Change the Windows service account

You can change the service account that runs PI Integrator for Business Analytics. You may specify either a Window service account, a group Managed Service account (gMSA), or Windows Virtual accounts. If you are changing from or changing to a gMSA account or Virtual accounts, be aware of the following:

• If you are changing from a Windows service account with SQL authentication to a gMSA account or Virtual accounts, the gMSA account or Virtual accounts must use Windows authentication to authenticate with the backend SQL server that hosts PI Integrator for Business Analytics. It cannot be configured to use SQL authentication.

• If you are either changing from a gMSA account or Virtual accounts, or changing to a gMSA account or Virtual accounts, then after the account is changed, you will need to reenter the credentials for each publish target.

Verify that the logged-in user account, or the user account running the Change Service Account Utility, has the following permissions:

• Local Administrator privileges on the Microsoft Windows Server where PI Integrator for Business Analytics is installed

• Administrator privileges on the PI AF Server where the PI Integrator for Business Analytics Configuration database is installed

  Note: The PI AF Server is identified in the %PIHOME64%\Integrators\BA\CAST.UI.WindowsService.exe file in the <appSettings> section with the InstancePath key.

The following permissions are also required for the logged-in user account or the user account running the Change Service Account Utility:

• ALTER ANY LOGIN permission on SQL Server

• db_owner database role membership for the PIIntegratorDB, PIIntegratorLogs, and PIIntegratorStats databases

  Note: The only exception to this is if you are using SQL authentication and you do not want to change the SQL account; then these additional permissions are not required.

  If the installing user does not have the required permissions on the SQL databases, then a user with sysadmin privileges must first run the Go.Bat file which can be found in %PIHOME64%\Integrators\BA\SQL.

  If you are using SQL authentication and you do not want to change the SQL account, then you do not need to run these files.

• The new Windows service account that will be running the PI Integrator Framework service must be given "Log on as a service" rights on the machine on which PI Integrator for Business Analytics is installed. A user with administrator privileges can assign this right to the service. The procedure for making this assignment varies depending on your computer's operating system and software version.

• The new Windows service account also needs to have local profile. Login using the new service account to create a profile on the Microsoft Windows Server where PI Integrator for Business Analytics is installed.

Once this is done, then proceed with the procedure below.

• If you are changing from a Windows service account with SQL authentication to a gMSA account or Virtual accounts, the gMSA account or Virtual accounts must use Windows authentication to authenticate with the backend SQL server that hosts PI Integrator for Business Analytics. It cannot be configured to use SQL authentication.

• If you are either changing from a gMSA account or Virtual accounts, or changing to a gMSA account or Virtual accounts, then after the account is changed, you will need to reenter the credentials for each publish target.

1. From the %PIHOME64%\Integrators\BA directory, run the ChangeIntegratorServiceAccount.exe file as Administrator.

2. Follow the prompts and provide the password for the account that currently runs the PI Integrator Framework service.

   Note: You must first provide the password for the service account that is currently running the PI Integrator Framework service before you can change the service account.

   If the account is a gMSA account or Virtual accounts, do not provide a password and skip this step.

3. Follow the prompts and provide the service account and password for the new service account that will run the PI Integrator for Business Analytics services.

   The Change Service Account utility adds the new account and its permissions to PI AF and SQL Server.

   Note: If the new service account is a gMSA account, provide the name of the service account and do not provide a password.The Virtual accounts do not need the service account name or password.

4. Press Enter to exit the utility.

If you are changing from or to a gMSA account or Virtual accounts, you will need to reenter the credentials for each of your publish targets.