Hi Everyone,
I am our site admin for Enterprise Guide 4.305 running on Windows 7 and SAS v9.2 running on Windows Server 2008 R2. I am looking for a way to dynamically set the location of user WORK libraries for use with Enterprise Guide.
We currently set the WORK location for all of our Enterprise Guide users in D:\Program Files\SAS\SASFoundation\9.2\nls\en\SASV9.CFG using this command:
-WORK "E:\WORK\!USERNAME"
This allows for the automatic and secure storage of WORK data in user-specific _TD folders that are managed by the SAS Disk Cleanup Handler utility. For example, user ABC1234 to uses folder E:\WORK\ABC1234 for their WORK files while XYZ1234 uses E:\WORK\XYZ1234.
My users are looking for a subset of folks to automatically use the R: drive of our server instead of the E: drive for their WORK files. So if user XYZ1234 is part of a certain team (and an Active Directory role group/SAS Management Console group), I would like them to be automatically assigned R:\WORK\XYZ1234 while folks not part of that group are left to use the E: drive and E:\WORK\ABC1234.
I can tell who those folks are by the group they are in or I can insert them and their desired WORK location into a SAS table as an add-on to the Active Directory Sync process. I'm open to a number of different ways of doing this. I'd like the solution to be dynamic such that when folks are added to the Active Directory group, their WORK location automatically changes if appropriate.
Thanks in advance!
Hi,
You could try to specify the entire work folder location as an environment variable:
-work "!USERSASWORK"
... and set USERSASWORK on a per-user basis. You might prefer to derive this in the WorkspaceServer_usermods.bat script.
Will this requirement apply to other servers too, like stored process server, batch server etc. If so, or you see the potential for other group-based customizations like different memory settings, library assignments, etc, then you might also consider creating multiple application servers and directing users to specific application servers via access controls that hide the ones they shouldn't use. One group sees only SASApp1 whilst another group sees only SASApp2. Each application server has its own config dir, scripts, shared formats, autocalls and so on. It allows considerable group level configuration/isolation but does come with greater management overhead so is not always appropriate, especially for simple differences that can be handled through things like environment variable customizations.
Cheers
Paul
Hi,
You could try to specify the entire work folder location as an environment variable:
-work "!USERSASWORK"
... and set USERSASWORK on a per-user basis. You might prefer to derive this in the WorkspaceServer_usermods.bat script.
Will this requirement apply to other servers too, like stored process server, batch server etc. If so, or you see the potential for other group-based customizations like different memory settings, library assignments, etc, then you might also consider creating multiple application servers and directing users to specific application servers via access controls that hide the ones they shouldn't use. One group sees only SASApp1 whilst another group sees only SASApp2. Each application server has its own config dir, scripts, shared formats, autocalls and so on. It allows considerable group level configuration/isolation but does come with greater management overhead so is not always appropriate, especially for simple differences that can be handled through things like environment variable customizations.
Cheers
Paul
I also meant to say that the work option can also be specified across multiple locations (there's a few links in this blog post: Spreading the WORK load). I don't think it will help you in this instance as it is more about distributing the work load across multiple devices in a random or round-robin fashion. However, I did wonder what would happen if, due to file system permissions, only one of those locations is available to the current user? i.e. would it use the single effective location or generate an error? If you do try it out please let us know what you find.
Personally, I think that a WorkspaceServer_usermods.bat modification (or separate app servers) would probably be simpler and provide better flexibility.
Hi @ardobbins - since we had an offline conversation about this and I pointed you here, allow me to prime the pump for @PaulHomes (who I know lives in Linux-world but I'm sure has very solid Windows skills).
You could modify your WorkspaceServer_usermods.bat to contain a script like this, which uses the net user command to check AD group membership.
set i=0 set group=SANUSERS set user=%username% echo Checking if %user% is member of %group%... for /f %%f in ('"net user %user% /domain | findstr /i %group%"') do set /a i=%i%+1 if %i% gtr 0 (goto :SANUSERS) :SERVERUSERS echo %user% is not member of %group% set sasworkpath=d:\work goto :end :SANUSERS echo %user% is member of %group% set sasworkpath=h:\work :end
Full disclosure: I cribbed this from this IT blog.
Then in the WorkspaceServer_usermods.cfg, you could use "!sasworkpath" as the value for -WORK option.
I tested the batch commands from above, but did not test the WorkspaceServer config part. Hopefully this is at least a start.
I don't think it'll help you with your SAS 9.2 on Windows installation, but for the benefit of SAS for Unix users and SAS 9.3 for Windows users who might stumble across this thread with similar requirements in future, another possibility is to use restricted options.
Restricted options allow for customizing and restricting options (including work) on a global, per-user & per-group basis. They are supported at the global, user and group level for SAS on Unix (including SAS 9.2 and 9.3) and the global and per-user level for SAS 9.3 on Windows. There are some links to the documentation for restricted options in this blog post: SAS Restricted Options on UNIX
The reason I don't think this will help you with your Windows installation is that it seems to require SAS 9.3 when using Windows and does not appear to support per-group with SAS 9.3 on Windows.
Hi Paul,
Thank you so much for your help. I am working to test the changes to WorkspaceServer_usermods.bat and will let you know if that works. If can’t get to this to work, if I can’t find a way to make the solution as resilient to changes in Active Directory as we’d
like, or if I need to make other group-based customizations, I might try adding additional application server(s). While that solution initially comes with greater management overhead, it seems to be more resilient to change as users enter and leave Active Directory groups.
I’m aware of Usage Note 37593 that outlines the dynamic allocation of the WORK directory to multiple locations and while that doesn’t apply to us (yet) it might be worth a try to see if it simply ignores the file system permissions not assigned to the user.
I will try that as well.
Thanks again for the response.
Glen
Hi Paul,
Thanks again for your help. We were able to make the necessary changes to WorkspaceServer_usermods to prove we could set the WORK library conditionally there.
Glen
No worries Glen, I'm glad I could help. Thanks for letting us know the outcome too.
HI Glen,
what were done to re direct the users to use separate WORK location on FLY.
can you please share?
Build your skills. Make connections. Enjoy creative freedom. Maybe change the world. Registration is now open through August 30th. Visit the SAS Hackathon homepage.
Register today!What’s the difference between SAS Enterprise Guide and SAS Studio? How are they similar? Just ask SAS’ Danny Modlin.
Find more tutorials on the SAS Users YouTube channel.
Select SAS Training centers are offering in-person courses. View upcoming courses for: