C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Windows Domain Integration Sequence for SIMATIC PCS 7 - Installing Before or After Domain Join

Windows Domain Integration Sequence for SIMATIC PCS 7 - Installing Before or After Domain Join

In SIMATIC PCS 7 architectures, the host PC station must be joined to the Windows Active Directory Domain FIRST, before installing the SIMATIC PCS 7 software. The installation must then be executed under a Domain User account that has been added to the local PC's 'Administrators' group. Installing PCS 7 while the PC is in a local Workgroup causes the installer to populate critical security groups (such as SIMATIC HMI, SIMATIC NET, SIMATIC Management Users, and SQL Server groups) exclusively with local machine accounts. If the machine is subsequently joined to a domain, domain users will lack membership in these security groups, causing severe DCOM communication failures, SQL Server authentication blocks, and network project access denials.

Table of Contents

Executive Summary

Deploying industrial PC stations (Engineering Stations, redundant OS Servers, OS Clients, BATCH, and Route Control servers) in enterprise network environments requires strict alignment with IT infrastructure and Microsoft Active Directory domain policies. System integrators frequently debate whether it is preferable to install PCS 7 on a standalone workgroup machine before handing it over to plant IT for domain integration, or whether domain joining must precede software setup. Siemens system guidelines mandate domain membership prior to software deployment. This technical guide explains the underlying Windows security group population mechanics, outlines DCOM and SQL authentication consequences, and details remediation procedures for misconfigured systems.

Architecture and Fundamental Mechanics

Security Group Population: Workgroup vs. Domain Installation

SCENARIO A: INCORRECT WORKFLOW (Install in Workgroup -> Join Domain Later)
+-------------------------------------------------------------------------+
| 1. Install PCS 7 in Workgroup:                                          |
|    Installer creates local groups: SIMATIC HMI, SIMATIC NET, etc.       |
|    Populates groups with: [Local_PC\LocalAdmin, Local_PC\LocalUser]     |
|                                                                         |
| 2. Join Windows Active Directory Domain:                                |
|    Domain User logs on (Domain\Engineer1)                               |
|    Domain\Engineer1 is NOT in local SIMATIC HMI group!                  |
|                                                                         |
| RESULT:                                                                 |
| - WinCC Explorer cannot open project: 'Access Denied'                   |
| - DCOM connection between ES and OS fails completely                    |
| - SQL Server rejects database attachment                                |
+-------------------------------------------------------------------------+

SCENARIO B: RECOMMENDED SIEMENS WORKFLOW (Join Domain First -> Install PCS 7)
+-------------------------------------------------------------------------+
| 1. Join PC to Domain & Assign Domain Admin to Local Administrators      |
|                                                                         |
| 2. Log in as Domain User with Local Admin rights                        |
|                                                                         |
| 3. Install SIMATIC PCS 7:                                               |
|    Installer detects Domain context!                                    |
|    Populates SIMATIC groups with both Domain accounts & Local accounts! |
|    Configures SIMATIC Security Controller with full Domain SID mappings |
|                                                                         |
| RESULT: Flawless network authentication, DCOM routing, and SQL access!  |
+-------------------------------------------------------------------------+

The Mechanics of Siemens Security Groups

During setup, SimaticSecurityControl.exe configures Windows Local Security Policies, COM/DCOM access permissions, and local user groups:
1. SIMATIC HMI: Controls read/write access to WinCC project files, shared network folders, and the Microsoft SQL Server WinCC instance.
2. SIMATIC NET: Controls access to network interface cards (CP 1623, Softnet) and OPC servers.
3. SIMATIC Management Users: Required for central software deployment and inventory via SIMATIC Management Console (SMMC).

If the machine is installed before joining the domain, the installer has no access to the Domain Controller (DC) and cannot resolve domain Security Identifiers (SIDs). Consequently, domain accounts are completely omitted from these groups.

Step-by-Step Implementation Procedure

Step 1: Prepare the Clean Operating System and Network

  1. Install the approved version of Windows (e.g., Windows 10 Enterprise LTSC or Windows Server 2019).
  2. Configure network adapters with static IP addresses and configure primary/secondary DNS servers pointing to the Domain Controllers.
  3. Test DNS name resolution bidirectionally: ping domain.local and nslookup domain.local.

Step 2: Join the PC to the Windows Domain

  1. Open System Properties > Computer Name / Domain Changes.
  2. Select Domain, enter the corporate/plant domain name, and provide authorized domain administrative credentials.
  3. Restart the computer when prompted to complete the domain join.

Step 3: Configure Administrative Rights for the Installation Account

  1. Log into the PC using the local Administrator account.
  2. Open Computer Management > Local Users and Groups > Groups.
  3. Open properties for the local group Administrators.
  4. Click Add..., browse the domain, and add the Domain User account (or Domain Engineering Group) that will execute the PCS 7 installation.
  5. Log off the local administrator account.

Step 4: Execute SIMATIC PCS 7 Installation under Domain Account

  1. Log into the computer using the Domain User account configured in Step 3.
  2. Mount the PCS 7 installation media.
  3. Right-click Setup.exe and select Run as administrator.
  4. Complete the installation. The setup program automatically detects the domain context, queries the DC, and registers the active domain user and domain groups into SIMATIC HMI, SIMATIC NET, and SQL Server instances.
  5. When prompted after reboots, log back in using the identical domain account to allow setup routines to finalize.

Step 5: Remediation for Systems Installed Before Domain Join (If Already Misconfigured)

  1. If a PC was improperly installed before domain joining:
  2. Join the PC to the domain and restart.
  3. Log in as a Domain Administrator.
  4. Open Start > Siemens Automation > Security Control.
  5. Click the button Repeat Settings (or Einstellungen wiederholen).
  6. SIMATIC Security Control will rescan active users, query the domain controller, and re-apply permissions.
  7. Open Computer Management and manually verify that domain operator groups are present inside SIMATIC HMI and SIMATIC NET.

Verification

  1. Group Membership Audit: Open Computer Management > Local Users and Groups > Groups > SIMATIC HMI. Confirm that both the local user accounts and domain user accounts/groups are listed as active members.
  2. Network Share Access Test: From another PC in the domain, browse to \PCS7_PC\WinCC_Projects. Confirm that the folder opens without authentication prompts.
  3. WinCC Project Launch: Log in as a standard domain operator. Open a WinCC OS project in WinCC Explorer. Confirm that the project initializes without DCOM access denied warnings or SQL connection errors.

Limitations and Operational Precautions

  1. Domain Controller Availability: In critical plants, if the Domain Controller fails or network links are severed, cached domain credentials permit login, but authentication delays can slow down OS client reconnects; configure redundant Domain Controllers within the plant network.
  2. Group Policy (GPO) Conflicts: IT domain Group Policies must not enforce aggressive firewall locks, disable NTLMv2, or block DCOM protocols required by SIMATIC NET; coordinate with IT to place PCS 7 stations in a dedicated, exempted Organizational Unit (OU).

Engineer FAQ

Should I install PCS 7 before or after adding the PC to a domain?

Always join the PC to the domain FIRST, and then install PCS 7 under a domain account with local administrative privileges.

What happens if I install PCS 7 before joining the domain?

The installer only adds local accounts to SIMATIC security groups. When domain users log in later, they are blocked from WinCC, SQL, and network projects.

How do I fix a PC that was installed before domain join?

Join the domain, log in as domain admin, and run SIMATIC Security Control with 'Repeat Settings' to re-apply group permissions.

Which user groups does the PCS 7 installer create?

SIMATIC HMI, SIMATIC NET, SIMATIC Management Users, and dedicated SQL Server database instance groups.

Can I install PCS 7 using a Domain Administrator account?

Yes, provided the domain account is added to the local Administrators group of the target PC.

Does PCS 7 support Workgroups for smaller plants?

Yes. Single stations or small plants can operate entirely in a Workgroup, but if a domain is planned, join it before installation.

Why does WinCC say 'Access Denied' when opening a project?

The logged-in domain user is missing from the local SIMATIC HMI Windows group.

Can GPOs disable required PCS 7 Windows services?

Yes. Domain GPOs must be carefully configured to avoid disabling SIMATIC Shell, SQL Server, or message queuing services.

What is the role of SIMATIC Security Control?

It configures Windows DCOM settings, firewall rules, and user group assignments required for PCS 7 communication.

Where can I find Siemens domain configuration guidelines?

Refer to the SIMATIC PCS 7 PC Configuration and Network Security manual on Siemens Industry Online Support.

Technical References

Related Articles

Related Tags

  • Domain Integration
  • Active Directory
  • SIMATIC HMI
  • SIMATIC Security Control
  • Installation Order
  • Windows Security
  • PCS 7 Engineering
20 respuestas