Script to apply SAS 9.4 Recommended Operating System Protections for Windows Machines

[bheinsius]

Hi,

I have 12 Application Server Contexts that I have to apply the SAS 9.4 Recommended Operating System Protections for Windows Machines to.

Does anyone have a script that does this?

Thanks,

Bart

[jklaverstijn]

Hi Bart,

Have you considered Ansible for this? I do not have scripts for this specific use case as we have Linux servers. But having lots of (Windows or Linux) machines that all need to undergo the same treatment is something that Ansible does very well. That's why the Viya deployment relies heavily upon it for anything OS related.

Regards,

- Jan.

[angian · Accepted solution]

I don't have a script but I do use Powershell to quickly apply a set of permissions manually defined on a single folder to others.

For example I can manually set the permissions for ConnectSpawner as follows

SYSTEM FC
Administrators FC
Everyone Remove

Then quickly apply the same to 4 other folders.  You will see there are not many different combinations

$ConnectSpawner_ACL = Get-ACL D:\SAS\Config\Lev1\ConnectSpawner
Set-ACL -path D:\SAS\Config\Lev1\ObjectSpawner -AclObject $ConnectSpawner_ACL
Set-ACL -path D:\SAS\Config\Lev1\SASApp\OLAPServer -AclObject $ConnectSpawner_ACL
Set-ACL -path D:\SAS\Config\Lev1\SASMeta\MetadataServer -AclObject $ConnectSpawner_ACL
Set-ACL -path D:\SAS\Config\Lev1\ShareServer -AclObject $ConnectSpawner_ACL

Also to check my permissions are consistent between environments you can run this command and compare the output with a diff tool

 dir -Recurse -Directory D:\SAS | %{$file=$_;get-acl $($_.FullName)} | %{$_.GetAccessRules($True,$False,[Security.Principal.SecurityIdentifier]) | Get-Unique -OnType | %{Get-Acl -Path $($file.FullName) | Format-Table -Wrap}}