Hi guys, how do you handle Windows security patching (KBs) on WinCC servers in pharma environment?

We have a factory that runs 24/7 and is only shutdown once a year. 

There are 7 WinCC servers and a number of HMIs and IPCs.

WinCC is used for non-GMP data only -  so while WinCC is shutdown for Windows patching, the data loss is not critical.

But operators can't acknowledge alarms or control anything on these local systems, some of which are important with regards to availability in case anything happens and they need to operate one of the systems.

We've talked about changing the WinCC projects to redundant WinCC server setups - but it's expensive when it comes to time spent converting the systems and qualification. 

Also talked about restoring an offline image to a closed network, perform the patching, and restore the image to the running server. 

All solutions sound risky. What are you guys doing in your companies and how could we solve this?

 HI Murof, yes we have a mix of Windows Server 2016 which I'm told is basically LTSC...

Then there's a few Windows 10 Enterprise 2016/2019 LTSC, and lastly a few WinCC clients running Windows 10 Pro. 

All of them have SCCM installed now but we haven't given the approval to our IT to patch them due to the worry that pushing the patches could do something to the running WinCC installation.

So I read Siemens' own recommendations here (Windows updates on WinCC SCADA, IPC and other PC runtime systems), but they never actually mention how to perform these updates. 

So my question to you is, would it be possible to actually have SCCM automatically perform these updates every, say 3 months, while WinCC is running without getting any issues?

Since these all seem to be security patches only and not feature updates with upgrades of SQL servers, etc., and Siemens actually recommends LTSC, it shouldn't be a problem for the running WinCC servers, right?

Murof

Hello drStrangelove

do you run LTSC Windows Versions?

I sysems where a shutdown of a WinCC System is critical I would recommend using a Redundancy system to fulfil your requirements.

Bye Murof

Security patches most often require a system reboot, so in fact no, you can't patch without any risk.

Just like Murof said, you should have redundant servers (in combination with an Engineering Station.

You would be a lot more comfortable in a 24/7-plant.

 Thanks, but my question was actually if the security patches could be installed while WinCC was running. Have you had any experience with that? 

I would prefer WinCC being closed down because I know how fickle it can be sometimes, but have you had experiences with it running while patching? 

SteBo

Security patches most often require a system reboot, so in fact no, you can't patch without any risk.

Just like Murof said, you should have redundant servers (in combination with an Engineering Station.

You would be a lot more comfortable in a 24/7-plant.