Hematec Panel Deployment

Automated deployment scripts for Hematec industrial panels running Windows + SIMATIC WinCC Unified V19. Maintained by Regineering GmbH.

Overview

Deployment is split into two phases:

Phase	Launcher	Script	What it does
1	Start-Deployment.bat	Deploy-Panel-v2.ps1	Windows setup: accounts, locale, privacy, firewall, TeamViewer, Windows Update
2	Start-Simatic.bat	Install-Simatic.ps1	SIMATIC WinCC Unified V19 (4 steps, reboot between each)

Phase 1 writes a Panel-Info_<name>.txt report to the USB root. Phase 2 appends the SIMATIC status to the same file. A full transcript is also saved to C:\Deploy-Panel.log on the panel.

Repository Structure

Start-Deployment.bat        # Phase 1 launcher (double-click, triggers UAC)
Start-Simatic.bat           # Phase 2 launcher (double-click, triggers UAC)
ANLEITUNG.txt               # Full German instructions for the technician

setup/
  Deploy-Panel-v2.ps1       # Phase 1 main script (ACTIVE)
  Deploy-Panel.ps1          # Phase 1 legacy script (v1, kept for reference)
  Install-Simatic.ps1       # Phase 2 SIMATIC installation script
  config.ps1                # Fixed configuration (TV assignment ID, passwords, paths)

software/                   # NOT in git — copy manually to USB stick
  TeamViewer_Host_Setup.exe
  Simatic/
    SIMATIC_WinCC_Unified_V19.iso
    SIMATIC_WinCC_UnifiedRT_V19_Upd4.exe
    SIMATIC_WinCC_Unified_Reporting_V19_Upd4.exe
    SIMATIC_WinCC_Unified_Station_Configurator_V19_Upd4.exe

Usage

Copy the entire repo (plus the software/ folder) onto a USB stick. On the panel, double-click Start-Deployment.bat and follow the prompts. See ANLEITUNG.txt for step-by-step instructions.

Configuration

Edit setup/config.ps1 before first use:

• $TV_ASSIGNMENT_ID — TeamViewer assignment token (TV Management Console → Deployment → Customized Host). Same token for all panels.
• $USER_PASSWORD — fixed password for the operator account (default 123456789)

Project ID, location, and admin password are entered interactively at runtime.

What v2 Added Over v1

• Timestamped log file at C:\Deploy-Panel.log (via Start-Transcript)
• Step counter [01/16] for the technician
• Central error handler — all failures show a consistent "Deployment fehlgeschlagen" screen with the failing step name
• German locale and QWERTZ keyboard layout configured for both admin and operator accounts
• Operator user hive mounted once for both desktop and privacy settings (was two separate mounts in v1)
• PSWindowsUpdate module install failure degrades gracefully instead of aborting the deployment
• Security question answers from config.ps1 included in the Panel-Info report for manual setup

Known Issues / Notes

• .ps1 files must stay pure ASCII — PowerShell 5.1 reads UTF-8-without-BOM as Windows-1252, which corrupts non-ASCII characters and causes parse errors.
• CIM-based cmdlets (New-NetFirewallRule, Get-NetAdapter) fail with HRESULT 0x80070534 on fresh non-domain Windows installs. Workarounds applied: netsh, Get-WmiObject.
• Defender exclusions: Add-MpPreference fails on fresh installs (CIM); direct registry write fails on deployed panels (Tamper Protection). Script tries both in sequence.
• TeamViewer assignment returns 403 if the installed TV version is too old. Script auto-updates TV and retries once on 403. Returns 409 if already assigned to the account (normal on re-runs) — treated as success.
• .NET 3.5 activation via DISM can take 10–15 minutes. On some panels DISM hangs indefinitely — if so, cancel the script, enable .NET 3.5 manually via "Windows Features", then re-run Start-Deployment.bat.
• Security question answers for programmatically-created local accounts cannot be set via PowerShell 5.1 (requires undocumented SYSTEM-level SAM access). Answers are documented in the Panel-Info report for manual entry after deployment.