Protect piadmin

The piadmin PI user is the Data Archive super-user account, and measures should be taken to protect this powerful account.

Note: Do not use piadmin for normal administrative tasks.

• Disable explicit logins for the piadmin account (Disable explicit logins for piadmin). Explicit logins (also called password authentication) on the Data Archive server are not nearly as secure as Windows authentication or PI trusts. Instead, control access to this account through Windows authentication.

• If you cannot disable explicit logins for the piadmin account, then at least make sure that the piadmin account does not have a blank password. New Data Archive installations require a password for piadmin. While this is not mandatory for upgrades, it is strongly recommended.

• Restrict piadmin access to a small group of trusted administrators.