topic Re: ArcGIS Server account permissions in ArcGIS Enterprise Questions

ArcGIS Server account permissions

ShaharLevenson — Sun, 09 Feb 2014 10:35:06 GMT

Hello,

My ArcGIS Server 10.2.1 is running under a domain account for the server account. I've been asked by the system admin why does the server account need full-control permissions to folders such as <ArcGIS for Server installation directory>\framework or the directories folder. Couldn't it just be given a read/write permission instead?

Thanks,
Shahar.

Re: ArcGIS Server account permissions

nicogis — Sun, 09 Feb 2014 16:06:37 GMT

Certainly a permission superior to reading & writing is needed for these folders: http://technet.microsoft.com/en-us/library/bb727008.aspx (see Special Permissions for Files and Folders)

Re: ArcGIS Server account permissions

LeoDonahue — Mon, 10 Feb 2014 14:15:27 GMT

If you've chosen a local account, the local account and password must exist on each GIS server and be identical

Ask your system administrator why this works. It's actually exploiting a security hole in the OS, my opinion.

I would say a local account is fine, but a domain account is easier to manage. If you change the password on a local account, you have to change it on every machine you use it on.

Also, according to the link you provided Shahar, what permission requires this:
Start and stop processes that support the GIS server and services.

Doesn't the installation grant all the necessary permissions to a local account that you need?

Re: ArcGIS Server account permissions

ShaharLevenson — Wed, 12 Feb 2014 06:11:58 GMT

The installation process gave indeed the necessary permissions to the account.

My SysAdmin just asked me out of curiosity why the account needed such a high-level permission and I couldn't find an ESRI documentation which explains it.
I'm guessing the account needs to be able to delete files regardless of file permissions, but I'm not sure.

Re: ArcGIS Server account permissions

LeoDonahue — Wed, 12 Feb 2014 16:43:55 GMT

High level permissions granted to a local user account that is defined to a specific application installation location. That seems fairly reasonable.