Enable Kerberos delegation when AVEVA PI Vision uses a custom domain account
- Last UpdatedMay 01, 2026
- 5 minute read
Note: This section doesn't apply if installing in an environment whose end users only use OpenID Connect authentication.
When AVEVA PI Vision uses a custom domain account, both application pools and Windows services associated with AVEVA PI Vision run as that account. To enable Kerberos delegation, you must configure the AVEVA PI Vision website to use the application-pool credentials, create necessary service principal names (SPNs), and configure the service account to support Kerberos, including enabling delegation to the needed Data Archive and PI AF servers. These tasks are further explained below as Phase 1, Phase 2, and Phase 3.
Note: Before you start, verify that you have the Validated Write to Service Principal Names privilege on the user or computer object in Active Directory. You need this privilege to create SPNs in this procedure. Contact your IT administrator if you have insufficient privileges.
Phase 1: Prepare the PI Vision website
Follow the steps below to configure the AVEVA PI Vision website to use the application-pool credentials.
-
In Internet Information Services (IIS) Manager, select the PIVision site, and then under Management, double-click the Configuration Editor icon to open the Configuration Editor page.
-
From the Section list, select system.webServer/security/authentication/windowsAuthentication.
-
Set the useAppPoolCredentials property to True and click Apply.
-
Open a command prompt and run the iisreset command.
Phase 2: Configure Service Principal Names (SPNs)
Follow the steps below to create two Active Directory service principal names (SPNs).
-
Open a command prompt.
-
Use the setspn -U -S command to create an SPN for the netbios name and for the fully-qualified DNS name of the AVEVA PI Vision application server:
setspn -U -S http/netbios-server-name domain\service-account
setspn -U -S http/fully-qualified-DNS-name domain\service-accountFor example:
setspn -U -S http/myserver mydomain\PIVisionService
setspn -U -S http/myserver.mydomain.int mydomain\PIVisionServiceNote: If you point to your host with an A record (address record), register the SPN to the host rather than the server name. If you point to your host with a CNAME record (canonical name record), register the SPN to the server name. For more information, see Configuring Kerberos for DNS Aliases (ANAME and CNAME) on the Customer Portal.
Note: If the application pool account is a group-managed service account (gMSA), either replace the -U switch with a -C switch OR ensure that a trailing $ is included when specifying the account you’re registering the SPN to. This is needed because gMSAs are more similar to computer accounts than user accounts.
Note: For more information on setspn syntax and switches, see the Microsoft article on setspn.
Phase 3: Configure Kerberos delegation
If PI Vision uses a standard domain account, continue to Phase 3A. If PI Vision uses a group managed service account (gMSA), continue to Phase 3B instead.
Phase 3A: Configure Kerberos delegation when PI Vision uses a standard domain account
-
On your domain controller, open Active Directory Users and Computers.
-
Under the domain of the AVEVA PI Vision application server, click Users.
-
Right-click the name of the AVEVA PI Vision domain account and then click Properties.
-
In the Properties windows, click the Delegation tab and select settings for the account:
-
Select Trust this user for delegation to specified services only.
-
Select Use Kerberos only for a more secure configuration, or select Use any authentication protocol for a more flexible configuration:
-
Use Kerberos only requires that AVEVA PI Vision authenticate all users with Kerberos. This typically requires that all users connect to AVEVA PI Vision from a Windows computer joined to a trusted Active Directory domain.
-
Use any authentication protocol allows AVEVA PI Vision to authenticate users with NTLM, which may be required in some network topologies or if users connect to AVEVA PI Vision on mobile devices.
-
-
-
Add services for each Data Archive server that AVEVA PI Vision will access.
-
Click Add to open the Add Services window.
-
Click Users or Computers.
-
Enter the name of your Data Archive server that AVEVA PI Vision accesses. If your Data Archive is using a custom service account, search for that name instead. Then click Check Names.
-
Click OK to return to the Add Services window populated with the list of all service types.
-
From the Available services list, click PIServer and then click OK to add the SPN for the Data Archive server.
-
-
Add services for each PI AF server that AVEVA PI Vision will access.
Repeat step 7 but enter the name of your PI AF server and click AFServer as the service type.
Note: If the PI AF server runs as a custom service account, then search for the PI AF server SPN by that service account rather than the machine name.
The services that you added appear in the Properties window.
-
Select Apply.
Phase 3B: Configure Kerberos delegation when PI Vision uses a group managed service account (gMSA)
Note: If you are using a group managed service account (gMSA) for PI Vision or for your PI Data Archive or PI AF Server, we recommend using resource-based constrained delegation as it is directly compatible with gMSAs. If PI Vision is using a gMSA and you need to use traditional Kerberos constrained delegation, continue with this section.
For group Managed Service Accounts, the Delegation tab doesn't appear in Active Directory Users and Computers. To configure delegation for these special accounts, you need to set the following two attributes on these accounts:
-
userAccountControl defines the type of delegation and whether or not protocol transition is allowed
-
msDS-AllowedToDelegateTo defines the list of backend resource SPNs to which delegation will be allowed
The procedure below sets these attributes via PowerShell, but they can be manually updated through properties as well. Refer to Microsoft article on Configuring Kerberos Delegation for Group Managed Service Accounts for more information on both methods.
-
Open PowerShell.
-
Define a variable for the PI Vision service account that runs under a gMSA. In the example below, the gMSA is named PIVisionSvc$.
$acct = Get-ADServiceAccount -Identity “PIVisionSvc$”
-
Set userAccountControl property to disable unconstrained delegation (-TrustedForDelegation set to $false) and choose to enable or disable protocol transition with the -TrustedToAuthForDelegation flag. See the Microsoft documentation on the options for this flag.
For example, to enable protocol transition (Use any authentication protocol)
Set-ADAccountControl -Identity $acct -TrustedForDelegation $false -TrustedToAuthForDelegation $true
-
Define variable for the list of PI Data Archive and Asset Framework Server SPNs to which PI Vision will delegate. The example below includes SPNs for a PI Data Archive named PIDA and an AF Server named PIAF on the domain mydomain.int.
$allowedSpns = @(
"PIServer/PIDA",
"PIServer/PIDA.mydomain.int",
"AFServer/PIAF",
"AFServer/PIAF.mydomain.int")
-
Update msDA-AllowedToDelegateTo attribute to include the $allowedSpns defined in the previous step.
Set-ADServiceAccount $acct -Add @{ 'msDS-AllowedToDelegateTo' = $allowedSpns }
-
To verify your configuration run the following command
Get-ADServiceAccount -Server 'mydomain.int' -Identity ' PIVisionSvc