Open Server Manager -> Manage -> Add Roles and Features.
- Proceed to Features, and select .NET Framework 3.5 Features.
- On the Confirmation screen, click Specify an alternate source path at the bottom.
- Set the path to D:\sources\sxs and click Install.
Install Cumulative Rollups and SSU: Install Microsoft update KB2919355 (Windows Server 2012 R2 Update) and reboot.
Collect Diagnostic Memory Dump (If Crash Persists):
- If SeCon crashes again, do not dismiss the error dialogue. Open Windows Task Manager, navigate to the Details tab, right-click SeCon_x64.exe, and select Create dump file.
- Run the SIMATIC Assessment Suite - Data Collector (SAS-DC) to gather system event logs and event ID details.
Restart PCS 7 Setup: Relaunch Setup.exe from the PCS 7 V8.2 media with 'Run as administrator'. SeCon will execute cleanly, configure security policies, and continue with the standard software component selection.

Verification

Verify resolution through the following milestones:
1. Confirm that Setup.exe launches without any crash dialogs and displays the Siemens Setup initialization progress bar.
2. Check the Windows Application Event Log (eventvwr.msc): verify the absence of Event ID 1000 (Application Error) for SeCon_x64.exe.
3. In the Windows Services console (services.msc), verify that Siemens communication services and user groups (SIMATIC HMI, etc.) are properly generated and populated.

Limitations and Operational Precautions

Do not attempt to disable the Security Controller or terminate SeCon_x64.exe to bypass setup checks. Bypassing SeCon leaves DCOM security settings and firewall rules unconfigured, which causes severe runtime communication failures (such as WinCC Server disconnection or CFC compilation errors). Always ensure that the host computer is not subject to restrictive domain Group Policy Objects (GPOs) that prohibit local security policy modifications during installation.