Resolving Authorization of the Batch Server Errors in SIMATIC BATCH Control Center

In SIMATIC BATCH, when opening recipes or formulas in Batch Control Center (BatchCC) fails with the error 'For this functionality you need the authorization of the batch server', the failure is caused by the active Windows user account lacking membership in the 'SIMATIC BATCH' Windows user group on the Batch Server, or blocked remote licensing in Automation License Manager (ALM). To resolve this, add the client user account to the 'SIMATIC BATCH' group on both the Batch Server and client PCs, enable 'Allow remote connections' in ALM on the Batch Server, and update the Batch Server network computer name in BatchCC Project Settings.

Executive Summary

In SIMATIC BATCH distributed architectures (comprising Engineering Stations, redundant OS Servers, dedicated Batch Servers, and OS/Batch Clients), recipes and recipe formulas represent core intellectual property and operational control logic. When engineers migrate or restore a SIMATIC BATCH database backup from another project or facility, they often encounter an authorization lockout: upon attempting to open any master recipe, operation, or formula in Batch Control Center (BatchCC), the application displays the warning: For this functionality you need the authorization of the batch server, and refuses to display recipe structures.

This security block arises from SIMATIC BATCH's multi-layered role-based authorization model. When a database is restored from a foreign system, stored server computer names, security identifiers (SIDs), and ALM license bindings do not match the current network host. Additionally, Windows DCOM and user authentication require identical security credentials across client and server boundaries. This guide explains the security mechanics of SIMATIC BATCH and outlines the step-by-step procedure to resolve authorization errors and regain recipe access.

Architecture and Fundamental Mechanics

The SIMATIC BATCH security architecture integrates Windows user groups, DCOM security, and central license validation:

Windows User Group Architecture (SIMATIC BATCH Group):
- When SIMATIC BATCH is installed, the setup wizard creates dedicated local Windows user groups: SIMATIC BATCH and SIMATIC HMI.
- The BFCServer (Batch Flexible Control Server) process on the Batch Server validates incoming client API requests against membership in the SIMATIC BATCH group.
- In a workgroup environment, the user account running BatchCC on the client PC must exist on the Batch Server with the exact same username and password, and must be an explicit member of the SIMATIC BATCH group on the server. In an Active Directory domain, domain users must be assigned to this group.
Automation License Manager (ALM) Remote Validation:
- Recipe modification and formula editing require active SIMATIC BATCH engineering licenses (such as BATCH Recipes and BATCH Basic).
- These licenses reside on the Batch Server or a central license server.
- When BatchCC attempts to open a recipe, it queries ALM across the network. If ALM on the Batch Server is configured with 'Allow remote connections' disabled, client license queries are rejected, resulting in server authorization failure.
Database Computer Name Binding Post-Restore:
- The SIMATIC BATCH database (sbdata) stores the network computer name of the server where the project was originally generated.
- When a backup is restored onto a new physical machine with a different hostname, BatchCC attempts to contact the legacy computer name stored in the database headers.
- Until the project is updated and the process cell is transferred with current computer names in SIMATIC Manager and BatchCC, client sessions cannot validate authorization against the active Batch Server service.

Step-by-Step Implementation Procedure

Follow these steps to resolve Batch Server authorization errors and restore recipe access in BatchCC:

Configure Windows User Accounts and Groups on the Batch Server:
- Log on to the Batch Server with local administrator privileges.
- Press Win + R, type lusrmgr.msc, and press Enter to open Local Users and Groups.
- Click 'Groups' and double-click the SIMATIC BATCH group.
- Click 'Add...'. Add the Windows user account used by operators and engineers to log on to the Batch Client PC.
- (In a workgroup environment, ensure the identical user account and password exist under 'Users' on the Batch Server).
- Add the user to the SIMATIC HMI group as well.
Configure Client PC User Group Membership:
- On the Batch Client PC, open lusrmgr.msc.
- Confirm that the logged-on user is also a member of the local SIMATIC BATCH and SIMATIC HMI groups.
Enable Remote Connections in Automation License Manager (ALM):
- On the Batch Server, launch Automation License Manager.
- Select 'File > Settings...' from the main menu.
- Switch to the 'Connection' tab.
- Check the checkbox 'Allow remote connections'.
- Check 'Allow remote license key operation'.
- Click 'Apply' and 'OK'. Restart the Automation License Manager Service in services.msc if prompted.
Update Computer Names in SIMATIC Manager:
- Open SIMATIC Manager on the Engineering Station.
- In Component View, right-click the PC Station hosting the Batch Server application > select 'Object Properties'.
- Confirm that the 'Computer name' matches the current physical hostname of the Batch Server.
- Select 'Options > SIMATIC BATCH'.
- In the Batch configuration dialog, verify the server assignments and execute 'Generate' followed by 'Compile'.
- Download the Batch configuration to the Batch Server.
Update Process Cell in Batch Control Center (BatchCC):
- Launch BatchCC on the Batch Server or client.
- Select 'System > Update Process Cell'.
- Verify that the process cell updates cleanly without communication errors.
- Right-click the restored project root in BatchCC > select 'Project Settings' > verify the assigned Batch Server computer name.
Restart SIMATIC BATCH Services:
- In the Windows system tray of the Batch Server, right-click the Batch Launch Coordinator icon (or Batch Start/Stop).
- Select 'Stop SIMATIC BATCH'. Wait for all server modules to terminate.
- Select 'Start SIMATIC BATCH'. Wait for all services (BFCServer, CDV, etc.) to transition to green (Running).

Verification

Launch Batch Control Center (BatchCC) on the OS/Batch Client station.
Navigate to 'Master Recipes' in the left tree.
Double-click a restored master recipe or formula: confirm that the recipe canvas opens immediately without the message 'For this functionality you need the authorization of the batch server'.
Modify a recipe parameter and click 'Save': verify that changes are saved cleanly to the Batch Server database.
In the Batch Server system tray, verify that the Batch Launch Coordinator indicates healthy client connections.

Limitations and Operational Precautions

Never modify SIMATIC BATCH database tables directly using external SQL tools; database integrity is managed strictly through BatchCC and the SIMATIC BATCH API. When deploying redundant Batch Servers, user accounts, security groups, and ALM remote permissions must be configured identically on both primary and standby servers. Verify SIMATIC BATCH license packages (PO tiers and client licenses) through an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

What causes the error 'For this functionality you need the authorization of the batch server'?

The active client user is not a member of the SIMATIC BATCH Windows group on the Batch Server, or remote licensing in ALM is disabled.

Do OS Servers need the SIMATIC BATCH Windows group?

Only if SIMATIC BATCH Server software is installed on the OS Server. In distributed architectures where Batch resides on dedicated servers, the user group must be configured on the Batch Server.

Why did this issue appear after restoring a backup?

Restoring a database backup brings over original computer names and security identifiers from the previous system, requiring computer name updates and user group re-synchronization.