TP1900 HMI Shared Folder Access Failure on Windows 10: SMB v1 Fix

1. Problem Overview

Operator panels from the SIMATIC HMI Comfort line that run a Windows CE based runtime (including 6AV2124-0UC02-0AX0 — TP1900 Comfort) can print reports to a local PDF printer driver and then copy the resulting file to a Windows share on the engineering station. After the Microsoft Fall Creators Update (Windows 10, version 1709), the share is no longer visible from the panel. The panel reports the network path as unreachable, the PDF printer job is queued, but no file appears in the configured destination folder. The behavior is identical whether the share is created on a Windows 10 PC, a NAS that only speaks SMB v1, or a Windows Server that has been hardened to disable SMB1.

The root cause is not a panel configuration error and not a network reachability problem. The transport protocol that the panel uses to talk to a Windows share — SMB v1.0 (CIFS) — is no longer offered by the host operating system. The panel, which only implements the SMB1 dialect, can no longer complete the session negotiation and the share stays invisible.

2. Affected Hardware, Firmware and Software Versions

The behavior is not unique to the TP1900. Every SIMATIC Comfort Panel, every Multi Panel (MP) and every Thin Client that uses a CE or WinAC RTX based runtime is affected when the host PC stops advertising SMB1. Reference documentation is the Siemens manual "Integrating HMI Operator Panels in TCP/IP Networks", section "Access to shared folders", which explicitly lists this limitation on page 35 of the current revision.

3. Root Cause: SMB v1.0 Deactivation in Windows 10 1709

From Windows 10 version 1709 onward, Microsoft disables the SMB v1.0 client and server by default. The exact notice from the Siemens manual is reproduced here for clarity:

"SIMATIC Operator Panels with Windows CE operating system use the 'SMB protocol' for file access to shared folders. As of Windows 10, version 1709, the 'SMB v1.0 protocol' has been deactivated on the PCs by default. This measure prevents Operator Panels that use the 'SMB protocol' from accessing shared folders."

The panel negotiates the dialect on TCP port 445. The host responds with an SMB2 or SMB3 negotiate response. Because the CE stack cannot fall back, the session is dropped. The user typically observes that the configured UNC path (e.g. \\PC-NAME\Reports) is shown as unavailable, not found, or produces a timeout when the print job triggers the file transfer.

4. Symptoms and Error Behavior

Typical symptoms reported from the field, in the order they are observed during commissioning:

1. The PDF Printer Driver V1.5 creates the PDF locally on the panel (e.g. \Storage Card\PDF\Report_yyyymmdd_hhmmss.pdf) and the print preview works.
2. The configured "save location" path, set in the printer driver dialog of the panel to \\PCNAME\SharedReports\, is shown as reachable inside the panel's network browser only when the host still speaks SMB1.
3. After triggering a report, the file does not appear in the Windows share.
4. No explicit error code is raised; the job silently fails because the SMB session cannot be established.
5. Restarting the panel or the SMB service on the host does not resolve the issue.

If you enable the Windows host's SMB server operational logs (event viewer — Applications and Services Logs — Microsoft — Windows — SMBServer), you see event 1003 "SMB1 access denied" entries that correlate with the print trigger time stamp.

5. Solution Path A — Re-enable SMB v1.0 on Windows 10

Use this path when the PC is a dedicated engineering station in a process network, when no other SMB1 client is required, and when the security policy allows the exception.

5.1 Enable the SMB1 protocol via PowerShell

Open an elevated PowerShell on the Windows 10 host and execute:

Reboot the PC. After the reboot, verify:

Expected output: EnableSMB1Protocol = True.

5.2 Enable the SMB1 protocol through Control Panel

1. Open Control Panel → Programs → Turn Windows features on or off.
2. Tick SMB 1.0/CIFS File Sharing Support.
3. Expand the node and ensure SMB 1.0/CIFS Server is checked.
4. Click OK and reboot.

5.3 Confirm the server is now reachable from the panel

On the panel, open Control Panel → Network and Dial-up Connections → LAN → Properties → IP Address. Confirm that the panel is in the same subnet as the PC and that the gateway is correct. Then trigger a test report. The PDF must appear in \\PC-NAME\SharedReports.

6. Solution Path B — Use SIMATIC HMI Option+ Manager

When re-enabling SMB1 is not acceptable, the recommended path is SIMATIC HMI Option+ Manager. Option+ adds a managed file transfer channel between the panel and the engineering PC that does not require SMB1 on the host. The PDF Printer Driver V1.5 is configured to write to the panel's local storage; Option+ then copies the file to the PC using a Siemens-proprietary channel.

6.1 Install the option

1. Download SIMATIC HMI Option+ Manager from the Siemens Support portal entry 109769607. Pick the version that matches the TIA Portal release in use.
2. Install it on the engineering PC.
3. Install the matching Option+ runtime add-on on the panel using ProSave v16 or via TIA Portal transfer.

6.2 Configure the panel side

1. Open the panel's Options menu (Start → Options → HMI Option+ Manager).
2. Add a new transfer task: Source = \Storage Card\PDF\, Target = the local folder on the PC (e.g. C:\SharedReports\).
3. Set the trigger to On file change so each new PDF is copied automatically.

6.3 Configure the PC side

1. Start the Option+ Manager on the PC.
2. Allow the panel through the Windows Firewall inbound rule that Option+ creates automatically (default TCP port 50005).
3. Pair the panel by entering the panel's IP and the transfer key configured on the panel side.

6.4 Verification

Trigger a report on the panel. The PDF appears in C:\SharedReports\ on the PC within a few seconds. The Option+ Manager log shows the transfer as SUCCESS with the file size and CRC.

7. Network and Firewall Configuration

Both solution paths require a flat IP path between the panel and the PC. Verify the following prerequisites regardless of which solution you choose:

If the host is on a Public network profile, Windows blocks inbound SMB and file sharing by default. Switch the profile to Private for the engineering LAN or open TCP 445 explicitly for the panel subnet.

8. Shared Folder Permissions and Path Encoding

Once the protocol mismatch is solved, the second most common reason for a silent failure is permission or path encoding. Apply the following checklist:

1. Create the share with a dedicated local user (e.g. hmireport) and a strong password. Do not rely on the Guest account.
2. Grant hmireport the Change and Read NTFS permissions on the folder, and Modify share permissions.
3. Disable Windows password-protected sharing on the engineering PC if the panel cannot store credentials. Otherwise enable it and configure the panel to log in as hmireport.
4. Use a flat UNC path that does not contain spaces or non-ASCII characters. \\PC-NAME\Reports is preferred over \\PC-NAME\Users\John Doe\My Reports.
5. Avoid DFS shares, mapped drives, and offline files. The CE stack does not understand them.
6. Ensure the system time on the panel and the PC differ by less than 5 minutes; SMB is sensitive to clock skew for Kerberos and NTLMv2 session setup.

9. Verification Procedure

After either solution is applied, perform the following commissioning checks in order:

1. Browse test from the panel: Open the panel's network browser, enter \\PC-IP\Reports, and confirm that the folder list is shown.
2. Read test: Copy a small text file from the share to the panel's \Storage Card\. This confirms bidirectional SMB.
3. Write test: Trigger the PDF Printer Driver V1.5 to print a one-page test report. Verify that the file appears in the share within 10 seconds.
4. Sustained load test: Trigger 10 reports in rapid succession. The driver must not lose any file and must not leave 0-byte orphans on the panel.
5. Reboot test: Power cycle the PC. After Windows comes back, trigger one report. Confirm the transfer still works without manual reconnection.

Record the results in the commissioning report; if any step fails, capture an Event Viewer export from Microsoft\Windows\SMBServer\Operational and the panel's diagnostic buffer.

10. Security Considerations and Hardening

SMB v1.0 is disabled by default for valid security reasons. If you re-enable it for a panel integration, apply compensating controls:

• Place the PC and the panel on a dedicated VLAN with no path to the office or corporate network.
• Block inbound TCP 445 from any host other than the panel's IP using Windows Defender Firewall with Advanced Security.
• Disable SMB1 on every other host in the same VLAN by GPO.
• Subscribe to a vulnerability feed (US-CERT, BSI) and patch the host monthly.
• Document the exception in the plant's cybersecurity inventory, including the planned retirement date of the workaround.

Path B (Option+ Manager) avoids all of the above and is the long-term preferred configuration for new installations.

11. Alternative Approaches

When neither re-enabling SMB1 nor deploying Option+ is acceptable, the following workarounds can serve as a bridge:

12. Troubleshooting Matrix