Resolving TIA Portal Read-Only Save Error on Restricted Laptops

Problem Overview

Engineers who develop PLC programs on corporate laptops frequently encounter a stubborn fault when they continue work from a remote location: TIA Portal refuses to save the project, returning a "file is read-only" or "cannot save" dialog even though the user has just opened the file and is editing it normally. Save-As to a brand-new file name produces the same result, and exporting the project to a .zap archive fails for the same reason. The fault follows the engineer out of the office because it is rooted in the laptop's local policy, not in the project itself or in the network environment.

This article addresses that specific scenario - a Siemens TIA Portal (V15 through V19) project stored on the local drive of a domain-joined, IT-managed laptop where the user's standard account cannot obtain write permission on the working directory while disconnected from the corporate domain. The same root cause also reproduces on contractor laptops delivered with locked-down images, on shared engineering workstations behind kiosk-style policies, and on any machine where the Documents library is redirected to a network share that is unavailable offline.

The symptom pattern is consistent:

• The project opens without complaint and online/offline blocks compile normally.
• Save and Save-As both fail with messages referencing the .ap15, .ap16, .ap17, .ap18, or .ap19 container as read-only.
• Creating a brand-new empty project from the TIA Portal start screen also fails to persist on save.
• The error persists after saving to C:\Temp, D:\, USB sticks, and SD cards (when permitted).
• Export to .zap/TIA Portal archive fails with the same read-only error.

The implication is that TIA Portal's user-mode write attempt is being denied at a layer below the project file itself, typically by NTFS access control entries (ACEs) inherited from a parent folder, by AppLocker/WDAC policies, by antivirus self-protection on the TIA Portal install directory, or by Windows Information Protection (WIP) tagging inherited from the corporate tenant.

Symptom Catalogue and Error Text

The fault presents with slightly different strings depending on the TIA Portal version, the project container format, and the underlying denial mechanism. The exact text observed in the field includes:

Source	Error Text Observed	Likely Denial Layer
TIA Portal Save dialog	"The file is read-only." / "The file C:\...\MyProject.ap18 cannot be saved."	NTFS write ACE
TIA Portal Save-As dialog	"Cannot create file. Access to the destination is denied."	NTFS write on parent
Project archive export	"The project could not be archived. The destination is read-only or write-protected."	NTFS or WIP
Automation License Manager	License shows as floating server only; local USB dongle not enumerated	ALM service or USB policy
Event Viewer, Application log	Event 10016 (DistributedCOM), Event 7045 (service install) for Siemes-related services	DCOM for TIA Portal helpers
Event Viewer, Security log	Event 4663 with Access Mask 0x2 (WriteFile) granted = NO	NTFS audit confirming denial

Before drilling into remediation, capture the last three Application log entries under Source = TIA Portal or Source = Siemens.Automation and the corresponding Security log event IDs. These provide ground truth about which process, file, and access mask were denied so the technician does not chase the wrong policy.

Root Cause Analysis

Five distinct denial layers can produce identical end-user symptoms. Each must be ruled in or out before a fix is applied, because the correct answer for one layer actively worsens another.

1. NTFS inherited read-only or Deny-Write ACE. The Documents, Desktop, or project folder is marked Read-Only at the parent directory level, or a Deny ACE has been propagated by Group Policy. The attrib +R flag on a folder is treated as the default for all files inside, and the Deny ACE for the user or for the BUILTIN\Users group silently overrides the Allow ACE that TIA Portal sets on the .ap1x container.
2. Folder Redirection / Offline Files. The corporate policy redirects the user's Documents or a dedicated engineering folder to a UNC path such as \\fileserver\users$\jsmith. When the laptop is off the LAN, Windows attempts to write to the offline cache; if the cache has been disabled by policy, or if the redirected path no longer resolves, every save attempt returns "destination is read-only".
3. User Account Control (UAC) virtualisation and elevation. TIA Portal was launched as a standard user, then a child process (Siemens.Automation.Portal.exe, TIA-Portal.exe, or S7-PCT) attempts to elevate for the save. UAC virtualises the write into %LOCALAPPDATA%\VirtualStore, but TIA Portal's project model does not look there and reports read-only.
4. Application Whitelisting (AppLocker / WDAC / SRP). The TIA Portal helper executable that actually performs the container write is unsigned from AppLocker's perspective, or its hash is excluded. The process is started but its write call is intercepted and converted into an access-denied error by the policy engine.
5. Antivirus self-protection or Controlled Folder Access. Microsoft Defender's Controlled Folder Access, or a third-party AV's self-protection module, blocks writes into the Documents directory for processes that lack the trusted-application marker. TIA Portal is not on the default trusted list.

A sixth, less common cause is Windows Information Protection (WIP) tagging inherited from the corporate tenant. Files created in a work-app context inherit a WIP tag that prevents personal-context apps (including TIA Portal when run under a personal Outlook/Microsoft account profile) from reading them later. WIP-driven read-only presents identically to a Deny ACE.

Pre-Flight Diagnostics

Run these checks in order before touching TIA Portal. Each one takes under a minute and isolates a layer conclusively.

1. Verify the Working Folder's Effective Permissions

Right-click the project parent folder in Windows Explorer, choose Properties → Security → Advanced, and read the Effective Access tab. Input the current username (e.g. CORP\jsmith) and tick View effective access. The result must show Write as Allowed. Repeat for the .ap1x file itself.

From an elevated PowerShell window the equivalent check is:

$path = 'C:\Users\jsmith\Documents\TIA_Projects\LineA'
$acl  = Get-Acl -LiteralPath $path
$acl.Access | Format-Table IdentityReference, FileSystemRights, AccessControlType, IsInherited -AutoSize
# Effective access for current user:
$cuser = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$rule  = New-Object System.Security.AccessControl.FileSystemAccessRule($cuser.Name,'Write','Allow')
$acl | Where-Object { $_.AccessControlType -eq 'Deny' -and $_.FileSystemRights -band 0x2 }

Any line with AccessControlType = Deny and FileSystemRights containing Write (0x2 / 0x1F01FF) is the smoking gun for the read-only save error.

2. Confirm Folder Redirection Status

From cmd.exe run gpresult /h %TEMP%\gp.html && start %TEMP%\gp.html and search the report for Folder Redirection. If a redirected target exists, the local save will fail offline. The same information is available in the registry under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders; if any path starts with \\, it is redirected.

3. Confirm UAC and Elevation Status

Open an elevated cmd.exe and run whoami /groups | findstr /i "Integrity". The integrity level should read High. If it reads Medium, the shell is unelevated and any save TIA Portal makes from a child process will be virtualised or denied.

4. Confirm AppLocker / WDAC Policy

From an elevated PowerShell prompt:

Get-AppLockerPolicy -Effective | Format-List
Get-WdacPolicy -Active | Select-Object -ExpandProperty PolicyRules | Out-GridView

If a rule set is in place, look for Deny entries or for missing Allow entries for paths under C:\Program Files\Siemens\Automation. Note that V19 introduced a hardened signed-binary path; older allow rules often need refreshing when upgrading.

5. Confirm Controlled Folder Access

Run powershell -Command "Get-MpPreference | Select-Object -Property ControlledFolderAccessProtectedFolders, ControlledFolderAccessAllowedApplications". A value of 1 or 2 for ControlledFolderAccessProtectedFolders indicates the protection is active. TIA Portal must be listed in ControlledFolderAccessAllowedApplications or the write will be denied.

Resolution Path A - Restore NTFS Write Permission

This is the most common fix for the offline-engineer scenario. The user logged on with a cached domain credential, opened a project inside %USERPROFILE%\Documents, and the parent directory inherited a Read-Only attribute or a Deny ACE from a parent folder created earlier under a different security principal.

1. Close TIA Portal completely, including the TIA Portal helper processes visible in Task Manager (Siemens.Automation.Portal.exe, S7-PCT.exe, TIA-Portal.exe).
2. In Windows Explorer, right-click the project root folder and choose Properties → General → Attributes. Clear the Read-only checkbox. If the box is solid green (folder-only attribute), accept the change and propagate to all subfolders and files.
3. Open Properties → Security → Advanced. Enable Replace all child object permission entries with inheritable permission entries from this object, then click Apply.
4. Re-check Effective Access for the current user. Both Read and Write must be Allowed.
5. Reopen TIA Portal, open the project, perform a Save-As to the same folder under a new name, and verify the file timestamp updates.

If the IT-managed image blocks the user from clearing the Read-Only attribute (the property dialog greyed out), the fix must come from a local admin account or from an elevated cmd.exe:

attrib -R "C:\Users\jsmith\Documents\TIA_Projects\LineA" /S /D
icacls "C:\Users\jsmith\Documents\TIA_Projects\LineA" /grant "%USERNAME%":(OI)(CI)F /T

The /T switch traverses subdirectories and the (OI)(CI)F ACE grants Full Control with Object Inherit and Container Inherit, restoring the lost write path without breaking inheritance on sibling folders.

Resolution Path B - Bypass Folder Redirection Offline

If Folder Redirection is the culprit, redirecting the project to a fully local path is the cleanest fix. Two reliable options exist.

Option B1 - Use a Local Working Folder Excluded from Redirection

Create C:\TIA_Work\ on the system drive. Add it to the Group Policy exclusion list for Folder Redirection (if the IT department will cooperate), or simply place the project here and instruct TIA Portal to use the absolute local path. The Files-On-Demand mode of OneDrive should not be used for project containers because the sync client will hold the .ap1x file open during saves and produce intermittent read-only errors.

Option B2 - Force Offline Files Cache Available

If the redirected share is essential, ask IT to enable Always offline mode for the engineering OU and to pre-seed the cache. From an elevated prompt on the workstation, run:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\CscService\Parameters" /v UseWin32MemoryLock /t REG_DWORD /d 1 /f
sc.exe config CscService start= delayed-auto

This is an IT-managed change; do not apply it without change-control approval. Once the cache is populated, the laptop can save to the redirected path even when disconnected from the file server.

Resolution Path C - Elevation, Local Admin, and TIA Portal Group Membership

TIA Portal requires the local user to either be a member of SIEMENS TIA Portal Users or to be granted the equivalent rights via the installer. On a managed laptop the installer was run by IT under a service account and the local user account was never added to the group. Confirm membership with:

net localgroup "SIEMENS TIA Portal Users"
# or PowerShell:
Get-LocalGroupMember -Name "SIEMENS TIA Portal Users"

If the account is missing, an admin must add it:

net localgroup "SIEMENS TIA Portal Users" "CORP\jsmith" /add

Some corporate images also strip BUILTIN\Administrators from the user's token via UAC (Admin Approval Mode). Even if the user account has local admin rights, TIA Portal launched from a non-elevated shortcut will not actually have those rights. Right-click Siemens TIA Portal and choose Run as administrator for the duration of the offline session. To make this permanent for trusted users, the IT group can publish a task-scheduled shortcut that runs the portal with the HighestAvailable privilege level using schtasks /create /xml with a properly signed manifest.

Resolution Path D - License and Automation License Manager

The read-only save error is sometimes reported by engineers even when the underlying cause is the Automation License Manager (ALM) failing to enumerate a floating license at the disconnected location. TIA Portal does not block saves for ALM reasons, but a corrupted license cache can produce confusing dialogs that mention read-only paths. Verify the local ALM is healthy:

1. Start → Siemens Automation License Manager.
2. Confirm the local USB dongle (if used) is listed under Local and shows green.
3. Confirm any floating license target server is reachable. If not, select Active license → License search → Local search.
4. If a license is borrowed (checked out for travel), confirm the borrow end date has not passed. Borrowed licenses are stored as *.lic files under %ALM_DATA_PATH%\User\<user>.

For detailed ALM configuration, refer to the Siemens Automation License Manager documentation and the TIA Portal V18 installation manual.

Resolution Path E - Antivirus, Controlled Folder Access, and EDR Exclusions

Microsoft Defender's Controlled Folder Access will deny writes from TIA Portal into %USERPROFILE%\Documents unless the portal binary is on the allow list. To add the required exclusions from an elevated PowerShell window:

$paths = @(
  "C:\Program Files\Siemens\Automation\Portal V18\Bin\Siemens.Automation.Portal.exe",
  "C:\Program Files\Siemens\Automation\Portal V18\Bin\S7-PCT.exe",
  "C:\Program Files\Siemens\Automation\Portal V18\Bin\TIAPortal.exe"
)
foreach ($p in $paths) {
  Add-MpPreference -ControlledFolderAccessAllowedApplications $p
}

For third-party EDR suites (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Trend Vision One, etc.), the canonical exclusion request is:

• Process path: C:\Program Files\Siemens\Automation\Portal V*\Bin\Siemens.Automation.Portal.exe
• Process path: C:\Program Files\Siemens\Automation\Portal V*\Bin\TIA-Portal.exe
• File extension: .ap15, .ap16, .ap17, .ap18, .ap19
• Working directory: the user's project root

Validate the exclusion by running TIA Portal, performing a Save-As, and confirming that no EDR telemetry event with action BLOCK is recorded in the SOC console.

Resolution Path F - AppLocker, WDAC, and Code-Signing

On hardened corporate images the deny is enforced by Application Identity or Windows Defender Application Control. TIA Portal V17 and later binaries are signed by Siemens AG; the certificate fingerprint must be present in the WDAC allow list. The certificate SHA-256 thumbprint for the current Siemens code-signing certificate can be obtained from the file properties of Siemens.Automation.Portal.exe (Digital Signatures tab, Details, thumbprint). Add it as an Allow rule for the Publisher condition. Older images that relied on hash-based allow rules will fail after any TIA Portal service pack because the binary hash changes; migrate to publisher rules.

For AppLocker, the recommended exception inside an Signed by Siemens AG rule set is:

<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
  <FilePublisherRule Id="..." Name="Siemens TIA Portal" Description="Allow TIA Portal binaries" UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions>
      <FilePublisherCondition PublisherName="SIEMENS AG" ProductName="TIA Portal" BinaryName="*">
        <BinaryVersionRange LowSection="*" HighSection="*" />
      </FilePublisherCondition>
    </Conditions>
  </FilePublisherRule>
</RuleCollection>

Always pilot with EnforcementMode="AuditOnly" for at least one business week to confirm no false positives before switching to Enforced.

Resolution Path G - Archive/Export as a Last-Resort Workflow

When the engineer cannot obtain administrative cooperation (a typical situation on a weekend, off-network), the practical workaround is to work entirely in memory and transfer the project back to a writable machine. The workflow below has been used successfully to recover work without ever writing to the local disk in a way that triggers the policy.

1. Open the project read-only in TIA Portal (the open succeeds even when the save fails).
2. Make all required edits in the PLC, HMI, and Safety blocks.
3. Use Project → Archive → Archive to write a compressed archive. If the archive itself fails, attempt to write to a USB stick with a unique GUID-named folder; some corporate policies grant write permission to removable media where they block the local drive.
4. If archive fails, open the project library and use Export to file on each block individually as .scl, .fup, or .lad source files. These are plain text and can be carried forward in an email attachment.
5. Back in the office, rebuild the project from the source files. The .scl blocks can be reimported via External source files → Import in TIA Portal.

This approach loses the project library, device configuration, and security settings, but it preserves all PLC logic, which is usually the only thing the engineer was working on at home. For project recovery on a managed image, refer to the TIA Portal archive and recovery documentation.

Verification Procedure

After applying any of the resolution paths, run this verification sequence. Each step must succeed for the fix to be considered stable.

Step	Action	Pass Criterion
V1	Open TIA Portal elevated	Process shows Integrity Level = High in Process Explorer
V2	Open existing project	No read-only warning in the title bar
V3	Save (Ctrl+S)	File timestamp on .ap1x updates within 2 s
V4	Save-As to new name	New container appears in the destination folder with NTFS Write ACE for current user
V5	Compile	No errors related to save or write permissions
V6	Go offline and repeat V3-V5	Save still succeeds with no network connectivity
V7	Export archive	.zap archive is produced and matches SHA-256 expected size

If V3 fails but V6 succeeds, the fix depends on the network. If V6 fails, the fix is incomplete and the engineer should return to the diagnostics section; the most common reason for partial fixes is forgetting to remove the inherited Deny ACE on the project subdirectory.

Preventive Measures and Recommended Engineering Image

The most efficient long-term solution is a properly built engineering laptop image. The following baseline prevents the read-only save error from reappearing every release cycle.

• Engineering OU with Folder Redirection set to Not configured for Documents; allow local C:\Eng\ and D:\Eng\ roots.
• Engineering OU granted local administrator rights on the workstation (via restricted groups GPO) for the engineering staff.
• User added to local group SIEMENS TIA Portal Users as part of the image build.
• Automation License Manager installed with floating license configured; license borrowed automatically at user logon via task scheduler.
• Controlled Folder Access enabled with TIA Portal binaries and the engineering root pre-allowlisted.
• AppLocker/WDAC set to AuditOnly for the engineering OU.
• Offline Files enabled and pre-seeded for any required UNC paths.
• UAC set to Notify on app and settings changes only for engineering accounts.

Document this baseline as part of the engineering PC build procedure so that new laptops are configured consistently. A standardised image eliminates the Monday-morning tickets where weekend work was lost because of an inconsistent local policy.

Field Notes and Edge Cases

Several less common scenarios produce the same fault and are worth knowing before declaring the laptop fixed.

BitLocker-encrypted project drive with auto-unlock suspended offline. Some laptops ship with a secondary data partition encrypted with BitLocker and configured to auto-unlock only when the corporate network is reachable. When the laptop is at home, the partition mounts as read-only. Decrypt the drive once, or export the project to the unencrypted system partition before going offline.

OneDrive Known Folder Move. OneDrive's Known Folder Move feature silently redirects Documents, Desktop, and Pictures to the OneDrive sync root. When OneDrive is paused, throttled, or in Files-On-Demand mode without the file pinned locally, writes return "destination is read-only". Disable Known Folder Move for engineering accounts or move the TIA project out of the Documents folder entirely.

Symbolic link (mklink) to a network share. Some engineers create mklink /D C:\Eng \\<fileserver>\Eng$\jsmith to keep paths short. The link resolves only while the network is up; offline writes return the read-only error because the link target is unreachable. Replace the symlink with a local path or a true Offline Files cache.

V19 multiuser database locking. TIA Portal V19 introduced a SQLite-based multiuser project that uses file-level locks stored under %LOCALAPPDATA%\Siemens\TIA Portal V19\locks. If that directory is set read-only by policy, V19 returns a misleading read-only error that is actually a lock-acquisition failure. Verify with icacls "%LOCALAPPDATA%\Siemens".

Hyper-V or WSL2 shared clipboard interference. Running TIA Portal inside an RDP session to a Hyper-V VM on the same laptop can produce read-only errors if the VM integration component's shared folder service stalls. Disconnect the shared folder and re-test.

Recommended Workflow for the Offline Engineer

Engineers who regularly work from home on managed laptops should adopt the following disciplined workflow.

1. At the office, archive the project to C:\Eng\WorkingCopy\<project>.zap on a local path that is not redirected. Verify the archive by extracting it once.
2. Ensure the Automation License Manager has a borrowed license or a local dongle available.
3. Disconnect the network, change the project in TIA Portal, save locally, archive again, and copy the archive to a USB stick or a personal cloud location.
4. Back at the office, import the archive into the project repository and run a comparison against the last known good version.

This workflow avoids touching the redirected Documents path, sidesteps the read-only save error entirely, and provides an audit trail of the changes made off-network.

FAQ