When is the ArcGIS Server account used?

The ArcGIS Server account is used for the following purposes:

• Start and stop processes that support the GIS server and services.
• Read the GIS data behind your services.
• Read and write files to the ArcGIS Server directories; for example, when you create a map cache, the ArcGIS Server account writes the cache tiles into your server cache directory.
• Read and write files to the configuration store; for example, when you create a new cluster in Manager, the ArcGIS Server account writes the cluster configuration information to files in the configuration store.
• Read and write files to the ArcGIS Server installation location and system temp directory; for example, the account writes log files that you can use to troubleshoot the server.
• Read and write log messages to the logs directory.

Which account should I designate as the ArcGIS Server account?

The ArcGIS Server account defaults to the name arcgis. Accepting this default is sufficient for most nonproduction deployments; however, for production systems, it's recommended that you create a domain or Active Directory account prior to installing ArcGIS Server. If your organization's security policy requires passwords to expire, be aware that you will need to run the Configure ArcGIS Server Account utility to update the expired password.

You are allowed to specify a local account or a domain account. A recommended approach is to export the setup configuration file and reuse it on subsequent installations of ArcGIS Server. In this manner, you can guarantee that the ArcGIS Server account is configured exactly the same on all the GIS servers in your site.

What permissions do I need to grant to the ArcGIS Server account?

The ArcGIS for Server installation grants permissions to the ArcGIS Server account to perform basic functions such as starting and stopping server processes. It also gives the account read permissions to all folders in the ArcGIS for Server installation directory and full control permissions to the following folders:

• <ArcGIS for Server installation directory>\framework
• <ArcGIS for Server installation directory>\geronimo
• <ArcGIS for Server installation directory>\usr
• <ArcGIS for Server installation directory>\bin
• <ArcGIS for Server installation directory>\XMLSchema

Before you create your site, you should grant the ArcGIS Server account the following:

• Read and write permissions to the location where your server directories will be created. Keep in mind that you'll need to grant the ArcGIS Server account read and write permissions to any new server directories that you create after configuring your site.
• Read and write permissions to the location where your configuration store will be created.
• Read and write permissions to <ArcGIS Server installation directory>\arcgisserver\logs and permission to create this folder if you have not already manually created it.
• Read permissions to the directories containing the database connection files that you'll register with the server before publishing. If you'll be using Windows authentication instead of database authentication, you'll need to also grant the account write access.
• Read permissions to the GIS data folders that you'll register with the server before publishing. If you allow the publishing process to copy your data to the server (see Copying data to the server automatically when publishing), the data is placed in your server directories where the ArcGIS Server account was already granted permissions. You do not have to apply any more permissions to your original server directories.

When you create your site, the ArcGIS Server account is given permissions to read and write to the ArcGIS Server logs directory. If you create a new log location, you will need to manually grant the ArcGIS Server account read and write permissions to it.

The ArcGIS Server account does not need to be in the Administrators group on any machine in your site.

Changing the ArcGIS Server account

You don't need to rerun the ArcGIS Server installation to change the ArcGIS Server account. After you install, you can change the account by running the Configure ArcGIS Server Account utility, which is included with the software. You might do this to respond to a change in security policy or when troubleshooting your server.

It's recommended that you use this utility instead of trying to manually change the ArcGIS Server account with your operating system tools. The utility has been designed to apply permissions to all necessary directories (as explained above) across all the machines in your deployment. If you try to change the account manually and you make a mistake, you could experience server failure and downtime.

To change the ArcGIS Server account using the utility, follow these steps:

1. On one GIS server in your site, browse to the utility from the Windows Start menu under ArcGIS > ArcGIS for Server > Configure ArcGIS Server Account.
2. Specify the name and password for the account you want to designate as the ArcGIS Server account. Click Next.
3. Optionally specify the root server directory and configuration store locations used by your ArcGIS Server site. For example
   • If your root server directory and configuration store are available through local drive letter paths, and you specify these directories in the utility, the utility automatically grants the new account read and write permissions to the directories.
   • If your root server directory and configuration store use network (UNC) paths, leave these fields empty and manually grant the new account read and write permissions to the directories after completing the utility.
4. Optionally specify the logs directory location. If you enter a location, the utility automatically grants the new account read and write permissions to the directory. If you leave this field empty, you'll need to manually grant the new account read and write permissions to the directories on every GIS server in your deployment after completing the utility.

   Note:

   The logs directory is not related to the server directories or the configuration store location. If you change the location of the logs directory, try to keep the location at the root level of your GIS server. You cannot designate a network directory as the log location. For more information, see About server logs.

5. Click Next.
6. On the Export server configuration file dialog box, consider the following:
   • If you only have one GIS server in your deployment, you can optionally save the configuration file. Be sure to store it in a secure location. Click Next.
   • If you have multiple GIS servers in your deployment, export the configuration file. This saves you from reentering the information into the utility for the remaining machines in your site. In this manner, you can guarantee that the ArcGIS Server account is configured exactly the same on all the GIS servers in your site. Specify a secure location for the configuration file and click Next.
7. On the summary panel, review the account properties and click Configure. Your new account is configured as the ArcGIS Server account. Close the utility.
8. Run the utility on each of the remaining machines in your site. You can point the utility to the configuration file you created earlier or reenter the information you provided above.
9. Grant the new account read permissions to the data directories and database connection files you've registered with the server. If you're using Windows authentication instead of database authentication, you'll need to also grant the account write access to the connection files. For instructions on how to do this, see Registering your data with ArcGIS Server using ArcGIS for Desktop.

Specifying the locale of the ArcGIS Server account

The locale of the ArcGIS Server account is set to the locale of the Windows account specified during the installation. If no account is specified and the default is used (arcgis), the locale of the account is determined by your operating system settings. The locale is important, since all messages generated by the server, such as logs, are displayed in the locale of the ArcGIS Server account. To display the server's messages in a different language or format, you'll need to do the following:

1. On the machine hosting ArcGIS Server, log in as the ArcGIS Server account.
2. Open Control Panel and select Region and Language.
3. Click the Formats tab and select the desired country from the Format drop-down list.
4. Click the Keyboards and Languages tab and change the Display language to the desired language.
5. Click the Administrative tab and select the desired system locale by clicking the Change system locale button.
6. Click OK.