topic Re: Script to apply SAS 9.4 Recommended Operating System Protections for Windows Machines in Administration and Deployment

Script to apply SAS 9.4 Recommended Operating System Protections for Windows Machines

bheinsius — Tue, 11 Feb 2020 09:51:34 GMT

Hi,

I have 12 Application Server Contexts that I have to apply the SAS 9.4 Recommended Operating System Protections for Windows Machines to.

Does anyone have a script that does this?

Thanks,

Bart

Re: Script to apply SAS 9.4 Recommended Operating System Protections for Windows Machines

jklaverstijn — Tue, 11 Feb 2020 20:46:15 GMT

Hi Bart,

Have you considered Ansible for this? I do not have scripts for this specific use case as we have Linux servers. But having lots of (Windows or Linux) machines that all need to undergo the same treatment is something that Ansible does very well. That's why the Viya deployment relies heavily upon it for anything OS related.

Regards,

- Jan.

Re: Script to apply SAS 9.4 Recommended Operating System Protections for Windows Machines

angian — Wed, 12 Feb 2020 23:31:52 GMT

I don't have a script but I do use Powershell to quickly apply a set of permissions manually defined on a single folder to others.

For example I can manually set the permissions for ConnectSpawner as follows

SYSTEM FC
Administrators FC
Everyone Remove

Then quickly apply the same to 4 other folders. You will see there are not many different combinations

$ConnectSpawner_ACL = Get-ACL D:\SAS\Config\Lev1\ConnectSpawner
Set-ACL -path D:\SAS\Config\Lev1\ObjectSpawner -AclObject $ConnectSpawner_ACL
Set-ACL -path D:\SAS\Config\Lev1\SASApp\OLAPServer -AclObject $ConnectSpawner_ACL
Set-ACL -path D:\SAS\Config\Lev1\SASMeta\MetadataServer -AclObject $ConnectSpawner_ACL
Set-ACL -path D:\SAS\Config\Lev1\ShareServer -AclObject $ConnectSpawner_ACL

Also to check my permissions are consistent between environments you can run this command and compare the output with a diff tool

dir -Recurse -Directory D:\SAS | %{$file=$_;get-acl $($_.FullName)} | %{$_.GetAccessRules($True,$False,[Security.Principal.SecurityIdentifier]) | Get-Unique -OnType | %{Get-Acl -Path $($file.FullName) | Format-Table -Wrap}}