Security best practices

For more information about security for OPCAE, see the DCOM Security and Configuration Guide. For more information about configuring security for PI Data Archive, see PI Data Archive Security Configuration Guide.

Interface installation requires an administrator account for the following tasks:

• Installing the interface software

• Creating the interface service account

• Creating, editing, and removing the interface service

• Adding, updating, and removing performance counters

Security considerations service accounts for PI Interfaces based on the UniInt framework are discussed in the PI Universal Interface (UniInt) User Guide.

Note: In order to assure that PI buffering functions properly, the user specified in the "Log on as" portion of the Service tab must be a member of the "PI Buffering Administrators", or the "PI Buffer Writers" user groups. A virtual service account can be added to those local groups, just like with any local/domain account. Failure to add a user to at least one of these user groups could result in a failure to buffer data. For more details, see the PI Buffer Subsystem

For more information about managing PI Data Archive security and trusts, see the PI Server System Management Guide.

Authentication and authorization

In order for the interface to connect to PI Data Archive, the interface service account must be authenticated and authorized for communications. This requires configuring security for the applications that connect to PI Data Archive. For more information about authentication and authorization for interfaces, see the PI Universal Interface (UniInt) User Guide.

PI point security

PI point security can be configured for user access to the point attributes using the ptsecurity attribute, and user access to the point data using the datasecurity attribute.

DCOM security

OPC server and client applications are based on Microsoft's COM/DCOM communication model. For an overview, see DCOM configuration

For more information about DCOM security for PI OPC products, see the DCOM Security and Configuration Guide.