ArcGIS Server failure issues following Windows Server patching updates

[HenokA]

We are having a problem with a standalone ArcGIS Server 10.9.1 that keeps failing every time there is a periodic non-ESRI patching (Windows Server patching). Then the ArcGIS Server service has to be manually restarted to bring Server back online.

And simply going for manual ArcGIS Server service restart does not address the issue and throws 

"Error 1069 : The service did not start due to logon failure".

Instead,  the ArcGIS Server account password has to be re-entered before successfully restarting manually.

It appears some operating system process is likely modifying the ArcGIS Server Service Account password during the Windows Server patching update, as perhaps explained in this ESRI workaround. 

Any hint or workaround to resolve this issue? What aspect of the Windows  Server patching is likely forcing this change in the ArcGIS Server Service Account password leading to ArcGIS Server failure?

Greatly appreciate your response to this,

Thank you.

[ChrisUnderwood]

Hello @HenokA  your ArcGIS Server account will be a Windows user, either Local or Domain. And if a Windows patch resets a Windows user's password, then I think you need to ask your IT people to help. Perhaps the patch is enforcing a password complexity or re-use policy that was not there before.

You could try a simple test of the user's password, eg right-click on a Notepad icon, select Run as a different User, and enter the ArcGIS Server account credentials there. That will confirm if the problem is indeed the password or something else like permissions etc

[HenokA]

Thank you, Chris.

[NateMurry_NOAA]

Greetings all:

For the benefit of the community, I was able to track down what was happening here.

The clue to what is going on is what pops up when I manually re-enter the password for the ArcGIS server service user account '.\admin', as one of us always has to do after Windows server updates:

​​Th​e obvious implication of the above dialog is that shortly prior to this point (but after the Windows Server updates), the account​ '​.\admin' (the ArcGIS Server service user account), was NOT granted the 'Log On As A Service' right.  So​, before re-entering the ArcGIS Server service password, I checked the Local Security Policy, under ​Local Policies and User Rights Assignment.  Sure enough, the ArcGIS Server service account, '​.\admin', is ​​not in the list of accounts that can log in as a service.

​After re-entering the ArcGIS Server service password, a recheck of the Local Security Policy as above now shows that the ArcGIS Server service account 'admin' is in the list of accounts that that can 'Login As A Service'.  In our case, this change cannot be done manually here, as the option to 'Add User or Group' is grayed out.  I had to re-enter the password in the service dialog in order for the account to be re-added to the list that can login as a service.

--Nate