After installing the SAP S/4HANA Server system with a Primary Application Server and an ABAP Central Services instance you might want to install an Additional Application Server (AAS) for your SAP system.
An AAS for AS ABAP can be installed in a few minutes.
Installing an Additional Application Server
In addition to the Primary Application Server and the ABAP Central Server Instance (ASCS) you can install additional application server instances (AAS instances) for providing scalability for your SAP S/4HANA Server system.
SAPinst offers some command line options for being started. We will use the option allowing to use a virtual host name and a stack xml file, for this installation procedure.

Within Software Provisioning Manager drill down to the installation that you would like to conduct. The figure above highlights the selection (Additional Application Server Instance) that we will use.

AAS instances are usually installed on a different host from the PAS. So, how does SAPinst know which SAP system the AAS should belong to?
SAPinst asks for the location of the system-wide used profile directory of the SAP system, the AAS should belong to. By evaluating the location and content of the files therein, SAPinst acquires the essential information on the SAP system, the AAS should belong to.
SAPinst will create users (on operating system level, if required) for use by the AAS instance. Therefore, SAPinst asks for a Master Password. We recommend that you set the Master Password identical to the one used during the installation of PAS and ASCS.

The figure above also shows the selection screen for setting the instance numbers for the Additional Application Server (AAS) instance of your SAP system. The two-digit instance number needs to be chosen from the numbers between 00 and 97 and it must be unique on an individual host.
As you can see on the screen above, certain number are already in use: 10 and 11. The instance number defines several port numbers used for communication by your SAP system. For example, an ABAP dispatcher process communicates via port 32## where ## signifies the instance number. Therefore, in case any software on your SAP host uses ports in the range of 3200 to 3299 (for example), this need to be taken into consideration. SAPinst can only list ports used by SAP instances — so further restrictions need to be consider by you.

To increase the security of your SAP system, you can create a Message Server Access Control List (ACL) that can be used to limit access to the Message Server. For more information, please read the SAP Notes mentioned on the screen shot above.
Also, you can choose to remove access rights to the installation directory from user <sid>adm. This will improve security.


The installation of the AAS finished successfully!
You can check the result via transaction SM51.
You can review the installation procedure by checking the logs.