Siemens 840D PCU50 Ghost Image Restore: Password Failure Fix

1. Problem Overview

Field engineers performing a Ghost image restore on a legacy Siemens Sinumerik 840D system equipped with a PCU50 (part number 6FC5210-0DF02-0AA0) frequently encounter a hard authentication failure when using the integrated SERVICEMENU restore procedure. The control reports "Password is invalid for \\ExternalComputerName\SharedFolder. Re-enter your password" followed by "Login failed", even when the operator has correctly configured the external Windows XP host, the workgroup, the shared folder permissions, and disabled the firewall.

The failure is not a typo, a wrong cross-over cable, or a misconfigured Windows share. It is a known limitation of the SERVICEMENU 02.03.08 build that ships with the oldest PCU50 image sets, combined with the fact that this revision does not expose the Change Network Settings option to switch to TCP/IP — the unit is locked to the NetBEUI frame protocol.

2. Affected Hardware and Software

The PCU50 boots a Windows NT / Windows XPe image stored on the internal 2.5" IDE hard disk. The SERVICEMENU is launched from a hidden partition or from a Siemens-supplied boot environment, depending on the build, and presents a text-mode menu for backup and restore. On the 02.03.08 build, the only network protocol stack that the menu can negotiate is NetBEUI — there is no Change Network Settings entry that would allow an operator to bind the TCP/IP protocol instead.

3. Root Cause Analysis

The PCU50 SERVICEMENU 02.03.08 expects the operator to authenticate against the NetBEUI-accessible shared folder using a credential set that the Siemens boot environment can validate. The following factors converge to produce the "Password is invalid / Login failed" condition:

1. Protocol binding mismatch. NetBEUI requires a strict host name and workgroup match between the PCU50 and the external PC. If the external PC is a member of a Windows domain (even a single-machine Active Directory), NetBEUI session setup will reject the share. The peer must be a workgroup member — WORKGROUP is the conventional name used in the Siemens service procedure.
2. Local account vs. service account. The boot environment that runs the SERVICEMENU only recognises a small set of well-known accounts (AUDUSER being the most common). If the external PC has been hardened, the local user account may not exist, may be password-protected, or may require interactive sign-in, all of which fail under the text-mode NetBEUI redirector.
3. Encrypted password policy. Windows XP and later ship with "Send LM & NTLM responses only" or "Send NTLMv2 responses only" by default. The legacy NetBEUI redirector in the Siemens boot environment cannot negotiate NTLMv2 session keys; it expects an LM-compatible response. The mismatch is reported to the user as a generic "Password is invalid" even when the password itself is correct.
4. File and Printer Sharing scope. With Use simple file sharing enabled, Windows forces share access through the Guest account. If the Guest account is disabled, or the share is permission-locked to a specific user, the NetBEUI redirector returns an authentication error rather than a permissions error.
5. Firewall residue. Although the Windows XP firewall is disabled, third-party host-based firewalls (Norton, McAfee, Kaspersky legacy builds) can re-bind the NetBEUI port and block the LM announcement. The PCU50 will see link activity on the Ethernet LEDs yet still report "Login failed".

4. The NetBEUI Authentication Problem in Detail

NetBEUI is a non-routable, broadcast-heavy LAN protocol that Microsoft deprecated in favour of TCP/IP beginning with Windows XP. The Siemens 02.03.08 SERVICEMENU retains it because the boot environment is built on a Windows NT 4.0 / Windows PE 1.x base, where the NDIS NetBEUI driver is the only one that can attach to the PCU50's Intel Etherexpress NIC without a TCP/IP stack.

To complete a NetBEUI session setup against a Windows XP share, the following must all be true simultaneously:

• The external PC is in a workgroup, not a domain.
• NetBEUI is installed and bound to the same NIC that the cross-over cable is attached to.
• The NetBEUI computer name on the PC is <= 15 characters and matches the name used in the SERVICEMENU's \\ComputerName\Share path (NetBIOS name resolution, not DNS).
• The share is published via File and Printer Sharing for Microsoft Networks, which itself depends on the Server service running and the NetBEUI binding on the Server service's protocol list.
• Either the Guest account is enabled and the share allows Everyone, or a local user account exists whose name and password can be transmitted as an LM hash.

If any of these conditions is violated, the SERVICEMENU returns a non-specific authentication error. There is no verbose log on the PCU50 side. This is why the symptom is reported as "Password is invalid" even when the password has been triple-checked.

5. Solution Path A — Direct HDD Clone (Recommended, Field-Proven)

The fastest, most reliable recovery path is to bypass the SERVICEMENU entirely and clone the disk on a bench. This method requires no NetBEUI session setup, no external PC configuration, and no authentication handshake. It is the procedure that successfully restored the machine in the original service case.

5.1 Required Tools

• Symantec / Norton Ghost 8.0 corporate, Ghost Solution Suite 2.5, or a modern equivalent that can read legacy 2.5" IDE drives (e.g., Macrium Reflect, Acronis True Image with legacy PATA support, or dd on a Linux host).
• USB-to-IDE adapter (44-pin 2.5" laptop form factor). Verify the adapter supports Master/Slave selection; the PCU50 HDD is typically set to Master (single drive, no jumper).
• Laptop or bench PC running Windows XP / Windows 7 with the imaging software installed.
• Torx T8 and T10 drivers for the OP12 / PCU50 chassis disassembly.
• Anti-static wrist strap — the HDD is mounted on a conductive bracket that is bonded to chassis ground.
• The reference Ghost image (.gho or .ghs file). The image must have been captured at the partition level from an identical PCU50, or at the disk level if the SERVICEMENU partition layout is to be preserved exactly.

5.2 Procedure

1. Power down and lock out the machine. Open the main disconnect, apply LOTO, and wait at least 5 minutes for the DC bus to discharge. The PCU50 is fed by a 24 V standby rail that remains live even when the NC is off.
2. Remove the OP12 from the panel. Disconnect the MPI/Profibus cable and the X8 / X9 ribbon cables. Note the orientation of the IDE cable (pin 1 is typically red-stripe on the cable edge).
3. Extract the 2.5" IDE hard drive from the OP12. The drive is mounted on a vibration bracket. Disconnect the 44-pin IDE cable from the drive — do not pull on the cable, pull on the connector body.
4. Configure the USB-to-IDE adapter. Set the drive-select switch to Master (the PCU50 default). Connect the adapter to the laptop's USB port. Windows should enumerate the drive within a few seconds; if it prompts to format, cancel immediately — the drive already has a partition table.
5. Verify partition visibility in Ghost. Launch Ghost and confirm that two partitions are visible: a small (~50 MB) FAT16 service partition and a larger (~3–6 GB) NTFS system partition. If only one partition is visible, the adapter is in the wrong mode or the drive jumper is wrong.
6. Restore the image at the disk level. In Ghost, select Disk → From Image, point to the .gho file, and select the destination as the physical disk 1 (the PCU50 HDD). Confirm that the partition layout to be written matches the original (one FAT16 service, one NTFS data). Click OK and let the restore complete.
7. Validate the restore. After the restore, Ghost will report the byte count. Compare it to the original image size. Exit Ghost and use Start → Programs → Ghost → Ghost Explorer to inspect the new NTFS partition's contents — confirm the presence of \HMI Advanced\hmi.exe or the equivalent Sinumerik Operate / SinuTrain launcher for the build.
8. Reinstall the IDE cable and the HDD in the OP12, reverse the disassembly steps. Torque the chassis screws to 0.6 N·m; the OP12 enclosure is aluminium and the threads strip easily.
9. Reconnect and power up. Reattach the MPI/Profibus cable, close the disconnect, and observe the boot sequence. The PCU50 should present the SERVICEMENU splash within 30 seconds, then boot into Sinumerik Operate within a further 60 seconds.

5.3 Why This Works When the Network Method Fails

The bench-clone method has no network stack, no authentication layer, no share-level permission, and no firewall in the path. The image is written at the sector level by a tool that reads the source image and writes it directly to the destination media. The PCU50 sees the result as a clean, freshly imaged disk and boots the SERVICEMENU / Windows XPe image exactly as it would after a Siemens service-bench rebuild.

6. Solution Path B — Network Restore (When the HDD Cannot Be Removed)

If the PCU50 chassis cannot be opened (for example, on a machine under warranty or with sealed paint marks), the network method is still viable — but it requires deliberate configuration of the Windows XP host to be backward-compatible with the SERVICEMENU 02.03.08 NetBEUI redirector.

6.1 Windows XP Host Configuration Checklist

1. Install NetBEUI from the Windows XP CD (under ValueAdd\MSFT\Net\NetBEUI). Copy ndis.sys, nbf.sys, and the netnbf.inf into %SystemRoot%\inf and the two .sys files into %SystemRoot%\System32\Drivers. Add the protocol through the NIC's properties → Install → Protocol → NetBEUI.
2. Bind NetBEUI to the Server service as well as the Workstation service. Open ncpa.cpl, advanced → Advanced Settings, and ensure that NetBEUI is checked in the bindings list for both services.
3. Confirm the workgroup name is WORKGROUP. Domain membership will fail silently.
4. Enable the Guest account: net user guest /active:yes.
5. Set the local security policy to Send LM & NTLM responses: secpol.msc → Local Policies → Security Options → "Network security: LAN Manager authentication level" → Send LM & NTLM - use NTLMv2 session security if negotiated (do not select "Send NTLMv2 only").
6. Disable the Windows Firewall completely, including the exception list. Restart the Server service: net stop server && net start server.
7. Create a share with a simple path: net share Ghost=C:\ghost_image /grant:guest,full /grant:everyone,full. Avoid dollar signs, embedded spaces, or paths longer than 12 characters.
8. Set the local account password to a short, ASCII-only string: net user backup Password1 /add; add to Administrators and to the share ACL.

6.2 PCU50 SERVICEMENU Steps

1. From the SERVICEMENU, choose Service → Restore → Network.
2. Select 1 Connect to Network Drive.
3. When prompted for Letter for Network Drive, enter G.
4. For Directory to be mounted, enter \\BACKUPPPC\Ghost (replace BACKUPPPC with the actual computer name of the Windows XP host — must be ≤ 15 characters, no hyphens, no underscores that the redirector will mangle).
5. For User Name, enter backup (the local account you created in step 6.1.8).
6. For Password, enter Password1.
7. If the PCU50 still returns "Password is invalid", the NetBEUI handshake has failed at the LM-hash negotiation. Re-check the LAN Manager authentication level — this is the most common cause of a network-restore failure on SERVICEMENU 02.03.08.

7. Password Troubleshooting Matrix

8. Verification

After either restore path, perform the following acceptance checks before returning the machine to production:

1. Boot the PCU50. Confirm the SERVICEMENU splash is followed by a clean Windows XPe / Sinumerik Operate load. No missing DLL or hal.dll corrupt messages should appear.
2. From the main HMI, navigate to Start-up → Commissioning → Drive configuration and verify that all axis drives are present and green. A freshly restored image may need the NCK to re-load the drive assignment from the CF card.
3. Open Diagnostics → Communication → TCP/IP Diagnostics (or Net Diagnostics on a TCU). Confirm that the HMI can ping the NCU at its default address (typically 192.168.214.1 for the NCK, 192.168.214.240 for the PCU).
4. Run a part-program test (M0 → S200 → incremental jog of each axis). All axes should move without alarm 3000 / 3001 / 3002 / 3003. If alarm 3000 is raised, the NCK has not loaded the machine data — re-trigger a Reload MD from CF.
5. Verify license keys. The Siemens license is stored in the CF card on the NCU side, not on the HDD, so it should survive an HDD-only restore. If options are missing, re-import the license via Start-up → Commissioning → License.
6. Take a fresh backup image of the now-working disk. Label it with the machine serial number, the SERVICEMENU build, and the date. Store it on a network share that is not the same as the source share used for the restore.

9. Edge Cases and Field Considerations

9.1 HDD Replacement

2.5" IDE drives for the PCU50 are no longer in production. Common field substitutes are 40 GB or 80 GB drives pulled from legacy industrial equipment. Verify that the substitute drive supports UDMA 33 or lower; UDMA 66 / 100 drives will fall back to PIO mode and may slow the boot to an unacceptable level. Some SSD-to-IDE adapters (e.g., the DOM form-factor with a 44-pin IDE edge connector) are acceptable, but only if the adapter exposes a true IDE master/slave jumper — many cheap adapters default to cable-select and will not be detected by the PCU50 BIOS.

9.2 Image Compatibility Across SERVICEMENU Builds

An image captured on a 02.03.08 PCU50 can usually be restored to a PCU50 with a 02.04.xx or 02.05.xx SERVICEMENU. The reverse is not always true: images from later builds may install a newer winpe.iso or a new HAL that the older SERVICEMENU cannot boot. If the machine serial is associated with a 02.03.08 build, stay on 02.03.08 images.

9.3 Mixed PCU50 / PCU70 Fleets

PCU70 units use SATA drives and a different image format. Do not attempt to clone a PCU70 image onto a PCU50 HDD. The two are not interchangeable at the disk level; the bootloader, the HAL, and the bus enumerator are all different.

9.4 Antivirus on the External PC

Sophos, Kaspersky, and Trend Micro endpoint agents can intercept the NetBEUI SMB-equivalent packet and rewrite the response, breaking the LM-hash exchange. If the external PC is a managed corporate asset, the safest approach is to use a non-managed laptop with Windows XP SP3 and no AV beyond the built-in Windows Defender (off).

9.5 Servicemenu 02.03.08 Document Set

The original PDF referenced in the service case (Ghost Backup-NT-Xp-Service center not available) is a Siemens-internal document. A current public reference for the SERVICEMENU backup/restore procedure is the Siemens Industry Online Support portal, search term PCU50 SERVICEMENU backup restore. Always cross-check the current Siemens service note revision against the SERVICEMENU build on the unit — the documentation has been revised several times since 02.03.08.

10. Recommended Long-Term Actions

1. Capture a fresh Gold Image of every unique SERVICEMENU build in the fleet. Store on a network share with NTFS permissions, and on an offline USB drive in a fireproof safe.
2. Maintain at least one bench PC with a working USB-to-IDE adapter, Ghost 8.0 (or modern equivalent with legacy IDE support), and a known-good spare 2.5" IDE HDD. This is the single most cost-effective way to recover a legacy PCU50.
3. Label every PCU50 chassis with the SERVICEMENU build, the machine serial, and the date of the last full image restore. This accelerates triage when a future failure occurs.
4. For machines approaching end of life, plan a migration path to TCU / Sinumerik ONE — the 840D PCU50 platform is no longer in active development, and field-proven procedures like the one above will become harder to support as spare parts dry up.

11. FAQ