Siemens TP700 Comfort CSV Export to PC: Fix SMB1 Network Errors

1. Problem Summary

When configuring a Siemens SIMATIC TP700 Comfort panel (6AV2 124-1JC01-0AX0) to save runtime CSV archives (Data logging, Alarm logging, Audit logging) onto a Windows 10 PC share, the panel reports "path not found", "network drive unavailable", or simply writes nothing to the target folder. Ping from the PC to the HMI succeeds, the project is loaded, the connection in TIA Portal is "Online", yet the runtime store fails silently when the configured UNC path is used.

This symptom is a well-documented incompatibility between WinCC Comfort/Advanced V15.x and V16.x runtime on Comfort Panels and Windows 10 build 1709 onward, where the Server Message Block (SMB) protocol version used by the panel is disabled by default on the PC side.

2. Affected Hardware and Software

3. Root Cause Analysis

The Comfort Panel mounts a Windows shared folder using the SMB v1.0 protocol (CIFS) at runtime. Since Windows 10 Fall Creators Update (build 1709, release 2017-10-17) Microsoft disabled the SMB1 client and server by default for security reasons (WannaCry / NotPetya hardening).

If only EnableSMB1Protocol is toggled in Windows Features on the PC, the feature is installed but the client/server service still refuses inbound/outbound SMB1 negotiations unless the launch conditions of the lanmanworkstation and lanmanserver drivers are explicitly told to depend on the SMB1 driver:

• mrxsmb10.sys
• mrxsmb20.sys
• lanmanworkstation service start type = Automatic

Furthermore, Microsoft deprecated SMB1 entirely in Windows 11 24H2. Re-enabling SMB1 is therefore not a recommended long-term solution; it should be treated as a stop-gap or used only on isolated networks.

Underlying panel behaviour:

1. Runtime mounts \\<PC>\<share> with SMB1 dialect NT LM 0.12.
2. If the PC responds with NT LM 0.12 disabled (Windows 10 default), the panel receives STATUS_INVALID_PARAMETER (0xC000000D) for the negotiate request.
3. The mounted drive is silently discarded. WinCC does not throw a hard alarm; subsequent store operations simply write to internal flash.

4. Pre-Diagnostics Checklist

Run the following commands on the Windows PC (cmd as Administrator) before changing any project setting:

1. Confirm the HMI is reachable

   ping 192.168.0.10 <- HMI IP address, replace with your value

2. Check whether SMB1 client/server is active

   sc query lanmanworkstation sc query lanmanserver

   Look for STATE : RUNNING and confirm the binary path references mrxsmb10.sys.

3. Probe the SMB dialect manually

   powershell -Command "Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol"

   Expect EnableSMB1Protocol: False by default.

4. Test UNC access from the PC

   net use * \\192.168.0.10\<share> /user:<user>

   If this fails on the PC, the panel cannot succeed either.

5. Check the panel's runtime store path on the unit

   Start > Settings > Network and Dial-up Connections > PN/IE_1 > Properties

   Verify IP, Subnet, and that the IP is on the same subnet as the PC.

6. Capture a WinCC trace

   On the panel: Start > Control Panel > Service Mode. In wincccomfort.ini on the PC export the trace and grep for STATUS_BAD_NETWORK_NAME (0xC00000CC) or STATUS_INVALID_PARAMETER (0xC000000D).

5. Solution A — Re-enable SMB1 on Windows (Stop-gap)

Step 1 — Enable via Windows Features (GUI)

1. Open control appwiz.cpl.
2. Click Turn Windows features on or off.
3. Tick SMB 1.0/CIFS File Sharing Support.
4. Reboot.

Step 2 — Force SMB1 client via registry (Windows 10 1903+)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation]
"DependOnService"=hex(7):6d,00,72,00,78,00,73,00,6d,00,62,00,31,00,30,00,00,00,\
  6d,00,72,00,78,00,73,00,6d,00,62,00,32,00,30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Parameters]
"EnableSecuritySignature"=dword:00000000
"RequireSecuritySignature"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation]
"AllowInsecureGuestAuth"=dword:00000001

Save as smb1_on.reg and execute. Reboot again.

Step 3 — Allow guest / clear-text access for the panel user

1. Create a local Windows user panelsvc with a strong password.
2. Share the folder D:\CSV_Archive with Everyone: Read/Write (or restrict to panelsvc only).
3. In the TIA Portal project tree go to Runtime settings > Logging > Storage location:

Step 4 — Disable SMB1 again once the production data path is migrated.

6. Solution B — SIMATIC Option+ Manager (Recommended)

SIMATIC Option+ Manager is the recommended path for transferring CSV log files from Comfort Panels to a NAS or Windows share without SMB1. Option+ runs as a Windows service on the PC/NAS, accepts HTTP(S) push requests from the panel, and writes the file locally using the full SMB2/3 stack.

Architecture

Installation on the central PC

1. Download Option+ Manager from Siemens Support entry 109746111.
2. Install on the Windows PC that will host the archive share.
3. Start Option+ Manager Configurator, create a new destination folder, set TCP port 8443, and generate the panel certificate.
4. Export the CA bundle (PEM) and import it on the Comfort Panel: Start > Settings > Security > Certificates.

Panel side configuration

1. Open TIA Portal project, select the Comfort Panel, Runtime settings > Logging.
2. Change Save target from Network drive (UNC) to Option+ destination.
3. Enter PC hostname or IP, port 8443, target folder name.
4. Compile and download the project.

7. Solution C — WinCC Archiving Server / NAS

For plant-wide central archiving on a SQL back-end, deploy the WinCC Archiving Server (TIA Option). The Comfort Panel pushes segments via the WinCC channel; the server stores them into a SQL database and exports CSV on schedule. This removes SMB1 dependency completely and is the official path for regulated plants.

8. Solution D — Script-based CSV export via FTP / HTTP

For panel firmware that exposes the VBScript / C-script runtime (WinCC Comfort V16+), a scheduled function can copy the local archive file to an FTP server using the System.IO.File.Copy + WinHttpRequest objects. This is useful when the plant already runs an FTP collector service.

' WinCC Comfort VBScript - export daily CSV via HTTP POST
Sub ExportCsvToFtp()
  Dim src, dest, fso, file
  Set fso = CreateObject("Scripting.FileSystemObject")
  src = "\Storage Card SD\Logs\DataLog_" & Year(Now) & "_" & _
        Right("0" & Month(Now), 2) & "_" & Right("0" & Day(Now), 2) & ".csv"
  If Not fso.FileExists(src) Then Exit Sub
  Dim http : Set http = CreateObject("WinHttp.WinHttpRequest.5.1")
  http.Open "POST", "https://192.168.0.50:8443/upload", False
  http.SetRequestHeader "Content-Type", "text/csv"
  http.Send fso.OpenTextFile(src, 1).ReadAll()
  SmartTags("LastExportStatus") = http.Status
End Sub

Trigger from a scheduler (Runtime settings > Scheduler) every 5 minutes or at end-of-shift.

9. TIA Portal Network Drive Configuration Reference

10. Firewall and Windows Service Hardening

Even after SMB1 is enabled, the Windows Defender Firewall or a corporate GPO can block the inbound connection. Validate with:

netsh advfirewall firewall add rule name="Allow SMB1 from HMI" \
   dir=in action=allow protocol=TCP localport=445 \
   remoteip=192.168.0.10,192.168.0.11,192.168.0.12

And on the panel side confirm that Start > Settings > Security > Edge > Remote access permits the PC IP to reach TCP/445.

Group Policy caveat: domain-joined PCs under a GPO Computer Configuration > Administrative Templates > Network > Lanman Workstation > "Enable insecure guest logons" = Disabled will silently refuse SMB1 even if SMB1 is installed. Either move the PC out of that OU or relax that GPO only on the archive target.

11. Verification Procedure

1. On the panel, start the runtime and force a logging cycle (e.g. trigger a tag change).
2. After the configured save interval (default 30 s) inspect the share from the PC:

dir \\\PCNAME\CSV_Archive /S

Confirm a file named DataLog_<timestamp>.csv exists and that the byte size is > 0.

3. Open the CSV and check the header line. Typical header from WinCC Comfort:

"Date";"Time";"Var_Temperature";"Var_Pressure";"Status"

4. On the panel open Control Panel > System > Storage > Logs; the file size must have grown only by the latest segment, not the entire history (no copy storm).
5. Reboot the PC. Re-validate the share is reachable within 60 s of the panel booting.
6. Disable SMB1 again in a separate test cycle and confirm whether Option+ or Archiving Server keep working. If yes, you can keep SMB1 permanently off and decommission the legacy UNC share.

12. Field Notes and Common Pitfalls

• Username case sensitivity. Windows share accepts DOMAIN\user or user@domain; Comfort Panel credentials only accept the plain user form when the share is local. For a domain user, prefix WORKGROUP\ or use the full UPN [email protected].
• Passwords with special characters (!, @, #) are entered as literal in TIA Portal; escape \ in the UNC path with double backslash \\.
• CPU load during copy. A full SD-card log dump over SMB1 to a slow NAS can stall the HMI for 5-15 s. Plan a dedicated maintenance window or move to Option+ for incremental push.
• Audit trail size. Audit logging on Comfort Panels can exceed 100 MB/day. Always allocate a network share with NTFS compression disabled to avoid CPU spike during the write.
• Firmware compatibility. WinCC Comfort V17 added native SFTP support; if you upgrade the panel image, prefer SFTP over SMB1 entirely.
• Hostname vs IP. The panel resolves NetBIOS names only when a WINS server is configured. In isolated networks, hard-code the IP in the UNC path: \\192.168.0.50\CSV_Archive.

13. Troubleshooting Matrix

FAQ