Issue with group managed service account - node['arcgis']['run_as_msa']

[ramtechjoe]

We are running an install using a group managed service account. When we did this it set Portal to run as local service account instead of the account we specified.

we have:

"arcgis": {
        "version": "11.1",
        "run_as_user": "domainName\\ArcGIS_QA_Srvc$",
    "run_as_msa": true,
        "configure_windows_firewall": true,

Should we include a node['arcgis']['run_as_password'] as an empty string instead of leaving it out? Or something else?

Thanks -Joe

[cameronkroeker]

Hi @ramtechjoe,

Shouldn't need to include node['arcgis']['run_as_password']. If it was set to Local System rather than the gMSA then I suspect the portal setup.exe was not able to find the gMSA account so it defaulted to using Local System. Let's try the following:

• Uninstall portal
• Add the node['arcgis']['portal']['setup_options'] attribute to the json file so that it will capture an installation log. For example:

  "portal":{
  "setup_options":"/L*v C:\\Portal_Install.log"
  },

• Re-run Chef
• While Chef is running open Task Manager on the target node, and enable the command line column within the Details tab. We will want to keep an eye on a setup.exe process that will spin up when portal is being installed. If you expand the command line column it will show the run_as username being passed in. Let's ensure it matches domainName\\ArcGIS_QA_Srvc$. If it does match and still gets set to Local System then this means the setup was unable to detect or find the gMSA account.
• There may be additional information in the C:\\Portal_Install.log that could provide a clue.
• Also can check Windows Event application logs to see if there are any hints in there as well.

Or alternatively the quickest method might actually be to launch the portal setup.exe GUI, and manually provide the gMSA account details to see if it let's you proceed. If the setup is unable to detect/find the gMSA then it won't let you proceed with the installation and should throw an error.

Thanks, Cameron K.