Resolving Batch Control Center Authorization Delays and Lockouts on BATCH Clients in PCS 7

In SIMATIC BATCH V9.1 SP2, launching Batch Control Center (BatchCC) on a remote client workstation can take several minutes before failing with 'This action requires BATCH Server Authorization' and locking recipe editing privileges. This failure occurs when Automation License Manager (ALM) network communication is blocked by Windows Firewall, when remote license sharing is disabled on the Batch Server, or when user account rights in the local SIMATIC BATCH group are desynchronized.

Architecture of SIMATIC BATCH Client-Server Authorization

SIMATIC BATCH coordinates modular recipe execution according to ISA-88 standards:
* The BATCH Server: Manages recipe databases, electronic batch records (EBR), and communication with S7-400 / CPU 410 controllers. It hosts central server licenses and manages operational state synchronization.
* The BATCH Client: Workstations running Batch Control Center (BatchCC) and the Recipe Editor.
* Startup Validation: When an operator launches BatchCC on a client, the client initiates a multi-stage authentication handshake:
1. Validates the operator's Windows user account against the SIMATIC BATCH security group.
2. Contacts the Batch Server's Launch Coordinator service via NTLM or Kerberos.
3. Queries Automation License Manager (ALM) on the Batch Server across the terminal bus to acquire a floating SIMATIC BATCH Client license token.

Mechanism of the Error: 'This Action Requires BATCH Server Authorization'

When the client handshake is obstructed:
* BatchCC hangs on the splash screen for 2 to 5 minutes while internal network socket requests time out.
* The application finally displays the warning:

This action requires BATCH Server Authorization.
* Clicking OK allows BatchCC to open, but all interactive controls (creating batches, modifying recipes, releasing unit allocations) are disabled. The interface enters a restricted read-only mode, even when logged in with an authorized superuser account.

Root Cause 1: Automation License Manager (ALM) Network Communication Block

The primary technical failure occurs within the licensing layer:
* SIMATIC BATCH operates on floating network licenses hosted centrally on the Batch Server (e.g., SIMATIC BATCH Server Basic and SIMATIC BATCH Client).
* ALM Configuration: If ALM on the Batch Server is not explicitly configured to allow remote license requests, client queries are rejected immediately.
* Port Blocking: ALM communicates across TCP port 4410. If the Windows Firewall on the Batch Server or client blocks port 4410, the client times out waiting for license validation, defaulting to authorization lockout.

Root Cause 2: User Rights and SIMATIC BATCH Security Group Alignment

SIMATIC BATCH security relies on local Windows user groups:
* The active user account on the client must belong to the SIMATIC BATCH and SIMATIC HMI security groups on both the client PC and the Batch Server.
* In a workgroup environment without a domain controller, identical usernames and passwords must be configured on both machines. A password mismatch causes the Launch Coordinator to reject client authorization.

Step-by-Step Procedure to Restore BatchCC Client Functionality

To resolve the startup delay and authorization lockout:
1. Configure ALM for Network License Sharing on Batch Server:
* Open Automation License Manager on the Batch Server.
* Select File -> Settings.
* Navigate to the Connection tab.
* Check the box: Allow remote connections.
* Select the Access permission tab: ensure client subnets are authorized or set to "Accept all".
2. Verify Windows Firewall Rules:
* Open Windows Defender Firewall with Advanced Security on both server and client.
* Verify that an Inbound Rule exists permitting TCP port 4410 for the ALM service (almsrvx.exe).
* Run the SIMATIC Security Controller utility on both machines and click Repeat Settings to restore certified firewall rules.
3. Align User Group Memberships:
* On the Batch Server, open Computer Management -> Local Users and Groups -> Groups.
* Add the client operator Windows account to the SIMATIC BATCH group.
* Verify user privileges in the SIMATIC BATCH Permission Management utility.
4. Restart BATCH Services:
* On the Batch Server, restart the SIMATIC BATCH Launch Coordinator service via Windows Services (services.msc).
* Relaunch Batch Control Center on the client PC.

Verification

Launch Batch Control Center on the remote client workstation: confirm that the splash screen loads in less than 5 seconds without error dialogs.
Verify that the title bar displays connected status to the primary Batch Server.
Create a test master recipe or allocate a unit: confirm that the New, Edit, and Release buttons are fully enabled.
In ALM on the Batch Server, check the License Keys view: confirm that one SIMATIC BATCH Client license token is active and checked out by the client's computer name.

Limitations and Operational Precautions

Running BatchCC without a valid client license limits the workstation to view-only operation; do not decommission licenses on running production servers.
In redundant BATCH server architectures, ALM remote connection settings and licenses must be configured identically on both primary and standby servers.
Always validate final license package quantities (e.g., number of Batch clients, PO tiers) against the official Siemens Industry Mall catalog and authorized distributor quotations.

Engineer FAQ

What causes the 'This action requires BATCH Server Authorization' error in BatchCC?
Network communication failure between client and server ALM, or missing user rights in the SIMATIC BATCH group.
What TCP port does Automation License Manager use for network license sharing?
TCP port 4410.
Where in ALM do you enable remote license sharing?
In ALM under File -> Settings on the Connection tab by checking 'Allow remote connections'.
What Windows security group manages SIMATIC BATCH permissions?
The local Windows security group SIMATIC BATCH.
Can BatchCC run in read-only mode without a client license?
Yes, if authorization fails, BatchCC opens in restricted mode allowing operators to view active batches without modifying recipes.
What service coordinates client connections on the BATCH Server?
The SIMATIC BATCH Launch Coordinator service (s88coord.exe).
Does SIMATIC BATCH support domain Active Directory user accounts?
Yes, Active Directory domain accounts are fully supported when assigned to the domain SIMATIC BATCH group.
How many concurrent BatchCC clients can connect to a BATCH Server?
The number of concurrent clients is determined by the purchased quantity of SIMATIC BATCH Client floating license keys.
Does closing BatchCC return the floating license to the server?
Yes, terminating the BatchCC application releases the floating license token back into the central ALM pool.
What utility automatically opens firewall ports for SIMATIC BATCH?
The SIMATIC Security Controller application.

Technical References

SIMATIC PCS 7 SIMATIC BATCH Operating Manual (V9.1)
Automation License Manager (ALM) System Manual
Siemens Industry Online Support Entry: SIMATIC BATCH Client Authorization (Entry ID 299677)
ISA-88.01 Batch Control Standard Architecture