PI AF Application Service and PI AF SQL Server database considerations

By default, the PI AF Application Service runs under the NT SERVICE\AFService virtual account on the PI AF server computer. This account is a member of a local users group, called AFServers, on the PI AF SQL Server database computer. The AFServers user group is used to provide the PI AF Application Service the required access to the SQL Server database computer through a SQL Server login that is mapped to the AFServers group.

The installation applications create the default configuration as follows.

PI AF server installation

The PI AF SQL Server database portion of the installation application:

• Creates the PI AF Application Service on the PI AF server computer.

• Creates a virtual account, NT SERVICE\AFService, on the PI AF server computer.

• Configures the PI AF Application Service to run under the account specified during the installation. The default account is NT SERVICE\AFService, but you can specify a different account during the installation.

SQL Server database installation

If you select the Execute SQL Script option, the following rules apply:

• A local user group, AFServers, is created on the PI AF SQL Server database computer. This process fails if SQL Server is on a domain controller or on a Clustered SQL Server.

• If PI AF SQL Server database is installed on the same machine as the PI AF server:

  • NT SERVICE\AFService is added to the local AFServers group, regardless of the account assigned to the PI AF Application Service.

  • If the PI AF Application Service is configured to run using a domain account, that domain account is also added to the local AFServers group.

• If PI AF SQL Server database is installed on a different machine than the PI AF server, you are prompted for <domain>\<computer_name> for the PI AF server machine and the computer account for that machine is added to the local AFServers group. No user account for the PI AF Application Service is added to the local AFServers group. If you configure the Application Service to run as a domain account, you can add that account to the AFServers group on the PI AF SQL computer.

• A SQL Server login is created and mapped to the AFServers local user group. The SQL Server login has the necessary access required for the PI AF Application Service.

If you do not select the Execute SQL Script option, the following rules apply:

• The local AFServers group is not created and you need to create it manually and populate it on the PI AF SQL Server database machine. Use the rules above to populate this local group manually.