CALL MODULE routines might fail with an error under the following conditions: 

• You have enabled Kerberos Constrained Delegation.
• You install the hot fix from SAS Note 63143, "Windows Defender Credential Guard and SAS^® Software."

Here is the error message that is surfaced when you encounter this issue:

In this message, <module-name> refers to the name of the CALL MODULE routine that is not identified in the whitelist.

Click the Hot Fix tab in this note to access the hot fix for this issue.

To manage CALL MODULE routines, SAS has created a whitelist of allowed routines in the SASHELP registry rooted at CORE\CALLMODULE. By default, this list is empty. Users do not have permissions to edit the SASHELP registry, so your SAS administrator must make changes to the whitelist. The hot fix enables you to use the whitelist offering for CALL MODULE routines. The types of changes that the SAS administrator can make are detailed below: 

Enable All CALL MODULE Routines

The SAS administrator can enable all CALL MODULE routines to the whitelist by using the following example:

Enable Specific CALL Module Routines

The SAS administrator can selectively enable specific CALL MODULE routines to the whitelist by using the following example:

Note: The previous example enables all CALL MODULE routines.

Remove CALL Module Routines 

The SAS administrator can use the following example to remove routines from the whitelist:

List Whitelist Contents

The SAS administrator can use the following example to list the contents of the whitelist:

Operating System and Release Information

A fix for this issue for Base SAS 9.4_M6 is available at: