SINUMERIK 840D NCU 710.2 Network Drive No Access Rights Fix

Problem: 840D NCU 710.2 Network Drive Returns "No Access Rights!"

A SINUMERIK 840D sl control with NCU 710.2 is fully wired to the plant network and the HMI softkeys for network drives are visible, but pressing them is blocked. The HMI displays No access rights! immediately, without a connection timeout, and the softkey remains grayed out regardless of the active access level (operator, service, manufacturer). The local logical path /card/user/sinumerik/data is also inaccessible even though it should resolve to the on-board CompactFlash card.

Symptoms observed in the field:

• Network drive softkey in the HMI Program Manager is visible but inactive.
• Selecting the softkey produces the message No access rights! with no network round-trip delay.
• Local link /card/user/sinumerik/data is grayed out as well.
• Editing the connection entry and saving strips the leading slash, so /192.168.254.8/dmu persists as /user/sinumerik/data.
• USB stick insertion activates the USB softkey correctly, confirming the HMI itself is healthy and the EFS partition is mounted.
• ICMP ping and WinSCP between the service PC and the NCU succeed, so L3 connectivity is intact.

Root Cause Analysis

Four independent configuration defects can each produce this exact symptom. They must be ruled out in order, because resolving one often unmasks the next.

The most common field failure is layer 1 — the operator/machine builder never copied the basesys.ini template from the read-only system partition into the writable oem or user partition, so the HMI's network drive subsystem has no policy file and rejects every request.

Hardware and Software Baseline

Confirm the platform before changing any file. The NCU 710.2 belongs to the SINUMERIK 840D sl line and runs the SINUMERIK Operate HMI on a Linux basic system.

Reference: SINUMERIK 840D sl Operator Components Manual (IM9) for NCU variants and X120/X130/X127 port assignments.

Fix 1 — Restore the basesys.ini Configuration File

The basesys.ini file is the policy document that the HMI's network drive subsystem consults before any SMB session. Without it, every share — including local paths — is denied.

Locate the template

The factory template lives on the read-only system partition:

Copy into a writable partition

The HMI consults the file in this precedence order:

1. oem/system/etc/basesys.ini (OEM — machine builder)
2. user/system/etc/basesys.ini (End user / commissioning)
3. addon/system/etc/basesys.ini (Add-ons)
4. siemens/system/etc/basesys.ini (Siemens default, read-only)

Use WinSCP (SCP, port 22) or PuTTY to log in as user manufact with the service password and execute:

If the source template is missing (the symptom is reported when /card/siemens/system/etc/ and /card/oem/ are empty), a minimal baseline file that enables all required logical drives is sufficient. Save the following as basesys.ini:

[System]
Version=01.00.00

[LinuxBase]
; Enable logical drives exposed in the HMI
Enable_LW_Drive=1

[NetworkDrives]
Enable=1
; Disable NTFS-only restrictions
RestrictCifs=0
; Allow cleartext password (legacy NAS)
UseCleartext=1
; Maximum simultaneous connections
MaxConnections=8

[AccessLevels]
Manufacturer=7
Service=4
User=1

Save and reboot

After copying the file, perform an NCU restart so the HMI re-reads the configuration tree:

1. Set the access level to Manufacturer (password protected).
2. Commissioning → Restart → NCK Reset (or full power cycle).
3. Wait for the HMI to come up; log in again.

Fix 2 — Correct the SMB Path Syntax

The HMI Edit Logical Drive dialog strips the host component of a UNC path unless two leading slashes are present. The Linux SMB client (mount.cifs) follows the same convention as Windows: //server/share with two slashes.

Procedure:

1. Operator menu → Setup → Network Drive Configuration.
2. Highlight the entry with /192.168.254.8/dmu.
3. Edit and replace the path string with //192.168.254.8/dmu.
4. Confirm with the OK softkey. The summary line should now read //192.168.254.8/dmu, not /user/sinumerik/data.

If the dialog still rewrites the path, the basesys.ini from Fix 1 is missing or unreadable — re-apply Fix 1 first.

Fix 3 — Configure the Network Stack Properly

Static addressing on the NCU is strongly preferred over DHCP for production equipment; the DHCP lease can fail mid-cycle and the SMB session does not re-establish without a remount.

Static addressing via basesys.ini

[LinuxBase]
IP=192.168.254.100
NetMask=255.255.255.0
Gateway=192.168.254.1
DNS1=192.168.254.1
DNS2=
HostName=NCU710

If DHCP must be retained

1. Reserve the NCU's MAC in the DHCP scope (X120 service port or X130 plant port).
2. Force DHCP option 3 (Router) and option 6 (DNS) from the DHCP server.
3. Verify on a service PC connected to the same VLAN that ping 192.168.254.1 succeeds before touching the NCU.

The reported environment used 192.168.254.x addressing; the DHCP server was returning addresses but the gateway was left at 0.0.0.0 in the NCU because option 3 was not configured. Without a default route, outbound SMB to a host on a different subnet (or to a NAS on the same subnet reached through a routed VLAN) silently fails.

Fix 4 — Domain / Workgroup Alignment

Modern Windows file servers reject NT1 sessions without a matching machine account. The basesys.ini must declare the workgroup or AD domain explicitly.

[NetworkDrives]
Domain=MYDOM
Workgroup=WORKGROUP
UseKerberos=0
SmbVersion=2

Confirm with the IT department whether the server is in a domain. If the server is domain-joined but the NCU is not, the user dmu must be specified as MYDOM\dmu in the HMI's User field.

Fix 5 — Access Level and Softkey Enable

The softkey visibility in the Program Manager depends on the active protection level. Each logical drive has its own access-level ceiling.

The reported symptom states "It doesn't matter what access level is set" — this is the strongest evidence that the rejection is coming from the network subsystem (Fixes 1–4), not from the HMI's user-level guard. If Fixes 1–4 are applied and the softkey is still grayed out, raise the level to Manufacturer and verify the softkey does not appear under Setup → Network as well — if it does not appear at all, the SINUMERIK Operate option bit Enable network drives is off in the machine data.

Check:

MD9105 $MM_ENABLE_LADDER_DB_ADDR  ; not relevant — example only
MD19710 $MM_LADDER_DB_NAME            ; not relevant — example only
MD9108  $MM_HMI_ENABLE_NETWORK_DRIVE   ; legacy

Reference: SINUMERIK Operate Commissioning Manual — Network Drive Setup for the exact machine data on the active software version.

Verification Procedure

After applying the fixes, run the following checks in order. Stop at the first failure and re-apply the matching fix.

1. File exists: From the service PC via WinSCP, confirm /card/user/system/etc/basesys.ini is present and non-zero in size.
2. Permissions: File mode must be 0644, owner root. From the NCU shell: ls -l /card/user/system/etc/basesys.ini.
3. NCU restart: Power-cycle or NCK reset and wait for full HMI reload (~90 s on NCU 710.2).
4. Logical drive visible: Open Program Manager — the configured drive should now appear with a drive icon, not gray.
5. Ping the server: From the NCU shell: ping -c 3 192.168.254.8. Must return < 1 ms.
6. Manual mount test: mount -t cifs //192.168.254.8/dmu /mnt/test -o username=dmu,password=••••,vers=2.0. Must complete without NT_STATUS_LOGON_FAILURE.
7. File copy: cp /card/siemens/system/etc/template-basesys.ini /mnt/test/ && ls -l /mnt/test/template-basesys.ini.
8. HMI round-trip: From the HMI, open the network drive, copy a 1 KB test program, select it, and execute NC Start in a safe (empty) channel.

Troubleshooting Matrix

Working basesys.ini Template for Network Drives

The following file enables the network drive subsystem and pre-declares the share used in the case. It can be dropped in directly via WinSCP after adapting the credentials.

; basesys.ini — SINUMERIK 840D sl / NCU 710.2
; Copy to /card/user/system/etc/basesys.ini
; Owner: root, mode 0644

[System]
Version=01.00.00

[LinuxBase]
IP=192.168.254.100
NetMask=255.255.255.0
Gateway=192.168.254.1
DNS1=192.168.254.1
HostName=NCU710
Enable_LW_Drive=1

[NetworkDrives]
Enable=1
RestrictCifs=0
UseCleartext=1
SmbVersion=2
MaxConnections=8

[Drive1]
Server=192.168.254.8
Share=dmu
User=dmu
Password=MySecret123
MountPoint=/user/sinumerik/data
Workgroup=WORKGROUP

[AccessLevels]
Manufacturer=7
Service=4
User=1

The [Drive1] block pre-populates the network drive dialog so the operator does not have to type the //server/share string by hand.

Log and Diagnostic File Locations

Pull the relevant logs after a failed attempt; grep -i cifs /var/log/messages is the single most useful command.

Safety and Operational Notes

• The Manufacturer password must be changed from the Siemens default before commissioning — defaults are public knowledge.
• Cleartext SMB passwords in basesys.ini are stored on the CF card. Anyone with physical access to the NCU can read them. Use a dedicated low-privilege service account, not an administrator account.
• Do not mount the program source directory in read-write mode on more than one NCU simultaneously. G-code file locks are not enforced; concurrent writes corrupt files.
• A network drive failure during program execution must not crash the NCU. The HMI is designed to fall back to the local CF card path if the SMB share disappears; verify this fallback with a cable-disconnect test.

When the Issue Persists

If the softkey is still grayed out after all five fixes, escalate to a Siemens regional support request via the official support portal. Provide:

• NCU article number (six-digit, e.g. 6FC5371-0AA30-0AA0)
• Software version (HMI startup screen — bottom-right)
• Contents of basesys.ini
• Last 100 lines of hmi.log and /var/log/messages
• Screenshot of the network drive edit dialog

Open a ticket at Siemens Industry Online Support with the SINUMERIK 840D sl product tree selected.