Resolving STEP 7 / TIA Portal License Key Not Found Errors

Problem Overview

Siemens STEP 7 V5.x and TIA Portal (V11 and later) rely on the SIMATIC Automation License Manager (ALM) to validate locally stored licenses before any project can be opened, compiled, or downloaded to a PLC. When the License Manager fails to enumerate or validate a previously working license key, the host engineering tool reports a generic "License key not found" or "The license for STEP 7/TIA Portal cannot be found" dialog and refuses to start the editor.

This symptom is reported in the field even when the license is intact on disk, when the License Manager displays the license as valid, and when the same user profile worked the day before. The most common trigger in legacy Windows environments (Windows 7 / Server 2008 R2 with classic user profiles) is accumulation of stale RSA query files under the user profile, which eventually breaks the local license enumeration cache.

Symptoms and Error Behavior

Engineers typically observe one or more of the following behaviors:

• STEP 7 or TIA Portal refuses to start, reporting a missing license even though the License Manager UI shows the license present and valid.
• The error appears for only one Windows user account; logging in as a different user finds the license without issue. This is the single strongest indicator of a corrupted per-user RSA cache.
• After running a system maintenance utility such as CCleaner, disk defragmenter, or a registry cleaner, the License Manager UI continues to display the license as valid but the host application still cannot find it.
• Repeated license query attempts are observed in the background; the RSA folder grows by hundreds or thousands of files per session.

Representative Error Strings

Root Cause Analysis

Every time STEP 7, WinCC, or TIA Portal starts, it queries the License Manager through a local COM/RPC interface. The License Manager, in turn, validates the user's license tickets using Microsoft CryptoAPI RSA key containers located under the user profile:

On legacy Windows XP paths this is exposed as:

Inside this folder, CryptoAPI creates a sub-folder whose name is a very long string beginning with the SID prefix S-1-5-21-. Each license query in STEP 7 / TIA Portal triggers the License Manager to create a temporary key container file inside that sub-folder. Over weeks or months, this folder accumulates thousands of files. Each file carries its own long cryptographic identifier. When the file count crosses a threshold (empirically observed above 1,500 files but the value depends on the OS and CryptoAPI build), CryptoAPI is unable to enumerate the container in time and the License Manager returns a key not found result to the host application, even though the license file on disk is valid.

Secondary Causes

• Registry cleaner / CCleaner over-reach: Tools such as CCleaner can purge CryptoAPI registry entries or orphan container metadata. The license still appears valid in the ALM UI because the UI reads from its own local cache, but the actual validation handshake fails.
• Disk defragmentation across volumes: Defragmenting drives C: and D: does not move license files between volumes, but a third-party defragmenter that relocates files by filename pattern can in rare cases invalidate the protected storage location the License Manager expects.
• Profile path length overflow: If the user profile path (including the long CryptoAPI container name) exceeds the Win32 MAX_PATH limit (260 characters), file creation silently fails, producing orphaned references that confuse subsequent enumeration.

Affected Versions

Solution Method 1 — RSA Folder Cleanup (Primary Fix)

This is the in-place remedy that resolves the issue without uninstalling any Siemens software. Run it as the affected user, not as Administrator, because the RSA folder is owned by the user profile.

Prerequisites

• Close all instances of STEP 7, TIA Portal, WinCC, and the Automation License Manager.
• Disable any real-time antivirus that locks the CryptoAPI container directory during scan (common with older Trend Micro, Kaspersky, and Sophos builds).
• Confirm hidden files and folders are visible in Windows Explorer: View → Options → Show hidden files, folders, and drives.

Procedure

1. Open Windows Explorer and navigate to the RSA folder for the affected user:
   • Windows 7: C:\Users\<UserName>\AppData\Roaming\Microsoft\Crypto\RSA\
   • Windows XP (legacy paths): C:\Documents and Settings\<UserName>\Application Data\Microsoft\Crypto\RSA\
2. Locate the single sub-folder whose name begins with S-1-5-21-. This is the user's Security Identifier (SID) and is the only legitimate container. Do not delete the folder itself.
3. Open that sub-folder and inspect the files inside. You will see filenames consisting of long GUID-like strings with no extension.
4. Sort the folder by Date modified and delete every file whose modification date is older than 2 days. Do not delete files modified today or yesterday — these are in active use by the License Manager and possibly by other CryptoAPI consumers (S/MIME certificates, EFS, RDP credentials).
5. Close Explorer. Restart the Automation License Manager from Start → Siemens Automation → Automation License Manager.
6. Launch STEP 7 or TIA Portal and confirm the license is recognized.

Verification

Open the Automation License Manager. The affected license should now appear with a green checkmark under "Validity". Launch TIA Portal — the start screen should load in licensed mode rather than falling back to the demo / time-limited banner.

Solution Method 2 — Reinstall SIMATIC License Manager

When Method 1 fails (license still not found, or ALM UI itself shows the license as missing), reinstall the Automation License Manager while preserving the actual license file. This rebuilds the CryptoAPI handshake without invalidating your purchased license.

Procedure

1. Insert the original STEP 7 / TIA Portal installation medium or download the matching Automation License Manager installer from the Siemens Industry Online Support portal.
2. Use Automation License Manager → Help → System Info to record the current license key fingerprint (license number, target PC ID).
3. Close all Siemens applications. Use Control Panel → Programs and Features to uninstall SIMATIC Automation License Manager. Do not uninstall STEP 7 or TIA Portal.
4. Reboot. Confirm that C:\Program Files\Siemens\Automation\ still contains your license file (typically AX NF ZZ <license_key>.bin on legacy builds, or .lic files on TIA Portal).
5. Reinstall the Automation License Manager from the original installer. Accept all defaults.
6. Reboot again. The License Manager will auto-discover the existing license file on first launch.
7. If the license is still not visible, continue to Method 3 to transfer the license from the original USB stick or yellow floppy disk.

Solution Method 3 — License Transfer from USB Stick or Floppy

When the local license file is genuinely missing or has been flagged as corrupted by the License Manager (status reads "invalid" or "defective" rather than "valid"), recover the license from the original physical media.

Procedure

1. Insert the original Siemens USB license stick (typically red, marked "SIMATIC License") or the yellow floppy disk that shipped with the software.
2. Open Automation License Manager.
3. From the menu bar, choose License Key → Transfer.
4. In the source pane, select the USB stick / floppy. In the destination pane, select the local hard drive target (typically C:\Program Files\Siemens\Automation).
5. Click Transfer and enter the license number / CoL when prompted. This number is printed on the Certificate of License (CoL) sheet that accompanied the media.
6. After transfer completes, remove the original media and store it in a secure location. The license is now bound to the local hard drive.

T-Online Side Effects Warning

The Siemens-issued remedy text explicitly warns that the RSA folder also contains credentials used by the legacy T-Online email and dialer client (T-Online is Deutsche Telekom's discontinued ISP product, but the CryptoAPI container it uses is shared). After cleaning the RSA folder, users have historically reported that T-Online login credentials need to be re-entered, or that auto-dial functionality stops working.

Prevention and Best Practices

Once the license has been recovered, take these preventive measures to avoid recurrence:

1. Schedule quarterly RSA hygiene. Add a Windows Scheduled Task (running as the affected user) that deletes RSA files older than 14 days. Sample PowerShell:

   $path = "$env:APPDATA\Microsoft\Crypto\RSA\*\*"
   Get-ChildItem $path -File -ErrorAction SilentlyContinue |
     Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-14) } |
     Remove-Item -Force -ErrorAction SilentlyContinue

2. Exclude the CryptoAPI path from aggressive maintenance tools. Configure CCleaner, BleachBit, or similar utilities to exclude %APPDATA%\Microsoft\Crypto\RSA.
3. Avoid defragmenters that move files by name pattern. Use the built-in Windows defragmenter or a vendor that respects NTFS change journals.
4. Maintain a license archive. Keep the original USB stick, the yellow floppy, and the Certificate of License in a documented, fireproof location. Engineering stations fail; licenses need to be recoverable.
5. Run STEP 7 / TIA Portal as the same Windows user that owns the license. Per-user licensing means that creating a new Windows account on the same machine forces a license retransfer.

Verification Matrix

Troubleshooting Decision Flow

1. License missing for all users on the machine? → License file itself is corrupt or missing → Method 3 (transfer from media).
2. License missing for only one user? → Run Method 1 (RSA cleanup).
3. Method 1 fails and license still missing? → Run Method 2 (ALM reinstall), then Method 3.
4. License file present, ALM reinstalled, still missing? → HostID has changed (hardware swap). Return and reissue via Siemens License Web.
5. Original USB / floppy unavailable? → Contact Siemens Customer Support with the Certificate of License number for license reissue.

FAQ