Configuring SIMATIC BATCH Long-Term Archive Storage Paths: Windows Shares and User Authentication Policies

In SIMATIC BATCH V8.2, configuring automated long-term batch archiving to network storage directories (e.g. \STORAGE_SERVER\ARCHIVES) requires establishing unified Windows service authentication between the BATCH Server and the target file server. Automated archiving fails with access denied errors when the BATCH Server service lacks network logon rights to the remote host. To resolve this, create a dedicated Windows service account on the network domain, assign it Modify permissions on the shared archive folder, register these credentials in Batch Control Center (BCC) under Options -> Settings -> Project Settings -> User Credentials, and re-download the BATCH project.

Regulatory Mandates and Long-Term Archiving in SIMATIC BATCH

In regulated industries (pharmaceuticals, biotechnology, fine chemicals, food and beverage), batch automation records must be retained for extended periods ranging from 5 to 25 years. The ANSI/ISA-88 and FDA 21 CFR Part 11 standards mandate that completed batch electronic records—including setpoint trends, operator intervention logs, recipe steps, and cryptographic audit trails—remain tamper-proof, complete, and immediately retrievable.

SIMATIC BATCH provides automated archiving to offload closed batches from the active runtime database to an external storage server, ensuring system performance while maintaining full compliance.

Network Topologies for Batch Archiving: Local vs Shared Network Drives

When designing storage topologies for SIMATIC BATCH:

Local Drive Storage (D:\Batch_Archive): Simplest topology, eliminating network authentication dependencies. However, storing archives locally on the BATCH Server presents a single point of failure and complicates corporate backup integration.
Network Share Storage (\\FileServer\Batch_Archive): Centralizes batch records onto corporate storage area networks (SAN), network-attached storage (NAS), or dedicated file servers. While architecturally superior, it requires deterministic Windows network security policies.

Authentication Failures: Service Contexts vs Interactive Desktop Sessions

The predominant engineering failure during batch archive configuration is testing network shares using Windows Explorer desktop sessions:

An engineer logs into Windows as a domain administrator and verifies they can read and write files into \\FileServer\Batch_Archive.
However, the SIMATIC BATCH Server service (bfserverx.exe) executes in the background as Windows LOCAL SYSTEM.
When the automated archive task triggers, LOCAL SYSTEM cannot authenticate across the network to a remote Windows share.
The server logs fatal error: SIMATIC BATCH: Directory does not exist or access is denied. Logon failure: unknown user name or bad password.

Configuring the Project Settings User Credentials in Batch Control Center

Siemens engineered a built-in impersonation mechanism to resolve this service boundary:

In Batch Control Center (BCC), open Options -> Settings -> Project Settings.
Open the User Credentials tab.
Define a dedicated domain user account (e.g. DOMAIN\BatchServiceAccount) with its password.
When the BATCH Server service executes archiving, it presents these cached credentials to the remote file server, gaining authorized write access.

Comparative Architecture Matrix: SIMATIC BATCH Storage Targets

The following table compares storage architectures for SIMATIC BATCH long-term archiving:

Storage Target ArchitectureAuthentication RequirementResilience to Station FailureCorporate IT Backup IntegrationRecommended ApplicationLocal BATCH Server DiskLocal Windows user rightsLow (Lost if server disk fails)Requires local agent on BATCH ServerSmall test benches and pilot plantsOperator OS Client ShareComplex (Vulnerable to reboots)Poor (Client PC reboot halts archive)UnmanageableNot RecommendedCorporate File Server / NASBCC User Credentials (Domain user)High (Centralized RAID/SAN storage)Seamless (Standard corporate backup)Standard industrial production plantsSIMATIC Process HistorianBATCH PH Coupling (Integrated)Ultra-High (Database replication)Enterprise backup via SQL VSSLarge regulated pharmaceutical facilities

Step-by-Step Procedure to Set Up a Dedicated Batch Archive Network Share

Follow this sequence to establish reliable network archiving:

Create Active Directory Account: In Active Directory, create service user BatchArchiver. Set Password Never Expires and User Cannot Change Password.
Prepare File Server Folder: On the corporate file server, create folder D:\Shares\SimaticBatchArchives.
Set Share and NTFS Permissions: Share as SimaticBatchArchives. In Share Permissions, grant BatchArchiver Change/Read. In Security (NTFS), grant BatchArchiver Modify/Read/Write.
Configure BCC User Credentials: In Batch Control Center on the Engineering Station, navigate to Options -> Settings -> Project Settings -> User Credentials. Enter DOMAIN\BatchArchiver and password.
Configure Archive Path: In BCC Project Settings -> Archive, select UNC path \\FileServer\SimaticBatchArchives. Click Test Connection.
Set Auto-Archive Policy: Configure automated archiving: select After closing, delay 1 Day.
Compile and Download: In SIMATIC Manager, perform Compile / Download BATCH. Update process cell in BCC.

Verification

Confirm archiving integrity through these checks:

BCC Connection Test: Verify the connection test in BCC Project Settings returns a green checkmark.
Manual Test Batch Archive: Execute a test recipe, close the batch, and click Archive. Verify the *.sbx file appears in the share.
Automatic Lifecycle Verification: Verify closed batches transition to 'Archived' status autonomously upon timer expiry.
Restore Test: In BCC, select an archived batch and click Restore. Confirm the batch re-opens in read-only mode with intact curves.

Limitations and Operational Precautions

Observe the following data integrity precautions:

No Mapped Drive Letters: Never configure archive paths using mapped drive letters (e.g. Z:\Archive); background Windows services do not recognize interactive user drive mappings. Always use absolute UNC paths (\\Server\Share).
Share Immutability: Configure storage file system permissions to prevent accidental manual file deletion by unauthorized plant staff.
Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.