Recovering Missing License Keys and Automation License Manager (ALM) Database Corruption After Windows OS Recovery

In SIMATIC PCS 7 systems, when Automation License Manager (ALM) displays an empty license inventory and blank 'Installed Software' listings following an ungraceful Windows operating system recovery—even though the hidden 'AX NF ZZ' license repository folder is physically present on drive C:—the issue is caused by corrupted License Key database catalog headers, broken Windows file access control lists (ACLs), or an unstarted 'Automation License Manager Service' (almsrvx.exe). To recover the licenses: verify that the ALM service is running under the Local System account, grant full permissions on 'C:\AX NF ZZ' to the Siemens user group, execute the ALM internal 'Check License Keys' routine, and contact Siemens Customer Support with the physical Certificate of License (CoL) if cluster cryptographic signatures were invalidated.

Architecture of the Siemens License Storage Repository (AX NF ZZ)

Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.

In Siemens industrial software ecosystems (STEP 7, WinCC, PCS 7, Automation License Manager), software entitlements are governed by cryptographic digital license keys:
- The Hidden Storage Container (AX NF ZZ):
* Licenses reside in a hidden, read-only system directory at the root of the installation volume: C:\AX NF ZZ.
* Within this directory, individual license entitlements are encapsulated in encrypted binary containers named sibk*.ekb.
* The file names and cluster placement are bound to low-level NTFS disk sector geometries and the machine's hardware security ID (SID).
- The ALM Service Engine (almsrvx.exe):
* The Automation License Manager Service runs as a native Windows service executing under the NT AUTHORITY\LocalSystem account.
* ALM maintains an internal indexed database mapping installed Siemens software components against the available .ekb keys.
* When an operator opens the ALM GUI, it queries almsrvx.exe via remote procedure call (RPC). If the service cannot access C:\AX NF ZZ or if NTFS security descriptors were stripped, ALM reports zero installed licenses.

How Windows Recovery Corrupts License Key Integrity

The phrase 'Windows Recovery' covers several distinct operations that frequently damage license systems:
1. Windows System Restore / Reinstallation Over Existing OS:
- Rolling back to a previous Windows Restore Point restores an older Windows Registry snapshot. The registry references an older ALM database state that does not align with the current cluster map of C:\AX NF ZZ.
- Reinstalling Windows resets file ownership: the hidden AX NF ZZ directory loses permissions for the SIEMENS service accounts and SIMATIC HMI user groups.
2. Cluster Shifting and Sector Reallocation:
- Disk recovery utilities (such as CHKDSK or third-party partition repair tools) that fix disk corruption during recovery frequently reallocate bad sectors or move .ekb files across NTFS clusters.
- Because Siemens license keys utilize cluster-locked cryptographic signatures to prevent unauthorized copying, moving the physical file blocks invalidates the license key, rendering it 'Defective' or invisible.

Step-by-Step License and ALM Database Recovery Workflow

Follow this procedure to recover license visibility:

Verify ALM Windows Service Health:
- Open Windows Services (services.msc).
- Locate Automation License Manager Service.
- Verify that status is Running and Startup type is Automatic.
- Ensure the service logs on as Local System account (never configure a restricted domain user).
Restore NTFS Permissions on AX NF ZZ:
- Open Command Prompt as Administrator.
- Reveal the hidden system directory:
cmd attrib -h -s -r "C:\AX NF ZZ"
- Reset security permissions on the folder:
cmd icacls "C:\AX NF ZZ" /grant "SYSTEM":(OI)(CI)F /grant "Administrators":(OI)(CI)F /grant "Everyone":(OI)(CI)R /t
- Re-apply system and hidden attributes:
cmd attrib +h +s "C:\AX NF ZZ"
Re-initialize ALM Installed Software Inventory:
- The empty 'Installed Software' dropdown indicates that the Siemens registry inventory (HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\Automation License Manager) was cleared during recovery.
- Run the ALM setup installer from the PCS 7 DVD and select Repair. This rebuilds the registry enumeration schemas without deleting existing keys.
Execute ALM Check and Find Function:
- Open Automation License Manager as Administrator.
- Select drive C:.
- In the menu bar, select Edit > Check.
- ALM rescans C:\AX NF ZZ, re-indexes the .ekb files, and re-validates checksums.
- If keys appear with a yellow triangle or 'Defective' flag, proceed to the official recovery request.
Official Siemens License Restoration (Customer Support Request):
- If keys are corrupted beyond software recovery, locate the physical Certificate of License (CoL) documents provided with your original PCS 7 software delivery.
- Create an official Siemens Support Request via SIOS.
- Provide the License Key numbers, CoL Delivery Note numbers, and the ALM diagnostic export log. Siemens Customer Support will issue authorization codes to restore the lost entitlements.

ALM Diagnostic Status and License Recovery Matrix Table

The following table details common license key failure states and their resolution paths:

ALM Displayed StatusRoot CauseIs License Key Recoverable Locally?Approved Corrective ActionEmpty Inventory (0 Keys)ALM service stopped or NTFS permissions stripped from AX NF ZZYesStart almsrvx.exe, reset icacls permissions on C:\AX NF ZZInstalled Software BlankWindows Registry inventory keys wiped during OS restoreYesRun ALM installer in 'Repair' mode from PCS 7 DVDDefective (Yellow Warning)NTFS cluster shifted or CHKDSK modified .ekb file headersNoContact Siemens Support with CoL for emergency key reissueLicense Counter MismatchFloating license count desynchronized between server and clientYesExecute 'Check' in ALM on the central license serverDrive C: Not VisibleALM storage drive filter disabled in ALM optionsYesOpen ALM Options > Settings > Drives and enable Drive C:

Verification

To confirm that software licenses are fully operational:
1. Open Automation License Manager. In the left navigation pane, select Drive C:.
2. Verify that all required PCS 7 licenses populate the table (e.g. WinCC Server, WinCC RT PO, AS RT PO, STEP 7).
3. Verify that the License Type column displays Single or Floating, and the Validity column displays Unlimited.
4. In the menu, select File > Check All. Confirm that all license rows display a solid green status icon with zero defective flags.
5. Launch SIMATIC Manager and WinCC Explorer. Verify that both applications open without triggering 'License missing / Demo mode' runtime popups.

Limitations and Operational Precautions

When managing Siemens software licenses:
1. Always Transfer Licenses Prior to System Maintenance: Before performing Windows updates, hard drive maintenance, or system imaging, always transfer all active license keys from C: to a standard USB flash drive formatted in FAT32 or NTFS using ALM.
2. Never Back Up AX NF ZZ Using Standard File Copy: Standard Windows copy utilities or image backup tools (Acronis, Ghost) break the cryptographic cluster bindings of .ekb files. Restoring an image containing AX NF ZZ almost always renders the license keys defective.
3. Keep Physical Certificates of License (CoL): The physical paper or PDF Certificate of License is the only legally recognized proof of ownership. Siemens Customer Support cannot restore lost license keys without verified CoL numbers.

Engineer FAQ

Can I copy the AX NF ZZ folder from another computer to restore my licenses?

No. License keys in the AX NF ZZ folder are cryptographically tied to the unique hardware signature and disk sector geometry of the original machine. Pasting them onto another PC marks them permanently as 'Defective'.

Why does ALM say 'Service Not Running' even after starting it in Services?

This occurs if the ALM service executable (almsrvx.exe) was quarantined by an over-aggressive antivirus program, or if DCOM permissions for the ALM service account were corrupted during Windows recovery.

What should I do if my plant is down and I am waiting for Siemens Support to restore keys?

Automation License Manager includes emergency 'Trial Licenses' (valid for 14 or 21 days) for core PCS 7 components on the installation DVD, allowing plant operations to continue while permanent replacement keys are processed.

Can licenses be stored on a network shared drive?

No. License keys must reside on a local physical hard drive or a dedicated USB license dongle. However, ALM can act as a License Server across the network to distribute 'Floating Licenses' dynamically.