Permissions WTF

I have a intigrated log using a local group
the login does not have explicit access to any db's and no server roles
when i log on with query analyzer i can access any data (even though not a
server admin or anything else)
when i remove login...can log (as it should be)
why does this login have full access to all db's ?When i add the login and run IS_MEMBER and USER it says i am dbo of a user
database that i did not give access to what is going on ?
"David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
news:uNI5pih6FHA.3684@.TK2MSFTNGP12.phx.gbl...
>I have a intigrated log using a local group
> the login does not have explicit access to any db's and no server roles
> when i log on with query analyzer i can access any data (even though not a
> server admin or anything else)
> when i remove login...can log (as it should be)
> why does this login have full access to all db's ?
>|||You are getting in with sysadmin priviliges, possibly by membership of
another group. What does the following query return for your windows
account?
exec master..xp_logininfo 'DOMAIN\username'
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
news:uNI5pih6FHA.3684@.TK2MSFTNGP12.phx.gbl...
>I have a intigrated log using a local group
> the login does not have explicit access to any db's and no server roles
> when i log on with query analyzer i can access any data (even though not a
> server admin or anything else)
> when i remove login...can log (as it should be)
> why does this login have full access to all db's ?
>|||Thanks for reply, but it was my stupidity...i had been logged in as the
user when i had created the user databases...then forgot it was a member of
the group used to create the login....should have realized it when it said
i was member of db_owner and not srv role sysadmin...but i am getting slow
at my old age.
"Jasper Smith" <jasper_smith9@.hotmail.com> wrote in message
news:upEiioj6FHA.476@.TK2MSFTNGP15.phx.gbl...
> You are getting in with sysadmin priviliges, possibly by membership of
> another group. What does the following query return for your windows
> account?
> exec master..xp_logininfo 'DOMAIN\username'
> --
> HTH
> Jasper Smith (SQL Server MVP)
> http://www.sqldbatips.com
> I support PASS - the definitive, global
> community for SQL Server professionals -
> http://www.sqlpass.org
> "David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
> news:uNI5pih6FHA.3684@.TK2MSFTNGP12.phx.gbl...
>

Permissions to run vb code

In one of my reports I’m using vb code that copies one file from a local disk to a server.

Like this:

Public Shared Function CopyFile(ByVal infile As String, ByVal outfile As String)

Dim fi As System.IO.FileInfo = New System.IO.FileInfo(infile)

fi.CopyTo(outfile, True)

End function

The report is executed using report services directly in a browser.

In the Visual Studio environment it works ok. In the browser I get an error. I’m sure it is a permissions problem.

Any pointers to set op permission for this rdl-file ?

/NHS

There is no way to elevate code permissions for a particular RDL.

Better way is to move this code into a separate assembly, grant permissions to that assembly and call it from the report.

Permissions to run vb code

In one of my reports I’m using vb code that copies one file from a local disk to a server.

Like this:

Public Shared Function CopyFile(ByVal infile As String, ByVal outfile As String)

Dim fi As System.IO.FileInfo = New System.IO.FileInfo(infile)

fi.CopyTo(outfile, True)

End function

The report is executed using report services directly in a browser.

In the Visual Studio environment it works ok. In the browser I get an error. I’m sure it is a permissions problem.

Any pointers to set op permission for this rdl-file ?

/NHS

There is no way to elevate code permissions for a particular RDL.

Better way is to move this code into a separate assembly, grant permissions to that assembly and call it from the report.

Permissions to a local account on which SQL Server service works

My SQL Server 2005 runs on a local account. Is it neccesary to assign this login in SQL to a System Administrator role?

And is there any difference in SQL Server 2000?

thanks

Przemo

If you have used SQL Server Configuration Manager to set the service account, you don't need to do anything. The same thing goes for SQL Server 2000, if you have used Enterprise Manager to change the service account. You should avoid changing the service account manually and use instead Configuration/Enterprise Manager.

Thanks
Laurentiu

sql

Permissions on a SP

I have created and tested two triggers directly on the local server
and both work as they should. I initially had a problem with
xp_smtp_sendmail that was returning a 500.1
Internal server permissions error, I corrected this with applying the
correct permissions.
Both triggers work when activated from a direct logon but fail without
any error message when activated from the internet. Do I need to create
the necessary permissions on more stored procedures, or can I recreate a
SP from the master DB and copy it, if someone could point me in the right
direction it would be greatly appreciated.
JohnDon't send email from within a trigger. There is really no need to hold open
a transaction while you do this and you don't want to block other
transactions if the XP is slow in returning control to the trigger. Also, yo
u
want to avoid giving users the ability to run XPs in Master, even indirectly
,
if you can. The lack of execute permissions is what is causing this error
message.
Since Email is an inherently asynchronous medium it is easier and better to
schedule this with a SQL Agent based job running at suitable intervals.
Record whatever changes are required in a table and then use a job to pick
those up and send emails.
David Portas
SQL Server MVP
--|||Thanks David for the sound advice.
John
"David Portas" <REMOVE_BEFORE_REPLYING_dportas@.acm.org> wrote in message
news:10552FB0-890C-4036-80CD-CE40EE612444@.microsoft.com...
> Don't send email from within a trigger. There is really no need to hold
> open
> a transaction while you do this and you don't want to block other
> transactions if the XP is slow in returning control to the trigger. Also,
> you
> want to avoid giving users the ability to run XPs in Master, even
> indirectly,
> if you can. The lack of execute permissions is what is causing this error
> message.
> Since Email is an inherently asynchronous medium it is easier and better
> to
> schedule this with a SQL Agent based job running at suitable intervals.
> Record whatever changes are required in a table and then use a job to pick
> those up and send emails.
> --
> David Portas
> SQL Server MVP
> --

Permissions issue?

I have a SQL Server 2005 Express db on my local machine for testing and I'm
using Dreamweaver 8 to connect to it. No problem. However.. when I try out
a page on localhost through a browser, I get this message:
Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
[Microsoft][ODBC SQL Server Driver][SQL Server]Cannot open database
"Linker_app" requested by the login. The login failed.
/linkerapp/login.asp, line 24
That would usually be a permissions issue, but I found the database and
allowed the Internet Guest Account to access it . .but the message is still
there.
Can someone tell me what I'm doing wrong?
Many thanks!
Nancy
Here are some Express links that might come in handy. I would check to
ensure it allows remote connections and that the db is open.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsse/html/sseoverview.asp
Express Overview
http://msdn2.microsoft.com/en-us/library/ms165672.aspx Comparing Express
with MSDE
http://msdn.microsoft.com/sql/default.aspx?pull=/library/en-us/dnsse/html/sqlexpuserinst.asp
User Instances
http://www.datamasker.com/SSE2005_NetworkCfg.htm Configuring Express
for Remote Access
https://blogs.msdn.com/sqlexpress/archive/2005/05/05/415084.aspx
Configuring Remote Access
http://www.kbalertz.com/Feedback_914277.aspx Configuring SQL2005 for
remote access
http://msdn.microsoft.com/sql/express/default.aspx?pull=/library/en-us/dnsse/html/emsqlexcustapp.asp
Embedding Express in Apps
http://blogs.msdn.com/rogerwolterblog/archive/2006/04/13/575974.aspx
Backing up Express
Andrew J. Kelly SQL MVP
"Nancy" <nancy@.webwish.com> wrote in message
news:eYRSl$oZHHA.3928@.TK2MSFTNGP03.phx.gbl...
>I have a SQL Server 2005 Express db on my local machine for testing and I'm
>using Dreamweaver 8 to connect to it. No problem. However.. when I try
>out a page on localhost through a browser, I get this message:
> Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
> [Microsoft][ODBC SQL Server Driver][SQL Server]Cannot open database
> "Linker_app" requested by the login. The login failed.
> /linkerapp/login.asp, line 24
>
> That would usually be a permissions issue, but I found the database and
> allowed the Internet Guest Account to access it . .but the message is
> still there.
> Can someone tell me what I'm doing wrong?
> Many thanks!
> Nancy
>
|||got it .. thank you for the excellent links .. I have bookmarked many of
them.
Nancy
"Andrew J. Kelly" <sqlmvpnooospam@.shadhawk.com> wrote in message
news:ujFpbbsZHHA.4368@.TK2MSFTNGP06.phx.gbl...
> Here are some Express links that might come in handy. I would check to
> ensure it allows remote connections and that the db is open.
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsse/html/sseoverview.asp
> Express Overview
> http://msdn2.microsoft.com/en-us/library/ms165672.aspx Comparing Express
> with MSDE
> http://msdn.microsoft.com/sql/default.aspx?pull=/library/en-us/dnsse/html/sqlexpuserinst.asp
> User Instances
> http://www.datamasker.com/SSE2005_NetworkCfg.htm Configuring Express
> for Remote Access
> https://blogs.msdn.com/sqlexpress/archive/2005/05/05/415084.aspx
> Configuring Remote Access
> http://www.kbalertz.com/Feedback_914277.aspx Configuring SQL2005 for
> remote access
> http://msdn.microsoft.com/sql/express/default.aspx?pull=/library/en-us/dnsse/html/emsqlexcustapp.asp
> Embedding Express in Apps
> http://blogs.msdn.com/rogerwolterblog/archive/2006/04/13/575974.aspx
> Backing up Express
> --
> Andrew J. Kelly SQL MVP
> "Nancy" <nancy@.webwish.com> wrote in message
> news:eYRSl$oZHHA.3928@.TK2MSFTNGP03.phx.gbl...
>

Permissions issue?

I have a SQL Server 2005 Express db on my local machine for testing and I'm
using Dreamweaver 8 to connect to it. No problem. However.. when I try out
a page on localhost through a browser, I get this message:
Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
[Microsoft][ODBC SQL Server Driver][SQL Server]Cannot open datab
ase
"Linker_app" requested by the login. The login failed.
/linkerapp/login.asp, line 24
That would usually be a permissions issue, but I found the database and
allowed the Internet Guest Account to access it . .but the message is still
there.
Can someone tell me what I'm doing wrong?
Many thanks!
NancyHere are some Express links that might come in handy. I would check to
ensure it allows remote connections and that the db is open.
http://msdn.microsoft.com/library/d...r />
rview.asp
Express Overview
http://msdn2.microsoft.com/en-us/library/ms165672.aspx Comparing Express
with MSDE
http://msdn.microsoft.com/sql/defau... />
erinst.asp
User Instances
http://www.datamasker.com/SSE2005_NetworkCfg.htm Configuring Express
for Remote Access
https://blogs.msdn.com/sqlexpress/a.../05/415084.aspx
Configuring Remote Access
http://www.kbalertz.com/Feedback_914277.aspx Configuring SQL2005 for
remote access
http://msdn.microsoft.com/sql/expre...qlexcustapp.asp
Embedding Express in Apps
http://blogs.msdn.com/rogerwolterbl.../13/575974.aspx
Backing up Express
Andrew J. Kelly SQL MVP
"Nancy" <nancy@.webwish.com> wrote in message
news:eYRSl$oZHHA.3928@.TK2MSFTNGP03.phx.gbl...
>I have a SQL Server 2005 Express db on my local machine for testing and I'm
>using Dreamweaver 8 to connect to it. No problem. However.. when I try
>out a page on localhost through a browser, I get this message:
> Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
> [Microsoft][ODBC SQL Server Driver][SQL Server]Cannot open dat
abase
> "Linker_app" requested by the login. The login failed.
> /linkerapp/login.asp, line 24
>
> That would usually be a permissions issue, but I found the database and
> allowed the Internet Guest Account to access it . .but the message is
> still there.
> Can someone tell me what I'm doing wrong?
> Many thanks!
> Nancy
>|||got it .. thank you for the excellent links .. I have bookmarked many of
them.
Nancy
"Andrew J. Kelly" <sqlmvpnooospam@.shadhawk.com> wrote in message
news:ujFpbbsZHHA.4368@.TK2MSFTNGP06.phx.gbl...
> Here are some Express links that might come in handy. I would check to
> ensure it allows remote connections and that the db is open.
> http://msdn.microsoft.com/library/d.../>
verview.asp
> Express Overview
> http://msdn2.microsoft.com/en-us/library/ms165672.aspx Comparing Express
> with MSDE
> http://msdn.microsoft.com/sql/defau...>
userinst.asp
> User Instances
> http://www.datamasker.com/SSE2005_NetworkCfg.htm Configuring Express
> for Remote Access
> https://blogs.msdn.com/sqlexpress/a.../05/415084.aspx
> Configuring Remote Access
> http://www.kbalertz.com/Feedback_914277.aspx Configuring SQL2005 for
> remote access
> http://msdn.microsoft.com/sql/expre...qlexcustapp.asp
> Embedding Express in Apps
> http://blogs.msdn.com/rogerwolterbl.../13/575974.aspx
> Backing up Express
> --
> Andrew J. Kelly SQL MVP
> "Nancy" <nancy@.webwish.com> wrote in message
> news:eYRSl$oZHHA.3928@.TK2MSFTNGP03.phx.gbl...
>

Permissions for Domain user account

Hi,
I want to use a domain user account not belonging to local admin or domain admin groups in SQL 2000/2005 Enterprise edition. This is what I've done so far..
On the machine that is the Domain Controller:
- installed SQL 2005 as a domain admin

- created a domain user account using Active Directory Users and Computers. This user is only

"Member of" domain users; not any Administrators group.

- added this user to SQL Server Management Studio->Logins and in Server Roles assigned

sysadmin role.
Question 1: Do I need to give any additional permissions to this user to work with SQL?
Question 2: How can I test this user for basic SQL operations like database creation? Can I use Osql?
Question 3: Can I use this user account to login to my domain controller using remote desktop? I tried adding this user to remote users, but in vain.

Thanks!

Hi there,

Just a few of my thoughts....

Question 1: Do I need to give any additional permissions to this user to work with SQL?

Well, going off what you have said (making the domain user part of the sysadmin server role) this will allow the domain user to do any action on your database server.

Whether this is a good thing or not is debatable as it's pretty good practice to only give a user the lowest level of permissions they need in order to do whatever work they need to do. Not knowing your exact situation, giving the domain user the level of privilege you have might be overkill - but like I said it depends on what you're intending etc.

I would recommend you review security topics in SQL Server Books Online and use the info there in conjunction with your knowledge of the circumstances to select the appropriate strategy for giving permission to this user and any other users whose accounts you need to add.

Question 2: How can I test this user for basic SQL operations like database creation? Can I use Osql?

There are a few options here, I'll go into a few....

A) Yes you can use the OSQL or iSQL command line utilities to execute T-SQL if you're working with SQL Server 2000. Once again, SQL Server Books Online is a good resource for this.

If you're working with SQL Server 2005, it's better to use sqlcmd if you're looking to do things via a command line (http://msdn2.microsoft.com/en-us/library/ms170207(SQL.90).aspx)

B) It's easier to use graphical tools, I think. If you can use something like Query Analyzer (SQL Server 2000) or Management Studio (SQL Server 2005) to connect to your DB as the domain user (e.g. logging onto a machine with those tools installed as the domain user and then using those tools to connect to your database server) then that would probably be easier

Question 3: Can I use this user account to login to my domain controller using remote desktop? I tried adding this user to remote users, but in vain.

From what you've written it seems like you're doing the right thing. Here's a tutorial on the complete process which may help: http://www.windowsnetworking.com/articles_tutorials/Windows_2003_Terminal_Services_Part1.html
(Note that it's split into two parts...The link I've included is to the first part but the first part connects to the second part via another link)

TechNet isn't bad either: http://technet2.microsoft.com/windowsserver/en/technologies/featured/termserv/default.mspx

Like I said, from what you've written it's a little hard to gauge the exact problem but it seems like you're doing the right things. However, if you want to run through the steps in the articles & stuff I've placed links to above then things should work for your Terminal Services setup (they did for me)

========

Hope this helps a bit
|||

Thanks alot for your help. Sorry for a delayed reply as I was reading the material you suggested and the good news is that I am able to implement the same and have got things working.
ref - Question 1: As for the permissions, as you suggested, I no longer give the user sysadmin role. The user has dbowner role and it suffices.
ref-Question 2: I used Query Analyser itself by logging in to the machine as the domain user.
ref- Question 3: I could not get Remote Desktop to work for the user. I guess some licensing issue. As a workaround, I used VNC to login as the domain user.

Thanks again.

Permissions and Administration

Do you have to be a member of the local win2K administrators group in-order
to perform administration functions and create folders in Reporting Services?Any user can be given permissions to administer Reporting Services. If
using Forms Authentication, you don't have Windows users at all. In that
case, you can set a default administrator account in the
RSReportServer.config file (replace "USERNAMEHERE"):
<Security>
<Extension Name="Forms"
Type="RSCustomSecurity.Authorization,
ReportingServices.RSCustomSecurity" >
<Configuration>
<AdminConfiguration>
<UserName>USERNAMEHERE</UserName>
</AdminConfiguration>
</Configuration>
</Extension>
</Security>
I haven't tried setting the AdminConfiguration UserName for when Extension
Name="Windows", but it may be worth a shot.
--
Cheers,
'(' Jeff A. Stucker
\
Business Intelligence
www.criadvantage.com
---
"Andy998" <Andy998@.discussions.microsoft.com> wrote in message
news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> Do you have to be a member of the local win2K administrators group
> in-order
> to perform administration functions and create folders in Reporting
> Services?|||When we installed RS on a production server, we can't see the contents or
properties tab on the home page. We also do not see the New Folder or New
Data Source or Upload Files buttons and therefore can not create folders.
We had the NT administrator go into Site Settings page and add our NT
accounts on the System Role Assignments page as systems administrators, but
that did not help either. This works fine on our development server but were
also in the local admin group on that server.
"Jeff A. Stucker" wrote:
> Any user can be given permissions to administer Reporting Services. If
> using Forms Authentication, you don't have Windows users at all. In that
> case, you can set a default administrator account in the
> RSReportServer.config file (replace "USERNAMEHERE"):
> <Security>
> <Extension Name="Forms"
> Type="RSCustomSecurity.Authorization,
> ReportingServices.RSCustomSecurity" >
> <Configuration>
> <AdminConfiguration>
> <UserName>USERNAMEHERE</UserName>
> </AdminConfiguration>
> </Configuration>
> </Extension>
> </Security>
> I haven't tried setting the AdminConfiguration UserName for when Extension
> Name="Windows", but it may be worth a shot.
> --
> Cheers,
> '(' Jeff A. Stucker
> \
> Business Intelligence
> www.criadvantage.com
> ---
> "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > Do you have to be a member of the local win2K administrators group
> > in-order
> > to perform administration functions and create folders in Reporting
> > Services?
>
>|||Hi,
I have the exact same issue. I have tried the suggested workaround below,
but the problem presists. Do you have any other ideas?
"Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
news:OjW8H8i3EHA.2592@.TK2MSFTNGP09.phx.gbl...
> Any user can be given permissions to administer Reporting Services. If
> using Forms Authentication, you don't have Windows users at all. In that
> case, you can set a default administrator account in the
> RSReportServer.config file (replace "USERNAMEHERE"):
> <Security>
> <Extension Name="Forms"
> Type="RSCustomSecurity.Authorization,
> ReportingServices.RSCustomSecurity" >
> <Configuration>
> <AdminConfiguration>
> <UserName>USERNAMEHERE</UserName>
> </AdminConfiguration>
> </Configuration>
> </Extension>
> </Security>
> I haven't tried setting the AdminConfiguration UserName for when Extension
> Name="Windows", but it may be worth a shot.
> --
> Cheers,
> '(' Jeff A. Stucker
> \
> Business Intelligence
> www.criadvantage.com
> ---
> "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > Do you have to be a member of the local win2K administrators group
> > in-order
> > to perform administration functions and create folders in Reporting
> > Services?
>|||I have the exact same issue.
I have tried the workaround below, but problem persists.
pls help.
"Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
news:OjW8H8i3EHA.2592@.TK2MSFTNGP09.phx.gbl...
> Any user can be given permissions to administer Reporting Services. If
> using Forms Authentication, you don't have Windows users at all. In that
> case, you can set a default administrator account in the
> RSReportServer.config file (replace "USERNAMEHERE"):
> <Security>
> <Extension Name="Forms"
> Type="RSCustomSecurity.Authorization,
> ReportingServices.RSCustomSecurity" >
> <Configuration>
> <AdminConfiguration>
> <UserName>USERNAMEHERE</UserName>
> </AdminConfiguration>
> </Configuration>
> </Extension>
> </Security>
> I haven't tried setting the AdminConfiguration UserName for when Extension
> Name="Windows", but it may be worth a shot.
> --
> Cheers,
> '(' Jeff A. Stucker
> \
> Business Intelligence
> www.criadvantage.com
> ---
> "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > Do you have to be a member of the local win2K administrators group
> > in-order
> > to perform administration functions and create folders in Reporting
> > Services?
>|||No I have not found the answer for this. I am starting to believe this
product is more trouble than it's worth. If I figure this out I'll let you
know.
"RIchard Baldock" wrote:
> I have the exact same issue.
> I have tried the workaround below, but problem persists.
> pls help.
>
> "Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
> news:OjW8H8i3EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > Any user can be given permissions to administer Reporting Services. If
> > using Forms Authentication, you don't have Windows users at all. In that
> > case, you can set a default administrator account in the
> > RSReportServer.config file (replace "USERNAMEHERE"):
> >
> > <Security>
> > <Extension Name="Forms"
> > Type="RSCustomSecurity.Authorization,
> > ReportingServices.RSCustomSecurity" >
> > <Configuration>
> > <AdminConfiguration>
> > <UserName>USERNAMEHERE</UserName>
> > </AdminConfiguration>
> > </Configuration>
> > </Extension>
> > </Security>
> >
> > I haven't tried setting the AdminConfiguration UserName for when Extension
> > Name="Windows", but it may be worth a shot.
> > --
> > Cheers,
> >
> > '(' Jeff A. Stucker
> > \
> >
> > Business Intelligence
> > www.criadvantage.com
> > ---
> > "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> > news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > > Do you have to be a member of the local win2K administrators group
> > > in-order
> > > to perform administration functions and create folders in Reporting
> > > Services?
> >
> >
>
>|||I have resolved this issue.
Follow these steps.
1. have an windows administrator go to to the report server web page.
click sitesetting and add you Windowns account as a systems administrator.
2. Have the windows administrator then got to the home page press new
folder and create your new folder, The have them add your windows local group
or domain account as a content manager for this new folder.
Once this is complete you should see this folder on the home page as well as
the New folder, New Data Source asnd Upload buttons.
Andy
"RIchard Baldock" wrote:
> I have the exact same issue.
> I have tried the workaround below, but problem persists.
> pls help.
>
> "Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
> news:OjW8H8i3EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > Any user can be given permissions to administer Reporting Services. If
> > using Forms Authentication, you don't have Windows users at all. In that
> > case, you can set a default administrator account in the
> > RSReportServer.config file (replace "USERNAMEHERE"):
> >
> > <Security>
> > <Extension Name="Forms"
> > Type="RSCustomSecurity.Authorization,
> > ReportingServices.RSCustomSecurity" >
> > <Configuration>
> > <AdminConfiguration>
> > <UserName>USERNAMEHERE</UserName>
> > </AdminConfiguration>
> > </Configuration>
> > </Extension>
> > </Security>
> >
> > I haven't tried setting the AdminConfiguration UserName for when Extension
> > Name="Windows", but it may be worth a shot.
> > --
> > Cheers,
> >
> > '(' Jeff A. Stucker
> > \
> >
> > Business Intelligence
> > www.criadvantage.com
> > ---
> > "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> > news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > > Do you have to be a member of the local win2K administrators group
> > > in-order
> > > to perform administration functions and create folders in Reporting
> > > Services?
> >
> >
>
>|||I logged on as the local administrator and yes I got to the home page and
added my domain account as a systems adminstrator.
I could see all the tabs.
But then logging on as myself, I still only see the 'contents' tab.
I went back as adminstrator to check, and as adminstrator I can only see the
contents tab !!!
I am really stumped by this - it is like you say a "very difficult" product.
Do you (or anyone) have any ideas , I'm desperate.
"ANDY998" <ANDY998@.discussions.microsoft.com> wrote in message
news:284DD604-9DFE-4448-BF9A-D6D2DD03277E@.microsoft.com...
> I have resolved this issue.
> Follow these steps.
> 1. have an windows administrator go to to the report server web page.
> click sitesetting and add you Windowns account as a systems administrator.
> 2. Have the windows administrator then got to the home page press new
> folder and create your new folder, The have them add your windows local
group
> or domain account as a content manager for this new folder.
> Once this is complete you should see this folder on the home page as well
as
> the New folder, New Data Source asnd Upload buttons.
> Andy
> "RIchard Baldock" wrote:
> > I have the exact same issue.
> > I have tried the workaround below, but problem persists.
> > pls help.
> >
> >
> > "Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
> > news:OjW8H8i3EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > > Any user can be given permissions to administer Reporting Services.
If
> > > using Forms Authentication, you don't have Windows users at all. In
that
> > > case, you can set a default administrator account in the
> > > RSReportServer.config file (replace "USERNAMEHERE"):
> > >
> > > <Security>
> > > <Extension Name="Forms"
> > > Type="RSCustomSecurity.Authorization,
> > > ReportingServices.RSCustomSecurity" >
> > > <Configuration>
> > > <AdminConfiguration>
> > > <UserName>USERNAMEHERE</UserName>
> > > </AdminConfiguration>
> > > </Configuration>
> > > </Extension>
> > > </Security>
> > >
> > > I haven't tried setting the AdminConfiguration UserName for when
Extension
> > > Name="Windows", but it may be worth a shot.
> > > --
> > > Cheers,
> > >
> > > '(' Jeff A. Stucker
> > > \
> > >
> > > Business Intelligence
> > > www.criadvantage.com
> > > ---
> > > "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> > > news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > > > Do you have to be a member of the local win2K administrators group
> > > > in-order
> > > > to perform administration functions and create folders in Reporting
> > > > Services?
> > >
> > >
> >
> >
> >|||I have "solved" this.
1. If you would like to see & use all the TABS on the "/Reports" Virtual
directory - disable anonymous access on both the "/Reports" and
"/Reportserver" Virtual directories.
Or
2. If you need to provide anonymous access to your "/Reportserver " virtual
directory then you will not be able to see & use all the TABS on "/Reports"
virtual directory simultaneously.
The obvious workaround is point 1 above. These can be shuffled as required.
Shitty but true. I guess this release was not "intended" to be used over web
etc ?
"RIchard Baldock" <RIchardBaldock@.community.nospam> wrote in message
news:e9SGPKb4EHA.3644@.tk2msftngp13.phx.gbl...
> I logged on as the local administrator and yes I got to the home page and
> added my domain account as a systems adminstrator.
> I could see all the tabs.
> But then logging on as myself, I still only see the 'contents' tab.
> I went back as adminstrator to check, and as adminstrator I can only see
the
> contents tab !!!
> I am really stumped by this - it is like you say a "very difficult"
product.
> Do you (or anyone) have any ideas , I'm desperate.
>
> "ANDY998" <ANDY998@.discussions.microsoft.com> wrote in message
> news:284DD604-9DFE-4448-BF9A-D6D2DD03277E@.microsoft.com...
> > I have resolved this issue.
> >
> > Follow these steps.
> >
> > 1. have an windows administrator go to to the report server web page.
> > click sitesetting and add you Windowns account as a systems
administrator.
> >
> > 2. Have the windows administrator then got to the home page press new
> > folder and create your new folder, The have them add your windows local
> group
> > or domain account as a content manager for this new folder.
> >
> > Once this is complete you should see this folder on the home page as
well
> as
> > the New folder, New Data Source asnd Upload buttons.
> >
> > Andy
> >
> > "RIchard Baldock" wrote:
> >
> > > I have the exact same issue.
> > > I have tried the workaround below, but problem persists.
> > > pls help.
> > >
> > >
> > > "Jeff A. Stucker" <jeff@.mobilize.net> wrote in message
> > > news:OjW8H8i3EHA.2592@.TK2MSFTNGP09.phx.gbl...
> > > > Any user can be given permissions to administer Reporting Services.
> If
> > > > using Forms Authentication, you don't have Windows users at all. In
> that
> > > > case, you can set a default administrator account in the
> > > > RSReportServer.config file (replace "USERNAMEHERE"):
> > > >
> > > > <Security>
> > > > <Extension Name="Forms"
> > > > Type="RSCustomSecurity.Authorization,
> > > > ReportingServices.RSCustomSecurity" >
> > > > <Configuration>
> > > > <AdminConfiguration>
> > > > <UserName>USERNAMEHERE</UserName>
> > > > </AdminConfiguration>
> > > > </Configuration>
> > > > </Extension>
> > > > </Security>
> > > >
> > > > I haven't tried setting the AdminConfiguration UserName for when
> Extension
> > > > Name="Windows", but it may be worth a shot.
> > > > --
> > > > Cheers,
> > > >
> > > > '(' Jeff A. Stucker
> > > > \
> > > >
> > > > Business Intelligence
> > > > www.criadvantage.com
> > > > ---
> > > > "Andy998" <Andy998@.discussions.microsoft.com> wrote in message
> > > > news:5E59ADDF-629E-45E7-BEE8-BC1206B3733E@.microsoft.com...
> > > > > Do you have to be a member of the local win2K administrators group
> > > > > in-order
> > > > > to perform administration functions and create folders in
Reporting
> > > > > Services?
> > > >
> > > >
> > >
> > >
> > >
>

Permissions

The Report Manager will not show on a client machine unless I logon with the local machine administrator account of the report server. The logon credentials that I am using, on the client, is in the administrators group of the local machine of the server.

I am only able to author and view reports when physically logged on to the machine with the report server. The same credentials that were used on client machine are used when logging on to the server machine. I have granted as much permission to the user account as possible unless I am missing something in the report server.

It seems like a related permission issue happens when trying to run Report Builder. I get a better error message when running Report Builder(See Below). To be sure I have given explicit server administrator to the client logon. Furthermore I have given content manager rights to the client logon for a model and a report.

The client machine has framework 2.0 installed.

Here is the error produced when attempting to run the Report Builder.

PLATFORM VERSION INFO
Windows : 5.1.2600.131072 (Win32NT)
Common Language Runtime : 2.0.50727.42
System.Deployment.dll : 2.0.50727.42 (RTM.050727-4200)
mscorwks.dll : 2.0.50727.42 (RTM.050727-4200)
dfdll.dll : 2.0.50727.42 (RTM.050727-4200)
dfshim.dll : 2.0.50727.42 (RTM.050727-4200)

SOURCES
Deployment url : http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application

ERROR SUMMARY
Below is a summary of the errors, details of these errors are listed later in the log.
* Activation of http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application resulted in exception. Following failure messages were detected:
+ Downloading http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application did not succeed.
+ The remote server returned an error: (401) Unauthorized.
+ The target principal name is incorrect

COMPONENT STORE TRANSACTION FAILURE SUMMARY
No transaction error was detected.

WARNINGS
There were no warnings during this operation.

OPERATION PROGRESS STATUS
* [1/23/2006 1:55:22 PM] : Activation of http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application has started.

ERROR DETAILS
Following errors were detected during this operation.
* [1/23/2006 1:55:22 PM] System.Deployment.Application.DeploymentDownloadException (Unknown subtype)
- Downloading http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application did not succeed.
- Source: System.Deployment
- Stack trace:
at System.Deployment.Application.SystemNetDownloader.DownloadSingleFile(DownloadQueueItem next)
at System.Deployment.Application.SystemNetDownloader.DownloadAllFiles()
at System.Deployment.Application.FileDownloader.Download(SubscriptionState subState)
at System.Deployment.Application.DownloadManager.DownloadManifestAsRawFile(Uri& sourceUri, String targetPath, IDownloadNotification notification, DownloadOptions options, ServerInformation& serverInformation)
at System.Deployment.Application.DownloadManager.DownloadDeploymentManifestDirectBypass(SubscriptionStore subStore, Uri& sourceUri, TempFile& tempFile, SubscriptionState& subState, IDownloadNotification notification, DownloadOptions options, ServerInformation& serverInformation)
at System.Deployment.Application.DownloadManager.DownloadDeploymentManifestBypass(SubscriptionStore subStore, Uri& sourceUri, TempFile& tempFile, SubscriptionState& subState, IDownloadNotification notification, DownloadOptions options)
at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut)
at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)
Inner Exception
System.Net.WebException
- The remote server returned an error: (401) Unauthorized.
- Source: System
- Stack trace:
at System.Net.HttpWebRequest.GetResponse()
at System.Deployment.Application.SystemNetDownloader.DownloadSingleFile(DownloadQueueItem next)
Inner Exception
System.ComponentModel.Win32Exception
- The target principal name is incorrect
- Source: System
- Stack trace:
at System.Net.NTAuthentication.GetOutgoingBlob(Byte[] incomingBlob, Boolean throwOnError, SecurityStatus& statusCode)
at System.Net.NTAuthentication.GetOutgoingBlob(String incomingBlob)
at System.Net.NegotiateClient.DoAuthenticate(String challenge, WebRequest webRequest, ICredentials credentials, Boolean preAuthenticate)
at System.Net.NegotiateClient.Authenticate(String challenge, WebRequest webRequest, ICredentials credentials)
at System.Net.AuthenticationManager.Authenticate(String challenge, WebRequest request, ICredentials credentials)
at System.Net.AuthenticationState.AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials authInfo)
at System.Net.HttpWebRequest.CheckResubmitForAuth()
at System.Net.HttpWebRequest.CheckResubmit(Exception& e)

COMPONENT STORE TRANSACTION DETAILS
No transaction information is available.

reading the other posts about permissions leads me to believe that the permissions problem has to do with the number of hops from the client to the server processes. I have not fixed the problem but I am sure this is what it is.

I am still not sure about one thing. Since windows auth. is used, is it possible that the web service and the front end are picking up on the credentials when running it from the server machine? Alternatively, when running it from the client, kerberos auth. must be used to pass the credentials from the front end to the web service.

|||I am getting the same error trying to donwnload the report builder to any client. Works fine with a server\local account but not with a network account. I added myself to the local Server\SQLServer2005SQLBrowserUser & Server\SQLServer2005SQLReportServerUser groups with no avail.

Permissions

hi all

my computer = NZ3 (sql Server)
my computer = the report server

I can design / view / publish to local host (myserver)
others in domain can only view local host (myserver) and no content

so to test added one person - as content manager
he can now see all reports - but when he goes to run
gets the error cannot create a connection to the datasource?

I am using sql server 2005 standard

where else should I be changing or setting permissions

thanks
jewel

Hi,

seems that you are using Integrated Authentication. Although the user can manage the content (the actual report / permissions etc) he does not have access to the database. If you want to grant him access to the appropiate tables with the data, you will have to priviledge him on the database, otherwise he won′t be able to connect nor access the database. Open the SSMS and navigate to the security node of the server. Add the Windows user as a login and grant him the appropiate rights in the database.

HTH, Jens K. Suessmeyer.

http://www.sqlserver2005.de

|||

thanks Jens

that enabled him to see now cool.

So when I have a group set up - do I have to add each one in the Security Logins to enable this to work?

thanks

Jewel

|||

Hi,

yes you need to Map those Windows User group to Security Node and then Assign them proper privilage for Database and Objects of Database for access as per the Role/Group.

Hemantgiri S. Goswami

Permissions

The Report Manager will not show on a client machine unless I logon with the local machine administrator account of the report server. The logon credentials that I am using, on the client, is in the administrators group of the local machine of the server.

I am only able to author and view reports when physically logged on to the machine with the report server. The same credentials that were used on client machine are used when logging on to the server machine. I have granted as much permission to the user account as possible unless I am missing something in the report server.

It seems like a related permission issue happens when trying to run Report Builder. I get a better error message when running Report Builder(See Below). To be sure I have given explicit server administrator to the client logon. Furthermore I have given content manager rights to the client logon for a model and a report.

The client machine has framework 2.0 installed.

Here is the error produced when attempting to run the Report Builder.

PLATFORM VERSION INFO
Windows : 5.1.2600.131072 (Win32NT)
Common Language Runtime : 2.0.50727.42
System.Deployment.dll : 2.0.50727.42 (RTM.050727-4200)
mscorwks.dll : 2.0.50727.42 (RTM.050727-4200)
dfdll.dll : 2.0.50727.42 (RTM.050727-4200)
dfshim.dll : 2.0.50727.42 (RTM.050727-4200)

SOURCES
Deployment url : http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application

ERROR SUMMARY
Below is a summary of the errors, details of these errors are listed later in the log.
* Activation of http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application resulted in exception. Following failure messages were detected:
+ Downloading http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application did not succeed.
+ The remote server returned an error: (401) Unauthorized.
+ The target principal name is incorrect

COMPONENT STORE TRANSACTION FAILURE SUMMARY
No transaction error was detected.

WARNINGS
There were no warnings during this operation.

OPERATION PROGRESS STATUS
* [1/23/2006 1:55:22 PM] : Activation of http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application has started.

ERROR DETAILS
Following errors were detected during this operation.
* [1/23/2006 1:55:22 PM] System.Deployment.Application.DeploymentDownloadException (Unknown subtype)
- Downloading http://{Server Name:port number}/ReportServer/ReportBuilder/ReportBuilder.application did not succeed.
- Source: System.Deployment
- Stack trace:
at System.Deployment.Application.SystemNetDownloader.DownloadSingleFile(DownloadQueueItem next)
at System.Deployment.Application.SystemNetDownloader.DownloadAllFiles()
at System.Deployment.Application.FileDownloader.Download(SubscriptionState subState)
at System.Deployment.Application.DownloadManager.DownloadManifestAsRawFile(Uri& sourceUri, String targetPath, IDownloadNotification notification, DownloadOptions options, ServerInformation& serverInformation)
at System.Deployment.Application.DownloadManager.DownloadDeploymentManifestDirectBypass(SubscriptionStore subStore, Uri& sourceUri, TempFile& tempFile, SubscriptionState& subState, IDownloadNotification notification, DownloadOptions options, ServerInformation& serverInformation)
at System.Deployment.Application.DownloadManager.DownloadDeploymentManifestBypass(SubscriptionStore subStore, Uri& sourceUri, TempFile& tempFile, SubscriptionState& subState, IDownloadNotification notification, DownloadOptions options)
at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut)
at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)
Inner Exception
System.Net.WebException
- The remote server returned an error: (401) Unauthorized.
- Source: System
- Stack trace:
at System.Net.HttpWebRequest.GetResponse()
at System.Deployment.Application.SystemNetDownloader.DownloadSingleFile(DownloadQueueItem next)
Inner Exception
System.ComponentModel.Win32Exception
- The target principal name is incorrect
- Source: System
- Stack trace:
at System.Net.NTAuthentication.GetOutgoingBlob(Byte[] incomingBlob, Boolean throwOnError, SecurityStatus& statusCode)
at System.Net.NTAuthentication.GetOutgoingBlob(String incomingBlob)
at System.Net.NegotiateClient.DoAuthenticate(String challenge, WebRequest webRequest, ICredentials credentials, Boolean preAuthenticate)
at System.Net.NegotiateClient.Authenticate(String challenge, WebRequest webRequest, ICredentials credentials)
at System.Net.AuthenticationManager.Authenticate(String challenge, WebRequest request, ICredentials credentials)
at System.Net.AuthenticationState.AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials authInfo)
at System.Net.HttpWebRequest.CheckResubmitForAuth()
at System.Net.HttpWebRequest.CheckResubmit(Exception& e)

COMPONENT STORE TRANSACTION DETAILS
No transaction information is available.

reading the other posts about permissions leads me to believe that the permissions problem has to do with the number of hops from the client to the server processes. I have not fixed the problem but I am sure this is what it is.

I am still not sure about one thing. Since windows auth. is used, is it possible that the web service and the front end are picking up on the credentials when running it from the server machine? Alternatively, when running it from the client, kerberos auth. must be used to pass the credentials from the front end to the web service.

|||I am getting the same error trying to donwnload the report builder to any client. Works fine with a server\local account but not with a network account. I added myself to the local Server\SQLServer2005SQLBrowserUser & Server\SQLServer2005SQLReportServerUser groups with no avail.

Permission Issue

I am trying to test a new ASP.NET application on my local instance of MSDE.
I created a virtual directory named "db" with a sub-directory of
"processed". My web page opens an XML file in the "db" directory, does some
processing and then I want to move the file to the "processed"
sub-directory. When I execute the Move I get the following error:
'************************************************* ***
Exception Details: System.UnauthorizedAccessException: Access to the path
"C:\Inetpub\wwwroot\db\processed\SC313WorldPrelims .xml" is denied.
ASP.NET is not authorized to access the requested resource. Consider
granting access rights to the resource to the ASP.NET request identity.
ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
Network Service on IIS 6) that is used if the application is not
impersonating. If the application is impersonating via <identity
impersonate="true"/>, the identity will be the anonymous user (typically
IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET write access to a file, right-click the file in Explorer,
choose "Properties" and select the Security tab. Click "Add" to add the
appropriate user or group. Highlight the ASP.NET account, and check the
boxes for the desired access.
Source Error:
Line 50: End If
Line 51: Response.Write("Executing File.Move command!<br>")
Line 52: File.Move(strFilename, fntarget)
Line 53: '*****
Line 54: Else
'************************************************* ****
The instructions don't seem to apply to my system (Win XP Pro SP1)? The
options are different and I don't see any "ASP.NET" account? I suspect I am
min-interpreting something here?
Thanks for any help.
Wayne
Hi
Post this question in microsoft.public.inetserver.iis.security as it is not
a database problem.
Regards
Mike
"Wayne Wengert" wrote:

> I am trying to test a new ASP.NET application on my local instance of MSDE.
> I created a virtual directory named "db" with a sub-directory of
> "processed". My web page opens an XML file in the "db" directory, does some
> processing and then I want to move the file to the "processed"
> sub-directory. When I execute the Move I get the following error:
> '************************************************* ***
> Exception Details: System.UnauthorizedAccessException: Access to the path
> "C:\Inetpub\wwwroot\db\processed\SC313WorldPrelims .xml" is denied.
> ASP.NET is not authorized to access the requested resource. Consider
> granting access rights to the resource to the ASP.NET request identity.
> ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
> Network Service on IIS 6) that is used if the application is not
> impersonating. If the application is impersonating via <identity
> impersonate="true"/>, the identity will be the anonymous user (typically
> IUSR_MACHINENAME) or the authenticated request user.
> To grant ASP.NET write access to a file, right-click the file in Explorer,
> choose "Properties" and select the Security tab. Click "Add" to add the
> appropriate user or group. Highlight the ASP.NET account, and check the
> boxes for the desired access.
> Source Error:
>
> Line 50: End If
> Line 51: Response.Write("Executing File.Move command!<br>")
> Line 52: File.Move(strFilename, fntarget)
> Line 53: '*****
> Line 54: Else
> '************************************************* ****
> The instructions don't seem to apply to my system (Win XP Pro SP1)? The
> options are different and I don't see any "ASP.NET" account? I suspect I am
> min-interpreting something here?
> Thanks for any help.
> Wayne
>
>
>
|||OK - will do
Wayne
"Mike Epprecht (SQL MVP)" <mike@.epprecht.net> wrote in message
news:95192DB5-306F-4001-B69D-9471BEE2088D@.microsoft.com...
> Hi
> Post this question in microsoft.public.inetserver.iis.security as it is
not[vbcol=seagreen]
> a database problem.
> Regards
> Mike
> "Wayne Wengert" wrote:
MSDE.[vbcol=seagreen]
some[vbcol=seagreen]
path[vbcol=seagreen]
or[vbcol=seagreen]
Explorer,[vbcol=seagreen]
am[vbcol=seagreen]