C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Troubleshooting WinCC OPC DA DCOM Error 0x80070005 Access Denied in PCS 7

Troubleshooting WinCC OPC DA DCOM Error 0x80070005 Access Denied in PCS 7

Connecting external OPC DA clients to a SIMATIC PCS 7 WinCC OS Server frequently aborts with DCOM error 0x80070005 (Access is Denied) due to hardened Windows Distributed COM security restrictions. When an OPC client discovers the server via OPCEnum but fails to activate the WinCC OPC Server CLSID {75D00BBB-DDA5-11D1-B944-9E614D000000}, Windows rejects the incoming remote call. Resolving error 0x80070005 requires adding the client user account to the Distributed COM Users and SIMATIC HMI security groups, configuring DCOM Default Launch and Access limits, executing the Siemens Security Controller, and targeting the correct redundant server node.

Table of Contents

Mechanisms of OPC DA and DCOM Security in SIMATIC WinCC

SIMATIC WinCC acts as an OPC Data Access (OPC DA 2.05a / 3.0) server via the internal communication component SopcDaSrv.exe, registered under CLSID {75D00BBB-DDA5-11D1-B944-9E614D000000} (OPCServer.WinCC):

  • Discovery Phase (OPCEnum): The client contacts the remote server's OPCEnum.exe service over TCP Port 135 to enumerate installed OPC servers. If network ping and Port 135 are open, discovery succeeds.
  • Activation and Remote Procedure Call (RPC): When the client attempts to instantiate OPCServer.WinCC, the Windows DCOM subsystem evaluates caller identity against local security descriptors.
  • The Error Manifestation: If the client's Windows account lacks explicit Launch or Access activation tokens, the DCOM layer blocks the creation request, returning HRESULT 0x80070005 (E_ACCESSDENIED).

Root Causes of DCOM Error 0x80070005 (Access Denied)

Key contributors to access denial include:

  1. Missing Group Membership: The user account running the OPC client application does not belong to the Distributed COM Users and SIMATIC HMI security groups on the WinCC Server.
  2. Strict DCOM Machine Limits: Windows Server 2016 and 2019 enforce hardened DCOM Machine Access and Launch Restrictions (dcomcnfg) that override local application-specific permissions unless explicitly granted.
  3. Mismatched Workgroup Credentials: When operating outside an Active Directory domain, identical local usernames and passwords must exist on both machines. An authenticated token mismatch triggers immediate denial.
  4. Redundant Server Target Confusion: On redundant WinCC OS server pairs, connecting to OPCServer.WinCC on the standby server without specifying the redundant server index or configuring mutual failover can result in connection refusal.

Step-by-Step DCOM and Security Configuration on the WinCC Server

Execute this progressive configuration on the WinCC OS Server hosting the OPC interface:

Step 1: Add Client User to Mandatory Security Groups

  1. Open Windows Computer Management (compmgmt.msc).
  2. Navigate to Local Users and Groups -> Groups.
  3. Locate the group Distributed COM Users:
    * Add the Windows user account (e.g., DOMAIN\OpcServiceAccount or local matching user) that runs the OPC client.
  4. Locate the group SIMATIC HMI:
    * Add the client user account to ensure access to WinCC runtime shared memory.
  5. Have the user log off and log back on to update token group memberships.

Step 2: Configure System DCOM Limits in DCOMCNFG

  1. Open the Windows Run dialog (Win + R), type dcomcnfg, and press Enter.
  2. Navigate to Component Services -> Computers -> My Computer.
  3. Right-click My Computer and select Properties.
  4. Select the COM Security tab:
    * Under Access Permissions, click Edit Limits...:
    • Ensure ANONYMOUS LOGON, Distributed COM Users, and SIMATIC HMI are present.
    • Grant Local Access and Remote Access (Allow).
    • Under Launch and Activation Permissions, click Edit Limits...:
    • Ensure Distributed COM Users and SIMATIC HMI are present.
    • Grant Local Launch, Remote Launch, Local Activation, and Remote Activation (Allow).
  5. Click OK to apply.

Step 3: Run Siemens Security Controller

  1. Open the Start menu and launch Siemens Security Controller.
  2. Click Repeat Settings to re-align Siemens-specific registry permissions, firewall ports, and DCOM endpoint policies.

Configuring Distributed COM Users and Windows Authentication

In non-domain (workgroup) environments where the OPC client resides on a separate network:

  • Local Account Synchronization: Create an identical local user account on the WinCC server matching the exact username and password of the client account.
  • Network Access Sharing Model: In Windows Local Security Policy (secpol.msc), navigate to Security Options -> Network access: Sharing and security model for local accounts. Ensure it is set to Classic - local users authenticate as themselves (not Guest only).

Redundant OS Server OPC Instance Naming Conventions

In redundant SIMATIC PCS 7 systems:

  • The primary server typically hosts OPCServer.WinCC.
  • The secondary partner server may register its instance with an index suffix: OPCServer.WinCC.1.
  • If a third-party client (such as AspenTech CIMIO, Kepware, or Matrikon) fails to connect to the primary node due to an active client exclusivity lock, configuring the client to query OPCServer.WinCC.1 on the standby server verifies whether server-side resource contention is the root cause.
  • For automated redundancy, deploy the WinCC Connectivity Pack or OpenPCS 7, which provides an OPC DA client-switch mechanism across redundant servers.

Verification

Confirm successful OPC DA communication:

  1. Local OPC Scout Verification:
    * On the WinCC server, launch OPC Scout V10 (or Siemens OPC Scout).
    * Connect locally to OPCServer.WinCC and browse the tag namespace. Confirm that process variables read with Good quality code.
  2. Remote Client Connection Test:
    * On the remote OPC client PC, launch the client interface (or remote OPC Scout).
    * Connect to OPCServer.WinCC on the server node.
    * Confirm that error 0x80070005 no longer appears and that tags subscribe successfully.
  3. Event Viewer Audit:
    * Inspect Windows Event Viewer System logs on the server; verify that no DCOM Event ID 10016 or 10006 errors are recorded.

Limitations and Operational Precautions

  • DCOM Hardening Updates (KB5004442): Modern Windows operating systems enforce DCOM authentication hardening. Ensure all OPC client applications support RPC_C_AUTHN_LEVEL_PKT_INTEGRITY to avoid connection drops.
  • OPC DA Technology Obsolescence: OPC DA relies on legacy Microsoft COM/DCOM technology. For new installations or cross-network integrations, migrate to OPC UA (Open Platform Communications Unified Architecture) via OpenPCS 7 to eliminate DCOM complexity entirely.
  • Firewall Port Requirements: OPC DA requires TCP Port 135 plus dynamic TCP RPC ports (typically 49152–65535). Restricting dynamic RPC ports in corporate firewalls requires fixed DCOM port configuration.

Engineer FAQ

  • What does error code 0x80070005 mean in WinCC OPC communication?
    It is the standard Windows HRESULT for 'Access is Denied', indicating that DCOM security prevented the client from activating or accessing the WinCC OPC server.
  • Why can the OPC client discover the server but fail to connect?
    Discovery is handled by OPCEnum.exe, which has looser access requirements; activating OPCServer.WinCC requires full DCOM Launch and Activation permissions.
  • What local Windows groups must the OPC client user belong to on the server?
    The user must belong to Distributed COM Users and SIMATIC HMI.
  • What is the programmatic identifier (ProgID) for the WinCC OPC DA server?
    The ProgID is OPCServer.WinCC (or OPCServer.WinCC.1 on secondary redundant stations).
  • Does WinCC OPC DA support connections without user authentication?
    Windows DCOM requires authentication; Anonymous Logon can be granted access limits in dcomcnfg, but authenticated user accounts are strongly recommended.
  • How does Siemens Security Controller help resolve DCOM issues?
    The Security Controller automatically resets and hardens DCOM, registry, and firewall rules required for Siemens industrial software communication.
  • What is OpenPCS 7 in relation to WinCC OPC communication?
    OpenPCS 7 is an optional Siemens communication package providing centralized OPC DA, OPC HDA, and OPC A&E access across an entire PCS 7 plant.
  • Can I use a third-party OPC client like Kepware or Matrikon with WinCC?
    Yes, any OPC Foundation-compliant OPC DA 2.05a or 3.0 client can communicate with WinCC, subject to DCOM security validation.
  • What happens if the primary WinCC server fails in a redundant pair?
    Standard OPC DA clients do not support automatic failover unless configured with redundancy middleware (like OpenPCS 7 or client-side redundancy brokers).
  • Why is OPC UA preferred over OPC DA for remote connections?
    OPC UA operates over standard TCP/IP (single port, e.g., 4840), utilizes certificate-based encryption, and completely eliminates Microsoft DCOM vulnerabilities.

Technical References

  • Siemens Industry Online Support (SIOS) Portal: Which DCOM settings must be checked for WinCC with OPC DA? (Entry ID: 109768431).
  • Microsoft Technical Documentation: Managing DCOM Security and Hardening Guidelines.
  • OPC Foundation: OPC Data Access Custom Interface Standard (Version 3.0).

Related Articles

Related Tags

PCS 7, WinCC, OPC DA, DCOM, Error 80070005, Access Denied, OPCEnum, Network Security

20 respuestas