PI AF and Service Principle Name Registration

SPN registration in PI AF 2.2 and 2.3

By default, for PI AF 2.2 and 2.3, a PI AF server attempts to register a Service Principal Name (SPN) for the PI AF Application Service upon startup, if the PI AF Application Service is running under the NetworkService account and the servicePrincipalName value is defined in the AFService.exe.config file. This value is defined by default.

SPN registration in PI AF 2.4 and greater

For PI AF 2.4 and greater, the PI AF Application Service attempts to register an SPN upon startup, if the servicePrincipalName value is defined in the AFService.exe.config. This value is defined by default. Depending on the account type, the SPN is created in different ways:

• If the PI AF Application Service is running under the virtual account, NT SERVICE\AFService, introduced in PI AF 2.7, or the NetworkService account, the SPN is created for the machine account for the machine on which the service is running.

• If the PI AF Application Service is running under a domain account, the SPN is created for that domain account.

• If the PI AF Application Service is running on a Windows Cluster, there are special circumstances surrounding SPN registration. See PI AF server installation in a failover cluster.

SPN registration with domain accounts

Local computer accounts, such as NetworkService, typically have permission to set an SPN. However, domain accounts often do not. If the PI AF Application Service is running under an account that does not have the privilege to create an SPN, you need to perform extra configuration for a client such as PI System Explorer to connect to that PI AF Application Service using an SPN. There are multiple ways to set the necessary configurations:

• Have an administrative user manually register the SPN. A domain admin generally manages SPNs. For detailed instructions, see Manage SPNs for the PI AF application service.

• Assign permissions to the domain account under which the PI AF Application Service runs so the service can manage the SPN creation. A domain admin generally manages these permisssions.