Backing Up Siemens TIA Portal Licenses via Automation License Manager

Siemens automation software (STEP 7, TIA Portal, WinCC, PCS 7, SINAMICS Startdrive, SIMOTION Scout) is protected by license keys bound to a hardware container (USB stick) or a software container (virtual hard-disk key). When the original media fails, is lost, or the engineering PC is rebuilt, recovering the runtime capability of the engineering station (ES) or operator station (OS) requires a verified backup or a formal recovery request to Siemens Industry Online Support. This reference documents the practical backup procedure using the Siemens Automation License Manager (ALM), the certificate of license (CoL) workflow, the command-line backup path, and the recovery procedure when no backup is available.

1. Why a License Backup Is Mandatory

Siemens license keys are non-reproducible cryptographic objects generated against a unique order number and a unique license certificate number. Once issued:

• The same license serial number cannot be duplicated onto a second container.
• If the host PC is rebuilt without first exporting the key, the key is lost with the drive.
• Re-issuance is a manual process that requires the original Certificate of License (CoL) and verification by Siemens.
• Lead time for verified re-issuance runs typically 5 to 10 working days plus courier transit.

Backups are the only way to eliminate this downtime window.

2. License Types and Container Formats

Verify the installed license set on the engineering station before initiating backup. Open ALM, expand the host node, and note the part numbers (e.g., 6AV2 100-0AA00-0AA0 for WinCC ES, 6ES7 822-1AA03-0YA5 for STEP 7 Professional Combo). These part numbers are required when re-ordering a replacement or when generating a recovery request.

3. Prerequisites

• Automation License Manager installed. ALM is installed by default with TIA Portal, STEP 7, WinCC, and Startdrive. Standalone installer available from the Siemens support portal as SIMATIC Automation License Manager.
• Local administrator rights on the engineering PC (required to read/write the protected license vault).
• A known secure destination path for the backup file (network share, secondary drive, or encrypted external media). Do not store the backup on the same physical drive as the original key.
• Certificate of License (CoL) document for every license in scope. The CoL is the printed or PDF document shipped with the original media; it carries the license certificate number required by Siemens support.
• If the engineering station runs floating licenses, access to the license server (default TCP/4410 for the ALM RPC channel) and administrative credentials for the server account.

4. ALM Backup Procedure – Local License Keys

4.1 Launch the Automation License Manager

From the Windows Start menu launch Siemens Automation License Manager (executable: almsrvapp.exe, normally located at C:\Program Files\Siemens\AutomationLicenseManager\Bin or C:\Program Files (x86)\Siemens\AutomationLicenseManager\Bin). Connect to the local PC.

4.2 Identify the License Holders

1. In the left pane, expand the local host entry (e.g., PC-ENG-01 [local]).
2. Expand the License Keys node. All currently installed keys are listed with part number, license name, and validity date.
3. For each key, right-click and select Properties to capture: part number, certificate number, and expiration. Record this data in a license inventory file for audit purposes.

4.3 Export the License Key

1. Right-click the target license entry.
2. Select Back up license key (or Export > License key in newer ALM versions).
3. Choose a destination folder. The ALM writes a .zip archive containing the encrypted key (file extension .licbin) and a metadata file (.xml) carrying the part number, certificate number, and binding hash.
4. Repeat for every key in the inventory.

4.4 Verify the Backup

After export, perform a round-trip verification:

1. Copy the backup archive to a scratch directory on a different PC that has ALM installed.
2. Open ALM on the scratch PC, right-click the local host, and select Import license key.
3. Point to the exported .zip file. ALM extracts and validates the key. A successful import displays the license under the local host.
4. Deactivate or delete the test key immediately after verification to keep the certificate unique to the original host.

5. ALM Backup Procedure – Floating License Server

For a centralized license server (recommended for plants with 5+ ES/OS seats), the backup is performed on the server side:

1. Connect ALM to the license server using Connect to remote computer and enter the server hostname or IP.
2. Stop the ALM service on the server: sc stop "almsrv" from an elevated command prompt. This prevents key corruption during export.
3. Right-click each license in the server inventory and select Back up license key.
4. Restart the service: sc start "almsrv".
5. Validate that floating clients can re-checkout the license by opening a TIA Portal instance on a sample client.

6. Command-Line Backup (Silent / Scripted)

For scripted, repeatable backups (e.g., scheduled task), ALM ships a console executable. The path is typically:

Common command-line operations:

Example scheduled task (PowerShell) to back up all local keys nightly:

$dest = "\\fileserver\licbackup\$env:COMPUTERNAME-$((Get-Date).ToString('yyyyMMdd'))"
New-Item -ItemType Directory -Force -Path $dest
& "C:\Program Files\Siemens\AutomationLicenseManager\Bin\almcl.exe" -exportall -path $dest

7. ES and OS Specific Considerations (WinCC / PCS 7)

WinCC Engineering Stations (ES) and Operator Stations (OS) ship with their own license parts. In PCS 7 environments, the OS runtime license is bound to the OS server. When backing up:

• WinCC ES licenses (6AV2 100-... series) must be backed up from each engineering PC. They cannot be pooled on a single workstation.
• WinCC RT / OS Server licenses (6AV2 101-... series) are activated on the runtime server. Activation must be deactivated (returned to the container) before the container is exported, otherwise the license remains in use on the source host.
• AS Engineering (STEP 7 / TIA Portal) licenses can be moved freely with ALM deactivate-then-activate sequence, but PCS 7 AS bundle licenses often ship as a combo key covering multiple components; back up the entire key, not individual components.

8. License Recovery When No Backup Exists

If a backup is not available, the only path is a formal recovery request through Siemens Industry Online Support. Expect the following workflow:

1. Open a support request at the Siemens Industry Online Support portal. Category: Licensing / License recovery.
2. Provide scanned copies of: the original Certificate of License (cover page) showing the certificate number; the original USB stick or floppy label; a recent ALM log file (ALM > Help > Save log) proving the key is defective or missing.
3. Siemens verifies the certificate number against the original order record. Confirmed requests are escalated to license fulfillment.
4. A new USB key with the same certificate number is shipped via DHL / FedEx. Standard lead time: 5 to 10 working days after verification. Hot cases (production-down) are routed via the support hotline and have been delivered in 24 to 48 hours in documented cases.
5. On receipt, install the new key via ALM > Connect target computer > Install license.

9. Transferring Licenses Between Stations

When migrating a license from one ES to another (e.g., hardware refresh):

1. On the source PC, open ALM and select the key.
2. Click Transfer license (or Deactivate on older ALM versions). The key is returned to the original USB container or to a transferable archive.
3. Move the USB stick to the target PC, or copy the archive to the target PC.
4. On the target PC, connect ALM, plug the USB stick, and click Activate. The key is now bound to the new host.

License transfer works only if the original certificate number remains unique. The deactivation step must complete successfully; if ALM reports a defective or unreachable container, escalate to Siemens support immediately.

10. Verification Checklist

11. Troubleshooting Matrix

12. Storage and Retention Recommendations

• Retain license backups for the full lifecycle of the engineering PC plus the standard retention policy of the plant (typically 7 years for GMP / regulated industries).
• Encrypt backup files at rest (BitLocker on the storage volume or 7-Zip AES-256).
• Include a license inventory sheet (CSV or XLSX) in the same folder. Columns: Hostname, Part number, CoL number, Export date, Expiry, Notes.
• For multi-site deployments, replicate backups to a central secured share with read-only ACLs for the engineering group.

For environments using Siemens Desigo CC building automation, license management is handled by the License Management Utility (LMU) with a separate backup tree under Settings > Backup (see Siemens LMU Engineering documentation). The principle is identical: secure the key outside the host, retain the certificate document, and verify import on a scratch host.