I was having an issue getting SQL Server Reporting Services 2008R2 SP3 working under a domain service account on Windows Server 2008R2. It started with this What am I missing for my SSRS Service account local server permissions? and I have progressed from there some.
I have a domain account setup as the service account for SSRS and the service is running. However on the /ReportServer and /Reports pages I am getting page cannot be displayed on my local server. Looking at the logs under "C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\LogFiles" I saw two errors
library!WindowsService_0!e7c!04/25/2017-08:21:37:: e ERROR: Throwing Microsoft.ReportingServices.Library.ReportServerDisabledException: , Microsoft.ReportingServices.Library.ReportServerDisabledException: The report server cannot decrypt the symmetric key that is used to access sensitive or encrypted data in a report server database. You must either restore a backup key or delete all encrypted content. ---> System.Runtime.InteropServices.COMException (0x80070008): Not enough storage is available to process this command. (Exception from HRESULT: 0x80070008) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) at RSManagedCrypto.RSCrypto.ImportSymmetricKey(Byte symKeyBlob) at Microsoft.ReportingServices.Library.ConnectionManager.b__2() --- End of inner exception stack trace ---;
Which made sense since I had changed the account that was being used. I simply deleted encrypted content to address that since it was a new SSRS instance anyway. The second error was the one that took me for a loop
rshost!rshost!f64!04/25/2017-08:21:38:: e ERROR: Failed to initialize listener for type 2. servicecontroller!DefaultDomain!b7c!04/25/2017-08:21:38:: e ERROR: Error creating HTTP endpoint. System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at Microsoft.ReportingServices.HostingInterfaces.IRsUnmanagedCallback.CreateHttpEndpoint(RsAppDomainType application, String urlPrefixes, Int32 cPrefixes, String hosts, Int32 cHosts, Boolean wildCardPresent, String virtualDirectory, String filePath, Int32 authType, Int32 logonMethod, String authDomain, String authRealm, Boolean authPersist, Int32 extendedProtectionLevel, Int32 extendedProtectionScenario, Boolean enabled) at Microsoft.ReportingServices.Library.ServiceAppDomainController.SetWebConfiguration(RunningApplication rsApplication, Boolean enabled, String folder)
That was difficult to figure out on my own. Research for the general error "Access Denied" in this context led to many different avenues but none that address my specific problem. Most stemmed from not using Reporting Configuration Manager to set up the service account. I did in my case and was able to verify the actions it took were done correctly. RsExec role, URLReservations using new account etc.
I ran into a thread that said...
The service account wasn't a part of the "Bypass Traverse Checking" local security policy. Once the account was added to that policy, the issue was resolved.
Much to my surprise that actually fixed the issue. My problem is that the documentation for account permissions on the SSRS account do not mention this permission is required. They only state that "Log On As A Service" is required.
All my other SSRS environments, which I inherited, use a domain admin as the service account so I have nothing to compare to. I am trying to get away from that setup.
Is this just a flaw in MS documentation or did I cover up the problem (XY)? I do not understand how "Bypass Traverse Checking" fixed "ERROR: Failed to initialize listener"