Troubleshooting PI Web API Access on Windows Server 2012: The IE Enhanced Security Lesson

When deploying OSIsoft's PI Web API, one of the first steps after installation is to verify that the service is running and accessible at the default endpoint, typically https://localhost/piwebapi. However, successfully starting the service doesn't always guarantee immediate access to the API, especially on systems with strict security settings such as Windows Server 2012.

Recently, a user named Kireet faced exactly this scenario. Despite following all documentation, verifying logs, and ensuring the service was active, attempts to load the PI Web API in a browser resulted in a blank or empty response. Only after in-depth troubleshooting and a review of server security settings did the solution become clear—Internet Explorer Enhanced Security Configuration (IE ESC) was blocking the content.

Common Troubleshooting Steps

When you encounter PI Web API access issues:

1. Verify Service Status: Use the Services control panel to ensure "PI Web API" is running.
2. Consult Documentation: The PI Web API Troubleshooting Guide offers a comprehensive checklist.
3. Check Event Logs: Enable Analytic and Debug logs in Event Viewer under Applications and Services Logs>PI Web API. Look for errors or warnings around service startup and listening endpoints.
4. Examine Port Bindings and Certificates:
   • Confirm appropriate SSL certificate bindings using netsh http show sslcert.
   • Verify firewall rules permit traffic on port 443 (HTTPS).
5. Browser-specific Issues:
   • Try accessing the endpoint from a different browser or machine to rule out local browser issues.
   • Review browser security settings.

The Role of IE Enhanced Security Configuration

Windows Server installations often have IE Enhanced Security Configuration enabled by default. This feature restricts the ability of IE to access intranet and Internet sites, disables scripts, and restricts various content types. For developers and administrators, this can result in pages appearing blank, failing to load, or being non-functional, even if the back-end services are working perfectly.

Solution:

• Disable IE Enhanced Security Configuration for administrators (and users if necessary) via Server Manager > Local Server > IE Enhanced Security Configuration. Alternatively, use a different browser like Edge or Chrome, which are unaffected by IE ESC.

Key Takeaways

• When installing PI Web API on Windows Server, do not overlook browser and OS-level security features.
• If troubleshooting turns up empty with logs and the service is running, check for IE ESC and similar browser restrictions.
• Use the official troubleshooting guide and always try accessing the endpoint from multiple environments to isolate the problem.

An ounce of awareness around IE Enhanced Security can save hours of debugging and help you get your PI Web API deployment running smoothly!

Have you run into similar web API accessibility issues on secured servers? Share your experiences and solutions below!