Permissions to a standard database role

Q: A standard database role named abc is created and assigned permissions to
db_reader and db_writer roles.
Then the database users are made members to the role abc.
(The DatabaseAccess under users displays viaGroupMembership.)
But why doesnot users have access to the database?
(SQLServer2000)Hi,
Please let me now what error message, if any, you receive when you attempt
to access the database. Also, if you have auditing enabled, what error
message, if any, do you receive in the SQL Error Log or the Application
Event Log?
Based on my test, the configuration you describe should work OK.
Thanks.
Gary
This posting is provided "AS IS" with no warranties, and confers no rights.

Permissions for SSAS Service Account?

Hi All,

Please help with this.

I'm running a server with Windows Server 2003 R2 Enterprise x64 Edition.

On the box I've performed one named instance installation of SSAS.

I've installed SP1 as well.

There's no firewall running on the machine.

My domain account is in the SSAS Server role.

SSAS Service is running according to SQL Configuration Manager

SQL Browser Service is running according to SQL Configuration Manager

If I run both SSAS and SQL Browser under Local System, everything works OK. But this is not the way I want it, because it's not safe and SSAS is unable to read data from the remote SQL box.

If I change the service account to a domain user account, I can't connect to SSAs anymore. The error message is:

TITLE: Microsoft SQL Server Management Studio

A connection cannot be made to redirector. Ensure that 'SQL Browser' service is running. (Microsoft.AnalysisServices.AdomdClient)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

I've both set the logon account at setup, using SQL Config Mgr and Service Manager.

Using PortQry I can see nothing's listening on port 2382.

It should work. I'm beginning to think this user account doesn't have sufficient rights.

So I've created two local accounts and used these as service accounts. Same thing, untill I added both accounts to the local administrators group, then everything worked fine again.

What am I doing wrong here? Your suggestions are much appreciated.

Thanks,

Coen

Hello. You have another configuration that you do not mention: "Surface area"

You will have to allow remote connections in this configuration tool. That is for each SQL Server 2005 service that you are using.

HTH

Thomas Ivarsson

|||

Couple of things.

One. Make sure you use SQL Configuration Manager to change serivce logon account for both SQL Browser and for Analysis Server.

Second. Take a look at the connectivity troubleshooting guide http://www.sqljunkies.com/WebLog/edwardm/archive/2006/05/26/21447.aspx

Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||

The Surface Afrea Conf tool returns the following error:

TITLE: Surface Area Configuration

A connection cannot be made. Ensure that the server is running. (Microsoft.AnalysisServices)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

|||

I am using the SQL Config Mgr to change the user id's. BTW this is sometimes a bit crooked, and I still need to change the Service Account in the Service Manager as well.

Besides, I don't really think the problem's in there. Setup should set the correct permissions for the Logon Account.

Thanks for pointing me to your post on SQLJunkies. I've used it before.

|||I've narrowed it don a bit. It seems only the Service Account used for SQL browser has to be in the Local Admins group.

Permissions for SSAS Service Account?

Hi All,

Please help with this.

I'm running a server with Windows Server 2003 R2 Enterprise x64 Edition.

On the box I've performed one named instance installation of SSAS.

I've installed SP1 as well.

There's no firewall running on the machine.

My domain account is in the SSAS Server role.

SSAS Service is running according to SQL Configuration Manager

SQL Browser Service is running according to SQL Configuration Manager

If I run both SSAS and SQL Browser under Local System, everything works OK. But this is not the way I want it, because it's not safe and SSAS is unable to read data from the remote SQL box.

If I change the service account to a domain user account, I can't connect to SSAs anymore. The error message is:

TITLE: Microsoft SQL Server Management Studio

A connection cannot be made to redirector. Ensure that 'SQL Browser' service is running. (Microsoft.AnalysisServices.AdomdClient)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

I've both set the logon account at setup, using SQL Config Mgr and Service Manager.

Using PortQry I can see nothing's listening on port 2382.

It should work. I'm beginning to think this user account doesn't have sufficient rights.

So I've created two local accounts and used these as service accounts. Same thing, untill I added both accounts to the local administrators group, then everything worked fine again.

What am I doing wrong here? Your suggestions are much appreciated.

Thanks,

Coen

Hello. You have another configuration that you do not mention: "Surface area"

You will have to allow remote connections in this configuration tool. That is for each SQL Server 2005 service that you are using.

HTH

Thomas Ivarsson

|||

Couple of things.

One. Make sure you use SQL Configuration Manager to change serivce logon account for both SQL Browser and for Analysis Server.

Second. Take a look at the connectivity troubleshooting guide http://www.sqljunkies.com/WebLog/edwardm/archive/2006/05/26/21447.aspx

Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||

The Surface Afrea Conf tool returns the following error:

TITLE: Surface Area Configuration

A connection cannot be made. Ensure that the server is running. (Microsoft.AnalysisServices)

ADDITIONAL INFORMATION:

No connection could be made because the target machine actively refused it (System)

BUTTONS:

OK

|||

I am using the SQL Config Mgr to change the user id's. BTW this is sometimes a bit crooked, and I still need to change the Service Account in the Service Manager as well.

Besides, I don't really think the problem's in there. Setup should set the correct permissions for the Logon Account.

Thanks for pointing me to your post on SQLJunkies. I've used it before.

|||I've narrowed it don a bit. It seems only the Service Account used for SQL browser has to be in the Local Admins group.

Permission Issue

I am trying to test a new ASP.NET application on my local instance of MSDE.
I created a virtual directory named "db" with a sub-directory of
"processed". My web page opens an XML file in the "db" directory, does some
processing and then I want to move the file to the "processed"
sub-directory. When I execute the Move I get the following error:
'************************************************* ***
Exception Details: System.UnauthorizedAccessException: Access to the path
"C:\Inetpub\wwwroot\db\processed\SC313WorldPrelims .xml" is denied.
ASP.NET is not authorized to access the requested resource. Consider
granting access rights to the resource to the ASP.NET request identity.
ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
Network Service on IIS 6) that is used if the application is not
impersonating. If the application is impersonating via <identity
impersonate="true"/>, the identity will be the anonymous user (typically
IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET write access to a file, right-click the file in Explorer,
choose "Properties" and select the Security tab. Click "Add" to add the
appropriate user or group. Highlight the ASP.NET account, and check the
boxes for the desired access.
Source Error:
Line 50: End If
Line 51: Response.Write("Executing File.Move command!<br>")
Line 52: File.Move(strFilename, fntarget)
Line 53: '*****
Line 54: Else
'************************************************* ****
The instructions don't seem to apply to my system (Win XP Pro SP1)? The
options are different and I don't see any "ASP.NET" account? I suspect I am
min-interpreting something here?
Thanks for any help.
Wayne
Hi
Post this question in microsoft.public.inetserver.iis.security as it is not
a database problem.
Regards
Mike
"Wayne Wengert" wrote:

> I am trying to test a new ASP.NET application on my local instance of MSDE.
> I created a virtual directory named "db" with a sub-directory of
> "processed". My web page opens an XML file in the "db" directory, does some
> processing and then I want to move the file to the "processed"
> sub-directory. When I execute the Move I get the following error:
> '************************************************* ***
> Exception Details: System.UnauthorizedAccessException: Access to the path
> "C:\Inetpub\wwwroot\db\processed\SC313WorldPrelims .xml" is denied.
> ASP.NET is not authorized to access the requested resource. Consider
> granting access rights to the resource to the ASP.NET request identity.
> ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
> Network Service on IIS 6) that is used if the application is not
> impersonating. If the application is impersonating via <identity
> impersonate="true"/>, the identity will be the anonymous user (typically
> IUSR_MACHINENAME) or the authenticated request user.
> To grant ASP.NET write access to a file, right-click the file in Explorer,
> choose "Properties" and select the Security tab. Click "Add" to add the
> appropriate user or group. Highlight the ASP.NET account, and check the
> boxes for the desired access.
> Source Error:
>
> Line 50: End If
> Line 51: Response.Write("Executing File.Move command!<br>")
> Line 52: File.Move(strFilename, fntarget)
> Line 53: '*****
> Line 54: Else
> '************************************************* ****
> The instructions don't seem to apply to my system (Win XP Pro SP1)? The
> options are different and I don't see any "ASP.NET" account? I suspect I am
> min-interpreting something here?
> Thanks for any help.
> Wayne
>
>
>
|||OK - will do
Wayne
"Mike Epprecht (SQL MVP)" <mike@.epprecht.net> wrote in message
news:95192DB5-306F-4001-B69D-9471BEE2088D@.microsoft.com...
> Hi
> Post this question in microsoft.public.inetserver.iis.security as it is
not[vbcol=seagreen]
> a database problem.
> Regards
> Mike
> "Wayne Wengert" wrote:
MSDE.[vbcol=seagreen]
some[vbcol=seagreen]
path[vbcol=seagreen]
or[vbcol=seagreen]
Explorer,[vbcol=seagreen]
am[vbcol=seagreen]