SSRS and UAC (User Access Control)

One of the frequently asked question in many forums is “I am an admin on the machine (Windows Vista or Windows 7 or Windows 2k8) where SSRS is installed but I am not able to access the reports”. 

Recently I faced a similar issue. I am an admin on the machine which has Windows 2008 R2 installed. On top of it, I installed SSRS 2008 R2 and then configured the RS with proper values. 

Then when I tried to access the report manager by navigating to the URL, I got an error message like 

User ‘Domain\User’ does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed.
  

I once again checked my configuration but everything looked fine. Since the error message gave some hint on UAC, I ran the browser as admin and navigated to the report manager. Now it did not throw any error message. I was able to see the home page and all other menu including the Site Settings. 

I added myself as System Admin in the Site Setting 

 

Closed the browser and opened it again in normal mode. Still  it was throwing same error. 

Opened the browser again in Admin mode. Navigated to the home folder and added myself and assigned to all the roles. 

 

After this when I ran the browser in normal mode, I was able to access all report manager and all the folders. 

The issue is that by default UAC allows the users (even the administrators) to do the tasks with the privilege of normal user, i.e, say when you open the browser or an application, it is opened with the normal user’s privilege and not that of administrator’s privilege. 

What I understood is that when I opened the browser in normal mode, UAC passed standard user’s privilege to SSRS and hence SSRS was not able to identify that I am an admin. To get the admin access either I have to run the browser in admin mode or add myself explicitly to SSRS System Admin roles. 

So you have two options to tackle this issue 

1) Fix it at your SSRS end as outlined above  (or)

2) Manage your UAC appropriately. Have a look at the below one to know more about UAC and how to manage it.

http://technet.microsoft.com/en-us/library/cc709691(WS.10).aspx

I went for the first option as UAC is mandatory in my ORG and also it helps you to secure your machine.

About these ads

About Suresh Kumar D

Hardcore SQL Developer and aspiring Database Architect.
This entry was posted in SSRS. Bookmark the permalink.

50 Responses to SSRS and UAC (User Access Control)

  1. Dhina says:

    Hi

    I have resolved the problem with the help of your post. Thanks.
    Your blog looks informative. Keep it up.

    Regards,
    Dhina
    Chennai

  2. Cameron says:

    Nice article. Helped me resolve the issue.

  3. Rafa says:

    Hi Suresh, many many thanks, you really hit the nail on this problem providing the one and only solution that worked. Thanks again!

  4. Steven Kielkucki says:

    Suresh, thanks for the information / direction. This seems to be a sore point with SSRS.

    • Steven, thanks a lot for the review. I can understand your point. I have also observed that in SSRS many things are not straight forward but most of the times work around exists.

  5. Ennio says:

    Suresh,

    Your explanation worked very fine. I was stucked with some users that cannot do their reports deployment. The solution worked for me using Win 2008 R2 and SQL Server Standard 2008 R2.

    Thank you for you small but clearly explained topic on SSRS 2008.

  6. Zainab says:

    Hi,

    I tried the solution but it did’t work with me …!!

    I even added the user to Active Directory Administrators Group, but still I cannot access the report manager using that user !!

    Please advice

  7. Even after running IE as Administrator I am still getting the same issue. I think something was botched with the install. I may uninstall SSRS and reinstall.

  8. Okay I got it running…

    I am running Windows 7 Pro x64 and SQL Server 2008 R2 Developer Edition. This system is not part of a domain, it’s a personal pc.

    1) I had to open a command prompt (running it as an Administrator)
    2) Then I ran net user administrator /active:yes
    3) Set the password for Administrator
    4) Then I Shift+Right clicked on IE on quick launch and selected “Run as Different User”
    5) Typed in the credentials for the built-in Administrator account
    6) Navigated to http://localhost/Reports
    7) Typed in the credentials for the built-in Administrator account again
    8) Clicked on Site Settings
    9) Clicked on Security
    10) Added my account to Report Manager as a System Administrator

  9. Joe says:

    So here’s a challenging one. A friend of mine was having this issue. I found your article and gave it a whirl, but to no avail. The site works when running the browser as admin, but not as a normal execution privileges (which is also a domain admin). The one mix here that I am totally unsure of is that this server is also a domain controller (Don’t as me why). Any ideas there?

  10. karthik says:

    HI..

    Thanks for your post.. It helped me resolved my error!!! Keep posting!!

  11. Andrew Broad says:

    Many thanks to Suresh for the original article, and Samson for your post. A combination of the two solved this problem for me.

  12. Shashi says:

    This post saved my day.
    Thanks a lot for posting this.

  13. Pingback: 2010 in review | Kirukkal a.k.a Scribbling

  14. Joseph Fallon says:

    Thanks very much – fixed my issue immediately !!

  15. Jess says:

    I’ve not managed to resolve this issue. Like you, I can get access when I open IE in admin mode but when I go to the New Role Assignment, I don’t see all the options you show in the screenshot. I just see System Administrator and System User as options. Even checking both, I get the error when opening IE normally.

    • Hi Jessica,

      You need to add your ID in two places, one is Site Setting which you have already done.
      The other one is not from Site Setting. It is from Properties window. To get that

      Navigate to Home folder – > You will see two tabs (under the name Home) Contents, Properties. -> Click on Properties -> Click on Security -> Click on New Role assignments
      You will get all the options like Browser, Content Manager, etc..

      Hope this helps

      • Josh B says:

        If someone is having trouble finding the “Properties” tab on the Home folder screen this is what I did…

        To get to the second screenshot (what Suresh is calling “Properties window”) I had to select the “Folder Settings” button from the Home folder, not the “Properties” tab.

  16. Paul Brown says:

    I can see everything except the home screen. I can go to site setting and My subscriptions, but whenever I hit Home I get the error “User ‘Domain\User’ does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed.” It happens whether I use run as admin or not. Do you have any idea why that would be?

  17. Hi Brown,

    This is strange. Once I came across an issue where in user (not admin) was not able to access the home folder. That was because of access issue. Refer the link http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/c068b8a5-6113-487b-99f5-ccf2de2f11d0/

    In your case you are saying that you are not able to access with admin access also. Can you, for testing purpose, disable the UAC and check whether you are able to access the home folder or not. Refer the link http://technet.microsoft.com/en-us/library/cc709691(WS.10).aspx to see how to disable the UAC.

  18. kshema says:

    Thanks.. This worked with me…

  19. Sintia Angarita says:

    Your post saved me from hours of looking into an answer. It is simple and straight forward to the answer. Keep up the great work here.

  20. Kashif Aslam says:

    Thanks a lot! I don’t know how many hours I have wasted figuring this out. But this is the excellent article I have found. And thanks to the commentators too!

  21. Maju says:

    In my case, I have got all the folders by setting the user role but not the Report Builder link. To get this any additional settings is needed ?

    • Sorry for the delayed reply. Out of action for few days.

      If your issue is still not resolved, did you add the user to the “Report Builder” role? Otherwise , I think the user will not get that link.

      • Maju says:

        Already the user had that permission even though the Report Builder was not showing. But when I added this user in system role assignment then I got hte report builder link.

        Thanks

  22. singanan says:

    Helped me in a neck of moment, thanks a lot suresh

  23. Eric says:

    This was a great help thanks!

  24. Russell Sneddon says:

    This article was a great help to me too. Thank you very much. I can now access my SSRS instance as an administrator, without the need to use “Run as administrator”.

    I now have a related issue. On my 2008 SSRS instance, if a user with no SSRS privileges logs in to Report Manager then they get the correct screen with no folders/reports listed and no error messages.

    On my 2008 R2 instance, a similar user gets the message “User ‘W10\SSRS Content Manager’ does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed.”.

    I prefer the blank screen with no off-putting error message. Can this difference be easily explained? Is it simply down to 2008 vs 2008 R2, or is it likely that I’ve got some other configuration difference somewhere?

    Many thanks to anybody who gives this some thought!

    • Hi Russell,

      Reg. the new issue, that your user is seeing error message, I think this is the normal functionality and if I remember it used to happen with SSRS 2008 also.

      However if you want to overcome this, I solution I see is creating a new role with “View Folder” permission only to Report Server Home folder. Here is how I will go about it.

      Create a new role , say NavigateFolder. You can create it by connecting to the Report Server using SSMS. You need to connect select “Reporting Services ” in the Server Type dropdown and then expand the security node . Right click on the Roles and New Role.

      In the resulting window select only “View Folders”

      Then go to your report manager and add the domain users to your home folder and assign only the NavigateFolder role.

      Now users will be able to navigate to the home folder.

      Then you can over-ride the users permission in the sub-folders by assigning appropriate roles (in your case browser).

      You can refer this link for more detail on this issue

      http://social.msdn.microsoft.com/Forums/en-US/sqlreportingservices/thread/c068b8a5-6113-487b-99f5-ccf2de2f11d0/

      where a similar issue was resolved though it is not exactly same as yours.

      Pls let me know if you face any issues.

      • Russell Sneddon says:

        Thanks for taking the time to respond. Are you sure the error message should appear in SSRS 2008 (not R2)?

        The only role assignment I have set at the Home folder is my administrators group as content managers. As I said, when I access the Home folder from an account with absolutely no SSRS privileges (either direct or via a group) on SSRS 2008 I just get a blank screen (even though there are plenty of folders and reports at that level). On SSRS 2008 R2 I get the unfriendly error message.

        I’m using “Run As” with Internet Explorer to test this on R2. That seems to be working because the error message is referencing the correct user name, but I wonder if that is the reason for the difference? I’ll test it out.

  25. Thanks! Your post saved a lot of my time :)

  26. Jeffry Altamar says:

    thanks a lot , i set it up as you mentioned in the post and it worked.

  27. ramana says:

    User ‘—-’ does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed. When open the browser with admin rights and try to open that report server by copying the link, also getting the same issue. Can you please help me out. Thank you,.

  28. Pingback: SQL Server Reporting Services – Insufficient Permissions | How I Learn Stuff

  29. Shakir Shaikh says:

    Thanks for your article Suresh. It saved my day.

  30. ozone702 says:

    Thank you very much. After searching for a few hours, I luckily stumbled upon this to fix the issue.

  31. adam says:

    Hi Suresh. Thanks for the post. It should perhaps be made more clear that the role assignment should be on the folders. Creating the new role under Site Settings -> Security doesn’t work. I’m not sure what the Site Setting Security role assignment does.

  32. Phelan says:

    Suresh, Thank you for the post. I tired doing it in Firefox at first, but had to make the changes in IE first and now it is working in Firefox.

  33. HeliFox says:

    Windows 8 users!
    Symptom – after all done (running IE in admin mode) you can not see Site Setting link!

    In Windows 8 you have to TURN OFF UAC not just reduce UAC level to minimum – it is not the same. (Some details you can find here: http://www.neowin.net/forum/topic/1120770-windows-8-run-everything-as-administrator/)

    So at first disable UAC, make everything as described in article and then enable UAC again (while disabled UAC means you are not able to access Store for example).

    How to disable UAC:
    regedit
    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
    change EnableLUA to 0
    restart PC

    Good luck.

  34. Drummond says:

    Reblogged this on drummondsql and commented:
    Great informational post. I was toying around with SSRS the other day and forgot about the UAC issue with IE.

  35. Pingback: SSRS and UAC | drummondsql

  36. John says:

    Finally!!!! Something that worked!

    This also works with SSRS 2012.

  37. Jude laww says:

    Top man. Well done. Also worked for me. UAC sucks

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s