Validating and Deploying Microsoft Windows Updates on SIMATIC PCS 7 Systems

Microsoft Windows security updates, monthly quality rollups, and servicing stack updates (SSU) must never be installed automatically on SIMATIC PCS 7 systems without formal compatibility verification. Siemens conducts monthly laboratory testing of all Windows patches against active PCS 7 versions (including V9.0 SP2 on Windows Server 2012 R2 and Windows 10 Enterprise 2015 LTSB). System administrators must cross-reference planned patches against the official Siemens compatibility spreadsheet 'Which Microsoft Updates have been tested for compatibility with SIMATIC PCS 7' (Entry ID 109749362) before deploying them via a dedicated WSUS server.

Executive Summary

Maintaining cybersecurity compliance in industrial automation requires patching known operating system vulnerabilities while safeguarding continuous plant availability. In facilities operating SIMATIC PCS 7 V9.0 SP2 on Windows Server 2012 R2 (for OS Servers) and Windows 10 Enterprise 2015 LTSB (for OS Clients), plant security teams regularly request approval to install Microsoft security updates (such as KB5005563, KB5005613, KB5005627, and KB5005569).

Deploying unverified Windows updates into an operational PCS 7 DCS environment poses severe operational hazards. Microsoft patches can introduce unannounced DCOM hardening policies, alter SQL Server network protocols, or modify RPC timing, causing WinCC communication disconnects and station freezes. This guide details the formal Siemens patch validation process, explains how to interpret the monthly compatibility matrix, and outlines best practices for managed patch deployment.

Architecture and Fundamental Mechanics

The interaction between Microsoft Windows Updates and SIMATIC PCS 7 software components involves critical low-level operating system hooks:

The DCOM / RPC Communication Subsystem: WinCC client-server architectures, AS-OS engineering tools, and Automation License Manager rely extensively on Microsoft Distributed Component Object Model (DCOM) and Remote Procedure Calls (RPC). Security patches that enforce strict DCOM authentication levels (such as Microsoft CVE-2021-26414) can instantly sever communication between OS Clients and OS Servers if installed without corresponding Siemens software updates.
SQL Server Database Engine: WinCC utilizes Microsoft SQL Server (2014 SP2 in PCS 7 V9.0 SP2). Windows Cumulative Updates that update .NET Framework runtimes or cryptographic cipher suites can disrupt SQL Server network protocol bindings (sqlncli11.dll), stalling real-time tag logging.
Siemens Quality Assurance and Compatibility Testing: Siemens operates dedicated DCS test laboratories running production-representative PCS 7 architectures. Within weeks of Microsoft's 'Patch Tuesday' releases, Siemens subjects all security and quality updates to regression testing against active PCS 7 versions (V8.2, V9.0, V9.1). The results are published in a continuously updated Excel matrix attached to Siemens Online Support Entry ID 109749362.
Patch Status Classification:
- Tested / Compatible: The patch demonstrated zero regression defects during laboratory testing and is approved for deployment.
- Under Test: Testing is currently underway; deployment should be deferred.
- Not Compatible / Incompatible: The update causes known operational failures; deployment is prohibited until Siemens releases a hotfix.

Step-by-Step Implementation Procedure

Follow these steps to validate, stage, and deploy Microsoft Windows Updates on SIMATIC PCS 7 systems:

Disable Automatic Windows Updates on All PCS 7 Workstations:
- On every ES, OS Server, and OS Client, open the Local Group Policy Editor (gpedit.msc).
- Navigate to: Computer Configuration > Administrative Templates > Windows Components > Windows Update.
- Double-click 'Configure Automatic Updates' and set it to 'Disabled' (or set to '2 - Notify for download and auto install'). This prevents unannounced reboots and unverified patch installations.
Download and Consult the Siemens Compatibility Spreadsheet:
- Access Siemens Industry Online Support (SIOS) and search for Entry ID 109749362: 'Which Microsoft Updates have been tested for compatibility with SIMATIC PCS 7'
- Download the latest Excel file: PCS7_Tested_Microsoft_Updates.xlsx.
- Open the spreadsheet and navigate to the tab corresponding to your operating system: e.g., 'Windows Server 2012 R2' or 'Windows 10 Enterprise 2015 LTSB'.
- Locate the specific KB numbers requested by IT (e.g., KB5005563, KB5005613, KB5005627, KB5005569).
- Verify that the 'Test Result' column displays 'Compatible' (or 'Released') for your installed PCS 7 version (PCS 7 V9.0 SP2).
Check Servicing Stack Update (SSU) Prerequisites:
- Microsoft quality rollups require current Servicing Stack Updates to install cleanly without rollbacks.
- Confirm that the prerequisite SSU (e.g., KB5001403 for Server 2012 R2, KB5001399 for Win10 1507) is installed prior to the monthly cumulative rollup.
Stage and Approve Patches in Windows Server Update Services (WSUS):
- In the plant perimeter network / DMZ, configure a dedicated WSUS server.
- Approve ONLY the specific KB numbers verified as 'Compatible' in the Siemens matrix.
- Group PCS 7 stations into staging rings: Ring 1 (Test/Engineering Station), Ring 2 (Standby OS Servers and Clients), Ring 3 (Master OS Servers).
Execute Staged Deployment During Maintenance Windows:
- Deploy approved patches to Ring 1 (Engineering Station) first. Verify SIMATIC Manager, CFC, and WinCC compilation operate normally.
- In redundant OS Server pairs, patch the Standby OS Server first. Verify that runtime redundancy synchronization completes cleanly.
- Perform a manual redundancy switchover so the newly patched server becomes active.
- Patch the partner OS Server and verify complete system stability before updating OS Clients.

Verification

On patched workstations, open Windows Command Prompt and run systeminfo to verify that the approved KB updates are listed under 'Hotfix(s)'.
Launch SIMATIC Manager and WinCC Explorer: confirm that all engineering editors open without licensing or DLL initialization faults.
In WinCC OS Runtime, verify that S7 communication channels report 'State: OK' in WinCCChannelDiagnosis.exe.
Check Windows Event Viewer under Application and System logs to confirm zero DCOM error events (Event ID 10016 or 10036) or SQL service termination warnings.
Verify that faceplate command actions and historical trend browsing function smoothly across all OS Clients.

Limitations and Operational Precautions

Never install Microsoft 'Preview' rollups or out-of-band non-security patches on production DCS systems. Operating systems that have reached Microsoft End of Life (such as Windows Server 2012 R2 or Windows 10 2015 LTSB) require Siemens Extended Support agreements and Microsoft Extended Security Updates (ESU) to receive ongoing patches. Consult an authorized Siemens distributor or the Siemens Industry Mall for operating system migration upgrade paths to PCS 7 V9.1.

Engineer FAQ

Where does Siemens publish the list of tested Windows patches?

Siemens publishes and updates a monthly compatibility Excel spreadsheet in Siemens Industry Online Support under Entry ID 109749362.

What happens if an unverified Windows update breaks WinCC communication?

You must uninstall the offending KB update via Windows Control Panel > 'Programs and Features' > 'View installed updates', reboot the computer, and block the patch in WSUS until a Siemens-tested version is released.

Why should Servicing Stack Updates (SSU) be installed before rollups?

SSU updates contain the component-based servicing engine that installs Windows updates. Installing a rollup without the required SSU can cause installation loops or fatal boot failures.

Is it safe to connect PCS 7 computers directly to Microsoft Windows Update over the internet?

No. Direct internet connections violate IEC 62443 industrial security standards. All updates must be staged through a local WSUS server or deployed manually via offline installers.

Does Siemens test third-party antivirus updates alongside Windows patches?

Yes. Siemens tests major industrial antivirus suites (Microsoft Defender, Symantec, Trend Micro, McAfee) to ensure compatibility with each monthly patch cycle.