Configure user access without local Windows groups

If you are not using AF Identities to define access to administrators, PI Vision Users, or Utility Users and you are not allowed to create any of the Windows groups due to a local security policy, you can change the authorization rules in IIS Manager to use domain groups. Add two application settings in Internet Information Services (IIS) Manager. Enter domain groups in the format: <domainname>\<groupname>.

1. Run Internet Information Services (IIS) Manager.

2. To replace the PI Vision Users local group:

   1. In the Connections pane, select Sites > Default Web Site > PIVision.

   2. In the Features View > ASP.NET group, double-click Application Settings.

   3. Right-click the Application Settings page, and then select Add to open the Add Application Setting window.

   4. In the Name field, enter VisionUser.

   5. In the Value field, enter the domain group that can access the AVEVA PI Vision application.

   6. Select OK.

3. To replace the PI Vision Admins local group:

   1. In the Connections pane, select Sites > Default Web Site > PIVision.

   2. In the Features View > ASP.NET group, double-click Application Settings.

   3. Right-click the Application Settings page, and then select Add to open the Add Application Setting window.

   4. In the Name field, enter VisionAdmin.

   5. In the Value field, enter the domain group that can access the AVEVA PI Vision Admin site.

   6. Select OK.

4. To replace the PI Vision Utility Users local group:

   1. In the Connections pane, select Sites > Default Web Site > PIVision > Utility.

   2. In the Features View > ASP.NET group, double-click Application Settings.

   3. Double-click the UtilityUsers setting to open the Edit Application Setting window.

   4. In the Value field, enter the domain group that can access the AVEVA PI Vision utilities.

   5. Select OK.