SINUMERIK 808D Network Drive Lost: Enable SMB1 in Windows 10

1. Problem Description

The SINUMERIK 808D ADVANCED Turning HMI reports "The network drive connection is lost. Please check your network connection!" when an operator attempts to map or browse a shared folder on a Windows 10 PC from Setup → Network → Network Drive on the operator panel. The error is returned immediately after the operator submits a UNC path (e.g. \\192.168.214.10\MPF), a username, and a password — even when:

• The Windows PC responds to ICMP ping from the 808D (and vice versa).
• The shared folder is reachable from other Windows machines on the same LAN.
• The supplied credentials are valid and the share has both NTFS and share-level permission for that account.
• The Ethernet adapter in Windows shows only "Unidentified network" — a benign Windows behavior on point-to-point links without a DHCP server or default gateway.

2. Affected Systems and Versions

3. Root Cause: SMB1 Disabled by Default in Modern Windows

Microsoft disabled the Server Message Block 1.0 / Common Internet File System (SMB1) client and server in Windows 10 starting with version 1709 (October 2017), in response to publicly weaponized exploits including EternalBlue (MS17-010), WannaCry, NotPetya, and Adylkuzz. The protocol is still shipped as an optional Windows feature but is toggled OFF in the default install image and in many enterprise lockdown baselines.

The 808D ADVANCED HMI is built on an embedded Linux platform bundled with an older Samba client. When the operator mounts a network drive, the HMI initiates an SMB negotiate offering only the NT1 dialect. If the Windows 10 peer advertises only SMB2/SMB3 dialects in its response, the 808D cannot complete session setup — TCP three-way handshake completes, but the application-layer conversation aborts. The HMI's status message reports this as a "lost connection" because the SMB session itself never finished negotiating.

Windows 7 PCs default-enable SMB1, which is why direct, reliable mapping works from a Win7 host but fails from any Win10 build since 1709. This is the documented behavior Microsoft describes in its SMB1 removal lifecycle notice (see SMB1 deprecation lifecycle).

4. Prerequisites

• Local Administrator rights on the Windows 10 PC, or ability to run elevated PowerShell / DISM.
• Network cable connecting the 808D Ethernet port (X60 on Turning, X61 on Milling) directly to the PC's RJ-45, or via an unmanaged/managed switch.
• Both devices on the same IPv4 subnet. 808D default: 192.168.214.1, subnet mask 255.255.255.0. Recommended PC: 192.168.214.10 static.
• A Windows user account on the PC with a non-empty password — SMB1 / LanManager refuses empty-password client logons.
• The folder shared with at least Read permission (and Modify if NC program write-back is needed) for the supplied account.
• Windows Firewall profile set to Private or Domain — Public profile blocks inbound SMB by default.

5. Primary Fix: Enable SMB1 via Windows Features

1. Open Control Panel (Win+R → control).
2. Navigate to Programs → Programs and Features.
3. In the left pane click Turn Windows features on or off.
4. In the Windows Features dialog, expand SMB 1.0/CIFS File Sharing Support.
5. Tick the checkbox(es):
   • SMB 1.0/CIFS Client — required so the 808D can mount a Windows share.
   • SMB 1.0/CIFS Server — required if the 808D's own HMI share (used by some service tools) must also be reachable from the PC.
6. Click OK and allow Windows to apply the change. A reboot is mandatory; mounting attempts before the reboot will continue to fail.
7. After reboot, verify the listener state from an elevated PowerShell:

   Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RestrictReceivingNtmlSessionSecurity
   # Expect: EnableSMB1Protocol = True

6. Alternative: PowerShell One-Liner

For scripted deployment across multiple engineering stations, batch files, or MDT/SCCM task sequences:

# Requires elevated PowerShell
Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol-Client" -NoRestart
Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol-Server" -NoRestart
Restart-Computer -Force

Equivalent DISM invocation, useful for offline image servicing or WinPE:

DISM /Online /Enable-Feature /FeatureName:SMB1Protocol-Client /All /NoRestart
DISM /Online /Enable-Feature /FeatureName:SMB1Protocol-Server /All /NoRestart

Confirm afterward:

Get-WindowsOptionalFeature -Online | Where-Object {$_.FeatureName -match "SMB1"} | Select FeatureName, State

7. Alternative: Group Policy (Local or Domain)

For persistent enterprise deployment, or to permit guest-style access when the 808D HMI account does not strictly emit NTLMv2 responses:

1. Open gpedit.msc (Local Group Policy Editor) or the equivalent GPO in Active Directory Group Policy Management.
2. Navigate to Computer Configuration → Administrative Templates → Network → Lanman Workstation.
3. Enable "Enable insecure guest logons". This permits the 808D HMI to authenticate against a share whose account has minimal LM/NTLMv1 response semantics.
4. Navigate to Computer Configuration → Administrative Templates → Network → Lanman Server.
5. Enable "Enable SMB1 Protocol" on the server side.
6. Force-refresh policy: gpupdate /force, then reboot.

Equivalent registry-only toggle for locked-down images where GPO is unavailable:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
  -Name "SMB1" -Type DWord -Value 1
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" `
  -Name "AllowInsecureGuestAuth" -Type DWord -Value 1

8. Verification Procedure

1. From the Windows 10 PC, open File Explorer and enter \\192.168.214.1. The 808D's HMI share should appear (typically named share, user, or the part-program directory).
2. From the 808D HMI: Setup → Network → Network Drive. Configure:
   • Computer: 192.168.214.10 (or the PC's hostname)
   • Path: MPF (or your shared folder name)
   • User: Windows account name
   • Password: account password
   • Domain: leave blank for local accounts
3. Press Mount. A successful mount lists the share contents; failure returns to the same error message.
4. Write a 1 KB test file from the 808D into the mounted share; read it back from Windows to confirm bi-directional transfer.
5. On the Windows host, while the 808D is connected, run Get-SmbSession. The 808D's IP must appear with Dialect: 1.00 and the share name in the Path column.
6. For TCP-layer confirmation independently of SMB: Test-NetConnection -ComputerName 192.168.214.1 -Port 445 → TcpTestSucceeded : True.

9. Network Configuration Reference

10. Alternative File Transfer Methods

If SMB1 cannot be enabled for security or compliance reasons, the 808D supports several alternate channels for NC program and tooling-data transfer:

11. Security Considerations

Enabling SMB1 reintroduces vulnerabilities that Microsoft has deprecated since 2017. The risk profile depends entirely on network exposure — on an isolated engineering cell, residual risk is manageable; on a corporate network, it is not.

Recommended hardening checklist when SMB1 must remain enabled:

1. Configure Windows Firewall with Advanced Security: inbound rule for 445/TCP scoped to the 808D PPU IP and the engineering PC IP only. Reject all other sources.
2. Place both devices on a dedicated VLAN with no route to the corporate LAN or internet.
3. Use a low-privilege local account on the PC (for example cncuser) with a strong 12+ character password; remove it from the local Administrators group.
4. Apply the principle of least privilege: NTFS ACL on the share folder = cncuser: Modify; share permission = cncuser: Read/Write.
5. Audit share access weekly from PowerShell: Get-SmbSession | Where-Object {$_.ClientComputerName -match 'SINUMERIK'} | Select ClientComputerName, ClientUserName, Dialect, SecondsConnected.
6. Subscribe to Siemens Industry Online Support security advisories for firmware updates that add SMB2/3 support on the 808D ADVANCED PPU.

12. Troubleshooting Matrix

13. Reference: 808D Network Menu Map

Setup
└── Network
    ├── TCP/IP
    │   ├── DHCP            [OFF]            (default OFF)
    │   ├── Address         192.168.214.1    (default)
    │   ├── Subnet Mask     255.255.255.0    (default)
    │   └── Gateway         0.0.0.0          (default — direct link)
    ├── Computer Name      SINUMERIK         (default, configurable)
    ├── Network Drive
    │   ├── Computer        192.168.214.10   (engineering PC)
    │   ├── Path            MPF              (shared folder name)
    │   ├── User            cncuser          (low-privilege account)
    │   ├── Password        ********
    │   └── Mount           [Execute]
    ├── FTP (optional)
    │   ├── Server Active   [ON]
    │   ├── User            cncuser
    │   └── Password        ********
    └── HMI Access          [Activate]

HMI sl Menu (alt path)
└── Setup
    └── Network Drive
        └── (same fields as above)

FAQ