0

I was having an issue getting SQL Server Reporting Services 2008R2 SP3 working under a domain service account on Windows Server 2008R2. It started with this What am I missing for my SSRS Service account local server permissions? and I have progressed from there some.

I have a domain account setup as the service account for SSRS and the service is running. However on the /ReportServer and /Reports pages I am getting page cannot be displayed on my local server. Looking at the logs under "C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\LogFiles" I saw two errors

library!WindowsService_0!e7c!04/25/2017-08:21:37:: e ERROR: Throwing Microsoft.ReportingServices.Library.ReportServerDisabledException: , Microsoft.ReportingServices.Library.ReportServerDisabledException: The report server cannot decrypt the symmetric key that is used to access sensitive or encrypted data in a report server database. You must either restore a backup key or delete all encrypted content. ---> System.Runtime.InteropServices.COMException (0x80070008): Not enough storage is available to process this command. (Exception from HRESULT: 0x80070008)
   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
   at RSManagedCrypto.RSCrypto.ImportSymmetricKey(Byte[] symKeyBlob)
   at Microsoft.ReportingServices.Library.ConnectionManager.b__2()
   --- End of inner exception stack trace ---;

Which made sense since I had changed the account that was being used. I simply deleted encrypted content to address that since it was a new SSRS instance anyway. The second error was the one that took me for a loop

rshost!rshost!f64!04/25/2017-08:21:38:: e ERROR: Failed to initialize listener for type 2.
servicecontroller!DefaultDomain!b7c!04/25/2017-08:21:38:: e ERROR: Error creating HTTP endpoint. System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at Microsoft.ReportingServices.HostingInterfaces.IRsUnmanagedCallback.CreateHttpEndpoint(RsAppDomainType application, String[] urlPrefixes, Int32 cPrefixes, String[] hosts, Int32 cHosts, Boolean wildCardPresent, String virtualDirectory, String filePath, Int32 authType, Int32 logonMethod, String authDomain, String authRealm, Boolean authPersist, Int32 extendedProtectionLevel, Int32 extendedProtectionScenario, Boolean enabled)
   at Microsoft.ReportingServices.Library.ServiceAppDomainController.SetWebConfiguration(RunningApplication rsApplication, Boolean enabled, String folder)

That was difficult to figure out on my own. Research for the general error "Access Denied" in this context led to many different avenues but none that address my specific problem. Most stemmed from not using Reporting Configuration Manager to set up the service account. I did in my case and was able to verify the actions it took were done correctly. RsExec role, URLReservations using new account etc.

I ran into a thread that said...

The service account wasn't a part of the "Bypass Traverse Checking" local security policy. Once the account was added to that policy, the issue was resolved.

Much to my surprise that actually fixed the issue. My problem is that the documentation for account permissions on the SSRS account do not mention this permission is required. They only state that "Log On As A Service" is required.

All my other SSRS environments, which I inherited, use a domain admin as the service account so I have nothing to compare to. I am trying to get away from that setup.

Is this just a flaw in MS documentation or did I cover up the problem (XY)? I do not understand how "Bypass Traverse Checking" fixed "ERROR: Failed to initialize listener"

  • I don't know enough to post an answer, but I've had a similar experience attempting to get SSRS 2014 working with a non-admin service account. The issue seems to be to do with the permissions the service account needs in the file system to access the SSRS installation location (often .\Program Files\Microsoft SQL Server\MSRSnn.MSSQLSERVER). As I understand it, "Bypass traverse checking" skips security checks on interim folders when navigating between a folder and its subfolders, so by implication a permission is missing somewhere in the MSRS... folder tree - but that's really a guess. – Ed Harper Apr 26 '17 at 14:29
  • @EdHarper I had tried to use procmon to find the source of the permissions failure but was unsuccessful. Too much information to parse. Then again I was not looking for specific account related issues. I might break it to test again to see if I can come up with something else. I just hate all of the answers that were "just run it as local system" or something similar. Thanks for the information – Matt Apr 26 '17 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.