Domain Security Groups unable to Browse Report Folders

I am user SQL/RS 2005 on a 2003 Server on a 2000 domain and I have created a
domain security group and added a user to it. I then went into the security
tab of reporting services Home and added the group with the role of Browser.
I then added the same group to a child folder in the same manor. The user
can NOT see any folders or objects to browse and doesn't get the My Reports
folder showing either. If I add one of the builting groups (ssuch as
builtin\users) to the Home folder, all users can see and browse that folder.
The only references I have found say that domain groups should automatically
be enabled when RS is installed. I have had this problem from the beginning.
I even tried adding the user to a local group and adding the local group to
the Home folder and had no luck. If I add the same user explecitly to the
Home and sub-folders, everything works fine.
Does anyone have any idea what might be wrong in my configuration?
I tallked to a colleague who has SAL/RS Dev Edition on an XP machine
attached to a 2003 domain and he has the exact same problem.
This is very frustrating because it is a maintenance nightmare for the site
security.
I did check and the Default Web Site and the Reports and the Report Server
site are set to Windows Authentication and not to allow anonymous access.
Any help will be greatly appreciated.Are you specifying the domain name before the group name? Like
MYDOMAIN\MYGROUPNAME.
"qIjDraco" wrote:
> I am user SQL/RS 2005 on a 2003 Server on a 2000 domain and I have created a
> domain security group and added a user to it. I then went into the security
> tab of reporting services Home and added the group with the role of Browser.
> I then added the same group to a child folder in the same manor. The user
> can NOT see any folders or objects to browse and doesn't get the My Reports
> folder showing either. If I add one of the builting groups (ssuch as
> builtin\users) to the Home folder, all users can see and browse that folder.
> The only references I have found say that domain groups should automatically
> be enabled when RS is installed. I have had this problem from the beginning.
> I even tried adding the user to a local group and adding the local group to
> the Home folder and had no luck. If I add the same user explecitly to the
> Home and sub-folders, everything works fine.
> Does anyone have any idea what might be wrong in my configuration?
> I tallked to a colleague who has SAL/RS Dev Edition on an XP machine
> attached to a 2003 domain and he has the exact same problem.
> This is very frustrating because it is a maintenance nightmare for the site
> security.
> I did check and the Default Web Site and the Reports and the Report Server
> site are set to Windows Authentication and not to allow anonymous access.
> Any help will be greatly appreciated.
>|||What I do is have a local group that I add domain groups and individual
domain users. I have never had to do anything other than add them to the
proper role. It is possible to force a subdirectory from inheriting from the
above directory. Perhaps you have done this?
--
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"qIjDraco" <qIjDraco@.discussions.microsoft.com> wrote in message
news:42C60E14-438A-4D5A-AFB4-698D2DD736A3@.microsoft.com...
>I am user SQL/RS 2005 on a 2003 Server on a 2000 domain and I have created
>a
> domain security group and added a user to it. I then went into the
> security
> tab of reporting services Home and added the group with the role of
> Browser.
> I then added the same group to a child folder in the same manor. The user
> can NOT see any folders or objects to browse and doesn't get the My
> Reports
> folder showing either. If I add one of the builting groups (ssuch as
> builtin\users) to the Home folder, all users can see and browse that
> folder.
> The only references I have found say that domain groups should
> automatically
> be enabled when RS is installed. I have had this problem from the
> beginning.
> I even tried adding the user to a local group and adding the local group
> to
> the Home folder and had no luck. If I add the same user explecitly to the
> Home and sub-folders, everything works fine.
> Does anyone have any idea what might be wrong in my configuration?
> I tallked to a colleague who has SAL/RS Dev Edition on an XP machine
> attached to a 2003 domain and he has the exact same problem.
> This is very frustrating because it is a maintenance nightmare for the
> site
> security.
> I did check and the Default Web Site and the Reports and the Report Server
> site are set to Windows Authentication and not to allow anonymous access.
> Any help will be greatly appreciated.
>|||I tryied using a local group and tried adding my domain users and had no luck
there too.
Is there any special user id / previledges you are running your SQL and RS
services under?
Mine are as follows:
SQL Server: Local System
SQL Server Active Directory Helper: Network Service
SQL Server Agent: Local System
SQL Server Analysis Services: {domain account setup for SQL}
SQL Server Browser: {domain account setup for SQL}
SQL Server FullText Search: Local System
SQL Server Integration Services: Network Service
SQL Server Reporting Services: {domain account setup for SQL}
SQL Server VSS Writer: Local System
qIjDraco
"Bruce L-C [MVP]" wrote:
> What I do is have a local group that I add domain groups and individual
> domain users. I have never had to do anything other than add them to the
> proper role. It is possible to force a subdirectory from inheriting from the
> above directory. Perhaps you have done this?
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services|||Yes, I did specify the domain name before the group name. That is why I am
so confused.
qIjDraco
"SteveIrwin" wrote:
> Are you specifying the domain name before the group name? Like
> MYDOMAIN\MYGROUPNAME.
>|||Did you find the solution because I have the same problem.
Thanks--
Nelson Vega Marrero
Las Vegas Nevada
Tech Result
"qIjDraco" wrote:
> I tryied using a local group and tried adding my domain users and had no luck
> there too.
> Is there any special user id / previledges you are running your SQL and RS
> services under?
> Mine are as follows:
> SQL Server: Local System
> SQL Server Active Directory Helper: Network Service
> SQL Server Agent: Local System
> SQL Server Analysis Services: {domain account setup for SQL}
> SQL Server Browser: {domain account setup for SQL}
> SQL Server FullText Search: Local System
> SQL Server Integration Services: Network Service
> SQL Server Reporting Services: {domain account setup for SQL}
> SQL Server VSS Writer: Local System
> qIjDraco
> "Bruce L-C [MVP]" wrote:
> > What I do is have a local group that I add domain groups and individual
> > domain users. I have never had to do anything other than add them to the
> > proper role. It is possible to force a subdirectory from inheriting from the
> > above directory. Perhaps you have done this?
> >
> > --
> > Bruce Loehle-Conger
> > MVP SQL Server Reporting Services
>|||Did you find the solution because I have the same problem and I do not know
what should I do in oder to fix that.
I'm thinking maybe the RS does not work online with the Active Directory and
once it copy the group it never do it again but I'm not sure
Please anyhelp
--
Nelson Vega Marrero
Las Vegas Nevada
Tech Result
"qIjDraco" wrote:
> I am user SQL/RS 2005 on a 2003 Server on a 2000 domain and I have created a
> domain security group and added a user to it. I then went into the security
> tab of reporting services Home and added the group with the role of Browser.
> I then added the same group to a child folder in the same manor. The user
> can NOT see any folders or objects to browse and doesn't get the My Reports
> folder showing either. If I add one of the builting groups (ssuch as
> builtin\users) to the Home folder, all users can see and browse that folder.
> The only references I have found say that domain groups should automatically
> be enabled when RS is installed. I have had this problem from the beginning.
> I even tried adding the user to a local group and adding the local group to
> the Home folder and had no luck. If I add the same user explecitly to the
> Home and sub-folders, everything works fine.
> Does anyone have any idea what might be wrong in my configuration?
> I tallked to a colleague who has SAL/RS Dev Edition on an XP machine
> attached to a 2003 domain and he has the exact same problem.
> This is very frustrating because it is a maintenance nightmare for the site
> security.
> I did check and the Default Web Site and the Reports and the Report Server
> site are set to Windows Authentication and not to allow anonymous access.
> Any help will be greatly appreciated.
>|||Unfortunately I haven't found the solution yet. I tried chaning the ID
reporting services and SQL were running under, but no change in behavior.
qIjDraco
"Nelson Vega" wrote:
> Did you find the solution because I have the same problem and I do not know
> what should I do in oder to fix that.|||Did you contact microsoft ?
--
Nelson Vega Marrero
Las Vegas Nevada
Tech Result
"qIjDraco" wrote:
> Unfortunately I haven't found the solution yet. I tried chaning the ID
> reporting services and SQL were running under, but no change in behavior.
> qIjDraco
> "Nelson Vega" wrote:
> > Did you find the solution because I have the same problem and I do not know
> > what should I do in oder to fix that.
>|||Did you contact Microsoft about the problem?
--
Nelson Vega Marrero
Las Vegas Nevada
Tech Result
"qIjDraco" wrote:
> Unfortunately I haven't found the solution yet. I tried chaning the ID
> reporting services and SQL were running under, but no change in behavior.
> qIjDraco
> "Nelson Vega" wrote:
> > Did you find the solution because I have the same problem and I do not know
> > what should I do in oder to fix that.
>|||I finally got past this problem. I changed my services to running as shown
below. Now I create a domain security group and add the appropriate users to
it. Then I create a local group on the SQL machine and add the domain group
as the only member of the local group. I then give the local group the
appropriate permission to each folder on the web site (browser, content
manager, admin, etc.). RS properly checks and shows the folders it should to
each user.
Services run as "Network Service":
SQL Server Active Directory Helper
SQL Server Integration Services
Services run as "Local System":
SQL Server FullText Search
SQL Server VSS Writer
Services run as a domain admin ID that I created just for the SQL services:
SQL Server
SQL Server Agent
SQL Server Analysis Services
SQL Server Browser
SQL Server Reporting Services
I think my problem was that some of the services initially installed with
the wrong type of "Log On As" user. Everything seems to be working just fine
for me now.
qIj Draco
--
"Nelson Vega" wrote:
> Did you find the solution because I have the same problem.|||I tried to implement the solutions listed in this thread to no avail.
I have been trying to get my Domain Security Groups to work with SRS for
over a week. The only thing that seems to work is adding the domain user to
the root (home) folder and managing sub-folders with groups. This is a huge
pain when you have 100's of users.
One interesting observation is when I add a test user to our domain and then
add them to the ReportingGroup on our domain, this test-user is allowed to
access what I set forth with groups, without adding them specifically to
reporting services as an individual user. Could some attribute in Active
Directory, that we place on regular users, be blocking the SRS server from
utilizing these regaulr domain users?
I am not an AD expert, nor am I really a network admin, I am just trying to
use tools defined by Microsoft to manage a Microsoft product. This is a
critical issue for us, do you think that if I burn a support ticket they
would be able to resolve this issue? It seems I am not the only one with this
problem!
"Bruce L-C [MVP]" wrote:
> What I do is have a local group that I add domain groups and individual
> domain users. I have never had to do anything other than add them to the
> proper role. It is possible to force a subdirectory from inheriting from the
> above directory. Perhaps you have done this?
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
>
> "qIjDraco" <qIjDraco@.discussions.microsoft.com> wrote in message
> news:42C60E14-438A-4D5A-AFB4-698D2DD736A3@.microsoft.com...
> >I am user SQL/RS 2005 on a 2003 Server on a 2000 domain and I have created
> >a
> > domain security group and added a user to it. I then went into the
> > security
> > tab of reporting services Home and added the group with the role of
> > Browser.
> > I then added the same group to a child folder in the same manor. The user
> > can NOT see any folders or objects to browse and doesn't get the My
> > Reports
> > folder showing either. If I add one of the builting groups (ssuch as
> > builtin\users) to the Home folder, all users can see and browse that
> > folder.
> >
> > The only references I have found say that domain groups should
> > automatically
> > be enabled when RS is installed. I have had this problem from the
> > beginning.
> > I even tried adding the user to a local group and adding the local group
> > to
> > the Home folder and had no luck. If I add the same user explecitly to the
> > Home and sub-folders, everything works fine.
> >
> > Does anyone have any idea what might be wrong in my configuration?
> >
> > I tallked to a colleague who has SAL/RS Dev Edition on an XP machine
> > attached to a 2003 domain and he has the exact same problem.
> >
> > This is very frustrating because it is a maintenance nightmare for the
> > site
> > security.
> >
> > I did check and the Default Web Site and the Reports and the Report Server
> > site are set to Windows Authentication and not to allow anonymous access.
> >
> > Any help will be greatly appreciated.
> >
>
>