Resolving SIMATIC BATCH Auto-Archiving Permissions and Logon Failures Across Network Directories

When SIMATIC BATCH auto-archiving fails with 'Directory does not exist or access is denied. Logon failure: unknown user name or bad password', the failure occurs because auto-archiving is executed by the background BATCH Server service, not the interactive Windows user logged onto the client PC. When auto-archiving triggers, the BATCH Server service attempts to access the network share (\CLIENT3\ARCHIVING) using its own local system account. To resolve this, open Batch Control Center -> Options -> Settings -> Project Settings -> User Credentials tab, and configure a dedicated Windows service account that possesses full Modify permissions on the shared archive folder across the network.

SIMATIC BATCH Archiving Architecture: Client vs Server Execution Contexts

In SIMATIC PCS 7, SIMATIC BATCH maintains recipe execution records, batch logs, and electronic signatures in an active relational database. To satisfy regulatory mandates (such as FDA 21 CFR Part 11) and prevent database bloat, completed and closed batches are archived into compressed, cryptographically sealed archive files (*.sbx or XML/PDF packages) moved to long-term storage directories.

A foundational architectural distinction governs how archiving executes:

Manual Archiving: Triggered interactively by an operator inside the Batch Control Center (BCC) GUI, executing under the security token of the currently logged-in Windows user.
Automated Archiving (Auto-Archive): Evaluated cyclically by the BATCH Server background service (bfserverx.exe). It executes autonomously without active user logon sessions.

Why Manual Archiving Succeeds While Automated Archiving Fails

When engineers test archiving from an engineering station or client workstation, manual archiving often succeeds because the engineer's account has local administrative privileges. However, when the automated timer fires (e.g. 7 days after batch closure), the BATCH Server fails with access denied errors:

The BATCH Server runs on a dedicated server node (BATCH_SRV), whereas the target archive directory is frequently placed on a client PC or corporate NAS share (\\CLIENT3\ARCHIVING).
By default, background services authenticate across the network as NT AUTHORITY\ANONYMOUS LOGON or machine accounts (DOMAIN\BATCH_SRV$), which are rejected by the destination share.
Unless explicit credentials are provided, cross-machine network authentication fails.

Configuring User Credentials in Batch Control Center (BCC)

To bridge cross-machine authentication, SIMATIC BATCH includes a dedicated credential manager:

Open Batch Control Center.
Navigate to Options -> Settings -> Project Settings.
Switch to the User Credentials tab.
Enter a validated Windows Domain user account (or mirrored local account) with username and password.
The BATCH Server service caches these credentials and impersonates this user when connecting to network shares during auto-archiving.

Network Share and NTFS Security Permissions for Archive Targets

Both Windows Share and NTFS permissions must align on the target archive folder:

Share Permissions: Grant Change and Read permissions to the configured BATCH archive user account.
NTFS File Permissions: Open folder Properties -> Security tab. Grant Modify, Read & Execute, List folder contents, Read, and Write permissions.
Avoid sharing folders hosted on operator OS Clients; store archives on a dedicated file server, OS Server data disk, or Process Historian.

Comparative Diagnostic Matrix: SIMATIC BATCH Archiving Faults

The following table correlates BATCH archiving error messages with underlying root causes:

Error Message in BCC / Event LogUnderlying MechanismSecurity ContextCorrective ActionLogon failure: unknown user name or bad passwordServer lacks credentials for remote shareBATCH Server Service (SYSTEM)Enter domain credentials in BCC Project SettingsDirectory does not exist or access is deniedRemote share path unreachable or NTFS read-onlyNetwork share ACLVerify folder share path; add Modify NTFS permissionsBatch cannot be archived: Batch status invalidBatch is still in 'Released' or 'Active' stateBATCH State MachineBatches must transition to 'Closed' before archivingArchive timeout during PDF report generationAdobe/PDF generator locked by hanging taskWinCC Report SystemRestart PDF spooler service on BATCH ServerManual archive OK; Auto-archive failsAuto-archive executes via server, not client userService account discrepancyPopulate User Credentials tab in BCC

Step-by-Step Procedure to Configure Automated Network Batch Archiving

Follow this engineering procedure to establish reliable auto-archiving:

Create Service User: In Active Directory (or local computer management on both machines), create a dedicated service account: BatchArchiveUser.
Configure Target Share: On the destination storage server, create folder D:\Batch_Archives. Share as Batch_Archives. Assign Modify permissions to BatchArchiveUser.
Configure BCC User Credentials: On the BATCH Engineering Station, open Batch Control Center -> Options -> Settings -> Project Settings -> User Credentials. Enter DOMAIN\BatchArchiveUser and password. Click OK.
Configure Archive Path in BCC: In BCC, select Options -> Settings -> Project Settings -> Archive. Set path to \\StorageServer\Batch_Archives.
Enable Auto-Archiving: Check 'Automatic archiving'; configure the trigger condition (e.g. Archive batches 7 days after closure).
Propagate and Download: In SIMATIC Manager, perform Compile / Download BATCH. Update process cell in BCC.
Test Connection: In BCC Project Settings, click Test Connection. Verify green status.

Verification

Confirm archiving operation through these checks:

BCC Connection Test: Confirm the test connection button returns 'Connection successful' from both the ES and BATCH Clients.
Manual Archive Test: Close a completed test batch. Manually archive it from BCC; verify *.sbx file appears in the network folder.
Auto-Archive Verification: Set auto-archive timer to 1 hour on a test system. Verify closed batches transition to 'Archived' status autonomously.
Log File Audit: Check C:\ProgramData\Siemens\Automation\Logfiles\SimaticBatch\; confirm zero logon failure entries.

Limitations and Operational Precautions

Observe the following data management precautions:

Never Store Archives on Client PCs: Hosting production archives on an operator client (\\CLIENT3\ARCHIVING) is vulnerable to client reboots, network disconnection, and accidental file deletion.
Password Expiration Policies: Ensure the configured BatchArchiveUser service account has 'Password Never Expires' enabled in Active Directory to prevent unexpected auto-archiving failures.
Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.

Engineer FAQ

What format are archived SIMATIC BATCH files stored in?

Archived batches are stored as compressed, encrypted SBX files containing the complete recipe execution trace, process values, and electronic signatures.

What happens if the archive storage network share goes offline?

Closed batches remain in the local BATCH Server database until the network share becomes reachable, after which the auto-archiving queue resumes transfer.