Troubleshooting No Pictures Found on WinCC OS Clients with Restricted Users

The error 'No pictures found' occurs on a WinCC OS Client when logging in with a newly created restricted Windows user because the user account lacks network access permissions to the shared project directory on the OS Server. WinCC OS Clients do not store graphics locally; they load picture files (GraCS) over the Terminal Bus from the OS Server share. If the user account does not exist on the OS Server with the exact same credentials, or is not a member of the local 'SIMATIC HMI' group on both the client AND server, Windows network authentication fails, blocking graphic loading.

Client-Server Graphic Loading Architecture in PCS 7

In a distributed SIMATIC PCS 7 architecture, thin OS Clients operate as visualization portals:
* The client machine hosts a minimal WinCC Client project database (*.mcp).
* Process graphics (*.pdl), faceplate scripts, and bitmap symbols are stored centrally on the OS Server inside the project subfolder GraCS.
* When an operator activates Runtime on the client, WinCC queries the loaded Server Data Package (*.pck) to locate the server's Universal Naming Convention (UNC) network share (e.g., \\OS_SRV_01\WinCC_Project\GraCS).
* If the operating system grants access, the client renders the startup picture @Overview1.pdl. If network authentication fails, the graphic subsystem aborts with the error dialog: No pictures found.

Root Causes of Terminal Bus Authentication Failures

When an administrative account works seamlessly while a newly created restricted operator account fails, the fault lies in Windows cross-station authentication:

Workgroup Credential Mismatch (Pass-Through Authentication Failure): In non-domain industrial workgroups, Windows utilizes pass-through authentication. If the restricted user Operator1 is created on the client PC, but has a different password, mistyped username, or does not exist on the OS Server, the server rejects network file requests with Access Denied.
Missing Membership in the Server's 'SIMATIC HMI' Group: Windows folder sharing for WinCC projects grants NTFS and Share permissions specifically to the local group SIMATIC HMI. Adding the user to SIMATIC HMI on the client PC is insufficient; the user must be a member of SIMATIC HMI on the OS Server.
Restricted Windows User Rights: While standard operator accounts should be restricted from altering Windows system settings, removing core network access rights (such as "Access this computer from the network" in Local Security Policy) blocks WinCC file transfers.

Step-by-Step Security and User Configuration Procedure

Execute the following administrative configuration to establish valid cross-machine access:

Align User Credentials Across All Stations:
* On every station (Engineering Station, OS Server A, OS Server B, and all OS Clients), open Computer Management (compmgmt.msc).
* Navigate to Local Users and Groups -> Users.
* Create the restricted user account (e.g., Operator_Plant) with the exact same username and password on all machines (passwords are case-sensitive).
* Uncheck "User must change password at next logon" and check Password never expires.
Assign Mandatory Windows Security Groups:
* On BOTH the OS Client AND the OS Server, add the user account to the following local groups:
- Users
- SIMATIC HMI (Mandatory: grants access to WinCC databases and shares).
- SIMATIC Management Users (Optional: for SIMATIC Management Console).
- Do NOT add standard operators to Administrators or Power Users.
Verify OS Server Project Share Permissions:
* On the OS Server, open Windows Explorer and locate the project folder.
* Right-click the folder and select Properties -> Sharing -> Advanced Sharing.
* Under Permissions, verify that the group SIMATIC HMI has Full Control (or Change/Read).
* Go to the Security (NTFS) tab and ensure SIMATIC HMI possesses Modify, Read, and Execute permissions.
Test Network Share Access from Client:
* Log into the OS Client machine as the restricted user.
* Open Windows File Explorer and navigate directly to the server share UNC path:
\\OS_SRV_01\WinCC_Project\GraCS
* Confirm that .pdl picture files can be viewed and opened without receiving a Windows network credentials prompt.

Verification

On the OS Client, launch WinCC Runtime under the restricted Windows user account.
Verify that the primary overview navigation bar, alarm summary banner, and plant overview pictures load immediately without any "No pictures found" error dialogs.
Open an APL faceplate. Confirm that tag values, trends, and alarm journals populate dynamically.

Limitations and Operational Precautions

In corporate Active Directory domains, manage user accounts centrally: create a domain user, add the user to a Domain Global Group, and nest that group into the local SIMATIC HMI group on all industrial servers and clients.
Never share project directories with "Everyone" without proper NTFS security; unrestricted shares expose critical industrial control databases to malware and ransomware across the network.
Running multiple OS Clients under identical generic operator logins (e.g., Operator1) is common in control rooms; ensure individual operator accountability is maintained via WinCC internal user administration or SIMATIC Logon.

Engineer FAQ

Why did the administrative user work without issue?
The administrator account had identical credentials pre-configured across all stations during PCS 7 installation, automatically inheriting full administrative network share rights.
Does the client need local administrator privileges to run WinCC?
No. OS Clients are specifically designed to run under standard restricted Windows Users, provided they belong to the local SIMATIC HMI group.
Can picture files be copied locally to the client to avoid server sharing?
No. PCS 7 client-server architecture requires dynamic picture loading and server data package routing over the Terminal Bus. Local graphics break central multi-client engineering.

Technical References

SIMATIC PCS 7 OS Process Control System; Client-Server Architecture Manual (A5E41356262-AA).
Siemens Industry Online Support Entry ID 109801081: Setting Up User Rights and Network Shares in PCS 7.
SIMATIC HMI WinCC V7/V8 Security and Workgroup Configuration Guide.

Related Tags

PCS 7, WinCC, OS Client, OS Server, User Rights, SIMATIC HMI, Terminal Bus, Networking

Troubleshooting No Pictures Found on WinCC OS Clients with Restricted Users