Access proxy settings for a Group Managed Service Account for the PrintingTool service to access external web services

Summary

Esri recommends using a gMSA (Group Managed Service Account) to run the ArcGIS Server service, as described in the ArcGIS Server account document.

Moreover, "While most ArcGIS Server services do not need to connect outside of the network, the PrintingTools service or custom geoprocessing services may need to access external web services". See: Configure a forward proxy server with ArcGIS Server

Therefore it is sometimes necessary to configure proxy settings so the ArcGIS Server service account can access the internet and thus external web services.

In principle, open a Windows session using the service account, or run Microsoft Edge as another user with the service account and go to Options > Settings, as shown in the following images:

For example, to retrieve/identify the service account that starts the ArcGIS Server service, open the Windows Services console (see the 'Log On As' column):

1. In Microsoft Edge, select Run as different user:

2. Run as different user with the service account that starts the ArcGIS Server service:

3. Go to Settings in Microsoft Edge :

4. Open the computer's proxy settings > Connections tab:

5. Under LAN settings > Proxy server, select Use a proxy server for your LAN, and click Advanced.

6. In the Proxy Settings dialog, under Servers > Proxy address to use and Port:

• For a gMSA account, this procedure cannot be followed because "the account cannot be used for interactive logins", as decribed in the Group managed service account section of the ArcGIS Server account document.

Procedure

In this case, to access the proxy settings for the gMSA account, follow the procedure below:

1. Download the PsExec v2.43process utlilty.
2. Extract the contents of the *.zip file.
3. Run Psexec64.exe to install the program.
4. Open a Command Prompt as Administrator.
5. Navigate to the directory extracted in step 2 using the cd command.
6. From this Command Prompt, in the directory from step 5, run the following command:

PsExec64.exe -i -u DOMAIN\gMSA-Account$ -p ~ cmd.exe

This opens a new Command Prompt window running under the gMSA account.

7. Enter the command inetcpl.cpl to open Internet Options and access the proxy settings for the gMSA account.