Reporting Services Error
The permissions granted to user 'DOMAIN\user' are insufficient for performing this operation. (rsAccessDenied) Get Online Help
I had this issue in the past with Windows 10 and the solution was to run it in IE 11 under administrator as per this article:
https://learn.microsoft.com/en-us/answers/questions/453441/the-permissions-granted-to-user-domainuser-are-ins
As IE 11 is not available anymore I am struggling to get this working.
I tried re-installing my instance of SSRS, re-setting up the WebService URLs, creating a new ReportServer database in SQL Server and configuring the Report Server database credentials in the Report Server Configuration Manager. This didn't work.
I also tried going into the users and policyuserrole tables in the ReportServer database and manually added my account and SSRS roles to it. This didn't work.
The Report Manager url doesn't allow me access anything or make security changes.
My account is the only administrator on this machine and is inside the Administrators group.
Can anyone help me get this working? Is there something specific to my environment that could be causing this?
See the last comment in the article
The permissions granted to user 'Domain\User' are insufficient for performing this operation. (rsAccessDenied)
or here
Stack overflow article or
SSRS : rsAccessDenied : The permissions granted to user are insufficient for performing this operation (rsAccessDenied)
Related
I'm getting the error below when I try and access SSRS on SQL Server 2008 R2
I'm not sure how many others have started using SQL 2008 R2 SSRS, but I am having an issue with getting the error below when I try and access the reports server url
User does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed
What I have tried:
I can access the url if I run IE as an administrator
Once you're able to log in to YourServer/Reports as an administrator, click Home in the top-right corner, then Folder Settings and New Role Assignment. Enter your user name and check a box for each role you want to grant yourself. Finally, click OK. You should now be able to browse folders without launching your browser with elevated privileges.
Don't forget to set the security at the site level **AND ** at the folder level. I hope that helps.
I have done much searching on this without a solid solution.
I just set up a new SSRS instance on the same server as my SQL 2016 instance. Everything is running fine report wise, etc. The problem is that when a report is scheduled, it creates a Sql Agent Job in SQL Server, and the SQL Agent is erroring out with the following:
The job failed. Unable to determine if the owner
(MyDomain\ReportService) of job 17F8E31D-0838-4829-8C3C-E3FE5BBD3483
has server access (reason: Could not obtain information about Windows
NT group/user 'MyDomain\ReportService', error code 0x5. [SQLSTATE
42000] (Error 15404)).
Current setup:
SSRS using an Active Directory account as the service account called
Report Service
Sql Server 2016 Engine is using an Active Directory account as the service
account called SqlService
Both SSRS and SQL Database are on the same machine
I double checked that SqlService is SysAdmin and has all other
permissions, and non-SSRS jobs run fine
From my research, I can solve this in one of three ways:
Change the SSRS SQL Agent job created by SSRS to be owned by SA (by
default the job is owned by MyDomain\ReportService). The problem
with this is that I would have to do this every time a user creates
a new subscription via SSRS or create an ongoing script because SSRS
by default will use the service as the owner. And I KNOW that this
was not done at my previous employer.
I could make the SqlService a
domain administrator. I don't want to do this for security reasons,
obviously.
I could give the SqlService "SeImpersonatePrivilege"
(Impersonate a client after login) on my domain via the security
policy. This also works, but there seems like there would be a
better way, and I would think this is also a security risk as
setting this doesn't explicitly limit SqlService to only
impersonating the ReportService.
So, my question is hopefully from those who have set SSRS up, what is the best practice for allowing SQL Server to run the SSRS subscriptions? It's possible that something in our environment is messed up permissions wise, but I guess mostly I'm looking for advice on how should this be set up. Thank you greatly in advance.
I eventually discovered that we had some kind of limitation on the active directory rights of the service account. I wasn't unable to pinpoint the exact permissions, but after adding the account to a group that explicitly allowed viewing active directory users and groups, it worked. So, this was due to abnormal limitations for basic domain user rights.
Link
From the site listed above:
Could not obtain information about Windows NT group/user ‘domainuser’, error code 0x5. [SQLSTATE 42000] (Error 15404)(ConnIsLoginSysAdmin)
The solution to this is to add the SQL Server service account to the ‘BUILTINWindows Authorization Access Group’ on your DC.
You can then run “EXECUTE AS USER = ‘domainuser’” on SQL Server to check.
I just installed SQL 2012 Enterprise on a laptop running windows 10 Pro x64.
When I try to execute my SSRS reports from the report manager, I always get the same error:
An error has occurred during report processing. (rsProcessingAborted)
Cannot impersonate user for data source 'DataSource1'. (rsErrorImpersonatingUser)
Log on failed. Ensure the user name and password are correct. (rsLogonFailed)
The user name or password is incorrect
I am using integrated windows authentication with a domain account.
The domain account can log on through SSMS and can access the databases with no issue and run queries.
I have also tried using a local SQL account and password but with the same result - The username or password is incorrect, yet this account works through SSMS and is able to execute queries and such.
When i click the Test Connection button in SSRS datasource configuration, it states the connection was created successfully. (I have included a shot of what I am talking about in the uploaded image)
After googling, people stated that the account that is being used to connect to the database using windows impersonation had to have log on locally permissions, so I added the account through local security Policy, but it made no difference.
Another blog stated the SSRS Service account had to also be granted log on locally permissions - so I granted it the log on locally permission as well. Still to no avail.
I have also tried disabling the windows firewall and connecting to both the machine name and localhost just in case there was some screwy rules regarding localhost - still with the same result.
Other people suggested the execution account in SSRS manager needed be disabled. I didn't set this up initially - but set the account up just in case it had something to do with it - still with the same error then removed it again still with the same error.
Can anyone offer any other suggestions as to what might be the cause and how I might fix this?
Many thanks and Cheers
Rod.
OK - managed to work out the problem and a workaround. But it doesn't actually solve the problem.
Problem is Chrome and IE11 wont update the Reports web site when managing datasources. Even when launched as administrator, the SSRS management interface site does not appear to save the changes. Edge is just a joke so don't even bother with that one.
Now - I figured Microsoft has broken something which SSRS interface needs in windows 10, so I logged onto a Windows 7 machine and using IE11, was able to navigate to report manager site, update the credentials (windows and SQL Server credentials) and the reports run.
Confirmed this by trying to change the credentials back on windows 10 and it immediately broke the reports again. Set the credentials back in Win 7 and it corrected the reports.
So if you are using windows 10 and are having issues configuring credentials for SSRS reports, try logging in from a windows 7 machine and set through IE on that machine.
EDIT: IE11 works on older windows 10 build (enterprise) , latest build (Pro) seems to be broken.
Cheers
Rod.
If you have specified an unattended execution account, SSRS flip-flops between impersonating it and the identity specified in your data source during the rendering process. If you use an unattended execution account, you’ve got to keep the password up-to-date.
You could also choose not to use the unattended execution account at all, which may also solve your problem. For more detail see http://blogs.msdn.com/b/bimusings/archive/2006/08/16/702490.aspx
Simply,
Go to Report Configuration Manager
Go to Excution Account
Enter Domain\UserAccount [User Account is your windows User]
Enter Password [Windows Password]
Save and you are good to go
I have been attempting to configure SQL Server 2008 R2 (Standard) for replication between two instances running on Windows 2008 R2. Both machines are on an internal AD domain (2008R2 domain). The issue I am having is specifically with the subscription process being unable to push transactions (yes, doing transactional replication) from the distributor to the subscriber. It is using a domain user (sqlrepl_distrib) which is in the domain users group by default to do this.
The error from the logs is:
Login failed for user 'XXXX\sqlrepl_distrib'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: ]
I have tried numerous things to get it work, but the only way I could get the subscription to work was to use my domain admin login (which is obviously unacceptable as a permanent solution).
The sqlrepl_distrib user has permissions as db_owner on both the publisher and subscriber database, as well as the distribution database, so that shouldn't be related to the issue. SQL Server is configured for Windows authentication only. I verified the user/pass also works by logging into the domain with it. DBs and MSSQL instances are owned by the domain administrator, I think this may possibly be the problem, but not sure.
I have also tried to disable UAC on both SQL Server machines, but this did not help (yes I rebooted).
Hoping someone would have a clue as to what's going on. I am fairly new to SQL Server, so I expect it could be something dumb, but Google has failed me to find a solution (the error that comes up in google seems to be with users being unable to access SSMS, which isn't my problem... that works fine).
To setup the replication, I followed the guide from Microsoft at http://msdn.microsoft.com/en-us/library/aa337389.aspx. It does not mention this particular error. I tried 3 times to setup the process all over again with the same results.
Anything pointing me in the right direction would be helpful (but please don't point me to a 1000 page long MSDN article and expect me to parse through that).
Thanks!
What's the user running the service?
Do check if the spn of the named instance is registered, and also the spn for sql server browser service, as a named instance will force the kerberos authentication to be delegated from the browser service.
And make sure that the browser service is enabled to delegate to the sql spn on windows ad.
First check in SOL server configure manager LOG ON with what users---> for
example user log on as :-NT AUTHORITY\NETWORK SERVICE
check all publisher and distributor and subscriber 'logins' (for this goto your instance--> security-->logins . you must check 'NT AUTHORITY\NETWORK SERVICE' this login is there or not. if dose't have login create New login with the name 'NT AUTHORITY\NETWORK SERVICE' all publisher and distributor and subscriber.
you can right click the above login--> take properties-->usermapping--> change options-->here select that database and give permitions DB_woner and PUBLIC to database
like thaat you can change all publisher and distributor and subscriber.
ofter that re-run your replication
Note:
here I'm LOGON with NT AUTHORITY\NETWORK SERVICE
and
my DATABASE is: Sudheer
Check your own what are LOGON with '????' and Database is '???' in your system!!
I am running SQL Server Reporting Services on SQL Server 2008 Standard and trying to get the web pages to work.
What do I have to do to get RS (Report Manager, Reporting Services Connection), to see me as an admin in the first place so that I can make then change my role and look at the Web Service URL properly?
I have Windows authentication Enabled in II7 and I have anonymous authentication disabled.
I am logged in as a local Administrator (however the pages don't seem to realize that I am an admin).
Through the tables in ReportServer db, I can tell that BUILTIN\Administrators is in there.
I have my local machine in Trusted Sites in Internet Explorer.
Using Chrome instead of IE, I get similar results. I have not tried Firefox.
Most of the help I have found online assumes that you can add your login as an administrator explicitly from the perspective of RS. I cannot figure out how to do that because everyway I try to administer roles I cannot get to work....
At:
http://machine/ReportServer_DEPAHELIX
I get:
Reporting Services Error
The permissions granted to user 'Chris-PC\Chris' are insufficient for performing this operation. (rsAccessDenied) Get Online Help
SQL Server Reporting Services
At:
http://machine/Reports_DEPAHELIX/Pages/Folder.aspx
I see only Home, with Home, My Subscriptions, Help and cannot really do anything. There are no reports there yet because when I try to deploy from BIDS, I get Error 1 The permissions granted to user 'Chris-PC\Chris' are insufficient for performing this operation. 0 0
At:
http://machine/Reports_DEPAHELIX/Pages/SystemSecurity.aspx
I see
You do not have permission to access this page.
And when I connect to Reporing Services through SQL Server Management Studio, I see Jobs, Security and Shared Schedules, and that's it. I can expand Security>Roles and see 5 built in roles, however
when I right click on a Role, the context menu has Properties grayed out.
What do I have to do to get RS to see me as an admin?
Appreciate you have a resolution; if anyone else has this problem; MS have put a step by step guide up on msdn. "Configure a Report Server for Local Administration on Windows Vista and Windows Server 2008"
http://msdn.microsoft.com/en-us/library/bb630430.aspx
I have the same exact problem, i am running on Windows 7. I also cannot deploy to the SQL Server, if I am not logged in as Administrator (and not as a users of the Admin group.)
One thing that solved my problem is to start Internet Explorer as Administrator, even if you are logged in as a Admin users. (Right-click and select "Start as an Administrator") Same in Visual Studio in order for you to deploy. It's annoying, but it works...
As stated by John, must be "Administrator", not just a member of Administrators group. Trying to make more users part of BUILTIN\Administrators is not the answer. The answer is to login initially as "Administrator" and then setup Reporting Services related groups for your system or domain then configure the roles associated with those groups using RS tools, and add the appropriate users to the specific new groups.
Found my answer after hours of searching ...
As other users suggest, you need to right-click and choose Run As Administrator. However, on Windows 7 it seems that Internet Explorer by default does not provide current user credentials to Reporting Services. What happens then is that you get a login prompt when you try to access Reporting Services. If you get a login prompt, you need to adjust security settings.
Choose Intenet Options and go to the Security tab. Click on Trusted sites. Either drag the security slider to low security or click on Custom level. If you click on Custom level, go to the User Authentication/Logon option and choose "Automatic logon with current name and password".
Original post here for reference:
http://blogical.se/blogs/jahlen/archive/2009/10/02/setting-up-sql-server-reporting-services-on-windows-7-vista-or-windows-2008.aspx
Sql Server 2008 does not recognize Windows administrators as database sysadmins. You have to add the Windows administrator group to the Sql sysadmins role.
You can add the group like this:
Open Sql Server Management Studio
Open Security -> Logins, and create a login for the Administrators group
Open Security -> Server Roles, and add the login to the syadmin role
During installation, setup will offer to make the current user a database administrator. If you accept that, the current windows user will be added to the database sysadmin group. If you installed Sql Server as "Administrator", that explains why only the "Administrator" account was able to configure your Reporting server.
If you had installed Sql Server as "YourDomain\YourAccount", that account would have added to the sysadmin role instead. So there's nothing special about "The" administrator.
I have found that the BUILTIN\Administrators account is not treated correctly for permissions within SSRS, if you create a new group Eg SSRS_Administrators and add all your admin users to this group and define SSRS_Administrators as a content manager within report manager all is good.
If you're a local admin, run c:\program files\Internet Explorer\iexplore.exe as administrator (right-click, run as administrator). This open the SSRS Report Manager and you can do what's needed.