Architecting, installing and maintaining your SAS environment

Windows Server and User Profile Issue

Accepted Solution Solved
Reply
Contributor
Posts: 39
Accepted Solution

Windows Server and User Profile Issue

Hi All,

 

We have a LSF gridsetup with SAS 9.4 and Studio all on Windows servers.  This is a new install and users are getting the error "User <domain>\<userid> has insufficient permissions to create C:/Users/<userid>/.images...".  The strange thing is that it was working previously, so something has changed, but I cannot determine what.  If I make the user a local admin, the error goes away; however, when I check the effective permissions on the c:\users location on all the grid nodes, they have Modify permissions.  Users that already have a user profile folder under c:\users do not get the error.  I've already asked our server admins if anything has changed, but I get the standard "no".  Anyone have any suggestions on what to look at?

 

Thanks!


Accepted Solutions
Solution
‎12-01-2016 08:17 AM
Contributor
Posts: 39

Re: Windows Server and User Profile Issue

I found the setting that was causing this problem.  In Management Console under Logical Stored Process Server properties on the load balancing tab, we had GRID set for the balancing algorithm.  I corrected this by changing it to cost, and the problem went away.  User profiles were then created on the GRID compute nodes upon users logging into Studio.

View solution in original post


All Replies
Super User
Posts: 3,251

Re: Windows Server and User Profile Issue

When does this error occur? Try logging onto the SAS application server and creating a file manually in the folder that is giving the permissions error. Do you strike the same problem?

Contributor
Posts: 39

Re: Windows Server and User Profile Issue

Sorry, I forget that part.  They get the error when trying to submit any code.  I had the users RDP into the servers, navigate to their home folders, and they were able to create files.  Once they remote into the servers, their profile and home folder are created, and then the error stops.  Obviously SAS users should not have to remote into all 7 of our grid compute nodes to create their profiles before being able to use SAS.  We also have SAS 9.2 and 9.3 running via Display Manager from Citrix; the error does not happen when using the old versions, it's unique to SAS Studio 3.5 and SAS 9.4.

 

Due to a similar error that was preventing users from even logging into Studio, I changed the following in the local sasv9.cfg files:

 

-SET MYSASFILES "?FOLDERID_Documents\My SAS Files\9.4"
-SASUSER "?FOLDERID_Documents\My SAS Files\9.4"
-WORK "!TEMP\SAS Temporary Files"

 

to all point to a shared storage array that SAS uses.  So it's strange to me that it's trying to write anything the c:\users\<userid> on the SAS servers to begin with.

 

 

Super User
Posts: 3,251

Re: Windows Server and User Profile Issue

What is your security set-up for SAS Studio? It looks your SAS servers run on Windows. Are you using single signon (SSL) by any chance? I'm not an expert in this area but we have run into problems with SSL and ensuring permissions are delegated correctly across all SAS servers. The key here seems to be getting your Kerberos settings correct if that is involved.

Contributor
Posts: 39

Re: Windows Server and User Profile Issue

Yes, we have all Windows servers.  SAS has confirmed that SAS Studio needs to be able to write to c:\users\<userid>\.images and there's no option to change that location.  As for the security setup, I'm not sure exactly how to answer that, but we don't utilize single sign on.  Our users login with their domain credentials in the form of <domain>\<userid>.  The logical workspace server settings are "Use Server Access Security" is checked, "Authentication service" is set to Host, and  "Security package" is set to kerberos.  These are the same settings we used for SAS 9.2 and 9.3, but those versions ran from Citrix servers where users' profiles were created upon running any application from Citrix if they weren't already present.  I've confirmed that the sassrv account, which is used to run the SAS services, has trusted for delegation set.  Thanks for any advice or suggestions that you can think of to try.

Solution
‎12-01-2016 08:17 AM
Contributor
Posts: 39

Re: Windows Server and User Profile Issue

I found the setting that was causing this problem.  In Management Console under Logical Stored Process Server properties on the load balancing tab, we had GRID set for the balancing algorithm.  I corrected this by changing it to cost, and the problem went away.  User profiles were then created on the GRID compute nodes upon users logging into Studio.

☑ This topic is solved.

Need further help from the community? Please ask a new question.

Discussion stats
  • 5 replies
  • 501 views
  • 2 likes
  • 2 in conversation