CALL MODULE routines might fail with an error under the following conditions:
- You have enabled Kerberos Constrained Delegation.
- You install the hot fix from SAS Note 63143, "Windows Defender Credential Guard and SAS® Software."
Here is the error message that is surfaced when you encounter this issue:
ERROR: Module <module-name> is not in whitelist of allowed routines in the SASHELP registry.
In this message, <module-name> refers to the name of the CALL MODULE routine that is not identified in the whitelist.
Click the Hot Fix tab in this note to access the hot fix for this issue.
To manage CALL MODULE routines, SAS has created a whitelist of allowed routines in the SASHELP registry rooted at CORE\CALLMODULE. By default, this list is empty. Users do not have permissions to edit the SASHELP registry, so your SAS administrator must make changes to the whitelist. The hot fix enables you to use the whitelist offering for CALL MODULE routines. The types of changes that the SAS administrator can make are detailed below:
Enable All CALL MODULE Routines
The SAS administrator can enable all CALL MODULE routines to the whitelist by using the following example:
/* Create registry file to enable all routines to the whitelist. */
data _null_;
file 'whitelist_sashelp.sasxreg';
put '[CORE\CALLMODULE\*]';
run;
/* Import the file. */
proc registry import='whitelist_sashelp.sasxreg' USESASHELP ; run;
Enable Specific CALL Module Routines
The SAS administrator can selectively enable specific CALL MODULE routines to the whitelist by using the following example:
Note: The previous example enables all CALL MODULE routines.
/* Create registry file for specific routines to the whitelist. */
data _null_;
file 'whitelist_sashelp.sasxreg';
put '[CORE\CALLMODULE\hello2]';
put '[CORE\CALLMODULE\hello4]';
run;
/* Import the file. */
proc registry import='whitelist_sashelp.sasxreg' USESASHELP ; run;
Remove CALL Module Routines
The SAS administrator can use the following example to remove routines from the whitelist:
/* Create a registry file for routines to be removed from whitelist. */
data _null_;
file 'whitelist_remove.sasxreg';
put '[CORE\CALLMODULE\hello2]';
run;
/* Uninstall the file. */
proc registry UNINSTALL='whitelist_remove.sasxreg' USESASHELP;
run;
List Whitelist Contents
The SAS administrator can use the following example to list the contents of the whitelist:
proc registry listhelp startat='CORE\CALLMODULE'; run;
Output:
NOTE: Contents of SASHELP REGISTRY starting at subkey [CORE\CALLMODULE]
[ CORE\CALLMODULE]
[ hello2]
[ hello4]
Operating System and Release Information
SAS System | Base SAS | Microsoft® Windows® for x64 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8 Enterprise 32-bit | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8 Enterprise x64 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8 Pro 32-bit | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8 Pro x64 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8.1 Enterprise 32-bit | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8.1 Enterprise x64 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8.1 Pro 32-bit | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 8.1 Pro x64 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows 10 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows Server 2012 Datacenter | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows Server 2012 R2 Datacenter | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows Server 2012 R2 Std | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows Server 2012 Std | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows Server 2016 | 9.4_M6 | | 9.4 TS1M6 | |
Microsoft Windows Server 2019 | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Enterprise 32 bit | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Enterprise x64 | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Home Premium 32 bit | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Home Premium x64 | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Professional 32 bit | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Professional x64 | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Ultimate 32 bit | 9.4_M6 | | 9.4 TS1M6 | |
Windows 7 Ultimate x64 | 9.4_M6 | | 9.4 TS1M6 | |
*
For software releases that are not yet generally available, the Fixed
Release is the software release in which the problem is planned to be
fixed.