Check and set permissions for SPN creation

By default, PI System Explorer and other PI AF clients connect to the PI AF server using Kerberos security. Kerberos authentication requires either a service principal name (SPN) or a user principal name (UPN). If PI AF clients cannot connect to the PI AF server using Kerberos security, the authentication method rolls back to NTLM authentication, which is less secure.

By default, for PI AF 2014 R2 (version 2.6) and later, PI AF server attempts to register an SPN for the PI AF application service upon startup. If the PI AF application service is running under a system account, the SPN is created for the machine account for the machine on which the service is running. In all other situations, the SPN is created for the account of the user running the PI AF application service.

For additional information about configuring Kerberos authentication, see the Knowledge Base article: Configuring Delegation for PI AF.