Resolving Windows Security and Access Permission Errors During SIMATIC BATCH Archiving

In SIMATIC BATCH, errors archiving completed batches from the Batch Control Center (BCC) client occur when the operating user or the SIMATIC BATCH background service (sb_server.exe) lacks write permissions to the configured archive destination folder. In modern Windows platforms (Windows 7, Server 2008 R2, Server 2012 R2), strict User Account Control (UAC) and NTFS access control lists (ACL) block file creation. To resolve this, grant Full Control NTFS and Share permissions to the local Windows user group SIMATIC BATCH, configure a valid UNC path, and verify that the target storage volume is accessible.

SIMATIC BATCH Archiving Architecture and Database Offloading

In regulated process industries governed by FDA 21 CFR Part 11 or GMP guidelines, completed production batches must be permanently preserved as immutable Electronic Batch Records (EBR). In SIMATIC PCS 7, the SIMATIC BATCH subsystem manages this process through the Batch Control Center (BCC).

When a recipe completes:
* The batch record initially resides in the active Microsoft SQL Server database on the BATCH Server (sb_server.exe).
* To prevent database bloat and ensure high real-time execution speeds, completed batches are moved from the active database to an Archive Directory (.sba / XML / PDF archive formats).
* Operators or supervisors trigger this archiving process manually from the BCC Client interface (Batch -> Archive) or configure automated batch archiving upon recipe termination.

Root Causes for Archive Failures from BCC Clients

When an operator clicks Archive on a completed batch in BCC, the client frequently aborts with:
Error when archiving batch: Access denied / Destination path is not writable.

This error is almost universally caused by Windows security restrictions:
1. Asymmetric Client-Server Execution Context:
- The operator initiates the command on a BCC Client machine (e.g. OS_CLI01).
- However, the physical file write operation is executed by the SIMATIC BATCH Server service (sb_server.exe) running on the central BATCH Server (BATCH_SRV01).
- If the archive destination folder is located on a network share or secondary storage, the service account executing on the server must possess write access, not just the local client operator.
2. Missing Membership in SIMATIC BATCH Group:
The logged-on Windows user does not belong to the mandatory local Windows user group SIMATIC BATCH on the server machine.
3. NTFS vs. Share Permission Bottleneck:
The Windows network share permissions may be set to 'Everyone: Read/Write', but the underlying NTFS file permissions on the physical disk remain restricted to 'Administrators Only'.

NTFS File System Permissions vs. Windows Share Security

Windows enforces security through two distinct layers that must both permit the operation:
* Share Permissions: Governs network entry over SMB (Server Message Block). Must be set to SIMATIC BATCH: Full Control or Authenticated Users: Change/Read.
* NTFS Permissions: Governs physical disk read, write, modify, and delete operations.
* The Rule of Least Privilege: Windows always enforces the most restrictive combination of Share and NTFS permissions. If Share is 'Full Control' but NTFS is 'Read', all file creation fails with 'Access Denied'.

SIMATIC BATCH Security and User Group Permission Matrix

The following matrix details required Windows user groups and rights for SIMATIC BATCH archiving:

Security EntityLocationRequired PermissionsOperational RoleSIMATIC BATCH (Group)Local Server & DomainFull Control (NTFS & Share)Mandatory group for all batch operatorsSIMATIC BATCH AdministratorLocal Server & DomainFull Control + OwnerAuthorizes recipe release and archive deletionSYSTEM / LocalSystemLocal ServerFull ControlRequired by sb_server.exe background serviceAuthenticated UsersNetwork ShareChange / ReadPermits cross-machine client network accessSIMATIC Logon RoleSIMATIC Logon GUIAssigned to 'Batch Archiving'Grants GUI rights inside BCC interface

Step-by-Step Procedure to Configure Secure Batch Archive Shares

Follow this standardized procedure to eliminate archiving access errors:
1. Create a Dedicated Archive Directory:
- On the storage drive (e.g. D:\BatchArchives\), create a clean folder named CompletedBatches.
2. Configure Windows Network Sharing:
- Right-click the folder and select Properties -> Sharing -> Advanced Sharing.
- Check Share this folder. Set Share Name to CompletedBatches$.
- Click Permissions:
- Remove Everyone.
- Add the group SIMATIC BATCH and check Full Control.
- Add Authenticated Users and check Change and Read.
- Click Apply.
3. Configure Physical NTFS Permissions:
- In the folder properties dialog, switch to the Security tab.
- Click Edit -> Add.
- Add the local group SIMATIC BATCH (or domain equivalent).
- Check Modify, Read & Execute, List folder contents, Read, and Write.
- Add SYSTEM with Full Control.
- Click Advanced: Ensure permissions inherit to all child objects.
4. Update Archive Path in SIMATIC BATCH Configuration:
- On the Engineering Station, open the Batch Configuration Dialog (Configure BATCH).
- Navigate to the System Characteristics -> Archive Directory settings.
- Enter the standardized UNC network path:
\\BATCH_SRV01\CompletedBatches$
- Do NOT use mapped drive letters (e.g. Z:\), as mapped network drives are user-session dependent and invisible to Windows system services!
5. Download BATCH Server Configuration:
- Execute Compile and Download for the SIMATIC BATCH server.
- Restart the BATCH server application to apply path changes.

Verification

Verify that batch archiving functions flawlessly from BCC clients:
1. Open the Batch Control Center (BCC) on a remote client workstation.
2. Locate a completed production batch in the batch overview tree.
3. Right-click the batch and select Archive.
4. Confirm that the operation executes immediately with a green progress bar and zero error prompts.
5. In Windows File Explorer on the archive server: Open D:\CompletedBatches\. Confirm that the batch archive file (.sba or XML folder) is present with valid timestamps and non-zero byte size.
6. In BCC, confirm that the batch status transitions from 'Completed' to 'Archived'.

Limitations and Operational Precautions

Never map archive paths using local drive letters (C:\ or D:\) in multi-client architectures; clients cannot resolve the server's local drive letters. Always deploy UNC paths (\\Server\Share).
Avoid archiving batches directly to USB thumb drives or network shares with unstable Wi-Fi links; write interruptions can corrupt the archive file.
Ensure long-term archive storage volumes have automated backups and adequate disk capacity monitoring.

Engineer FAQ

Can an archived batch be restored back into the Batch Control Center?

Yes. In BCC, selecting 'Batch -> Restore' and pointing to the archived .sba file allows engineers to reload historical batches into BCC for re-inspection or re-printing.

Why does Windows User Account Control (UAC) interfere with batch archiving?

When UAC is active at maximum levels, administrative tokens are filtered out of background service handles. Granting permissions explicitly to the SIMATIC BATCH user group rather than relying on the local Administrator group bypasses UAC filtering.