Thanks Paul. That is exactly what I was looking for. I have modified logconfig.xml previously but it was trial and error. ... View more

Mystery solved.  2 years ago, I created a Metadata group to segregate a new team which was Indirectly Denying access. Not obvious but %mdsecds showed the blockage :   %mdsecds(identitynames="team1user, team2user", identitytypes="Person,Person", folder="\DeptData", membertypes="Library"); proc print data=work.mdsecds_join noobs; var objname publictype identityname ReadMetadata WriteMetadata ; run;   Regarding meta libs, even with meta data bound libraries, it is going to be tough to block direct access to D:\data\saslib1. The locations are also defined as SMB shares \\server\data and ACLs need to work for both local and network access.  Difficult to change and test on Windows. I may start another thread to discuss.     ... View more

That makes complete sense but is not what we see. I will set up some dummy libs on our test server.   ... View more

I forgot to mention that int[] is sufficient for most of our numeric data. We have some key fields stored as long integers which we will store as character in SQL . Since much of this data is used for modelling, the users have agreed that numeric precision is not a priority compared with storage capacity. ... View more

The intention is to add data change control which seems more manageable in SQL Server using change tracking. Also, a lot of the data might benefit from partitions - concatenating multiple periods using SQL views for time series analysis. SQL Server seems to have better view performance than SAS but it is more difficult to measure. ... View more

Thanks for pointing me to the FedSQL paper - very useful reference. proc sql _method lets me look under the covers when testing.  ... View more

Thanks. I have been asked for an initial assessment and don't have many details yet. Since a lot of workload is moving from on-prem servers to Azure, I am assuming Azure Active Directory will replace our local domain controllers. SAS94 will stay local for at least the next 2 years.   ... View more

Thanks for the response. It looked like it was possible and I hope my organisation is prepared to support Kerberos/IWA/NTLM. For once, there is some budget.... ... View more

Getting the owners sometimes needs Admin rights but not always. Here are 4 different outputs :   # Compact view for pasting into email Get-ChildItem "D:\SASWork" -File -recurse | select Directory, Name, length, <# path, filename,#> lastwritetime, @{Name="Owner"; Expression={ (Get-ACL $_.Fullname).Owner }} | Sort-Object -Descending length | Out-GridView # Write to standard output for selecting details Get-ChildItem "D:\SASWork" -File -recurse | select Directory, Name, length, <# path, filename,#> lastwritetime, @{Name="Owner"; Expression={ (Get-ACL $_.Fullname).Owner }} | Sort-Object -Descending length | Format-Table # Write to csv for DSD parsing with SAS Get-ChildItem "D:\SASWork" -File -recurse | select Directory, Name, length, <# path, filename,#> lastwritetime, @{Name="Owner"; Expression={ (Get-ACL $_.Fullname).Owner }} | Export-CSV -Path D:\sas\Batch\datafiles\D_SASWork_Files_$(get-date -f "yyyyMMdd").csv -NoTypeInformation # Pre-req : Install-Module ImportExcel -AllowClobber -Force # Write to xlsx Get-ChildItem "D:\SASWork" -File -recurse | select Directory, Name, length, <# path, filename,#> lastwritetime, @{Name="Owner"; Expression={ (Get-ACL $_.Fullname).Owner }} | Export-Excel -Path D:\SAS_Users\AFarrer\xlsx\D_SASWork_Files_$(get-date -f "yyyyMMdd").xlsx ... View more

@MarcoGhiglieri Adding members to 'SAS General Servers' is a good suggestion.   Sadly, my users have little interest in using SAS Stored Processes even though they are heavy Excel users with the SAS addin enabled after some effort on my part.....   I think I will move the domain service account to a SAS Batch account used for writing to Prod SQL Server tables.    On another note, I really miss attending SGF and meeting other SAS admins. Online is not the same.... ... View more

Got it. Thanks Nigel.   I had forgotten that the userid was added to 'SAS General Servers' group so that Stored Processes could access SQL Server using ODBC.   Our site is all Windows Server 2019 with a lot of integrated authentication that also works with Azure. Any process running as an AD domain user will authenticate without userid or password. Great in most cases but tricky for service accounts used by regular users. Connection to SQL Server 2019 with userid/password is actually blocked. For testing, I use runas a lot.   However, I am very disappointed that the Search and Advanced Search could not find the userid. I tried with and without '\'   Thanks to everyone who responded so promptly.     ... View more