Resolving MP377 Network File Access Errors to Windows Server

1. Problem Statement and Symptoms

A Siemens SIMATIC HMI panel MP377 (12" or 15" Comfort Panel variants, e.g. 6AV6 644-0AB01-2AX0) is being used to execute a VBScript on the device that opens a remote file path on a Windows file server. The script fragment is:

Set f = CreateObject("FileCtl.File")
f.Open "\\\\servername.domain.dom\\path", 8

The runtime returns:

From a Windows PC on the same physical switch the same UNC path opens after a credential prompt, which proves the share exists, the ACLs are valid, and DNS resolves the name. The failure is therefore specific to the WinCE-based panel's network stack, not the server.

2. Root Cause: Windows CE Network Stack Limitations

The MP377 family runs Windows CE 5.0 / 6.0 depending on firmware generation (image Boot Loader V12.x and above for CE 6.0 panels). The WinCE network architecture has three constraints that together explain every observed symptom:

1. SMB 1.0 / CIFS only. The Microsoft SMB client shipped with WinCE 5/6 only speaks SMB 1.0. Any Windows server that has SMB1 disabled (the default since Windows 10 1709 and Windows Server 2019) will reject the session with no negotiated dialect, producing ERROR_BAD_NETPATH on the client side.
2. NetBIOS over TCP/IP is bound, not routable. WinCE's name-resolution order is NBNS (NetBIOS Name Service) first, then DNS. NBNS broadcasts do not cross a Layer-3 boundary. If the panel and the server sit on different subnets separated by a router, NBNS resolution silently fails and the UNC parser returns error 53 even when ICMP ping by FQDN succeeds (because ping uses the DNS resolver directly).
3. VBScript on CE uses the compact runtime. FileCtl.File is a CE-specific COM object (CLSID {7BA88C8B-...}, documented in the WinCE SDK) that wraps CreateFile. It does not use the Win32 Network Provider API chain the way a Windows PC's WScript.CreateObject("Scripting.FileSystemObject") does. There is no in-band credential prompt and no DCERP referral hop.

3. MP377 Network Configuration Procedure

Configure the panel's transport so that name resolution and authentication match what the server expects. Open Control Panel > Network and Dial-up Connections on the panel (Start > Settings > Control Panel > Network).

1. Double-tap DM9CE1 (or the LAN adapter shown as NE2000 Compatible for older MP377 12" variants, RTL8139 for the 15").
2. On the IP Address tab set a static address (recommended for production) or enable DHCP. Confirm the gateway and subnet mask point at the router interface that reaches the server VLAN.
3. On the Name Servers tab enter the Active Directory-integrated DNS server IP. Disable WINS / NBNS if the server is in a routed subnet. If NBNS cannot be disabled, point it at a WINS server that is reachable across the router.
4. On the Identification tab enter the workgroup name matching the server's (default WORKGROUP or the AD domain short name). This populates the NetBIOS scope the panel advertises.
5. Tap OK and reboot the panel when prompted. Confirm with ipconfig /all from a Telnet session (enable Telnet in Control Panel > System > Services) that the adapter shows the new DNS suffix and gateway.

On the Windows server side, open Computer Management > System Tools > Local Users and Groups and create a local user that mirrors the panel's NetworkID entry, with the same password. The MP377 cannot join an Active Directory domain and uses NTLMv2 only, so the share must be hosted on a workgroup member or on a server with the local user provisioned.

4. FileCtl.File Object Reference

The FileCtl.File object exposes a stripped-down file API. For network file writes the relevant members are:

A working template for the MP377, assuming the UNC path resolves and SMB1 is enabled on the server, is:

Dim f, line
Set f = CreateObject("FileCtl.File")
On Error Resume Next
f.Open "\\\\servername.domain.dom\\share\\data.txt", 8
If Err.Number <> 0 Then
  HMIRuntime.Trace "Open failed: " & Err.Number & " " & Err.Description & vbCrLf
  Exit Sub
End If
On Error Goto 0
f.LinePrint f, Now & "," & SmartTags("Tag_Recipe")
f.Close
Set f = Nothing

Wrap every network call with On Error Resume Next and trace the err.number into HMIRuntime.Trace (visible in the MP377 Service Tools log) so that intermittent SMB session loss does not crash the HMI runtime.

5. SMB Protocol Compatibility Matrix

To confirm whether the failure is dialect-mismatch, run on the server:

If EnableSMB1Protocol is False, the MP377 cannot reach it via UNC. The cleanest long-term fix is to migrate the panel to a WinCC Unified Comfort Panel (MTP/MTP Unified) that ships with a modern SMB2 stack. For brownfield MP377 installs, re-enable SMB1 on the server temporarily only as a diagnostic step; in production use one of the alternatives in Section 8.

6. Router and Cross-Subnet Considerations

When the panel and the server sit on different IP subnets, four things must be true for \\servername.domain.dom\share to resolve:

1. DNS resolution across the router. The router must forward UDP/53 (or TCP/53 for large replies) to the DNS server in the server's subnet. The panel's ping test uses DNS, so a green ping is necessary but not sufficient.
2. TCP/445 (SMB) routed. Many corporate firewalls block TCP/445 by default. Test with Test-NetConnection servername -Port 445 from a Windows PC. If the panel cannot reach 445, no SMB traffic will flow and the redirector reports 53 immediately.
3. NBNS scoped or disabled. NetBIOS name queries are broadcasts and do not traverse routers. If the panel's resolver still has NBNS at the top of its order, the name appears to fail even though DNS would have worked. On WinCE 6.0 the registry key HKEY_LOCAL_MACHINE\Comm\Tcpip\Hosts\<adapter>\DNS lets you reorder; on CE 5.0 use the Control Panel > Name Servers dialog to clear WINS entries.
4. SMB signing policy. If the server enforces SMB signing, the WinCE 1.0 client cannot meet the NTLMv2 signing requirement. Disable signing on the share path or whitelist the panel's IP in a Group Policy exception.

7. Resolving the net use Status 87 Error

The CE shell net use is a stripped-down clone of the Win32 utility and does not accept every flag. The syntax that produced status 87 was:

Status 87 is ERROR_INVALID_PARAMETER; the parser fails on the order of arguments. The CE shell expects /USER to be the first flag, then the credentials, then the device. The correct invocation is:

Or, if the panel is in a workgroup and the share is hosted on a Windows PC:

Notes specific to CE:

• The * device-letter placeholder is not supported; specify a drive letter (Z:) or omit it for a connection without a letter.
• The /persistent:yes flag does not exist on CE; mappings are not persistent across reboots anyway.
• If the share path contains a space, the entire UNC must be wrapped in double quotes: net use "\\server.domain.dom\my share" /USER:user pw.

A successful mapping returns The command completed successfully. and the UNC is reachable as a drive. After this the FileCtl.File.Open call will succeed provided the SMB version matches.

8. Alternative File Transfer Methods

If re-enabling SMB1 is not acceptable, three vendor-supported alternatives preserve the original intent of writing a file from the HMI to a server:

8.1 FTP server on the Windows host

Install IIS FTP on the Windows server and write to a known path using WinInet from the panel. The MP377 includes the WinInet CE stack, so:

Dim inet, f
Set inet = CreateObject("InetCtl.Inet.1")
inet.Protocol = 4            ' icFTP
inet.URL = "ftp://server.domain.dom/upload/data.csv"
inet.UserName = "ftpuser"
inet.Password = "ftppw"
inet.RequestTimeOut = 30
inet.Execute "PUT", "localfile.csv"
inet.WaitForResponse 30

FTP traverses routers and proxies cleanly, has no SMB1 dependency, and is auditable on the server side. Use FTPS over TLS if the network is not isolated.

8.2 Sm@rtServer / Web server retrieval

Siemens Sm@rtServer (the option baked into WinCC flexible 2008 / TIA Portal) can expose the panel's file system to a browser. Write the file to a local SD card or USB stick on the panel, then have the operations user download it through the Sm@rtServer web page. This is the workaround the field community converged on for WinCE limitations and is the path with the fewest surprises on a greenfield install.

8.3 OPC UA / script-tag export over the control network

For structured data, the MP377 can publish tag values to an OPC UA server on the Windows host (e.g. the Siemens OPC UA server module or Kepware). The data lands in a SQL or historian table rather than a flat file, but it eliminates the SMB1 dependency entirely. Use this when the downstream consumer is analytics, not a flat CSV.

8.4 Server-side file pickup via Storage Migration Service context

If the goal is consolidation of CSV drops from many panels, design the Windows host as a target for a one-way pickup: the panel writes to a local share on a workgroup Windows bridge box that does run a modern OS, and the bridge replicates the directory tree up to the enterprise file server using Storage Migration Service or DFS-R. The MP377 only ever talks to the bridge over SMB1 in an isolated VLAN; nothing past the bridge needs legacy dialects.

9. Verification and Diagnostic Tests

After applying the configuration, validate in this order:

1. DNS resolves the FQDN. From a Telnet session on the panel, run ping -n 2 servername.domain.dom. The reply must come from the server's IP. If it does, DNS is functional.
2. TCP/445 is reachable. From a Windows PC, run Test-NetConnection servername.domain.dom -Port 445. Then from the panel, run telnet servername.domain.dom 445; a blank screen is success.
3. SMB1 is enabled on the server. Get-SmbServerConfiguration | fl enablesmb1 must return True.
4. Credential maps. Run the corrected net use command from Section 7. Look for The command completed successfully.
5. VBScript test. Execute the FileCtl.File.Open block and tail HMIRuntime.Trace for err.number = 0.
6. Server-side log. On the server, enable SMB server auditing and confirm the connection in Event Viewer > Applications and Services Logs > Microsoft > Windows > SMBServer. The client name will show as the panel's hostname.

10. Troubleshooting Matrix

FAQ