Siemens PCU 50 Backup Failing: Restore AUDUSER Credentials

1. Problem Overview

The Siemens SINUMERIK PCU 50.3 (and the legacy PCU 50.5 variant connected to an XP backup target) is the industrial PC that hosts the HMI runtime for 840D sl, 828D, and 840evo CNC controls. The standard service-system backup procedure pushes a Norton Ghost image of the PCU's system partition (typically drive C:) from the PCU's service menu to a shared folder on an engineering workstation or file server. The PCU opens a temporary SMB session to the target share, copies the image, and disconnects.

After a routine Windows Update cycle on the Windows XP Professional target, the service menu still maps the drive and still prompts for credentials, but every write attempt now returns Access denied - surfaced as Win32 error code 5 (ERROR_ACCESS_DENIED). The interactive Windows logon password that previously authenticated the connection is no longer accepted, and the documented service account is not recognized either. The backup halts on the first sector write; the HMI side raises alarm 53 (network/authentication failure during the backup push).

2. Affected Hardware and Software

3. Root Cause Analysis

The April 2014 Windows XP security updates tightened the local-account authentication model used when a remote system connects to a share. Two policy changes in those updates are responsible for the broken AUDUSER backup:

1. Local-account authentication no longer falls back to a plaintext / legacy exchange. The update alters HKLM\SYSTEM\CurrentControlSet\Control\Lsa and the related network-security-provider chain so that the legacy LM/NTLM session setup is no longer accepted unless the share is configured for the new model. The AUDUSER / SUNRISE account on the XP host may still exist, but its credentials are rejected if the share is misconfigured.
2. The default Network access: Sharing and security model for local accounts policy flips from "Guest only - local users authenticate as Guest" to "Classic - local users authenticate as themselves" on hosts that are not domain-joined, when the update is installed with default options. Under the older "Guest only" model, every remote user was silently mapped to the local Guest account, which is why an interactive Windows logon password worked at all in earlier configurations. Under the new "Classic" model, the connection requires a real local account with a matching password - and the PCU 50 only knows one: AUDUSER / SUNRISE.

The HMI-side alarm 53 is the generic TCP/IP connection failure code raised by the service-backup stack; it covers the entire authentication and transport failure surface, not just connectivity. Inspecting the service-menu log on the PCU confirms a STATUS_LOGON_FAILURE (0xC000006D) returned by the SMB server. The Windows-side error 5 observed from any client that supplies incorrect credentials matches the same condition.

References: Microsoft Learn - Network access: Sharing and security model for local accounts; Microsoft Learn - Guest fallback behaviour and Access denied; Siemens Industry Online Support for SINUMERIK 840D sl PCU 50 service manuals.

4. AUDUSER Service Account Reference

The PCU 50 service backup expects a local user named AUDUSER on the backup target with the password SUNRISE. These values are hard-coded in the PCU service partition image; they cannot be customized from the HMI. They are part of the Siemens service tooling and are intended only for authorized service personnel.

The account design goes back to the early 1990s SINUMERIK backup tooling. The PCU side assumes that any target that can serve a Ghost image is a dedicated engineering host, not a domain member or a workstation used for unrelated work. This assumption is what allows the credential pair to be hard-coded in the service image: the operator never sees a password prompt in normal use because the share authenticates the connection silently. The Windows Update change described in step 3 above removes that silent-authentication path; the AUDUSER/SUNRISE pair must be present on the target as a real local account for the workflow to work.

5. Pre-Diagnostic Checklist

Run these checks before modifying the XP target. They confirm the failure is on the workstation side and not on the PCU.

1. From the PCU service-menu command shell, run ping <target_ip>. A reply proves Layer 3 connectivity.
2. From the same shell, run net view \\<target_ip>. A listing proves that the SMB session completes at the protocol layer. If this command fails, the failure is at NetBIOS name resolution or at the firewall, not at authentication.
3. From the same shell, run the exact credential pair the service backup will use:
   net use Z: \\<target_ip>\backup /user:AUDUSER SUNRISE
4. Interpret the result:
   • The command completed successfully. - the AUDUSER account exists and the password matches; the failure is downstream at NTFS or share permissions.
   • Error 1326 (ERROR_LOGON_FAILURE) - the account is missing, disabled, locked, or the password is wrong.
   • Error 86 (ERROR_INVALID_PASSWORD) - the local password complexity policy rejected SUNRISE; loosen the policy or reset the password.
   • Error 5 (ERROR_ACCESS_DENIED) - share or NTFS rights are missing for AUDUSER.
   • Error 1219 - multiple connections from the same user; drop stale sessions.
   • Error 1208 - extended error; check Event Viewer for the underlying status code.
5. On the XP target, open secpol.msc -> Local Policies -> Security Options and inspect Network access: Sharing and security model for local accounts. If the value is "Classic", AUDUSER must exist as a local account with the exact password SUNRISE.
6. Open lusrmgr.msc -> Users. Confirm AUDUSER exists, is not disabled, "Account is locked out" is clear, and "User must change password at next logon" is not set.
7. Open a Windows command shell on the XP target and run net session or net file. Any pre-existing session from the same PCU can hold the share open in an incompatible mode; close it with net session \\<target_ip> /delete.
8. Confirm that the firewall on the XP target permits inbound TCP/445 and UDP/137-138 from the PCU's subnet. A Windows Firewall rule named "File and Printer Sharing" must be enabled on the active profile.

6. Step-by-Step Recovery Procedure

All steps are performed on the Windows XP target with administrator credentials. Do not modify the PCU 50 image; the PCU side is correct.

6.1 Recreate the AUDUSER local account

1. Log in to the XP target as a member of the local Administrators group.
2. Open Control Panel -> Administrative Tools -> Computer Management.
3. Expand System Tools -> Local Users and Groups -> Users.
4. If AUDUSER does not exist, choose Action -> New User. Type AUDUSER in the User name field, type SUNRISE in both password fields, and clear "User must change password at next logon". Enable "Password never expires". Click Create.
5. If AUDUSER exists but the password is unknown, right-click the account and choose Set Password.... Type SUNRISE twice, confirm the warning, and click OK.
6. Double-click AUDUSER. On the Member Of tab, add the local group Backup Operators in addition to the default Users group. Click OK.
7. On the General tab, confirm that the account is not disabled and that Account is locked out is clear. Enable Password never expires so a subsequent password policy change cannot break the PCU.
8. On the Account tab, deny interactive logon by selecting Deny for Logon locally and Log on through Terminal Services. Allow logon to the network (SMB) only. This is the recommended hardening for the service account.

6.2 Adjust the password policy so "SUNRISE" is accepted

1. Open secpol.msc -> Account Policies -> Password Policy.
2. If Password must meet complexity requirements is Enabled, set it to Disabled. SUNRISE (7 characters, all uppercase, alphabetic only) does not satisfy the default complexity rule once the April 2014 cumulative update is installed.
3. If Minimum password length is greater than 7, reduce it to 7 or lower. The PCU image is hard-coded for 7 characters.
4. If Password history is enabled and the previous AUDUSER password is still in history, clear the history by resetting the password with net user AUDUSER SUNRISE from an elevated shell.
5. Apply the changes. No restart is required for secpol.msc changes on Windows XP; the next authentication re-reads the policy.

6.3 Recreate or repair the network share

1. Create or identify the target folder on the XP host, e.g. D:\PCU_Backup. The volume must have enough free space for the image - typically 8-12 GB for a fully populated PCU 50.3.
2. Right-click the folder and choose Sharing and Security.... Switch to the Sharing tab.
3. Select Share this folder. Use a short ASCII share name; the Siemens service menu references backup, but any short name works as long as the PCU menu uses it.
4. Click Permissions. Add AUDUSER with Change permission. Remove Everyone if it is present.
5. Click the Security tab. Add AUDUSER with Modify NTFS rights. Tick Replace permissions on all child objects with those shown here if prompted.
6. Confirm by clicking OK twice.
7. Verify the share by running net share in a command shell. Confirm the share name, the local path, and the maximum number of users.

6.4 Align the local security policy with the Siemens expectation

1. Open secpol.msc -> Local Policies -> Security Options.
2. Locate Network access: Sharing and security model for local accounts.
3. Recommended setting for this workflow: Classic - local users authenticate as themselves. Combined with the recreated AUDUSER account, this matches the Siemens service expectation.
4. If the policy must remain Guest only - local users authenticate as Guest for any reason, the share must be readable and writable by the local Guest account, and Guest must not be disabled. This configuration is generally discouraged on connected engineering workstations.

6.5 Restart the SMB server to flush cached credentials

1. Open services.msc.
2. Right-click Server and choose Restart. Wait until the service is in the Started state.
3. Right-click Workstation and choose Restart. This clears the client-side cached credentials on the XP host that may still hold an old hash.
4. From an elevated shell run net use * /delete to drop any stale drive mappings on the XP host itself (this does not affect the PCU).

7. Verification Procedure

1. From the PCU service-menu command shell, run net use Z: \\<target_ip>\backup /user:AUDUSER SUNRISE. The expected response is The command completed successfully.
2. Run echo test > Z:\write_probe.txt. The file must appear on the XP host under the shared folder.
3. Run dir Z:\. The new file must appear in the listing.
4. Run net use Z: /delete to release the mapping cleanly.
5. Return to the service-menu backup wizard and start the image push. The PCU should advance past the authentication stage without raising alarm 53. A clean run produces a .gho file in the share.
6. On the XP host, run net session in an elevated shell. Confirm an active session from the PCU's IP under the AUDUSER identity.
7. Open the security log on the XP host. Look for event 540 (Successful Network Logon) with the AUDUSER account name. A failed run produces event 529 with status 0xC000006D.
8. After the image is written, run dir \\<target_ip>\backup /a from any engineering client to confirm the .gho file is present and its size matches the expected partition size.

8. Preventing Recurrence

Once AUDUSER is restored, lock the configuration so that the next Windows Update cycle does not break it again.

8.1 Disable automatic updates on the XP target

SINUMERIK service guidance is to freeze the engineering workstation in a known-good state. Open Control Panel -> Security Center -> Automatic Updates and set the configuration to Notify me but don't automatically download or install them. Apply updates only after they have been reviewed by the maintenance team against the Siemens compatibility matrix.

8.2 Snapshot the share and the account

Before every maintenance window, export the share definition and the AUDUSER account state to a removable drive:

net share backup > D:\backup_share.txt
reg export "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares" D:\shares.reg /y
net user AUDUSER SUNRISE /add /expires:never
net localgroup "Backup Operators" AUDUSER /add

The same script recreates the environment on a fresh XP install in under a minute. Storing it on offline media also insulates the configuration from ransomware or careless re-image.

8.3 Harden SMB without breaking AUDUSER

If the corporate policy mandates SMB signing, leave it enabled - AUDUSER is unaffected because signing is performed after authentication. Do not enable Network security: Do not store LAN Manager hash value on next password change in a way that conflicts with the local SAM; if the AUDUSER hash is wiped, regenerate it by re-setting the password with net user AUDUSER *.

8.4 Service account password rotation

Siemens expects AUDUSER/SUNRISE to remain constant across the entire fleet. Rotating the password on a single XP host causes a fleet-wide alarm 53 the next time any PCU pushes to that target. If your security policy mandates rotation, mirror the new value on every PCU image through the authorized Siemens service process - do not change it on the XP host alone.

8.5 Domain-joined hosts

If the XP workstation is joined to an Active Directory domain, audit policies pushed from the domain controller override local secpol.msc settings. Run gpresult /scope computer /v on the XP host to identify the controlling GPO and add an exception for the AUDUSER account or the backup share. The same considerations apply to the 840evo backup target if it is part of the IT-managed estate.

8.6 Virtual-machine targets

If the XP target is itself a virtual machine on Hyper-V or VMware ESXi, disable any time-sync drift during a Ghost run. A clock skew of more than a few minutes between the PCU and the XP host can be reported by some SMB implementations as a logon failure (NTSTATUS 0xC0000133, STATUS_TIME_DIFFERENCE_AT_DC). Pause or extend the time-synchronization interval for the duration of the backup window.

9. Alternative Backup Paths

If the AUDUSER path cannot be restored quickly, two alternative procedures are documented in the SINUMERIK 840D sl PCU 50 service manual.

The USB method is the most reliable fallback because it removes the Windows host from the loop entirely. Use it to obtain a working backup before troubleshooting the network share, especially before any further Windows Update cycle.

10. Alarm and Error Code Reference

11. Troubleshooting Matrix

12. Frequently Asked Questions