Resolving UMC Server Connection Error in TIA Portal V20

Resolving UMC Server Connection Error in TIA Portal V20

1. Problem Overview

Central user management (UMC) in TIA Portal V20 depends on three logical roles:

• UMC Server — a Univention-based VM hosting the directory service, UMC WebUI, and the Ring Server instance.
• UMC Agent — installed on every TIA Portal engineering workstation; registers with the ring server and brokers logons.
• Ring Server — the redundant messaging backbone between agent and server that maintains session state and replication status.

The failure mode reported in the field presents as:

The UMC Agent cannot be connected to the server: UM Ring ServeR ... cannot be reached

Symptoms observed in production environments (TIA Portal V20 Update 3 paired with UMC 2.15):

• DNS resolution of the server hostname succeeds (ping <umc-server> returns a valid IP).
• UMC WebUI is reachable on the server VM via https://<umc-server>/univention/management/.
• TIA Administrator fails when adding the agent or saving the server configuration.
• Subsequent synchronization attempts fail with error code 4 even when the administrator password has been reset.

2. UMC 2.15 Network and Port Reference

The UMC ring topology relies on a fixed set of TCP ports. Any firewall, anti-virus, or Windows Defender rule blocking these sockets breaks agent-to-ring-server connectivity while leaving DNS and ICMP untouched, which is why ping succeeds while the agent registration fails.

3. Root Cause Analysis

The error string "UM Ring Server ... cannot be reached" is emitted by the UMC Agent when one or more of the following conditions is true:

1. Service not started. The Windows service UMC Secure Communication is not running on the TIA Portal workstation. Without it, the local ring client cannot open a session against the remote ring server.
2. Firewall blocking ring sockets. TCP 6669 (ring) or TCP 7389 (LDAPS) is being filtered by host firewall, perimeter firewall, or anti-virus HIPS module.
3. Routing gap. The TIA Portal workstation can resolve the hostname but cannot route to the server IP (different VLAN, missing default gateway, or split-tunnel VPN). Siemens error #8000 1006 maps to "The UMC server refuses to establish the connection" and is frequently accompanied by routing-table mismatches.
4. IIS / TLS configuration on the UMC VM. Missing NTFS rights on C:\Windows\TEMP for the IIS_IUSRS group break the UMC WebUI backend and indirectly block agent enrollment.
5. Credential / sync drift. The UMC administrator password changed but the local cached secret in TIA Administrator was not refreshed; this surfaces as synchronization error code 4.

4. Pre-Flight Verification Checklist

Run these checks from the TIA Portal workstation before editing any server configuration:

1. DNS resolution
   nslookup <umc-server-fqdn> — must return the same IP shown by the UMC WebUI host. Mismatch indicates split-brain DNS.
2. TCP reachability (HTTPS)
   Test-NetConnection <umc-server> -Port 443 — must report TcpTestSucceeded : True.
3. TCP reachability (LDAPS)
   Test-NetConnection <umc-server> -Port 7389
4. TCP reachability (Ring)
   Test-NetConnection <umc-server> -Port 6669
5. Optional diagnostics
   Test-NetConnection <umc-server> -Port 11311
6. Local ring service
   Get-Service "UMC Secure Communication" — Status must be Running, StartType Automatic.
7. Certificate trust
   Open https://<umc-server>/univention/management/ in Edge/Chrome on the TIA workstation. A certificate error here will silently break the agent even when TCP 443 is open.

5. Resolving the Agent-to-Ring Connection

5.1 Confirm UMC Secure Communication service

1. Open services.msc on the TIA Portal workstation.
2. Locate UMC Secure Communication.
3. Set Startup type to Automatic.
4. Click Start. If the service refuses to start, capture the event from Applications and Services Logs → UMC before contacting Siemens support.

5.2 Open ring ports on the engineering workstation firewall

Add an inbound and outbound rule per port for the TIA Portal subnet:

New-NetFirewallRule -DisplayName "UMC HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "UMC LDAPS" -Direction Inbound -Protocol TCP -LocalPort 7389 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "UMC Ring"  -Direction Inbound -Protocol TCP -LocalPort 6669 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "UMC Diag"  -Direction Inbound -Protocol TCP -LocalPort 11311 -Action Allow -Profile Any

Repeat for -Direction Outbound. Apply matching rules on every intermediate firewall between the workstation and the UMC VM.

5.3 Validate the temporary firewall-bypass test

To isolate the firewall as the failure variable, perform a controlled bypass:

1. Disable Wi-Fi.
2. Unplug every Ethernet cable except the one carrying UMC traffic.
3. Temporarily disable Windows Firewall and any third-party HIPS.
4. Retry the TIA Administrator connection.
5. Re-enable all protections and restore cabling in the original order.

If the connection now succeeds, the failure is inside a rule — not in UMC itself — and the port list in Section 2 is the required scope of that rule.

5.4 Repair the UMC WebUI backend (TEMP permissions)

When the UMC WebUI returns "Unable to establish connection to server", the UMC Agent registration will also fail. The known fix is to grant the IIS worker account group read/write access to the Windows temp directory:

1. On the UMC VM, open %SystemRoot%\TEMP.
2. Right-click → Properties → Security → Edit.
3. Add IIS_IUSRS with Modify permission.
4. Apply, then restart the W3SVC service.

6. Resolving Synchronization Error Code 4

Error code 4 surfaces during the Synchronize with UMC server step inside TIA Administrator, even after the agent has successfully registered and the administrator password has been reset. The two confirmed causes are:

1. Stale cached credential. TIA Portal caches the UMC service account secret under the current Windows user profile. Changing the password in the UMC WebUI does not invalidate that cache.
2. Ring client not converged. After a server-side restart, the local UMC ring client requires a full handshake before accepting provisioning requests.

6.1 Clear the credential cache

1. Close TIA Portal completely (including the TIA Administrator helper process).
2. Open Credential Manager → Windows Credentials.
3. Remove every entry whose Internet or Network address contains the UMC server hostname or IP.
4. Restart TIA Portal and re-enter the administrator credentials in TIA Administrator.

6.2 Force ring re-convergence

1. Reboot the UMC VM and wait for the ring daemon to report READY in /var/log/univention/ring.log.
2. Reboot every engineering workstation that hosts a UMC Agent.
3. If the first cycle does not clear error code 4, perform a second paired reboot (server first, then agent) — multiple reboot cycles are an accepted field workaround until the issue is reproduced in a Siemens fix pack.

7. TIA Administrator Agent Configuration Procedure

After the network, service, and credential prerequisites are satisfied, configure the agent:

1. Start TIA Administrator from the TIA Portal installation group.
2. Select Central user management → Agents → Add.
3. Enter the fully qualified domain name of the UMC server (do not prefix https://; the agent resolves the scheme from the service definition).
4. Provide the UMC administrator username (default Administrator) and the current password.
5. Click Test connection. Expected result: "Connection to server established successfully."
6. Click Apply to register the agent.
7. Trigger Synchronize with UMC server. Expected result: no error code, role mappings populated under User roles.

8. Verification and Acceptance Tests

Run the following matrix after every change set. Record results in the commissioning log.

9. Known Issues and Field-Confirmed Caveats

• UMC 2.15 + TIA Portal V20 Update 3. Combination is reproducible for ring connection errors and synchronization error code 4. Apply the latest TIA Portal V20 service pack and the matching UMC 2.15 patch before opening a support ticket.
• Hidden certificate warnings. Some managed browsers suppress TLS warnings behind a "continue anyway" prompt. The ring client does not bypass the warning — it fails the handshake. Distribute the Univention UCS root CA via Group Policy before commissioning.
• Anti-virus DLL injection. Real-time anti-virus modules injecting into the UMC Secure Communication process can delay heartbeats past the ring timeout, producing intermittent "cannot be reached" errors even with all ports open. Add the UMC installation directory to the AV exclusion list.
• Split-horizon DNS. When the TIA Portal workstation and the UMC VM live on different DNS views (common in DMZ designs), name resolution may succeed but route to the wrong IP. Pin the server IP in the workstation's hosts file only as a temporary diagnostic step, never as a production fix.
• Multi-reboot workaround. Multiple coordinated reboots of the server VM and the agent workstation have cleared the symptom in the field. Treat this as a temporary mitigation, not a root-cause fix, and escalate a diagnostic bundle to Siemens support.

10. Escalation Bundle Checklist

If the ring connection still fails after executing Sections 4 through 7, open a Siemens support request with the following artefacts:

• Output of Test-NetConnection for ports 443, 7389, 6669, and 11311.
• Export of Windows event log "Applications and Services Logs / UMC" (.evtx).
• UMC VM logs: /var/log/univention/ring.log and /var/log/syslog.
• Screenshot of the TIA Administrator error dialog including the exact wording of the ring error.
• Result of Get-Service "UMC Secure Communication" on every engineering workstation.
• Installed software list for TIA Portal (InstalledApps.csv from the TIA installation directory).
• UMC server version output from univention-app info umc on the VM.

11. Related Siemens Error Codes

12. References to Official Documentation

Authoritative sources for the procedures above:

• Siemens TIA Portal — UMC 2.15.2 Troubleshooting
• Siemens TIA Portal — Logon of central users (error code reference)