Permissions for SSAS Service Account?

Hi All,

Please help with this.

I'm running a server with Windows Server 2003 R2 Enterprise x64 Edition.

On the box I've performed one named instance installation of SSAS.

I've installed SP1 as well.

There's no firewall running on the machine.

My domain account is in the SSAS Server role.

SSAS Service is running according to SQL Configuration Manager

SQL Browser Service is running according to SQL Configuration Manager

If I run both SSAS and SQL Browser under Local System, everything works OK. But this is not the way I want it, because it's not safe and SSAS is unable to read data from the remote SQL box.

If I change the service account to a domain user account, I can't connect to SSAs anymore. The error message is:

TITLE: Microsoft SQL Server Management Studio

A connection cannot be made to redirector. Ensure that 'SQL Browser' service is running. (Microsoft.AnalysisServices.AdomdClient)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

I've both set the logon account at setup, using SQL Config Mgr and Service Manager.

Using PortQry I can see nothing's listening on port 2382.

It should work. I'm beginning to think this user account doesn't have sufficient rights.

So I've created two local accounts and used these as service accounts. Same thing, untill I added both accounts to the local administrators group, then everything worked fine again.

What am I doing wrong here? Your suggestions are much appreciated.

Thanks,

Coen

Hello. You have another configuration that you do not mention: "Surface area"

You will have to allow remote connections in this configuration tool. That is for each SQL Server 2005 service that you are using.

HTH

Thomas Ivarsson

|||

Couple of things.

One. Make sure you use SQL Configuration Manager to change serivce logon account for both SQL Browser and for Analysis Server.

Second. Take a look at the connectivity troubleshooting guide http://www.sqljunkies.com/WebLog/edwardm/archive/2006/05/26/21447.aspx

Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||

The Surface Afrea Conf tool returns the following error:

TITLE: Surface Area Configuration

A connection cannot be made. Ensure that the server is running. (Microsoft.AnalysisServices)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

|||

I am using the SQL Config Mgr to change the user id's. BTW this is sometimes a bit crooked, and I still need to change the Service Account in the Service Manager as well.

Besides, I don't really think the problem's in there. Setup should set the correct permissions for the Logon Account.

Thanks for pointing me to your post on SQLJunkies. I've used it before.

|||I've narrowed it don a bit. It seems only the Service Account used for SQL browser has to be in the Local Admins group.

Permissions for SSAS Service Account?

Hi All,

Please help with this.

I'm running a server with Windows Server 2003 R2 Enterprise x64 Edition.

On the box I've performed one named instance installation of SSAS.

I've installed SP1 as well.

There's no firewall running on the machine.

My domain account is in the SSAS Server role.

SSAS Service is running according to SQL Configuration Manager

SQL Browser Service is running according to SQL Configuration Manager

If I run both SSAS and SQL Browser under Local System, everything works OK. But this is not the way I want it, because it's not safe and SSAS is unable to read data from the remote SQL box.

If I change the service account to a domain user account, I can't connect to SSAs anymore. The error message is:

TITLE: Microsoft SQL Server Management Studio

A connection cannot be made to redirector. Ensure that 'SQL Browser' service is running. (Microsoft.AnalysisServices.AdomdClient)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

I've both set the logon account at setup, using SQL Config Mgr and Service Manager.

Using PortQry I can see nothing's listening on port 2382.

It should work. I'm beginning to think this user account doesn't have sufficient rights.

So I've created two local accounts and used these as service accounts. Same thing, untill I added both accounts to the local administrators group, then everything worked fine again.

What am I doing wrong here? Your suggestions are much appreciated.

Thanks,

Coen

Hello. You have another configuration that you do not mention: "Surface area"

You will have to allow remote connections in this configuration tool. That is for each SQL Server 2005 service that you are using.

HTH

Thomas Ivarsson

|||

Couple of things.

One. Make sure you use SQL Configuration Manager to change serivce logon account for both SQL Browser and for Analysis Server.

Second. Take a look at the connectivity troubleshooting guide http://www.sqljunkies.com/WebLog/edwardm/archive/2006/05/26/21447.aspx

Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||

The Surface Afrea Conf tool returns the following error:

TITLE: Surface Area Configuration

A connection cannot be made. Ensure that the server is running. (Microsoft.AnalysisServices)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

|||

I am using the SQL Config Mgr to change the user id's. BTW this is sometimes a bit crooked, and I still need to change the Service Account in the Service Manager as well.

Besides, I don't really think the problem's in there. Setup should set the correct permissions for the Logon Account.

Thanks for pointing me to your post on SQLJunkies. I've used it before.

|||I've narrowed it don a bit. It seems only the Service Account used for SQL browser has to be in the Local Admins group.

Permission problems with sp_attach_db during installation

I successfully install SQL Express silently.

Then I try the following

-S .\INSTANCE -Q "sp_attach_db 'ATTACH_AS_NAME', 'C:\Program Files\APP_NAME\SQLData\APP_DB.MDF'"

This works...sometimes. But Many times I wll get a permissions error on the folder "C:\Program Files\APP_NAME". If I go and give "Everyone" "Full Permission" to the folder...it works fine.

My questions are:

1) What system users need access (and at what level) to this folder to do an attach? Because obviously giving everyone full access is bad.

2) Is there a better method for deploying a populated database with my application that this?

SQL service account needs modify privilege on "C:\Program Files\APP_NAME\SQLData\" path. If its running in Local system account then make sure SYSTEM or NT Authority \ System has modify privilege on the path
|||Do you know how to adjust the settings of that folder to allow that in a deployment package (Wise Install?)|||If you a trying to attach only the "mdf", use sp_attach_single_file_db and ignore your transaction log file(ldf)|||Hi,
1.) Click Start-->Run-->services.msc
2.) Check SQL Server startup account (Log On As)
3.) If its Local system then provide modify privilege for SYSTEM or NT Authority \ System for the folder "C:\Program Files\APP_NAME\SQLData\"
4.) If its some other ID provide modify privilege for the ID on "C:\Program Files\APP_NAME\SQLData\" folder.

Permission Problem

Hello,
I have a problem with SQL Express.
I have a machine with SQL Express Instance installed correct.I did a copy of
the hard disk and installed this hard disk in another machine. Change the
name in the new machine.
My problem is with the user
SQLServer2005MSSQLUser$<COMPUTERNAME>$MSSQLSERVER, but the another
computernameHi Maria,
Copying the hard disk and placing it on another machine the way you have
done is going to cause you a whole host of problems especially if you
are part of a domain. You should NEVER do it this way. At best make a
syspreped image and then apply it to another computer. This way you can
have the system's SID regenerated.
Even then you should not just indiscriminately install applications
prior to syspreping and expect them to work on another machine. In your
case I think that the best thing for you to do is to uninstall SQL
Server and reinstall it.
Jonathan
Maria Paz wrote:
> Hello,
> I have a problem with SQL Express.
> I have a machine with SQL Express Instance installed correct.I did a copy of
> the hard disk and installed this hard disk in another machine. Change the
> name in the new machine.
> My problem is with the user
> SQLServer2005MSSQLUser$<COMPUTERNAME>$MSSQLSERVER, but the another
> computername

Permission Problem

Hello,
I have a problem with SQL Express.
I have a machine with SQL Express Instance installed correct.I did a copy of
the hard disk and installed this hard disk in another machine. Change the
name in the new machine.
My problem is with the user
SQLServer2005MSSQLUser$<COMPUTERNAME>$MSSQLSERVER, but the another
computernameHi Maria,
Copying the hard disk and placing it on another machine the way you have
done is going to cause you a whole host of problems especially if you
are part of a domain. You should NEVER do it this way. At best make a
syspreped image and then apply it to another computer. This way you can
have the system's SID regenerated.
Even then you should not just indiscriminately install applications
prior to syspreping and expect them to work on another machine. In your
case I think that the best thing for you to do is to uninstall SQL
Server and reinstall it.
Jonathan
Maria Paz wrote:
> Hello,
> I have a problem with SQL Express.
> I have a machine with SQL Express Instance installed correct.I did a copy
of
> the hard disk and installed this hard disk in another machine. Change the
> name in the new machine.
> My problem is with the user
> SQLServer2005MSSQLUser$<COMPUTERNAME>$MSSQLSERVER, but the another
> computername

Permission Issue

I am trying to test a new ASP.NET application on my local instance of MSDE.
I created a virtual directory named "db" with a sub-directory of
"processed". My web page opens an XML file in the "db" directory, does some
processing and then I want to move the file to the "processed"
sub-directory. When I execute the Move I get the following error:
'************************************************* ***
Exception Details: System.UnauthorizedAccessException: Access to the path
"C:\Inetpub\wwwroot\db\processed\SC313WorldPrelims .xml" is denied.
ASP.NET is not authorized to access the requested resource. Consider
granting access rights to the resource to the ASP.NET request identity.
ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
Network Service on IIS 6) that is used if the application is not
impersonating. If the application is impersonating via <identity
impersonate="true"/>, the identity will be the anonymous user (typically
IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET write access to a file, right-click the file in Explorer,
choose "Properties" and select the Security tab. Click "Add" to add the
appropriate user or group. Highlight the ASP.NET account, and check the
boxes for the desired access.
Source Error:
Line 50: End If
Line 51: Response.Write("Executing File.Move command!<br>")
Line 52: File.Move(strFilename, fntarget)
Line 53: '*****
Line 54: Else
'************************************************* ****
The instructions don't seem to apply to my system (Win XP Pro SP1)? The
options are different and I don't see any "ASP.NET" account? I suspect I am
min-interpreting something here?
Thanks for any help.
Wayne
Hi
Post this question in microsoft.public.inetserver.iis.security as it is not
a database problem.
Regards
Mike
"Wayne Wengert" wrote:

> I am trying to test a new ASP.NET application on my local instance of MSDE.
> I created a virtual directory named "db" with a sub-directory of
> "processed". My web page opens an XML file in the "db" directory, does some
> processing and then I want to move the file to the "processed"
> sub-directory. When I execute the Move I get the following error:
> '************************************************* ***
> Exception Details: System.UnauthorizedAccessException: Access to the path
> "C:\Inetpub\wwwroot\db\processed\SC313WorldPrelims .xml" is denied.
> ASP.NET is not authorized to access the requested resource. Consider
> granting access rights to the resource to the ASP.NET request identity.
> ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
> Network Service on IIS 6) that is used if the application is not
> impersonating. If the application is impersonating via <identity
> impersonate="true"/>, the identity will be the anonymous user (typically
> IUSR_MACHINENAME) or the authenticated request user.
> To grant ASP.NET write access to a file, right-click the file in Explorer,
> choose "Properties" and select the Security tab. Click "Add" to add the
> appropriate user or group. Highlight the ASP.NET account, and check the
> boxes for the desired access.
> Source Error:
>
> Line 50: End If
> Line 51: Response.Write("Executing File.Move command!<br>")
> Line 52: File.Move(strFilename, fntarget)
> Line 53: '*****
> Line 54: Else
> '************************************************* ****
> The instructions don't seem to apply to my system (Win XP Pro SP1)? The
> options are different and I don't see any "ASP.NET" account? I suspect I am
> min-interpreting something here?
> Thanks for any help.
> Wayne
>
>
>
|||OK - will do
Wayne
"Mike Epprecht (SQL MVP)" <mike@.epprecht.net> wrote in message
news:95192DB5-306F-4001-B69D-9471BEE2088D@.microsoft.com...
> Hi
> Post this question in microsoft.public.inetserver.iis.security as it is
not[vbcol=seagreen]
> a database problem.
> Regards
> Mike
> "Wayne Wengert" wrote:
MSDE.[vbcol=seagreen]
some[vbcol=seagreen]
path[vbcol=seagreen]
or[vbcol=seagreen]
Explorer,[vbcol=seagreen]
am[vbcol=seagreen]