A GIS administrator is installing Portal for ArcGIS and ArcGIS Server on separate machines. They need services to run continuously and comply with enterprise password policies. Which account should be used to deploy the software?

For a multi-machine ArcGIS Enterprise deployment, a domain account is necessary for the software components to communicate and access shared network resources. A group-managed service account (gMSA) is the recommended type of domain account for this purpose. A gMSA is managed by the domain controller, which handles password management automatically. This ensures that services can run continuously without interruption from password expiration policies, directly fulfilling the requirements of the scenario. Using a gMSA is a security best practice for enterprise environments.

A. A GIS administrator account: Using a personal administrator account is not best practice. If the administrator's password expires or the account is disabled, the ArcGIS services will fail.
C. Create local accounts for every machine being used: Local accounts do not have permissions to access network shares on other machines, which is a requirement for a distributed ArcGIS Enterprise deployment.
D. Windows built-in account with local admin privileges: Built-in accounts, such as the Local System account, have extensive local privileges but limited network access capabilities, making them unsuitable for multi-machine deployments.

1. Esri ArcGIS Enterprise Documentation. (2024). The ArcGIS Server account. ArcGIS Enterprise 11.2 Documentation. Retrieved from https://enterprise.arcgis.com/en/server/latest/install/windows/the-arcgis-server-account.htm.

Section: The ArcGIS Server account > Domain account: "For production systems

it's recommended that you use a domain account or group managed service account (gMSA)... A gMSA is a type of domain account that is managed by a domain controller. It provides a secure way to run services without having to manually manage the account's password."

2. Esri ArcGIS Enterprise Documentation. (2024). The Portal for ArcGIS account. ArcGIS Enterprise 11.2 Documentation. Retrieved from https://enterprise.arcgis.com/en/portal/latest/install/windows/the-portal-for-arcgis-account.htm.

Section: The Portal for ArcGIS account > Domain account: "For production environments

it is recommended that you use a domain account or a group managed service account (gMSA)."

3. Esri ArcGIS Enterprise Documentation. (2024). Accounts used by ArcGIS Enterprise. ArcGIS Enterprise 11.2 Documentation. Retrieved from https://enterprise.arcgis.com/en/portal/latest/administer/windows/accounts-used-by-arcgis-enterprise.htm.

Section: ArcGIS Server account: "In a multiple-machine site

the ArcGIS Server account must be a domain account because the account must be recognized by all machines in the site... For enhanced security

you can use a group Managed Service Account (gMSA)."