Windows Scheduled Tasks Guidelines and Resource Management for PCS 7 OS Clients

In SIMATIC PCS 7 v8.1, standard Windows scheduled tasks are permitted on an OS Client station provided they do not consume real-time CPU/disk resources, initiate uncoordinated reboots, or interfere with WinCC runtime processes. Basic operating system maintenance tasks (such as idle font caching or certified antivirus definition updates) are allowed. However, automated Windows Update reboots, background disk defragmentation on active runtime partitions, and unscheduled third-party batch maintenance scripts are strictly prohibited to prevent operator screen freeze and communication dropouts.

Operating Environment and Resource Demands of PCS 7 OS Clients

A SIMATIC PCS 7 OS Client (6ES7652-0CX08-1XB0) functions as the real-time human-machine interface (HMI) for industrial plant operators. It must maintain constant graphics responsiveness, instant faceplate instantiation (< 1 second), and uninterrupted alarm annunciation over the terminal bus.

While the client operates on standard commercial operating systems (Windows 7 SP1 64-bit or Windows 10 Enterprise LTSB), default Windows installations include dozens of automated background scheduled tasks managed by the Windows Task Scheduler (taskschd.msc). If resource-intensive scheduled tasks trigger while an operator is conducting a critical process adjustment, CPU spikes or disk thrashing can cause operator mouse lag, delayed alarm displays, or terminal bus timeout disconnects.

Permitted vs Prohibited Windows Scheduled Tasks Matrix

The following matrix classifies Windows scheduled tasks on PCS 7 OS Clients:

Scheduled Task CategorySpecific Task Name / FunctionStatus on OS ClientOperational RationaleWindows Update Automatic RebootReboot / Schedule ScanSTRICTLY PROHIBITEDTriggers unexpected station reboot during live plant production.Disk DefragmentationDefrag / ScheduledDefragPROHIBITEDSlashes disk I/O throughput; degrades SSD lifespan. Disabled on SSDs.Customer Experience (CEIP)Consolidator, KernelCeipTaskPROHIBITEDUnnecessary telemetry; consumes CPU and network bandwidth.Antivirus Signature UpdatesSophos, McAfee, Trend MicroPERMITTED (Controlled)Essential for cybersecurity; schedule during off-peak shift change.System Hygiene / Font CacheFontCache, CleanupTemporaryStatePERMITTEDLow overhead; executes only during deep idle state.SIMATIC Maintenance ScriptsDiagnostic log rotationPERMITTEDOfficial Siemens background tasks configured by installation.

Table 1: Task classification matrix for SIMATIC PCS 7 OS Clients.

Disabling High-Risk Windows Scheduled Tasks via Group Policy

To ensure operating system stability, high-risk tasks should be disabled systematically via local Group Policy (gpedit.msc):

Disable Automatic Windows Update Reboots:
* Open Local Group Policy Editor (gpedit.msc).
* Navigate to: Computer Configuration > Administrative Templates > Windows Components > Windows Update.
* Enable: No auto-restart with logged on users for scheduled automatic updates installations.
* Configure: Configure Automatic Updates to Notify for download and auto install (Option 3).
Disable Disk Defragmentation:
* Open Windows Task Scheduler (taskschd.msc).
* Navigate to: Task Scheduler Library > Microsoft > Windows > Defrag.
* Right-click ScheduledDefrag and select Disable.
Disable Telemetry and Feedback:
* Navigate to: Task Scheduler Library > Microsoft > Windows > Customer Experience Improvement Program.
* Disable Consolidator, UsbCeip, and KernelCeipTask.

Best Practices for Antivirus and Security Maintenance Scheduling

For permitted security tasks such as antivirus updates:
* Configure signature definitions to download quietly without invoking modal popups or user prompts.
* Schedule full-system disk scans exclusively during planned unit turnarounds or plant shutdown periods; full disk scans must never execute during active process operations.
* Ensure antivirus real-time scanners include explicit exclusion rules for WinCC directories (C:\Program Files (x86)\Siemens\WinCC\, project .mcp folders, and SQL Server databases).

Verification

To confirm proper scheduled task configuration:

Open Windows Task Scheduler (taskschd.msc): inspect active tasks and verify that prohibited defragmentation and update reboot tasks are set to Disabled.
Open Windows Task Manager: monitor baseline CPU and disk utilization while WinCC Runtime is active. Baseline CPU should remain below 10% during steady-state monitoring.
Open WinCC Runtime: verify that navigating between complex process pictures and opening APL faceplates remains smooth and instantaneous without frame drops.

Limitations and Operational Precautions

Never disable core Windows kernel tasks required for RPC, DCOM, or Plug-and-Play hardware detection, as doing so will corrupt operating system stability.
When managing client stations within an Active Directory domain, ensure domain-level Group Policy Objects (GPOs) do not override local Siemens hardening rules.
Always execute SIMATIC Security Controller after modifying Windows features to restore validated security baselines.

Engineer FAQ

Can Windows Defender run scheduled scans on an OS Client?

Scheduled quick scans are acceptable if scheduled during off-peak hours, but real-time scanning must exclude WinCC project folders and SQL Server database files to prevent file locking.

Why is disk defragmentation dangerous on an OS station?

Defragmentation generates heavy continuous disk I/O queues. On spinning hard drives, this causes WinCC faceplate picture loading delays; on modern solid-state drives (SSDs), defragmentation is unnecessary and causes premature flash cell wear.

Can I schedule automated OS Client reboots weekly?

Automated reboots on OS Clients are strongly discouraged in 24/7 continuous process plants. Any station reboot should be performed manually under operator supervision.