Checklist: Configure Windows authentication for new installations

Identify user access categories

Understand how to identify user access categories

Create a PI identity for each access category (you can also use built-in identities, users, or groups, such as piadmins)

Understand PI identities

If using AD, determine which AD groups are needed and which identities to map them to

(if using AD) See Learn how to review Active Directory configuration

If using local Windows security, determine which local Windows groups are needed and which identities to map them to

(only if using local Windows security) See Configure Windows groups

If using local Windows security, configure matching Windows user accounts and passwords on Data Archive server and client workstations

(only if using local Windows security) See Use local Windows security or Understand local Windows security with AD

Create the mappings

for AD: Map AD groups to PI identities

for local Windows security: Create mappings

Configure access permissions

Understand how to configure access permissions

Configure authentication for interfaces

Configure PI interface connections using PI trusts

Check custom PI API applications, if any

(only for installations with existing clients & interfaces) See Check for unauthenticated PI API connections

Upgrade PI SDK on client computers to 1.3.6 or later

(only for installations with existing clients & interfaces; required for Windows authentication)

Upgrade PI API to PI API 2016 for Windows Integrated Security on client computers

(required for Windows authentication)

Configure clients that connect through an application server (for example, PI DLES and PI WebParts)

(if any) See Products that connect to an application server

Upgrade administrative applications:

• PI SMT version 3.3.1.3 or later

• PI Builder

• Module Database Builder version 1.2.1.3 or later

• PI ICU 1.4.7 or later

• PI APS 1.2.5.0 or later

(only for installations with existing clients & interfaces) See Administrative client applications

Disable explicit logins

(Optional) See Learn how to disable PI password authentication (explicit logins)