pcfserver.exe attempting to establish a TCP/443 connection with a Microsoft IP.

[matthewmeserve]

Hello,

Our security software appears to be blocking pcfserver.exe from establishing a connection with what appears to be a Microsoft IP.  Does anyone know why it would attempt to do this?

Information: The application C:\program files\sashome\saspcfilesserver\9.4\pcfserver.exe attempted to establish a TCP/443 connection to 52.109.12.22:443 from 10.x.x.x:56617. The operation was blocked.

Thanks,
Matt

[SASKiwi]

Because PCFS is breaking a network security rule implemented by your IT Security folks. It is common and indeed best practice for IT Security to limit network traffic across an organisation's IT network by imposing rules on where traffic is allowed to originate and terminate and on what network ports that can happen.

You will need to talk to IT Security about implementing a network traffic rule change to allow PCFS to work correctly.

[matthewmeserve]

I agree..and I understand why it is getting blocked. What I'm trying to understand is why PCFS would be trying to establish a connection to Microsoft. That being said, this user was trying to import an Excel file so I don't know if that is the basis. But it seems interesting to me that it would be trying to connect to an MS IP...for what reason?

[SASKiwi]

What MS product are you trying to use PCFS with? If it is trying to interface with an MS cloud-based product like Microsoft Office 365 that might explain what is going on.

[matthewmeserve]

This is just MS Office 2016, installed locally.

[SASKiwi]

OK, I think you'll need to check with SAS Tech Support to get an answer on that then.

[ballardw]

---

@matthewmeserve wrote:
I agree..and I understand why it is getting blocked. What I'm trying to understand is why PCFS would be trying to establish a connection to Microsoft. That being said, this user was trying to import an Excel file so I don't know if that is the basis. But it seems interesting to me that it would be trying to connect to an MS IP...for what reason?

---

I would see if the users code is using one of the procs like HTTP or a FILENAME URL to read something stored remotely.

[matthewmeserve]

The proc is pointed to a file on a server via mapped drive. Example: Q:\Path\Folder\filename.xmlx