PI Nexus+ / Reference
Access Issues
This reference lists the issues PI Nexus+ raises on PI and AF identities. Only administrators see them. The User Guide chapter Access links here.
Overview
This reference lists the issues PI Nexus+ raises on PI and AF identities. Only administrators see them. The User Guide chapter Access links here.
Access issues
Category Access on the Issues page, and the Issues tab of the Access workspace. Each issue is raised on one identity of one PI Data Archive or AF Server; the title carries the details, such as the number of points or the account. They do not change health percentages. Where Fix... is listed, an administrator can let PI Nexus+ make the change (see Fixing issues in the User Guide); every other issue can be staged in Act.
An identity reaches every account when it is PIWorld and enabled, or an enabled mapping names Everyone, Authenticated Users, Domain Users or a group that contains every account. An admin identity is piadmins, or a PI identity with write on PIDBSEC, PIUSER or PIMAPPING; on AF, an identity with admin on the server's Database collection.
| Issue | Severity | Raised when | Typical fix |
|---|---|---|---|
| Every account can write | Error | An enabled identity reaches every account and holds write or admin in server-level security, or PIWorld is enabled and holds write in database security (write on PIMSGSS, the message log, does not count) | Remove the broad mapping or the right. Fix... |
| Every account can write PI points | Error | An enabled identity reaches every account and has write in the datasecurity (values) or the ptsecurity (configuration, security included) of PI points | Remove the identity's write from the points' security. Fix... |
| Every account can change displays | Error | An enabled AF identity reaches every account and may write, fully control or administer PI Vision folders or displays | Narrow the folder or display permissions |
| Every account can change AF objects | Error | An enabled AF identity reaches every account and may write, delete or administer AF databases, element templates, elements or analyses | Remove those rights from the identity. Fix... |
| Admin identity mapped broadly | Warning | An enabled admin identity has an enabled mapping to a principal that means every account, or to an OpenID Connect client | Map a dedicated admin group instead. Fix... |
| Mapping to an invalid account | Warning | An enabled mapping names a disabled account, or one the directory does not resolve (deleted, or outside the current forest and unknown to Windows; an External account that Windows can name is not flagged) | Remove the mapping or point it at a current account. Fix... |
| PI password login | Warning | On a PI Data Archive, piadmin is enabled, or an enabled PI user allows explicit (password) login | Disable piadmin and use mappings; move the PI user to Windows authentication |
| PIWorld enabled | Warning | PIWorld is enabled: whatever it may read or write, every authenticated user can | Grant those rights through mappings, then disable PIWorld. Fix... |
| Every account can publish or administer PI Vision | Warning | An enabled AF identity that reaches every account holds the PI Vision Publisher or Admin capability on an instance | Give the capability to a narrower identity |
| Every account can run analyses | Warning | An enabled AF identity reaches every account and has execute on analyses: anyone can start, stop or backfill them, which rewrites their outputs | Remove execute from the identity. Fix... |
| Local administrators are server administrators | Warning | BUILTIN\Administrators of the server's host is mapped to an admin identity, the installation default | Map a dedicated admin group, then remove this mapping. Fix... |
| Mapped to several identities | Info | One account or group is mapped (enabled or not) to two or more identities on the same server; raised on each of them | Check that it needs the rights of all of them |
| Outdated mapping name | Info | The account name stored with a mapping, or a mapping name written as DOMAIN\account, differs from the account's current name. The mapping still works | Rename the mapping so reviews read the current name |
| Mapping to a disabled identity | Info | A disabled identity has enabled mappings, which have no effect | Remove the mappings, or enable the identity. Fix... |
| Display shared wider than its data | Info | An identity may open displays whose PI point or AF data some of its accounts cannot read: for them those values stay empty | Grant read on the points (ptsecurity and datasecurity) or read data on the elements, or narrow the display |
| Disabled identity keeps point write | Info | A disabled identity still has write in the datasecurity or ptsecurity of PI points: it grants nothing today, but enabling it gives everyone mapped to it (PIWorld: every user) that write | Remove the write before the identity is enabled |
| Admin held by an individual account | Info | A user or managed service account is mapped on its own to an enabled admin identity (NT SERVICE accounts are not counted) | Map a group instead; give a service account only the identity its job needs |
| Accounts mapped individually | Info | Three or more accounts are mapped one by one to an enabled identity without admin rights | Put them in a group and map the group |
| Redundant mapping | Info | An account is mapped directly to an identity and is also a member of a group mapped to it | Remove the direct mapping. Fix... |
| Mapping to an empty group | Info | An enabled mapping names a group the directory reports without members, so it grants nothing | Remove the mapping or fill the group. Fix... |
| Unused identity | Info | An enabled identity has no enabled mapping (nobody holds it), or is named in no security (it grants nothing). PI groups and PI users with password login count as held. Not raised for built-in identities (piadmin, piadmins, PIWorld, PIUserIncompatible, PIGroupIncompatible; AF Administrators, World, Owner, Asset Analytics, Asset Analytics Recalculation, Notifications, RTQP Engine), on a server whose last read was not complete, or as "grants nothing" before the server's object security is read | Map a group to it, grant it what its accounts need, or remove or disable it. On a PI Data Archive, first check that no PI trust uses it: trusts are not read. Fix... |
| Review overdue | Info | An enabled identity that can change data or configuration (Write or Admin at server level, or write on PI points, PI Vision displays or AF objects) was last reviewed more than 365 days ago. Never-reviewed identities are not raised | Review it again and choose Mark reviewed; the issue resolves |
