OPC Classic

What is OPC Classic?

OPC Classic is the collective name for the original OPC specifications (OLE for Process Control), including OPC DA, OPC HDA and OPC A&E, which use Microsoft COM/DCOM to exchange live process data, historical data and alarms between automation systems on Windows. The first specification appeared in 1996 and ended the situation in which every SCADA or HMI vendor had to write its own driver for every PLC. OPC Classic still runs in a great many existing installations, but its successor OPC UA is taking over because it is platform-independent and has security built in.

🧠 Where does OPC Classic come from?

In the mid-1990s industrial automation had a driver problem: ten software packages and ten brands of controller meant, in theory, a hundred separate interfaces. A group of vendors therefore decided to define one standard interface based on the Microsoft technology that was running on practically every operator station at the time: OLE and COM. Data Access 1.0 was published in 1996, and the OPC Foundation was set up the same year to maintain the specifications and certify products.

Because the name OPC now mainly stands for OPC UA, the older family is retrospectively called OPC Classic.

🔧 Which specifications make up OPC Classic?

The OPC Foundation distinguishes three core specifications. Each has its own COM interface, and therefore its own servers and clients:

Alongside these there were, among others, OPC XML-DA (Data Access over SOAP/XML, a first step away from DCOM), OPC DX (data exchange between servers), OPC Batch, OPC Security and OPC Complex Data. In practice these spread far less widely than DA, HDA and A&E.

🔄 How does OPC Classic work technically?

OPC Classic follows a client-server architecture. Within a local Windows network it is fast and widely supported:

• OPC server - translates the native protocol of a PLC, DCS or fieldbus into the standard OPC interface. A well-known example is Kepware, which exposes hundreds of device types through a single server.
• OPC client - a SCADA package, HMI, historian or MES interface that reads or writes values, or subscribes to changes.
• Local versus remote - when client and server run on the same machine, they talk via COM and no network configuration is needed. When they sit on different machines, the traffic goes over DCOM.
• Browsing - the OpcEnum service gives a client a list of the OPC servers installed on a machine.

DCOM first contacts the RPC Endpoint Mapper on TCP port 135 and then negotiates a dynamic port. Since Windows Vista and Server 2008 that port lies by default between 49152 and 65535; older Windows versions used 1025–5000. DCOM also needs matching user accounts, permissions in dcomcnfg and often callbacks from server to client. This makes OPC Classic hard to pass through a firewall, and explains why many installations were once set up with wide port ranges and permissions for the Everyone group.

🏭 Where do you still find OPC Classic?

OPC Classic is deeply embedded in OT environments built before OPC UA became mainstream:

• SCADA and HMI - many SCADA systems read PLC data via OPC DA
• Historians - Historian systems collect via OPC DA and serve data via OPC HDA for logging and analysis
• Alarm management - OPC A&E combines alarms from different systems
• Links to MES and ERP - MES and ERP systems usually obtain production data through a historian, gateway or middleware that in turn uses OPC DA or HDA

In the Purdue Model, OPC Classic servers and clients usually sit at levels 2 and 3, inside the process network. Because control systems often stay in service for twenty years, OPC Classic will remain present in legacy systems for years to come.

🔐 What are the security risks of OPC Classic?

OPC Classic was designed for a closed network and has no application-level security of its own, unlike OPC UA with its certificates and encrypted sessions. Security depends entirely on Windows and DCOM:

• Many open ports - TCP 135 plus a large dynamic range enlarges the attack surface
• Weak configurations - anonymous access, broad permissions for Everyone and low authentication levels are still common
• No encryption in practice - DCOM can enforce packet integrity and privacy, but older clients often do not support it
• Outdated hosts - OPC servers frequently run on Windows versions that no longer receive security updates, which complicates patch management
• Reconnaissance by malware - the Havex campaign by the Dragonfly group used a module in 2013–2014 that located OPC Classic servers on the network, and Industroyer (Ukraine, 2016) contained an OPC DA component

OPC Classic is therefore unsuitable for remote access over the internet or for traffic crossing a DMZ. Only use it inside a segmented zone protected by firewalls and strict access control.

What does Microsoft’s DCOM hardening mean?

With KB5004442 (CVE-2021-26414) Microsoft requires at least the packet integrity authentication level for DCOM activation. The change was phased in: optional in June 2021, enabled by default from 14 June 2022 and impossible to disable since 14 March 2023. Updated Windows clients raise the level of their activation requests automatically, so most connections keep working. Problems arise with OPC clients on unpatched or unsupported Windows versions and with applications that force a lower level themselves: they lose their connection to a remote OPC server. Anonymous activation, local connections, tunnels and OPC UA are not affected. Microsoft has therefore not abolished DCOM, but it has removed the margin for error that old configurations relied on.

🛠️ How do you handle OPC Classic in practice?

A realistic approach combines securing what exists with gradual migration:

1. Take inventory - record in your asset inventory which OPC servers and clients exist, which specification they use and which connections cross the network.
2. Keep OPC local - where possible, run client and server on the same machine so DCOM never has to touch the network.
3. Use a tunnel or wrapper - an OPC tunneller or a DA-to-UA wrapper replaces DCOM over the network with a single fixed TCP port, encrypted in most products.
4. Restrict DCOM - narrow the dynamic port range, remove anonymous access and apply hardening to the Windows hosts.
5. Segment - separate OPC traffic into zones and conduits in line with IEC 62443 and apply network segmentation; for one-way data to IT, a data diode is an option.
6. Migrate to OPC UA - when replacing SCADA, a historian or a DCS, choose native OPC UA support, and treat brownfield projects as an opportunity.

For Dutch organisations covered by the Cybersecurity Act (in force since 15 August 2026), this approach helps demonstrate that known risks in the OT chain are appropriately managed.

🔍 What is the difference between OPC Classic and OPC UA?

OPC UA integrates the functionality of DA, HDA and A&E into a single architecture, so in principle a migration need not give up any functionality. Tag addressing does change to an information model of nodes, which needs attention in configuration and documentation during the move.

❓ Frequently asked questions

Is OPC Classic still supported?

OPC Classic is still supplied by many vendors and the specifications remain available, but the OPC Foundation no longer develops the family further. New projects choose OPC UA. Existing OPC Classic installations keep working as long as the Windows hosts and DCOM settings are maintained.

Why did my OPC DA connection stop working after a Windows update?

Since Microsoft’s DCOM hardening (KB5004442), an OPC server rejects activation requests below the packet integrity authentication level. Clients on unpatched or outdated Windows versions, or software that sets a lower level itself, are therefore refused. Updating the client host or software, using an OPC tunnel or moving to OPC UA solves this.

Which ports does OPC Classic use?

Through DCOM, OPC Classic uses TCP port 135 for the RPC Endpoint Mapper and then a dynamic port, by default between 49152 and 65535. You can narrow that range per server. Local OPC Classic connections on a single machine use no network ports at all.

What is an OPC tunneller?

An OPC tunneller is software that carries OPC Classic traffic between two machines over a single fixed TCP connection instead of DCOM. Client and server each talk locally to the tunnelling software. This simplifies firewall rules and bypasses the DCOM configuration of OPC Classic.

Can OPC Classic work together with OPC UA?

Yes, OPC Classic and OPC UA can interoperate through a wrapper or proxy. A wrapper exposes an existing OPC DA server as an OPC UA server, while a proxy lets an old OPC DA client read data from an OPC UA server. This allows an installation to migrate step by step.

Is OPC Classic insecure?

OPC Classic is not insecure by definition, but it lacks built-in security and relies entirely on Windows and DCOM. In a well-segmented network with restricted ports and hardened hosts, the risk is manageable. OPC Classic should never run across untrusted networks or the internet.

📌 In summary

OPC Classic is the original COM/DCOM-based OPC family (DA, HDA and A&E) that has been exposing process data in Windows-based OT environments since 1996.

The standard solved the driver problem of the 1990s and still runs in countless installations. However, its Windows dependency, cumbersome DCOM configuration, limited scalability and lack of built-in security make OPC Classic a legacy technology. Secure existing connections with segmentation, tunnels and hardening, and plan the move to OPC UA.