I have a relatively new instance on SSRS 2008R2 SP3 running on Windows Server 2008 R2. I am trying to set up separate domain service accounts for the separate SQL Services i.e. agent, engine, reporting, etc. I have done this successfully for the Agent and Engine services using simple Domain accounts and following the required permissions from docs.microsoft.com.

At first I had made local accounts for all services because of a video I watched that used that as an example. So now that I actually wanted to start using reporting services I switch the account to a newly created Domain account. Using the pertinent section in the above article I configured, via GPO, the account to have "Log On As A Service" right. I ensured that right is present in the groups I created.

I then went into the Reporting Services Configuration Manager to change the account which was successful except that the step for starting the service ended in error.

System.InvalidOperationException: Cannot start service ReportServer on computer 'SQLSERVER01'. ---> System.ComponentModel.Win32Exception: Access is denied
   --- End of inner exception stack trace ---
   at System.ServiceProcess.ServiceController.Start(String[] args)
   at System.ServiceProcess.ServiceController.Start()
   at ReportServicesConfigUI.Panels.ServerInformationPanel.StartStopServiceTask(Boolean start)

Event Viewer has a similar error which I include to save the questions.

The SQL Server Reporting Services (MSSQLSERVER) service failed to start due to the following error: 
Access is denied.

So this is a Windows permission issue but I don't see what the problem could be since the Log On As a Service permissions are set correctly. That is verified by the security logs that show a successful logon of the account. If I make my service account a local admin on the server then the service starts correctly but I should not have to do that.

  • Did you use Reporting Services Configuration Manager to configure the service account? It appears you are having access denied to SQL Server Engine where your reportserver and reprotservertempdb databases reside. – SqlWorldWide Apr 25 '17 at 0:49
  • @SqlWorldWide Yes. I then went into the Reporting Services Configuration Manager to change the account which was successful except that the step for starting the service ended in error. What makes you think the SQL Server Engine is part of the issue? I made that account in a similar fashion. Perhaps there is an issue there as well? – Matt Apr 25 '17 at 0:55
  • Access denied error message made me think so. Confirm the reporting service account is a member of RSExecRole in reportserver database. Do you see any access related error in your SQL Server error log? – SqlWorldWide Apr 25 '17 at 1:00
  • I had checked that earlier. Yes it is in that role – Matt Apr 25 '17 at 1:01
  • Anything in SQL Error log? This question has few things that you can check. I am not sure what hardware you are running but check this out. – SqlWorldWide Apr 25 '17 at 1:17

As part of the troubleshooting I was doing to try and address the issue I ran Process Monitor while I was trying to start the service.

I tracked as event that also had a result of "Access Denied" which was the service trying to read files inside the directory where reporting services was installed an running from. In my case it was: "C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services"

I check the security of the folder and the service account I was using had no rights to the folder. That is why giving it local admin rights fixed it because that group did have access.

I gave my service account Modify access to the folder and its contents. After that I was able to start the service.

  • I am not 100% sure this was the right fix. I worry I covered up the problem but this did fix the issue and does not appear to have created a security hole or anything. – Matt Apr 25 '17 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.