Commands / Test-sqmSsasDirectoryPermissions
Cluster & Services

Test-sqmSsasDirectoryPermissions

Checks and corrects NTFS permissions for SSAS directories (Data, Log, Temp, Backup). Resolves the instance's paths from the registry, determines the SSAS service account, and grants FullControl wherever it is missing — idempotent, so repeated runs only touch what's still wrong.

Module: sqmSQLTool
Requires: Local Administrator
ShouldProcess: Yes
Output: PSCustomObject[]

Execution Flow

START Scan HKLM:\...\Microsoft SQL Server\MSAS* for -InstanceName Instance found? throw error Read DataDir / LogDir / TempDir / BackupDir from registry -ServiceAccount given? Get-CimInstance Win32_Service → read StartName foreach directory (Data, Log, Temp, Backup) Path set and exists? Status = NotFound / Missing Get-Acl → check for non-inherited FullControl rule Already FullControl? Status = OK ShouldProcess confirmed? Status = WhatIf New FileSystemAccessRule(FullControl, Allow) → Set-Acl Set-Acl succeeded? Status = Failed Status = Fixed Return PSCustomObject[] (one entry per directory) DONE
The function is idempotent — on repeated calls only directories that are still missing FullControl get an ACL change; everything already correct is reported as OK and left untouched. If -ServiceAccount is omitted, the account is read from the running Windows service (MSSQLServerOLAPService for the default instance, MSOLAP$<InstanceName> for named instances), so the SSAS service must be registered (it does not need to be running).

Parameters

ParameterTypeRequiredDescription
-InstanceNameStringOptionalName of the SSAS instance. Default: MSSQLSERVER (default instance). For named instances, e.g. SSAS2019.
-ServiceAccountStringOptionalName of the service account (e.g. NT SERVICE\MSSQLServerOLAPService). If omitted, it is auto-determined from the Windows service.
-WhatIfSwitchOptionalShows which permission changes would be made without executing them.
-ConfirmSwitchOptionalPrompts for confirmation before each ACL change.
-EnableExceptionSwitchOptionalThrows a terminating exception immediately on error instead of just logging it.
-ContinueOnErrorSwitchOptionalContinues checking the remaining directories even if one directory fails or is missing.

Return Value

Returns a PSCustomObject[] — one entry per checked directory (Data, Log, Temp, Backup) — with: InstanceName, Directory, Path, Status (OK, Fixed, Missing, NotFound, Failed, WhatIf, or Error), Message.

Examples

Example 1 — Check and fix the default instance

Test-sqmSsasDirectoryPermissions

Example 2 — Preview changes for a named instance

Test-sqmSsasDirectoryPermissions -InstanceName "SSAS2019" -WhatIf

Example 3 — Use an explicit service account

Test-sqmSsasDirectoryPermissions -ServiceAccount "CONTOSO\svc_ssas" -ContinueOnError

Example 4 — Show only directories that were fixed

Test-sqmSsasDirectoryPermissions | Where-Object Status -eq 'Fixed'
⬆ Index
All Commands