PI Windows Service Configuration

By default, the PI OPC UA Server is installed as a Windows Service using the virtual service account name NT SERVICE\AVEVAPIOPCUAServer. Perform the following instructions to change the service logon identity to a specific local or domain user account.

Note: This activity is not recommended and by doing so it may affect access to PI Systems if not using OIDC.

If the service account is changed, the following needs to occur as well:

• Grant the user account permission to run Windows services. This can be done with the Group Policy Management Console.

• Add the user account to the following two local groups: ASBSolution and ArchestrAWebHosting . This can be done using the Local Users and Groups Manager.

Change the service account

It is possible to change the account used to run the OPC UA Server, to either a domain account or another account on the local machine. Before changing the service to run under a different account, access must be granted to the service's data folders. These folders are located in the system's ProgramData folder, which is normally on the C: drive. The folder names are as follows:

• %ProgramData%\AVEVA\AVEVA PI OPC UA Server\data

• %ProgramData%\AVEVA\AVEVA PI OPC UA Server\data\keys

• %ProgramData%\AVEVA\AVEVA PI OPC UA Server\data\x509auth\certs

• %ProgramData%\AVEVA\AVEVA PI OPC UA Server\data\x509auth\certs\rejected

• %ProgramData%\AVEVA\AVEVA PI OPC UA Server\data\x509auth\certs\trusted

Before changing the service's account, perform the following steps on each of the folders listed above:

1. In Windows Explorer, right-click on the folder name and select Properties.

2. Select the Security tab.

3. Select Edit.

4. Select the desired user account from the Group or user names list.

5. In the Permissions for Users list, check Read and Write if not already selected.

6. Select OK twice to close both dialogs.

After setting folder permissions, perform these steps to change the service account:

7. Open the Services control panel applet.

8. Select AVEVA OPC UA Server.

9. Right-click and select Properties.

10. Select the Log On tab.

11. Under This Account, select the desired account name and password.

12. Select OK to close the dialog.

13. Right-click the service and select Restart.