Current New Security Directives on WIN

[shoin]

Organization are now clamping on service IDs having the ability to RDP, usually it is a common directive to use installing IDs for hot fix, UIP etc. type of activities.  For routine matters, especially on WIN platforms one could use an admin ID to start stop services, etc. but how have you folks dealt with UIP or hot fix application when security won't allow these SAS service IDs to remote login?

#2 Has anyone replaced the original SAS service IDs (svc_install, svc_sasdemo, svc_sassrv) by some IDs that do not have svc attached (for UIP/HF type tasks)? Pitfalls?

[SASKiwi]

In my experience, most SAS service accounts don't need the RDP permission, that is the ability to logon to SAS servers via Windows remote desktop connections. The one obvious exception to this is the SAS install account. Some service accounts may need the remote login permission but that isn't the same as RDP. So in general I would see no need to change service accounts and it should be fine to remove their RDP permissions. I suggest you check with Tech Support though for a second opinion.

Typically I use my own personal account for general SAS adminstration, as it has the RDP permssion and server admin permissions. That means it is fine for most housekeeping activities, including stopping and starting SAS services. I use the SAS install account when applying SAS maintenance.