user work area was temporary redirected to config\lev1\SASApp folder

[Alin1984]

Hi All,

We have a SAS 9.4 server and multiple user connecting and working via SAS EG 7.1

The SAS work is redirected from the config file to a different drive on the server.

I just noticed that there are sas tables in the SASAapp folder inside config. After investigation I found the user creating this and I checked the code he was using in EG. He was only doing output in work. Now after reruning all the files are ok transmitted to the correct work folder.

Any idea why the work folder could have been redirected to SASApp and now back to normal ?

Thanks for your input 

[Patrick · Accepted solution]

I don't have an answer for WORK but if you submit a SAS job in batch and you don't provide a path for -print and -log then all this output defaults to the location where SAS gets started from - and this is the App server folder. Not sure what would happen if you don't provide a path for work anywhere in the config files.

It is generally a good idea to deny users write access to the App server folder structure.

As for WORK: This should get pointed to a disk/drive as fast as possible.

[Kurt_Bremser]

How can it be that a user that is not the SAS install user writes files there? This points to a severe security fail.

[Alin1984]

The point is that the folder is secured and that specific user can't write there (I've tested). My guess was that on a connection interruption (that sometimes happens) SAS dumped work area there. Don't know if this is possible. The issue can't be replicated even with the help of that user...