I am running an instance of Reporting Services 2008 R2 and would like to customize the Browser role. By default, that role is allowed to view folders, reports and subscribe to reports. I want to remove the ability of users in the Browser role to subscribe to reports.
Please let me know if this role modification is possible. If not, is there a way to create a new role that can only view folders and reports?
You can accomplish this easily, but the path to this feature is a little unusual. To change the security like this you need to use SQL Server Management Studio to connect to SSRS:
Server type: Reporting Services
Server name: http://servername/reportserver
Once connected you can expand the Security folder and then the Roles folder to display your roles. Double click on "Browser" to get a properties window that should be straight forward. The task you want to deselect is "Manage individual subscriptions."
Related
Want to identify the users/login with Administrative access on server to migrate them to new server's. I have tried Select * from $System.TMSCHEMA_ROLE_MEMBERSHIPS but these give information regarding the particular database i need more at server level.
Ssas users are done quite differently from normal databases. Ssas uses only the active directory account of the user trying to connect.
On server level the only security is done in the properties of the server, there you can select active directory users with administrative access to the server.
On database level you can create roles, give them access to (part of a) database and link active directory users/groups to them.
Using the analysisservices namespace of microsoft you already mentioned you can look trough every role in every database and note the permissions.
As far as I know you can't actually use this namespace to see all the administrators of the user. But unless you have an unreasonable amount of administrators the best solution might be to just open the server in sql server management studio, click on properties, security and write down all the AD members manually.
I hope this helps you and good luck!
Good day. Am working in an environment that requires a security approach for checking users account (users in the active directory are changing data in the SQL SERVER).
I want to link/tie the users of an active directory to the SQL server account login account.
Am working with Powershell, i type Get-ADUser -filter *, it gives me the list of all listed users. If i log into my SQL SERVER with "winnie", how do i link/tie the active directory user with the sql server user called ""winnie"
You should never give users access to a database by single Windows User or by SQL User. The reason for this is because of the security later on. It will be better to manage and audit a group compared to giving out single users. If you have to restore that database to a new system. It will provide better security between a Production system and a Test system.
The only user who should have access to a database is the SA account. The others should be controlled by Security Groups.
How do you do this:
In SQL Server Management Studio, go to Object Explorer > (your server) > Security > Logins and right-click New Login:
Then in the dialog box that pops up, pick the types of objects you want to see (Groups is disabled by default - check it!) and pick the location where you want to look for your objects (e.g. use Entire Directory) and then find your AD group.
Any member of that AD group can now login to SQL Server and use your database.
Add the Read or Write permissions to the Security Group of choice. Limiting security issues it the future.
Best Practice:
Create Security Groups
Security Group naming convention exmaples:
SG_DBNAME_READ
SG_DBNAME_WRITE
SG_DBSERVER_ADMIN
We are upgrading to SSRS 2008 R2 on 2008 Server. We have a production environment that prevents us from having local admin permissions for accounts. We have been told that we can only have a batch level service account. I assume[d] the Content Manager and System Administrator role can run under this account however we can't seem to get ReportManager running without local admin. The SSRS database is installed on a separate box.
I'm hoping someone has a set of steps or reference to how we can configure this to work without local admin.
thanks
Marty
When installing SSRS by default there is no place to enter ssrs manager or ssrs credentials. Just set up the endpoints, database, email and a low level account. You would need an admin account initially to access the report manager once. During this time other system level accounts can be created that can match to your admins batch user requirements. I would propose two accounts for the SSRS box.
1. Report User - Can Run Reports Can View
2. Report Admin - Can Update Defs. Can Run Reports
Then deploy reports using ReportAdmin and request reports using ReportUser.
I have a application .net that search a folder on report server and reads the reports inside that folder and display on asp.net page. The permissions for the asp.net user are working fine to deploy and execute on website.
Now, I want to users to deploy on "My reports" folder, so they only see theirs reports.(The users have access to report server and use report builder).
I search and I could not find a solution for this:
I want to give permissions to an a user (the same that is running on asp.net server), to access all "My reports" folder of all users(Users Folder), so I can execute the reports inside users folder on website.
I put the asp.net server user as local administrator of the report server, but with that permission te user can only see the content of the folder, this user can not execute the report. Any idea what is the problem?
I finally found a solution, and does not involve add users to local administrator of the machine.
I used the IAuthorizationExtension.
I found this example that enable anonymous access for all users witch was a start.
On my implementation I used WindowsAuthorization, because I want to keep the existing authorization and give access to one specific user. On all CheckAccess methods I check if the user is the one I want to give access and return true otherwise return the WindowsAuthorization.CheckAccess(...). On all others methods of the interface I also used the WindowsAuthorization.
With this solution the user running website can access all content of reporting services.
My build agents are not starting after I change the properties credentials to the domain account from the network service. I done this because the network service account cannot write to my drop folder.
Each time I add the network service to the drop folder share, it appears then disappears.
http://msdn.microsoft.com/en-us/library/bb778394.aspx I followed this but some steps are different, i have xp and it doesn't show the share tab so i go through security tab
So I guess I'm asking two questions here;
Agents are not starting after changing credentials.
Network service not able to write to the drop folder.
Thanks in advance
Yes, Network Service won't have permissions to write to a drop location. That's pretty standard. You need to be using a domain account.
The TFS Build Service will need to run as a domain user so it can write to the drop location.
The domain account for the build agent will need to be in the TFS Project Collection group for build service accounts (internal to TFS). I can't remember what it's actually called but you need to be a collection administrator to update it.
The domain account will also need some login as batch/service permissions but that should be done automatically when you reconfigure the service. Do you use the TFS Admin console to reconfigure the agent or did you just set the credentials on the service? (You should use the TFS Admin console).