@alexal   Hi Alex Sorry if I was unclear - this WAS the log entry in the event viewer in Windows. But it only happens on VM1 using IWA, not on VM2 or VM3.   The System Event Viewer shows : The Security System has received an authentication request that could not be decoded. The request has failed.     At the same time a Log was recorded in SAS Metadata:   2017-10-26T11:37:00,385 INFO [09785175] 26273237:sasinst@xxxxxxxxxxxxxL - Client connection 26273237 for user XSSEXEC@xxxxxxxxxxxxxxxxx closed. 2017-10-26T11:37:06,621 INFO [09785027] :sasinst@xxxxxxxxxxxxxxxxxxxxx - Unexpected error in function AcceptSecurityContext. Error -2146893048 (The token supplied to the function is invalid ). 2017-10-26T11:37:06,621 WARN [09785027] :sasinst@xxxxxxxxxxxxxxxxxxxxx - New client connection (26276397) rejected from server port 8561 for unknown IWA user. Peer IP address and port are [::ffff:10.200.2.22]:61955 for APPNAME=SAS Enterprise Guide. 2017-10-26T11:37:06,621 INFO [09785027] :sasinst@xxxxxxxxxxxx - Client connection 26276397 closed.   ... View more

We have now set up some SPN's on the Compute node which had these missing.   We have a number of users complaining about not getting access to our SAS Metadata using IWA.   We have 3 Metadata Nodes in our cluster: VM1 VM2 (Master) VM3   On Node VM1 we regularly get these errors in the Log: 2017-10-26T08:33:00,805 INFO [09550903] :sasinst@xxxxxxxxxxxxxx - Client connection 26275365 for user sasevs@saspw closed. 2017-10-26T08:33:01,805 INFO [09550910] :sasinst@xxxxxxxx - Unexpected error in function AcceptSecurityContext. Error -2146893048 (The token supplied to the function is invalid ). 2017-10-26T08:33:01,805 WARN [09550910] :sasinst@xxxxxxxxx - New client connection (26274325) rejected from server port 8561 for unknown IWA user. Peer IP address and port are [::ffff:10.200.4.96]:63063 for APPNAME=SAS Enterprise Guide. 2017-10-26T08:33:01,805 INFO [09550910] :sasinst@xxxxxxxxxx - Client connection 26274325 closed. 2017-10-26T08:33:01,805 INFO [09418531] :sasinst@xxxxxxxxx - Unexpected error in function AcceptSecurityContext. Error -2146893048 (The token supplied to the function is invalid ). 2017-10-26T08:33:01,805 WARN [09418531] :sasinst@xxxxxxxx - New client connection (26273718) rejected from server port 8561 for unknown IWA user. Peer IP address and port are [::ffff:10.200.4.96]:63062 for APPNAME=SAS Enterprise Guide. 2017-10-26T08:33:01,805 INFO [09418531] :sasinst@xxxxxxxxxxxxx - Client connection 26273718 closed.   These errors do not appear on VM2 or VM3.   What could be the cause for this? How do we fix it?     I also saw this error in our Event Log on VM1:   Activation context generation failed for "c:\program files\SASHome\sasdeploymentmanager\9.4\products\cfgwizard__94260__prt__xx__sp0__1\utilities\w64\sasshortcutmgr.exe". Dependent Assembly Microsoft.VC80.CRT,processorArchitecture="ia64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762" could not be found. Please use sxstrace.exe for detailed diagnosis. ... View more

Very difficult in my current company. The SAS Platform itself is a great platform. When I first arrived it was quite unstable as there had been no Hotfixes applied or Security Patching done since installation 2 years prior. I began a schedule of regular Security patching and Hotfixing, and it stabilised.   My biggest issue is that fingers are poking behind my back in places where I am not always checking, and then things break. Also - our network is horrendously volatile with admins deploying firewalls, moving VMs around between areas etc, often breaking environments.   The general infrastructure is hard to maintain and much of it is in the hands of our IT dept. So I have to jump on the phone more than often to find out who fiddled with the fiirewalls, or why a Hosting server with our Metadata servers suddenly dropped off the network. It keeps me awake at night. ... View more

@alexal   Thanks again for your reply...   I would assume that it is the SASINST account, as it is used for about everything else. I had a look at the Object Spawners and they seem to run under a Local System Account ... View more

@alexal Thank you for this. Yes - I saw these instructions. My problem is I am new to this organisation and I was not there when it was installed on the original server, so I have no idea what the correct service account to use would be: SASINST? SASSRV? What I am really asking is if someone here has done this before, which account is recommended? I will most likely need to go and delete/recreate the SPNs previously set up, and document this so they know what I did to install IWA. We do not use Grid. Yet our 1st Compute node was set up as SAS/SASServ1 and not SASWS/SASServ1. Thank you for your reply. Much appreciated. ... View more

Thank you Astounding! this is perfect. much appreciated ... View more

Hi Reeza   Passwords can be reused, but each combination of PW1 + PW2 should be unique:   A + M = AM  >> OK A + N = AN  >> OK   B + M = BM >> OK C + N = CN >> OK   A + M = AM >> Not OK as it is already used ... View more

Thank you very much! This solves many issues for us! 🙂 ... View more

Thank you Paul and Patrick.   We picked up through testing and Process of Elimination late yesterday that all the folders encrypted and added to our Metadata bound repository BEFORE the latest Metadata Restarts last Friday evening seem to have a problem.   New folders that were added and encrypted since last Friday's restart seem to have no problems, and those users can freely add new encrypted datasets at will.   I have logged a call with SAS Tech Support and will mention this to them. Len ... View more

Hi Michelle   Yes - it seems ACT's will be the solution here, and I agree with the policy of Deny broadly and grant selectively. Thanks for your help. ... View more