Operational Impact and Security Guidance on Disabling Windows SMB File Sharing (Port 445) in PCS 7

Disabling Windows Server Message Block (SMB / TCP port 445) or turning off the 'Server' and 'File and Printer Sharing' services in SIMATIC PCS 7 severely disrupts core distributed operations. In PCS 7, SMB file sharing is essential for: remote OS downloading from the Engineering Station (ES), OS Client runtime operation (loading picture files, scripts, and server data packages from OS Servers), SIMATIC BATCH recipe and batch data synchronization, Process Historian archive transfers, and multi-user engineering. Disabling SMB will prevent OS downloads, paralyze OS Clients, and halt server synchronization. Instead of disabling SMB on control networks, harden the system by disabling obsolete SMBv1, enforcing SMBv2/SMBv3, and blocking port 445 exclusively at IT/OT perimeter firewalls.

Executive Summary

In response to high-profile network exploits (such as WannaCry, EternalBlue, and ransomware spreading via legacy SMBv1 vulnerabilities), plant IT departments frequently issue security mandates to disable Windows File Sharing (SMB) and block TCP port 445 across all industrial computing assets. Applying this restriction blindly to SIMATIC PCS 7 (including V8.0, V8.1, V8.2, and V9.x) induces catastrophic control system failures. Key functionalities—such as target OS project downloads, OS Client graphic loading, and batch execution—rely directly on Windows network shares. This guide details the exact operational impacts of disabling SMB and outlines approved Siemens security hardening alternatives.

Architecture and Fundamental Mechanics

SIMATIC PCS 7 employs a hybrid communication architecture comprising industrial protocols (S7 communication, Named Connections, ISO on TCP) and standard Microsoft Windows distributed technologies (RPC, DCOM, and SMB).

While real-time process values, setpoints, and alarms travel across the Plant Bus and Terminal Bus via S7 connections and Simatic Shell multicast, technological file synchronization relies fundamentally on Server Message Block (SMB / TCP 445, UDP 137/138, TCP 139):
1. Target OS Download Engine: When an engineer compiles and downloads an OS project from SIMATIC Manager, STEP 7 uses Windows network shares (\\<TargetComputer>\<ShareName>) to transfer the WinCC project directory, SQL Server configuration, and graphic screens (.pdl).
2. WinCC Client-Server Architecture: OS Clients do not maintain local copies of process screens or project libraries. At runtime, the client connects via SMB to the project share on the OS Server to load graphics, scripts, and Server Data (.pdk).
3. SIMATIC BATCH & Route Control: Master recipe databases, batch logs, and equipment phases synchronize across redundant servers using dedicated shared Windows folders.
4. Maintenance Station & PDM: Field device documentation and EDD files are retrieved via file sharing.

Terminating SMB on the Terminal Bus or Plant Bus breaks the underlying remote procedure calls, immediately isolating clients and halting engineering transfers.

Step-by-Step Implementation Procedure

Assess Operational Vulnerability Before Modifying Network Shares:
a. Map all active PCS 7 network shares by running net share from an administrative command prompt on the ES and OS Servers.
b. Confirm the presence of standard WinCC shares (e.g., <ProjectName>, WinCCProject, Simatic_Batch).
Establish OT Network Perimeter Firewalls:
a. Never block TCP port 445 internally between PCS 7 stations on the Terminal Bus or Plant Bus.
b. Restrict and block TCP port 445, 137, 138, and 139 at the boundary firewalls separating the industrial Automation DMZ / OT network from the corporate IT network.
c. Isolate remote access through a secure Industrial DMZ utilizing jump hosts and multi-factor authentication.
Disable Insecure SMBv1 Protocol (Leaving SMBv2/v3 Active):
a. Modern ransomware attacks target vulnerabilities in the legacy SMBv1 protocol. In PCS 7 environments running modern Windows versions, SMBv1 can be disabled while retaining secure SMBv2 and SMBv3.
b. On Windows 7 / Server 2008 R2: Open Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters. Set DWORD SMB1 to 0.
c. On Windows 10 / Server 2016/2019: Open PowerShell as Administrator and run:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol.
d. Verify that SMBv2 remains enabled: Get-SmbServerConfiguration | Select EnableSMB2Protocol (must return True).
Enforce Siemens Security Recommendations:
a. Run the Siemens Security Controller utility on all PCS 7 stations to apply hardened firewall policies.
b. Ensure that all Windows user accounts belong to approved security groups with strong password policies.

Verification

From an OS Client, browse via Windows Explorer to the OS Server project share (\\OS_SERVER_A\<ShareName>): verify read access to .pdl files.
In SIMATIC Manager on the ES, perform a test 'Download Changes' to a target OS Single Station: confirm the download completes without network path errors.
Open WinCC Runtime on an OS Client: verify that screen navigation transitions instantly without hanging on missing graphic files.
On the OS Server, run Get-SmbConnection in PowerShell: verify that active client connections utilize SMB dialect 2.1 or 3.x, confirming SMBv1 is inactive.

Limitations and Operational Precautions

Disabling SMBv1 on legacy PCS 7 V7.0 or Windows XP/Server 2003 installations is unsupported and will break legacy SIMATIC NET communication. Always test SMBv1 removal in a non-production staging environment prior to plant-wide rollout. Corporate IT network scans targeting port 445 within the control network must be coordinated to prevent overwhelming industrial switch buffers.

Engineer FAQ

Will WinCC Runtime stay running if SMB is disabled while active?

Existing process values may continue updating temporarily via active S7/RPC connections, but operators will be unable to switch screens, open faceplates, or view trend archives.

Can PCS 7 operate using FTP or HTTP instead of SMB for project downloads?

No. The PCS 7 Engineering System and WinCC download mechanisms are hardcoded to use Windows File Sharing and SMB protocols.

Is disabling SMBv1 safe for PCS 7 V8.1 and higher?

Yes. PCS 7 V8.1, V8.2, and V9.x running on supported Windows operating systems support SMBv2 and SMBv3; SMBv1 can be safely disabled following Siemens guidelines.

Why does SIMATIC BATCH fail when file sharing is restricted?

SIMATIC BATCH uses shared network directories to synchronize recipe execution data and archive batch logs across redundant batch servers.

How does the Siemens Security Controller interact with port 445?

The Siemens Security Controller automatically configures local Windows Firewall rules to permit SMB communication exclusively between authorized PCS 7 stations while blocking unauthorized external subnets.