Domain Group Account Won't Work
Sep 17, 2007
Greetings,
I am trying to configure Reporting Services to allow a domain group access to reports. I am able to configure the domain and group (mydomaingrpname) in both Report Manager and BIDS. I'm sure I entered the correct name because I purposely misspelled it and received an error. I think this tells me it is finding the group correctly.
However, when my test user goes to Report Manager, there are no folders displayed. I checked and he is in the domain group I am using. If I explicitly add him (mydomainandy) to the folders, he can see them and execute the reports.
After searching the forums and other websites, I have checked IIS is using Windows Integrated Security and not anonymous access.
Any ideas?
Rob
View 7 Replies
ADVERTISEMENT
Oct 24, 2007
Hi am
i am facing problem adding a domain group to the reporting services.
while setting the security of a report, i am getting the rsUnknownUserName error while adding a domain group.
the group is valid and it does exists. i tried creating a windows group on the machine running reporting services and tried adding the domain group and it accepted. but the reporting services is not accepting.
can somebody tell me whats the problem with this.
i am able to add other domain group belonging to the same domain and the SSRS accepts but not this particular domain group which is like any other domain group.
View 3 Replies
View Related
Jan 5, 2006
During install of SQL Server 2005, we can of course use a domain account or the built-in system account for running the services. I lean toward domain for obvious reaons but would like to know a +/- to each option and why I'd choose one over the other and what consequences or limitations one may encounter if I choose one over the other.
View 6 Replies
View Related
Jul 20, 2005
Hi there,BOL notes that in order for replication agents to run properly, theSQLServerAgent must run as a domain account which has privledges to loginto the other machines involved in replication (under "SecurityConsiderations" and elsewhere). This makes sense; however, I waswondering if there were any repercussions to using duplicate localaccounts to establish replication where a domain was not available.Anotherwords, create a local windows account "johndoe" on both machines(with the same password), grant that account access to SQL Server onboth machines, and then have SQL Server Agent run as "johndoe" on bothmachines. I do not feel this is an ideal solution but I havecircumstances under which I may not have a domain available; mypreliminary tests seem to work.Also, are there any similar considerations regarding the MSSQLSERVERservice, or can I always leave that as local system?Dave
View 1 Replies
View Related
Apr 25, 2007
I have a situation that I have discovered in our QA database that I need to resolve. When I looked at the Activity Monitor for our server, I discovered that a process is running under a domain user account for one of our .Net applications. The problem is that that domain user account has not been created as a SQL login account on the server. I am trying to figure out how someone can log in to the database server with a domain user account that has not been added to SQL Server as a login account.
Does anyone have any insight on this? I don't like the idea of someone being able to create domain account that can access the database without me granting them specific access.
- Larry
View 6 Replies
View Related
Apr 5, 2007
I have a root domain and child domain.
After using ADMT to migrate the domain user or group into the root domain, when I use enterprise manager to try and change the permissions allocated to that domain user/group, i get the 'Error 15401 NT user or Group not found'.
This is a correct error as the user is now in the root domain, however sql (in sysxlogins) still thinks its in the child domain.
Is there a simpler way, other than collecting the users permissions, deleting the user from SQL then adding back in with the correct domainusername format, then adding the permissions back?
I tried renaming the 'name' in sysxlogins (not recommended) and while that worked, whenever I tried to add the migrated user to another database, the login name was missing and would not resolve.
I believe it is something to do with the SID not matching.
Any ideas on how to fix this ?
View 1 Replies
View Related
Jan 5, 2008
I have one domoain in the forest. The domain level is set to Windows 2000 native mode and forest level is set to mixed mode. My SQL server 2005 server joined to this domain. I added a brand new domain local group and add a normal user account to this domain local group. I login to the SQL server 2005 server and make a query "SELECT * FROM sys.login_token". I cannot see my domain local group in sys.login_token. However, if I add my account to a global group, I can see it there.
Then, I setup another forest. This time, I have domain level set to Windows 2003 mode and forest level is set to Windows 2003 native mode. I do the same testing. This time, I can see my domain local group in sys.login_token.
Why does SQL server 2005 has this limitation? Is it a bug?
View 1 Replies
View Related
Jun 25, 2004
Hi
Doing webforms in ASP.NET and i have a connection string in the webconfig that connects to a locally created SQL Server user account.
This is fine however when i try to connect to a domain account created by the IT administrator for me, it wont work.
The User name and password he supplied are correct as i logged into my PC (Win 2000) using it to test it. However when i try to connect to this remote network domain account by changing my connection string it fails... anyone any ideas, or am i missing a subtlety of ASP.NET and SQL connectionstrings?
Heres the connection string that works...
ConnectionString = value="Server=MY-SERVER;Network Library=DBMSSOCN;Initial Catalog=MYDATABASE2;User ID=MrLocalUser;Password=password;"
Heres the connection string that fails...
ConnectionString = value="Server=MY-SERVER;Network Library=DBMSSOCN;Initial Catalog=MYDATABASE2;User ID=DOMAINMrDomainUser;Password=password;"
??????
View 1 Replies
View Related
Feb 17, 2006
Hi All,
How can I tell how SQL Agent is configured to start up with? Is it with the local system account or domain account?
Thanks.
View 2 Replies
View Related
Jul 20, 2005
I doing some testing with security and ran into the following problem.I want to log into the SQL server (from Query Analyzer) using mydomain account. To allow this, I went into Logins section inEnterprise Manager and added my user account as a Windows User.If I set Analyzer to use Windows authentication I am to log in with noproblems. But if it is set to SQL Server authentication and I type inmy username (in the format domainusername or username@domain) andpassword I get a login error.Is there a way to login in to SQL using domain account without usingwindows authentication?Thanks,Jason
View 2 Replies
View Related
Nov 3, 2006
New to SQL Server. Plan to install SQL Server 2005 standard edition on Windows 2k3. After searched a lot of places, still don't understand what exactly "domain user account" is. Could someone explain it to me?
1. Is this a OS account where SQL Server is running?
2. Or, is this an account under domain controller on other machine? Is this an account on DNS srver? How do I create it?
3. Or, is this an account in SQL Server?
Where is this account located? How do I manage it?
TIA.
View 4 Replies
View Related
Oct 5, 2007
Hello,
I am seeing a couple of domain/username accounts trying to access SQL 2k5 SP2 and get the error above. The concern I have is these accounts shouldn't be trying to access SQL at all and do not exist is SQL hence the error The question I have is how can I track down what is trying to use this account and connect to sql? Thanks in advance.
John
SQL Server Log:
Message
Login failed for user 'DOMAIN ampbell'. [CLIENT: <named pipe>]
Message
Error: 18456, Severity: 14, State: 27.
View 3 Replies
View Related
Sep 7, 2007
I have two servers that are setup to use their local system account.
They are in the same workgroup, but aren't on a domain.
Is there a way to setup replication without a domain? If so, how?
Thanks in advance
Susan
View 1 Replies
View Related
Jul 4, 2006
I recenly installed SP1 on 2 servers.
For some strange reason I am unable to run the SQL service or the SQL Agent service using the normal SQL service domain account. It has always worked and is currently running on the other server without a problem.
Has anyone had a similar problem?
View 1 Replies
View Related
Oct 18, 2005
Hi all,
I have seen in documents that I can install SS2K on a machine without network domain connection using a domain account.It said that domain accounts are prefered according to some reasons and it is not limited to machines on a domain so you should do it on a single PC.
I tried this during installation and entered many different things but no chance:
<OS_account>
<machine_name>/<OS_account>
...
Would you please telling me what should I enter as service starter account if I want to use domain users?
-Thanks in advance
View 1 Replies
View Related
Jun 8, 2007
Hi,
I want to use a domain user account not belonging to local admin or domain admin groups in SQL 2000/2005 Enterprise edition. This is what I've done so far..
On the machine that is the Domain Controller:
- installed SQL 2005 as a domain admin
- created a domain user account using Active Directory Users and Computers. This user is only
"Member of" domain users; not any Administrators group.
- added this user to SQL Server Management Studio->Logins and in Server Roles assigned
sysadmin role.
Question 1: Do I need to give any additional permissions to this user to work with SQL?
Question 2: How can I test this user for basic SQL operations like database creation? Can I use Osql?
Question 3: Can I use this user account to login to my domain controller using remote desktop? I tried adding this user to remote users, but in vain.
Thanks!
View 3 Replies
View Related
Mar 2, 2006
Hey everyone,
I apologize for the newbie question but I'm looking for the correct
answer. We have 4 production SQL servers at this time. When
we had originally set them up the "sa" account belonged to the domain
administrators group. Since we have a SQL admin team and a domain
admin team we would like to remove this privilege. Is this
something we can and should do? Our SQL servers use mixed mode
authentication and some databases are configured for Windows
authentication. I would appreciate any input from the community.
View 7 Replies
View Related
Mar 23, 2007
Hello,
I've done some searching, but have found no definite answer yet. Our SQL 2005 servers are members of Active Directory Services. We want to run SQL services using an ADS account.
I see 7 SQL services in the SQL Server Configuration Manager: Integration Services, FullText Search, SQL Server, Analysis Services, Reporting Services, Browser, and Agent.
Question: Is it a bad move to run them all using the same domain account? I mean, wouldn't this give, say the Browser service, more privileges than it needs by allowing its account access to the same resources as, for example, the Agent service? What I'm concerned about is a vulnerability in one service compromising another service.
I would like to be able to use one domain account for all 7 services on two SQL servers, but I have a feeling this is a poor choice.
What is the best method for running SQL services using a domain account?
Thanks,
-Tony
View 1 Replies
View Related
Mar 26, 2008
I can't get this to work. This is my setup:
2 Windows 2008 Server machines
- first machine holds MOSS 2007
- second machine SQL 2005 SP2+MOSS Web Front
MOSS config. database is on Sql server. I'm trying to configure Reporting Services on SQL server in Sharepoint Integration Mode. As per Microsoft tutorials I've set up domain accounts for Sql services. When I use Reporting Services Configuration to configure Web Service Identity to use an App. Pool that runs under a domain account i get this error:
"ReportServicesConfigUI.WMIProvider.WMIProviderException: An unknown error has occurred in the WMI Provider. Error Code 800708AC at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.SetWebServiceIdentity(String applicationPool)"
Database Setup and Windows Service Identity work fine using domain account.
I've searched many forums, Microsoft "How To" to no avail.
If anyone has some ideea on this please help.
View 11 Replies
View Related
Nov 6, 2015
I am running a SQL 2008r2 install while logged onto the server with a local admin account, not a domain account. I am specifying a domain account to run the SQL service. The install fails saying the service account credentials are invalid but I am 99.9% sure they are right.My theory - the local admin account running Setup cannot validate the service account creds against AD. Is it a requirement to run Setup while logged on with a domain account?
View 4 Replies
View Related
Jul 20, 2005
Hello,My server is part of a W2K domain. What do you advice me as account torun my SQL*Server, service started with a domain user account or aslocal system ?I need advices from a security point of view.Thank's in advance
View 4 Replies
View Related
Sep 13, 2006
I have SQL 2005 installed in a virtual (ESX) environment with a separate DC. Every minute or so an event shows up in the Application Event Log that says:
Type: Failure Audit
User: dgtestdc1$
Computer: sql1
Source: MSSQLSERVER
Category: (4)
Event ID: 18456
Description:
Login failed for user 'dgtestdc1$'. [Client: <ip address>]
Data includes: SQL1 master
Any idea what is causing this and how to fix it?
Thanks,
Mindy
View 5 Replies
View Related
Aug 23, 2007
I have a package that needs to be executed from a webpage, which I can get to INITIATE fine. The page calls a stored procedure which in turn starts a package (use DTExec and xp_cmdshell). The problem is that the package reads/writes to flat files that the most accounts do not have rights to. That being the case I get errors that the file doesn't exists. The package was developed by using a domain account which does have access to the files so it obviously runs fine in BIDS.
How do I force the stored package to run under that account when being called by a stored procedure? I've done this with scheduled jobs because I can use a proxy account. Is there something simlilar that I can do vis DTExec?
View 3 Replies
View Related
Mar 12, 2007
surprisingly, couldn't find anything about granting alter trace permissions to a domain account.
I try to run following sql:
GRANT ALTER TRACE TO MyDomainUser1;
GO
And get the following error when executing:
Msg 102, Level 15, State 1, Line 1
Incorrect syntax near ''.
What is correct SQL to grant alter trace permissions to a domain account?
TIA.
View 4 Replies
View Related
Oct 25, 2005
Please, I need your help... I`m desperate...
I`m trying to connect to the Analysis Services (AS 2000 Enterprise Edition SP4 on Windows Server 2003 EE, respository is in Access DB) throught Analysis Manager over HTTPS(HTTP) connection. I dont want to use domain account.
I need to specify USER_ID and PASSWORD to the Analysis Manager, but in registration of new server is only IP address or HTTP adress (for http://server) - but it doesn´t work - it says Unauthorized. But I`ve tried to use Anonymous account and it doesn`t work (client wan`t able to make connection)... I would like to use Basic Authentification.... Thise account is member of OLAP_Administrators... but the problem is where should I put USER_ID and PASSWORD???
It works perfect in Excel 2003.... MSOLAP.asp work fine in IE...
Thanks very much for your advise
Ricmond
View 1 Replies
View Related
Jul 23, 2014
Installed sql server 2012 enterprise. Runs with the built in account fine.
I tried entering a domain account to run as the service account from sql configuration it fails with the error "the specified network password is not correct".
I tried from services.msc and entered successfully but when I try to restart it fails that the log in credentials are wrong.
the domain account and password I entered are just fine. What's it I should do or missing?
View 3 Replies
View Related
Jul 20, 2005
Greetings:I am trying to conceive what risks might be created by runningmultiple SQL servers within a domain under a single domain account, asopposed to 1) running under the local service account or 2) multipledomain service accounts.In this case, all the SQL servers are SQL2000 running on Win2003. Theservice account is assigned only to the "Domain Users" group.We do use linked server calls, and I have played and suceeded gettingKereberos up to avoid double hop issues when using Windows Auth. Infact, this is one of the reasons that sparked the question in my mind-- in all the MS Kerebos SQL<->SQL examples, the SQL servers run undera unique service account.As an aside, most of the servers are "line of business" servers, butHR runs under a unique server with more sensitive information. I don'treally think that merits a seperate service account, but again, Icould well be missing something.I mostly looking for food for thought, but concrete examples ofgotchas would be appreciated.Thanks all.d.
View 2 Replies
View Related
Oct 15, 2015
Sometimes I have to unlock the account 3 or 4 times a day. This is getting annoying. Why would my service account keep getting locked out?
View 3 Replies
View Related
Sep 23, 2010
I am installing SQL Server 2005 on a server (Windows Server Enterprise Edition 2003 SP2) that is not domain controller and on the screen "Service Account" I checked the box "Customize for each service account" and typed a domain account (it has permission to "logon as a service"), its password and domain, and when I click the "Next" button, I am getting the error below:"SQL Server Setup could not validate the service accounts. Either the service accounts have not been provided for all of the services being installed, or the specified username or password is incorrect. For each service, specify a valid username, password, and domain, or specify a built-in system account. "
View 11 Replies
View Related
Sep 22, 2006
Hi all,
I have a SQL Server 2005 Express edition instance set up on one server, and IIS on another server.
The SQL Server process account is a domain user account, which I have added to the local groups that SQL Server created during installation (I originally used a local user account instead of domain account; however, the problem occurs with both).
SQL Server runs fine, and if I set my IIS application pool identity to a domain admin, my web app can access the database and retrieve the data necessary.
However, I have a domain user account that I want to use to run the app pool and retrieve the data. The domain user account is added to the IIS_WPG group on the web server. On the database server, I have created a login for the account, as well as added it to the db_datareader role of the database that is used for the site.
However, the user is not able to connect to the SQL Server. I get the "Login failed for user <user account>" error in ASP.NET. I also tried connecting with SQL Server Management Studio, and I get the same error. I checked and the user has connect permission to the database server.
With admin accounts, there are no problems logging in, etc.
Any pointers are appreciated,
Thanks,
SA.
Edit: I was able to find out that the State is 11 for the error. According to http://blogs.msdn.com/sql_protocols/archive/2006/02/21/536201.aspx, this indicates "Valid login but server access failure." I am not sure how to resolve this.
View 1 Replies
View Related
Aug 13, 2015
I have an instance of SSRS that will not run my report subscriptions if it is using a dedicated domain account I made for the express purpose of using it to run this service.
If I have SSRS use my personal domain account as the service account, my subscriptions run correctly. If I have SSRS use this other domain account, the subscriptions do not run.
What else do I have to configure to make this run correctly not on my personal account?
Error message below.
"ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: AuthzInitializeContextFromSid: Win32 error: 5; possible reason - service account doesn't have rights to check domain user SIDs., Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: The report server has encountered a configuration error. ;"
View 2 Replies
View Related
Jul 23, 2012
I am working with a client who is rolling out 50+ VM's based of a template we created. This is SQL 2012 CU1 running on Windows Server 2008 R2. Using the default service account the installer has it registers fine and we get the following in the SQL log.
The SQL Server Network Interface library successfully registered the Service Principal Name (SPN) [ MSSQLSvc/server.domain.com:1433 ] for the SQL Server service.
When we change to a domain service account through SQL configuration manager we see the following and cannot connect remote using integrated authentication The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/server.domain.com:1433 ] for the SQL Server service. Windows return code: 0x2098, state: 15. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
My understanding is you should and could change service accounts using the SQL Server Configuration Manager and it would set all permissions. Is there something we need to do in addition to get this up and working?
Convert DTS to SSIS |
Document SSIS |
30+ SSIS Tasks |
Real-time SSIS Monitoring |
Quick Starts |
BI Blitz
View 9 Replies
View Related
Dec 21, 2006
Attempting to link Access 2003 to SQL 2005, there is something keeping from doing so.
1 I setup the instance as sqlexpress.
2 I have a database shell there also.
3 It connects when I start the instance service.
4 My remote connections are configured to handle TCP/IP & Named Pipes.
Not in this order, but you get the idea. Now that I have these in place, I went first to the Access 2003 database to link the tables to this. When I came accross trouble in the form of need for a DSN to the domain for the things I created above.
In attempting to create one that looked functional, I came back to the same step. But, unsuccessful to link the tables again because browsing to that domain does not even show that particular file. This is the problem.
I do believe that once I am able to select a DSN, I will have a "healthy baby connection". I will then be the proud father of my first Server-side database setup!!!! But I am trying to get over these labor pains.
View 1 Replies
View Related
