Security-related Update to Custom ArcGIS Server GP Environment Documentation

Anonymous User — Fri, 04 Mar 2022 18:42:34 GMT

At version 10.9.1 (and recent earlier versions), the Esri documentation for setting up a custom Python geoprocessing environment for all services states...

"Sign in to your ArcGIS Server machine with the ArcGIS Server account..."

Like many organizations, we use a domain service account to run ArcGIS Server. It's contrary to our policy (and security best practices) to grant service accounts more permissions than are strictly necessary, including remote desktop access. I'd like to suggest the Windows documentation be updated to something like the following, which works perfectly:

Sign in to your ArcGIS Server machine as an administrator
From the Start Menu, choose Run
In the Run dialog enter the following:

runas /user:[your_arcgis_server_account] cmd.exe

Enter the ArcGIS Server account password
Change directory to... [remaining steps are the same]

This works fine for setting up and swapping to a custom conda environment without expanding the security footprint of the service account. I've never needed to RDP to an ArcGIS server using our service account before, so this stuck out to me. That said, ArcGIS Enterprise 10.9.1 has been great. Thanks for all your hard work!

Re: Security-related Update to Custom ArcGIS Server GP Environment Documentation

JianLange1 — Fri, 09 Dec 2022 22:33:06 GMT

Thank you for your feedback! We updated the documentation to address your concerns with ArcGIS Enterprise 11.1 release (planned for early 2023). Bear in mind that some organizations prohibit secondary logons by disabling the service.

idea Security-related Update to Custom ArcGIS Server GP Environment Documentation in ArcGIS Enterprise Ideas

Security-related Update to Custom ArcGIS Server GP Environment Documentation

Re: Security-related Update to Custom ArcGIS Server GP Environment Documentation