Making backups with PSA Disabled: How?

Question

So we're required to follow all of the ArcGIS Server Security "Best Practices", which include disabling the PSA account...which now results in Back up and restore your ArcGIS Server site configuration—ArcGIS Server Administration (Windows) | ArcGIS Enterprise  no longer working, as it complains that either the u and p is missing when I don't include, or when I do include it, fails and complains they're wrong. Anybody else have a work-around for this? Some .py code that will enable, then disable, the PSA as part of the routine?

ThomasColson · Answer

Yes, but the problem continues...can't "bake" AD login credentials into a .py that's tied to Windows Task Scheduler, can't add a service account to the admin role, all AD logins are by PIV-card only....the real solution here would be to create a "Backup" role in the ArcGIS Server web-tier security scheme, and allow site backups to be triggered by service accounts coming from AD, not a PSA. I can easily generate a token at the admin interface, but the backup scripts are running nightly, automated. This was working fine 'till I started paying attention to the "Highly Secure" doc.

JakeSkinner · Answer

You should be able to use another account that is part of your Administrator group to generate the token.  Are you using web tier authentication?

ThomasColson · Answer

Thanks, but there's a catch: to generate a token you need a user name and pw....and if the PSA is initially disabled, using the PSA login results in "

Failed to log in. Invalid username or password specified."

when trying to generate a token. BTW, this is in an https-only, Windows Active Directory-Web Adapter only, environment.