Resolving 'Your User Rights Do Not Include the Use of STEP 7' in SIMATIC Manager

In SIMATIC PCS 7, encountering the error message "Your user rights do not include the use of STEP 7" when launching SIMATIC Manager under a newly created Windows user account occurs because the user account is not a member of the mandatory Windows local security groups required by Siemens engineering software. Unlike standard office applications, SIMATIC Manager enforces strict operating system security validation to prevent unprivileged accounts from modifying automation databases. Resolving this issue requires adding the user account to the "Siemens TIA Engineer" (or "STEP 7 Users"), "SIMATIC HMI", and "SIMATIC NET" local user groups in Windows Computer Management and executing the Siemens Security Controller utility.

Operating System Security Model in SIMATIC PCS 7

SIMATIC PCS 7 engineering environments integrate multiple background database engines, communication drivers, and file repositories—including Microsoft SQL Server, SIMATIC Device Management, Automation License Manager, and Simatic Shell.

To protect industrial automation programs from unauthorized alterations or malicious tampering, Siemens implements role-based access control tied directly to the host operating system's local security accounts manager (SAM) or Active Directory domain.

When a computer is commissioned with PCS 7, the installer automatically configures dedicated Windows security groups. If a systems administrator creates a new Windows login (e.g., user_1 or a shift engineer account) and assigns it only standard Windows Users membership, SIMATIC Manager intercepts the startup process, verifies security tokens, and immediately blocks execution with: Your user rights do not include the use of STEP 7.

Mandatory Windows User Groups for Engineering Stations

For an engineering account to execute SIMATIC Manager, CFC, and WinCC, the Windows user must belong to specific security groups:

Windows Local User GroupRequired ForFunctional Privilege GrantedSiemens TIA EngineerSTEP 7 / SIMATIC Manager / CFCAccess to engineering database, S7 project files, and compilersSTEP 7 UsersLegacy STEP 7 V5.x installationsReplaced by Siemens TIA Engineer in newer PCS 7 releasesSIMATIC HMIWinCC Explorer / Graphics DesignerAccess to WinCC SQL Server database instances and project sharesSIMATIC NETCommunications / PG/PC InterfaceAccess to communication processors, Simatic Shell, and network driversPerformance Monitor UsersDiagnostics / Maintenance StationWindows performance counter auditing and diagnostic traces

If user_1 is only added to Siemens TIA Engineer but omitted from SIMATIC HMI, SIMATIC Manager will open, but opening WinCC or compiling the OS will fail with database access denial errors.

Step-by-Step Procedure to Add User Accounts via compmgmt.msc

To assign the required permissions to the user account:

Log into the Engineering Station using an account with local administrative privileges (e.g., Administrator).
Open Windows Computer Management: press Win + R, type compmgmt.msc, and press Enter.
In the navigation tree, expand System Tools -> Local Users and Groups -> Groups.
Double-click the group Siemens TIA Engineer (or STEP 7 Users).
Click Add..., enter the username user_1, and click Check Names; click OK to apply.
Repeat the process to add user_1 to:
- SIMATIC HMI
- SIMATIC NET
If the engineer must configure hardware adapters or install software updates, add user_1 to the local Administrators group.
Click Apply and close Computer Management.

Applying Permissions via Siemens Security Controller

Whenever Windows user groups or domain policies are adjusted, run the Siemens Security Controller to ensure file system and DCOM access control lists (ACLs) are updated:

In the Windows Start menu, navigate to Siemens Automation -> Security Controller (or execute C:\Program Files (x86)\Siemens\SecurityController\SecurityController.exe as Administrator).
Click Repeat Settings (or Apply Settings).
The Security Controller scans all installed PCS 7 components, verifies Windows Firewall exceptions, grants DCOM launch and activation permissions, and configures SQL Server rights for the updated groups.
Log out of Windows and log back in as user_1 to refresh the user's security token.

Verification

To verify that user permissions are properly configured:
1. Log into Windows as user_1.
2. Open Windows Command Prompt; execute whoami /groups and verify that Siemens TIA Engineer, SIMATIC HMI, and SIMATIC NET appear in the active group token list.
3. Launch SIMATIC Manager; confirm that the application starts without the user rights error popup.
4. Open a PCS 7 Multiproject, open a CFC chart, and open WinCC Explorer; confirm that all engineering editors open with full read and write capabilities.

Limitations and Operational Precautions

Never attempt to bypass Siemens user rights by granting generic 'Everyone' or 'Anonymous' permissions to the C:\Program Files (x86)\Siemens directory. Modifying default folder permissions manually violates industrial cybersecurity standards and can corrupt Windows DCOM access control lists. Always manage permissions exclusively through official Siemens local user groups and the Security Controller utility.

Engineer FAQ

Can a standard Windows domain user run SIMATIC Manager?

Yes, provided the domain user account (or a domain security group containing the user) is added to the local Siemens TIA Engineer and SIMATIC HMI groups on the physical Engineering Station.

Does adding a user to Siemens TIA Engineer grant Windows Administrator rights?

No. Siemens TIA Engineer grants specific engineering rights within SIMATIC applications without granting full administrative control over the Windows operating system.

Why must the user log off and log back in after adding groups?

Windows only generates security group tokens during the initial user logon. Group additions made while a user is logged in do not take effect until the next logon session.