PI AF and service principal name registration

Service principal name (SPN) registration in PI Asset Framework (PI AF) versions 2.2 and 2.3

In PI AF versions 2.2 and 2.3, the PI AF server registers a service principal name (SPN) at start up for the PI AF Application Service if the following conditions exist::

• The PI AF Application Service is running under the NetworkService account.

• The servicePrincipalName value is defined in the AFService.exe.config file. By default, this value is defined in the AFService.exe.config file.

SPN registration in PI AF 2.4 and greater

For PI AF versions 2.4 and greater, PI AF creates the SPN for the machine account on the computer where the service runs. By default, this value is defined in the configuration file. Depending on the type of account that the PI AF Application Service runs under, the SPN gets created differently as listed here:

• Virtual account: NT SERVICE\AFService or the NetworkService account: The SPN is created for the machine account for the machine that the service runs on.

• Domain account: PI AF creates the SPN for the domain account.

• Windows Cluster: There are specific instructions for SPN registration. See PI AF server installation in a failover cluster.

SPN registration with domain accounts

Local computer accounts (for example, NetworkService) typically have permission to register an SPN. Domain accounts often do not. If the PI AF Application Service runs under an account that cannot register an SPN, you must perform additional configurations before client application using the SPN (for example, PI System Explorer) can connect to the PI AF Application Service.

Use one of the following methods:

• Have a domain administrator register the SPN manually. For detailed instructions, see Manage SPNs for the PI AF application service.

• Grant the PI AF Application Service's domain account permissions to manage the SPN. A domain administrator typically grants the required permissions to the domain account that runs the PI AF Application Service.