The ArcGIS Server account

As ArcGIS Server does its work, it needs to start and stop processes, read and write data to locations on the file system, and communicate between machines. To do these things securely, it uses an operating system account that you specify when you install ArcGIS Server. This is known throughout the documentation as the ArcGIS Server account.

When is the ArcGIS Server account used?

The ArcGIS Server account is used for the following purposes:

• Start and stop processes that support ArcGIS Server and services.
• Read the GIS data behind your services when the registered database uses operating system authentication.
• Read and write files to the ArcGIS Server directories; for example, when you create a map cache, the ArcGIS Server account writes the cache tiles into your server cache directory.
• Read and write files to the configuration store; for example, when you create a new cluster in ArcGIS Server Manager, the ArcGIS Server account writes the cluster configuration information to files in the configuration store.
• Read and write files to the ArcGIS Server installation location and system temp directory; for example, the account writes log files that you can use to troubleshoot the server.
• Read and write log messages to the logs directory.

Note:

The ArcGIS Server account is not the same as the primary site administrator that you define when you create the ArcGIS Server site. For more information, see Securing your ArcGIS Server site.

Which account should I designate as the ArcGIS Server account?

The ArcGIS Server account defaults to the name arcgis. Accepting this default is sufficient for most nonproduction deployments; however, for production systems, Esri recommends that you create a domain or Active Directory account prior to installing ArcGIS Server. If your organization's security policy requires passwords to expire, be aware that you will need to run the Configure ArcGIS Server Account utility to update the expired password.

You are allowed to specify a local account or a domain account. You can export the setup configuration file when you install ArcGIS Server on the first machine in your site and use the configuration file when you install ArcGIS Server on the other machines in your site. That way, you guarantee that the ArcGIS Server account is configured exactly the same on all the machines in your site.

Domain account

A domain account makes it easier to access data on remote systems. A domain account is also preferable for security purposes because the account is centrally managed.

When specifying a domain account, use the format DOMAIN\username. If you do not specify the domain, the ArcGIS Server installation wizard creates a local account with the user name you specified. If you specify a domain account that does not exist, the installation returns an error.

If your logon settings deny login rights to the machine where ArcGIS Server is installed, you will encounter an error during the installation. It is not necessary to grant Log on locally group policy settings to the ArcGIS Server account. For more information, see Advanced considerations when using domain accounts.

Local account

If you've chosen a local account, the local account and password must exist on each machine in the ArcGIS Server site and be identical. You can create the local account with the same password on each machine before installing ArcGIS Server, or you can let the ArcGIS Server installation wizard create the local account; just be sure to use the same user name and password on every machine in the site.

If you're creating a new local account as part of the installation, the password you specify for the account must adhere to your operating system's local security policy. If the password does meet the minimum strength requirements of your operating system, the installation returns an error. Consult the Microsoft documentation for the version Windows you are using to learn how to check the security policy on your machines.

I have an SOC account from an ArcGIS Server 10 or earlier release site. Can I designate this as the ArcGIS Server account?

Prior to 10.1, ArcGIS Server required you to create an account called the SOC account and grant it permissions to all data folders. If you already have an SOC account and its permissions in place, you can specify it as the ArcGIS Server account when you upgrade. This can reduce or eliminate the need to reassign permissions during migration.

Can I use the Windows native Local System account to run the ArcGIS Server service?

Yes; however, it is not recommended for the following reasons:

• The Windows LocalSystem account is highly privileged, and this has security implications. For details, see The LocalSystem Account in the Microsoft Development Center.
• The LocalSystem account is not intended for accessing network locations. To access your service and site data, you'll have to store the data locally.
• In a site with multiple machines, you cannot use LocalSystem as the ArcGIS Server account.

What permissions do I need to grant to the ArcGIS Server account?

The ArcGIS Server installation grants permissions to the ArcGIS Server account to perform basic functions such as starting and stopping server processes. It also gives the account read permissions to all folders in the ArcGIS Server installation directory and full control permissions to the following folders:

• <ArcGIS Server installation directory>\framework
• <ArcGIS Server installation directory>\geronimo
• <ArcGIS Server installation directory>\usr
• <ArcGIS Server installation directory>\bin
• <ArcGIS Server installation directory>\XMLSchema
• <ArcGIS Server installation directory> \DatabaseSupport

Before you create your site, you should grant the ArcGIS Server account the following permissions:

• Read and write permissions to the location where your server directories will be created. Keep in mind that you must grant the ArcGIS Server account read and write permissions to any new server directories that you create after configuring your site.
• Read and write permissions to the location where your configuration store will be created.
• Read and write permissions to <ArcGIS Server installation directory>\arcgisserver\logs and permission to create this folder if you have not already manually created it.
• Read permissions to the directories containing the database connection files that you'll register with the ArcGIS Server site before publishing web services. If you'll be using Windows authentication instead of database authentication, you must also grant the ArcGIS Server account write access.
• Read permissions to the GIS data folders that you'll register with the ArcGIS Server site before publishing web services. If you allow the publishing process to copy your data to the server (see Copying data to the server automatically when publishing), the data is placed in your server directories where the ArcGIS Server account was already granted permissions. You do not have to apply any more permissions to your original server directories.
• Full control permissions on the Python27 folder. By default, this folder is located C:\Python27.

When you create your site, the ArcGIS Server account is given permissions to read and write to the ArcGIS Server logs directory. If you create a new log location, you need to manually grant the ArcGIS Server account read and write permissions to it.

The ArcGIS Server account does not need to be in the Windows Administrators group on any machine in your site.

Changing the ArcGIS Server account

You don't need to rerun the ArcGIS Server installation to change the ArcGIS Server account. After you install, you can change the account by running the Configure ArcGIS Server Account utility, which is included with the software. You might do this to respond to a change in security policy or when troubleshooting your server.

Use this utility instead of trying to manually change the ArcGIS Server account with your operating system tools. The utility is designed to apply permissions to all necessary directories (as explained above) across all the machines in your deployment. If you try to change the account manually and you make a mistake, you could experience server failure and downtime.

To change the ArcGIS Server account using the utility, follow these steps:

1. On one machine in your ArcGIS Server site, open the Configure ArcGIS Server Account utility.
2. Specify the name and password for the account you want to designate as the ArcGIS Server account. Click Next.
3. Optionally specify the root server directory and configuration store locations used by your ArcGIS Server site. For example
   • If your root server directory and configuration store are available through local drive letter paths, and you specify these directories in the utility, the utility automatically grants the new account read and write permissions to the directories.
   • If your root server directory and configuration store use network (UNC) paths, leave these fields empty and manually grant the new account read and write permissions to the directories after completing the utility.
4. Optionally specify the logs directory location. If you enter a location, the utility automatically grants the new account read and write permissions to the directory. If you leave this field empty, you'll need to manually grant the new account read and write permissions to the directories on every machine in your ArcGIS Server site after completing the utility.

   Note:

   The logs directory is not related to the server directories or the configuration store location. If you change the location of the logs directory, try to keep the location at the root level of your ArcGIS Server site. You cannot designate a network directory as the log location. For more information, see About server logs.

5. Click Next.
6. On the Export server configuration file dialog box, consider the following:
   • If you have multiple machines in your ArcGIS Server site, export the configuration file. This saves you from reentering the information into the utility for the remaining machines in your site. In this manner, you can guarantee that the ArcGIS Server account is configured exactly the same on all the machines in your site. Specify a secure location for the configuration file and click Next.
   • You can export and save the configuration file if you only have one machine in your ArcGIS Server site, you can optionally save the configuration file. Be sure to store it in a secure location and click Next.
7. On the summary panel, review the account properties and click Configure. Your new account is configured as the ArcGIS Server account. Close the utility.
8. Run the utility on each of the remaining machines in your site. You can point the utility to the configuration file you created earlier or reenter the information you provided above.
9. Grant the new account read permissions to the data directories and database connection files you've registered with the ArcGIS Server site. If you're using Windows authentication instead of database authentication, you need to also grant the account write access to the connection files.

Changing the ArcGIS Server account from the command line

Rather than run the Configure ArcGIS Server Account utility wizard, you can run the executable from a command prompt. The ServerConfigurationUtility.exe command line utility is installed in <ArcGIS Server installation location>\bin. You could script updates to the ArcGIS Server account after applying updates to your organization's security policy.

The available parameters are as follows:

ServerConfigurationUtility [/readconfig] | [/writeconfig] | [/username] | [/password] | [/rsdir] | [/csdir] | [/logsdir]

• <readconfig>—Optional path to a configuration file you have saved from a previous run of the utility.
• <writeconfig>—Optional path where a configuration file will be saved so you can apply the same properties in future runs of the utility.
• <username>—The name to use for the ArcGIS Server account.
• <password>—The password for the ArcGIS Server account.
• <rsdir>—The path of the root server directory. This parameter is optional, but if you don't supply it, you'll need to manually grant the ArcGIS Server account read and write permissions to the root server directory.
• <csdir>—The configuration store directory. This parameter is optional, but if you don't supply it, you'll need to manually grant the ArcGIS Server account read and write permissions to the configuration store.
• <logsdir>—The path to the ArcGIS Server logs directory. This parameter is optional, but if you don't supply it, you'll need to manually grant the ArcGIS Server account read and write permissions to the logs directory.

Example: ServerConfigurationUtility /writeconfig c:\temp\myconfig.xml /username arcgisnew /password secret /rsdir c:\arcgisserver\directories /csdir c:\arcgisserver\config-store /logsdir c:\arcgisserver\logs

Specifying the locale of the ArcGIS Server account

The locale of the ArcGIS Server account is set to the locale of the Windows account specified during the installation. If no account is specified and the default is used (arcgis), the locale of the account is determined by your operating system settings. The locale is important, since all messages generated by ArcGIS Server, such as logs, are displayed in the locale of the ArcGIS Server account. To display the messages in a different language or format, you'll need to change the display language for the ArcGIS Server account for each machine in your ArcGIS Server site. See Microsoft documentation for specific instructions for the operating system version you are using.