Siemens WinCC Smart Client Resolving Sm@rtServer Password

Problem Overview: Smart Client Connection Rejected at Password Prompt

When commissioning a Siemens HMI Comfort Panel with the Sm@rtServer option enabled, a common failure mode is a successful TCP/IP handshake between the Smart Client viewer and the panel, followed by an immediate rejection at the password dialog. The user enters what they believe to be the correct password based on the TIA Portal project configuration, and the Sm@rtClient viewer reports an authentication failure, terminates the session, or returns a generic "connection refused" or "invalid password" state without a clear cause.

This symptom is misleading because the project-side configuration appears correct: a password has been entered, the project has been compiled, downloaded to the panel, and the Sm@rtServer is shown as running in the panel's diagnostics. The root cause is that the Sm@rtServer password is not actually a TIA Portal project parameter that can be set inside the project tree; it is a runtime-only setting that must be applied directly on the target device, either through the Control Panel on the panel itself or by writing it to the panel's runtime configuration files.

Engineers who migrate from legacy WinCC flexible panels frequently encounter this problem because older panels shipped with a hard-coded default password of 100 for the Sm@rtServer. That default is no longer honored on Unified Comfort Panels or on newer TP/KTP Comfort Panels running current firmware. On those devices, an unset Sm@rtServer password means the Sm@rtServer is effectively disabled or rejects every connection attempt, even though the service reports as running.

Affected Products and Firmware

The following Siemens HMI families use the WinCC Internet Settings control panel applet described in this article. Always verify the exact catalog number and firmware version against the device label or the panel's System Information screen before applying any configuration change.

For panels running firmware prior to V14 SP1, refer to the legacy WinCC flexible documentation because the applet path and the password storage location differ. The behavior described in this article applies to all Unified Comfort Panels and to Comfort Panels from firmware V14 SP1 onward.

Root Cause: Runtime-Only Password Storage

Unlike most user credentials in a TIA Portal project, the Sm@rtServer password is not stored in the project file (.ap16/.ap17/.ap18/.ap19) and is not transferred during a project download. The password resides in the runtime registry and configuration files of the HMI device itself. The TIA Portal SMTP and device-settings dialogs referenced in the original report are unrelated to Sm@rtServer access control; SMTP is a separate concern used for e-mail notification jobs and does not gate remote-display connections.

This design choice has two consequences:

1. Setting a Sm@rtServer password inside the TIA Portal project has no effect on the running panel, even after a successful download and restart. The Runtime continues to use the password last written to the device configuration.
2. A factory-reset or a full image restore reverts the password to its firmware-defined default state. On modern Comfort Panels, that default state is "no password set," which causes the Sm@rtServer to reject all client connections.

The legacy default password of 100 documented for WinCC flexible is not carried forward. New Comfort Panels ship with an empty Sm@rtServer password field, and the operator is required to set one before the first remote session is established.

Where the Password is Configured: WinCC Internet Settings Applet

The Sm@rtServer password is configured in the WinCC Internet Settings applet, which is accessible from the Windows CE / Windows Embedded Compact Control Panel on the HMI device. The path is identical for every Comfort Panel family listed above.

On the panel:

1. Open the Control Panel. On a touch panel, this is reached via the Start menu or the system taskbar; on a keyed panel, use the Control key.
2. Double-tap WinCC Internet Settings. This launches a Siemens-branded applet that is distinct from the standard Internet Options dialog.
3. Switch to the Remote tab.
4. Under Sm@rtServer Settings, enter the desired password in the Password field and confirm it in the Confirm Password field.
5. Click OK or Apply to write the setting to the device. A confirmation dialog indicates the password has been saved.
6. Restart the WinCC Runtime, or restart the panel, to ensure the new password is loaded by the Sm@rtServer service.

Engineers often look for the password field in the wrong place. The three most common mistaken locations are:

• Device Settings → SMTP in the TIA Portal project tree — this is the e-mail gateway, not the Sm@rtServer.
• Runtime Settings → Services → Sm@rtServer in the TIA Portal project tree — this only enables the service and configures the TCP port; it does not set a password.
• Control Panel → Internet Options on the panel — this is the standard Windows CE Internet Options, not the WinCC Internet Settings applet.

Prerequisites for Password Configuration

Before you change the Sm@rtServer password on the target panel, confirm the following:

If the Sm@rtServer option is not licensed, the Sm@rtServer entry will not appear in the WinCC Internet Settings applet, and the password cannot be configured. In that case, transfer the Sm@rtServer license to the panel using Automation License Manager or the License Manager USB transfer utility before proceeding.

Step-by-Step: Setting the Sm@rtServer Password on the Panel

The following procedure resolves the exact symptom described in the original report — a Smart Client connection that is established at the TCP layer but rejected at the password prompt. The procedure must be executed on the panel itself; it cannot be performed remotely through the Sm@rtClient because the very service you are trying to repair is the one refusing the connection.

1. Log in to the panel with a user that has access to the Control Panel. If user administration is active in the project, only members of the configured "Administrator" group (or the group mapped to the Control Panel access right) can reach the applet.
2. Open Control Panel → WinCC Internet Settings. The applet icon is distinct; do not use the standard Internet Options icon.
3. Select the Remote tab. The Sm@rtServer Settings section is at the top of this tab.
4. Type the new password. Use a strong, memorable password. The maximum length is 24 characters; the allowed character set is ASCII alphanumeric plus the standard punctuation set. The password is case-sensitive.
5. Confirm the password. The second entry field is the verification field. If the two entries do not match, the applet refuses to save.
6. Save and exit. Click OK. The applet writes the password to \Flash\Simatic.S7-1500\...\HmiRtm.cfg and to the corresponding registry hive. The save is immediate; no project recompile is required.
7. Restart the Runtime. Use the panel's Start → Restart Runtime action, or perform a full reboot via the panel service. A Runtime restart is required because the Sm@rtServer thread reads the password only at service start.
8. Verify on the same panel that the Sm@rtServer is now listening. Open the diagnostics view (Start → System → Sm@rtServer) and confirm the service status is Running and the configured port matches the TIA Portal project setting (default 5900, changeable in the project).

Step-by-Step: Setting the Sm@rtServer Password Through the Project (Supplemental)

Some engineering workflows prefer to pre-stage the password in the project so that a panel image-restore is automatically followed by the correct password. This requires a manual edit because the TIA Portal UI does not expose the password field directly. The supported method is the WinCC configuration file edit on the engineering station, then a full project compile and download.

1. Open the TIA Portal project, navigate to the HMI device, and ensure Runtime Settings → Services → Sm@rtServer → Enable Sm@rtServer is checked.
2. Compile the HMI project to generate the runtime files.
3. Locate the generated HmiRtm.cfg in the project's IM folder.
4. Edit the Sm@rtServer section to set Password=<value> under the [Sm@rtServer] header. Save the file.
5. Recompile the project and download to the panel.

Verification Procedure

After setting the password, verify the change end-to-end from a PC running Sm@rtClient.

1. On the PC, launch Start → Siemens Automation → Sm@rtClient.
2. In the connection dialog, enter the panel's IP address or DNS name. Use the format <ip>:<port> if the port is not the default 5900.
3. Click Connect. The Sm@rtClient performs a VNC-style handshake with the Sm@rtServer.
4. At the password prompt, enter the new password. The Sm@rtClient should display the panel's runtime screen within 2 to 5 seconds.
5. If authentication fails, the Sm@rtClient returns to the connection dialog with a red status indicator. Do not retry more than three times in rapid succession; some firmware versions impose a lockout after repeated failed attempts.
6. For a non-interactive verification, use the Sm@rtClient command-line interface (where available) or a TCP test to confirm the service responds with a banner on port 5900. The presence of the banner confirms the service is running; it does not confirm the password is correct.

Troubleshooting Matrix: Smart Client Password Failures

Password Recovery and Reset Procedure

If the Sm@rtServer password has been lost and the panel is physically accessible, the recovery is straightforward because the password is a runtime setting, not a project-level credential.

1. On the panel, open Control Panel → WinCC Internet Settings → Remote tab.
2. Type a new password, confirm it, and save.
3. Restart the Runtime to force the Sm@rtServer to reload the new password.
4. Test the connection from the Sm@rtClient.

If the panel is not physically accessible, password recovery requires either a remote maintenance session (such as a separate Webserver session if one is enabled, or an SSH/remote-shell service) or a service call to the site. There is no backdoor, master password, or factory-reset shortcut that bypasses the Sm@rtServer authentication on Comfort Panels. A full image restore reverts the password to the empty state, which still requires the engineer to set a new password before the next Sm@rtClient connection will succeed.

Differences Between WinCC flexible and Comfort/Unified Panels

Engineers who have used WinCC flexible panels (MP277, MP377, TP177, OP277, and similar) carry assumptions that no longer apply to current hardware. The table below summarizes the deltas that matter for Sm@rtServer password handling.

The default password 100 was never documented as a security feature; it was a convenience default that allowed demonstration units to be commissioned without first stopping at the Control Panel. Removing the default on Comfort Panels is a deliberate hardening change, not an oversight. Sites that still rely on the default must update their commissioning procedures.

Security Considerations

The Sm@rtServer protocol is fundamentally a VNC derivative. On legacy panels, traffic is unencrypted and the password is the only barrier to remote takeover of the HMI. On modern Comfort Panels and Unified Panels, encryption can be enabled; the password is then used for authentication only and the session is wrapped in TLS.

• Always change the default password. An empty password is functionally equivalent to no authentication.
• Restrict the Sm@rtServer to LAN-only operation unless a VPN is in place. Direct exposure of TCP 5900 to the public internet is unsafe.
• Use the TIA Portal authorization levels (View, Operate, Admin) to limit what a remote operator can do even if the password is shared.
• Audit Sm@rtServer connections in the panel's diagnostic logs. The Service log records connection attempts, source IPs, and authentication outcomes.
• Rotate the password on personnel changes by following the runtime-only reset procedure described above. There is no need to recompile the project to change the password.

Configuration Reference: Sm@rtServer Settings in WinCC Internet Settings

The following table documents every relevant control in the Remote tab of the WinCC Internet Settings applet. The exact wording matches the TIA Portal V17 and V18 builds; older firmware uses synonymous labels.

Related Controls on the Webserver Tab

The Tag tab in the same WinCC Internet Settings applet controls the Webserver (HTML-based panel access). It is not used for Sm@rtServer. The relevant controls are listed for completeness because engineers frequently confuse the two:

Configuring the Webserver does not unlock the Sm@rtServer. The two services have independent authentication databases and independent enable flags.

Diagnostic and Logging Paths

If authentication continues to fail after following this article, capture the following diagnostic information before contacting Siemens technical support:

1. Panel-side log: \Flash\Logfiles\SmartServer.log on the panel. The log records connection attempts, source IPs, and authentication outcomes.
2. Sm@rtServer status screen: Control Panel → System → Sm@rtServer. This shows the running state, the active port, and the current password hash length (used to confirm a password is set without revealing the value).
3. PC-side Sm@rtClient log: %TEMP%\Siemens\SmartClient\trace.log on the engineering station. This records the VNC handshake and the password verification exchange.
4. Network capture: A Wireshark capture of the TCP 5900 exchange between the Sm@rtClient PC and the panel, with the password field filtered, is the definitive evidence of an authentication mismatch.

Frequently Asked Questions