Siemens Automation License Manager Firewall Port Configuration

Overview of the Siemens Automation License Manager

The Automation License Manager (ALM) is a Siemens AG utility that administers license keys for the SIMATIC, STEP 7, TIA Portal, and SINAMICS Startdrive product families. The license key is the technical representation of a software license and is bound to a specific dongle, hard-disk volume, or ALM server. ALM runs as a Windows service (almsrv64.exe / almsrv.exe depending on ALM release) plus a user interface (ALM.exe) and exchanges license data between engineering PCs and license servers using TCP.

The official application manual is published by Siemens as Automation License Manager (PDF). The companion Siemens Industry Online Support entry that lists the runtime ports required to operate the license management unit (LMU) is Required ports to operate LMU.

When ALM is used purely on a single workstation, no firewall configuration is required. The moment a license is transferred between two PCs, transferred to a license server, or borrowed over the network, the Windows Firewall or any corporate firewall in the path must allow the relevant TCP ports. This reference documents which ports must be opened, why each one is required, and how to configure Windows Firewall without disabling it entirely.

License Transfer Architecture

ALM license transfer over TCP uses two distinct communication layers:

1. ALM Remote Protocol (port 4410/tcp) – Used by the ALM client to discover a remote license server and to issue license-management commands (transfer, borrow, return, check-in). This port is owned by almsrv*.exe.
2. SMB / CIFS file-share (ports 139/tcp and 445/tcp) – Used by Windows file sharing to copy the binary *.LIC key file from the source PC into a writable shared folder on the target PC. ALM cannot drop the license file via a proprietary mechanism; it relies on a standard Windows share.

Required TCP Ports

How to Disable the ALM Remote Port (4410)

Sites that use ALM exclusively for local license management and do not need remote license transfer can reduce the attack surface by closing port 4410. According to the Siemens Required ports to operate LMU article, this is done from inside the ALM client:

1. Start Automation License Manager on the PC where the LMU is installed.
2. Open File → Settings.
3. In the dialog, clear the option that allows accessibility of port 4410 for remote connections.
4. Click OK and restart the almsrv* service (sc stop almsrv64 && sc start almsrv64 from an elevated command prompt) so the change takes effect.

Prerequisites for Network License Transfer

Before opening firewall ports, prepare the target PC so that ALM can drop a license file into it.

1. Shared folder with write permission. On the target PC, open Explorer, right-click the destination drive or folder (commonly C:\ or a dedicated D:\Licenses), choose Properties → Sharing, enable Share this folder on the network, and tick Allow network users to change my files. Add Everyone with Read/Write for a quick engineering setup, or restrict to a specific ALM service account for production.
2. Matching ALM version. Source and target ALM should be the same major release (for example, ALM V6.0 SPx paired with ALM V6.0 SPx). Mismatched versions can reject transferred keys. Siemens bundles ALM with STEP 7 / TIA Portal media; the latest is also available on the Siemens Industry Online Support portal.
3. Service account permissions. The Windows user that runs almsrv* on the source PC must be able to authenticate against the target share. Using a domain account is recommended so that Kerberos/NTLM credentials are accepted by both endpoints.
4. Firewall disabled / ports open. This is the main subject of the article – see the next section.
5. Network reachability. Validate basic IP connectivity before troubleshooting ALM: ping <target>, net view \\<target>, and Test-NetConnection -Port 4410 from PowerShell.

Windows Firewall Configuration

The recommended approach is to create inbound rules for ports 139, 445, and 4410 on the target PC, plus matching outbound allow rules on the source PC. Adding an exception for the executable (almsrv64.exe) is not sufficient because SMB is mediated by svchost.exe hosting the LanmanServer service group.

Inbound rules on the target PC

1. Open Windows Defender Firewall with Advanced Security (wf.msc).
2. Right-click Inbound Rules → New Rule.
3. Select Port → TCP → enter 4410. Name the rule ALM Remote (TCP 4410).
4. Repeat for TCP 139 (rule name: SMB NetBIOS Session) and TCP 445 (rule name: SMB Direct Host).
5. For each rule set Action to Allow the connection, Profile to Domain, Private (avoid Public), and Scope to the IP range of your engineering subnet.

Outbound rules on the source PC

If the source PC uses a host-based firewall with default-deny outbound policy, mirror the inbound rules as outbound allow rules for TCP 139, 445, and 4410 to the target IP address.

PowerShell one-liner

For quick deployment on a single target:

New-NetFirewallRule -DisplayName "ALM Remote 4410" -Direction Inbound -Protocol TCP -LocalPort 4410 -Action Allow -Profile Domain,Private
New-NetFirewallRule -DisplayName "SMB 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -Profile Domain,Private
New-NetFirewallRule -DisplayName "SMB 139" -Direction Inbound -Protocol TCP -LocalPort 139 -Action Allow -Profile Domain,Private

UNC Path and ALM Transfer Procedure

1. On the source PC, start ALM and select the license you want to transfer.
2. Right-click and choose Transfer → Network.
3. Enter the target PC name (for example \ENG-PC-02) or IP address (\192.168.10.42).
4. When prompted, choose the shared target drive / folder created in the prerequisites step.
5. Confirm the transfer. ALM writes the .LIC file to the share and registers it on the target license server.

Service and Process Reference

Verification Checklist

1. Confirm the ALM service is running: sc query almsrv64 → state RUNNING.
2. Confirm TCP 4410 is listening: netstat -ano | findstr :4410. PID should match almsrv64.exe.
3. From the source PC, run Test-NetConnection -ComputerName <target> -Port 4410. TcpTestSucceeded : True is required.
4. From the source PC, run Test-NetConnection -ComputerName <target> -Port 445. TcpTestSucceeded : True is required.
5. Open \\<target>\share in Explorer; create a small test file from the source PC to confirm write access.
6. Perform a test license transfer of a low-value trial license in ALM and verify it appears in the target ALM.
7. Review the Windows Firewall log (%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log) for dropped packets on ports 139, 445, or 4410.

Troubleshooting Matrix

Security Hardening Notes

• Restrict the inbound rules to the engineering VLAN / IP range; never expose SMB (139/445) or ALM (4410) on a Public profile.
• Disable SMBv1 on both PCs; ALM does not require it and SMBv1 is a known attack vector. Use Set-SmbServerConfiguration -EnableSMB1Protocol $false.
• If ALM is not used remotely, follow the File → Settings procedure to disable port 4410 as documented by Siemens.
• Avoid sharing the entire C:\ drive in production; create a dedicated Licenses$ hidden share with NTFS ACLs.
• Restrict source PCs to authorized engineering accounts by combining Windows Defender Firewall rules with IPsec or NPS policies where required.

Field-Proven Caveats

• When Windows Firewall is enabled with default rules, adding an exception for the ALM.exe executable alone is not enough – the SMB file copy is performed by svchost.exe hosting the LanmanServer service, so a process-based rule does not cover the share write.
• Domain-joined PCs on a corporate network often have firewall policy pushed by Group Policy; locally created rules may be overridden. Confirm the rules survive a gpupdate /force.
• VPN tunnels that drop SMB (NetBIOS) traffic will block port 139 but may still pass 445; if the remote office cannot reach the license server, use TCP 445 only or set up an SMB-over-quic / VPN profile that explicitly allows file-sharing.
• On virtualized engineering workstations with checkpoint firewalls, the checkpoint driver can block SMB even when Windows Firewall shows rules as active; verify with netsh advfirewall show allprofiles.