Task 4: Change the login credentials for your interfaces

Before creating new mapping based on your deployment scenario, determine if the user account configured for your interfaces (User1) is sufficient for your deployment and security needs. If the existing account is sufficient and aligns with the new mappings, use it as the Windows account for the upgraded PI API.

Note: You must restart an interface for any service account change to take effect on the interface. Evaluate your situation carefully regarding the downtime around the time necessary for an interface restart. It is important to understand the estimated downtime for your specific interface, as well as planning for the process.

Consider the following factors on whether to preserve your existing Windows account or create a new account for the PI API upgrade under the following scenarios:

• The Interface node is on a trusted domain computer. For this type of scenario, if the Windows account is either a domain Managed Service Account (MSA) or custom domain account, you can just use the same account for the upgraded PI API. An acceptable alternative can be to use a Network Service account or Virtual account.

• The Interface node is on a workgroup or untrusted domain. For this type of scenario, if the Windows account is a Local System account (domain account using Windows Credentials Manager), you can just use the same account for the upgraded PI API. However, if the Windows account is a Local System Account (mirrored Local System account on Data Archive), we recommend creating a new account for better security.

In addition, consider the following when changing the log on properties for the interface (running as a service).

• The new user account should have the permissions to the data source. Refer to the interface user guide specific to your interface for this information, available at the Customer Portal.

• The new user account should have permissions to access folders and files on the Interface node required for the interface to run correctly. You can determine whether any specific folders and file permissions are necessary by referencing the specific PI interface user guide available from the Customer Portal.

1. Open Services in your Interface node machine by using the Start menu > services.msc command. The PI interfaces run as services and will show up in this window.

2. Click on Properties.

3. Select each PI interface, listed as a service.

4. Enter the log on credentials for each interface to reflect the selected Windows account determined in an earlier task. See Task 3: Identify Windows account for your interfaces.

5. Restart the interface.

6. Verify that the interface is able to function correctly and still connecting to Data Archive through trusts.

   This verifies that the new user account for the interface does not have permission issues with the data source.