MS ReportServer refuses to work with domain account

Question

I have installed SQL Server 2008 ReportServer on dozens of servers, all virtually identical. It was always possible to configure it to use a domain account (the same one on all those servers). However, on MYSERVERNAME I get the following error:

System.InvalidOperationException: Cannot start service ReportServer on computer 'MYSERVERNAME'. ---> System.ComponentModel.Win32Exception: Access is denied


  --- End of inner exception stack trace ---
   at System.ServiceProcess.ServiceController.Start(String[] args)
   at System.ServiceProcess.ServiceController.Start()
   at ReportServicesConfigUI.Panels.WindowsServiceIdentityPanel.StartWindowsServicePostChangeWindowsServiceIdentity(ServiceController rsService)

This also happened after removing and re-installing ReportServer. The error goes away when I add the domain account to the administrators groups.

Any ideas?

Update:

From event viewer at same time:

Event Type: Failure Audit
Event Source:   Security
Event Category: Logon/Logoff 
Event ID:   537
Date:       [current]
Time:       [current]
User:       NT AUTHORITY\SYSTEM
Computer:   MYSERVERNAME
Description:
Logon Failure:
    Reason:     An error occurred during logon
    User Name:  
    Domain:     
    Logon Type: 3
    Logon Process:  Authz   
    Authentication Package: Kerberos
    Workstation Name:   MYSERVERNAME
    Status code:    0xC000018B
    Substatus code: 0x0
    Caller User Name:   MYSERVERNAME$
    Caller Domain:  MYDOMAIN
    Caller Logon ID:    (0x0,0x3E7)
    Caller Process ID:  824
    Transited Services: -
    Source Network Address: -
    Source Port:    -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Another update: I tried giving full control to individual and all drives to the domain account in question, but those were apparently not the permissions it is craving.

Another another update: I found out that all services fail to run using any domain account, all with the error "Access is denied", so it's not really a reportserver problem (added new tag). I have a "pure" service that doesn't do anything except be a service and it fails to run using domain accounts. I have also removed and added the computer from/to the domain since then with no change of symptoms.

score 0 · Answer 1 · answered Oct 22 '10 at 13:04

The SQL Server Reporting Services (MSSQLSERVER) service failed to start due to the following error: The service did not start due to a logon failure.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

score 0 · Answer 2 · answered Jun 16 '09 at 17:51

0

The domain account probably doesn't have the privilege to run as a service. Click Start, Run, type secpol.msc, go into Local Policies, User Rights Assignment. Double-click on "Log on as a service" and add the account there.

If that doesn't do it, go into Administrative Tools, Event Viewer. Look at the errors in the Security event log, copy/paste those into here, and we can troubleshoot those.

Also, just to be clear - you aren't trying to change the account after setting up SQL Server, right? You need to specify the account name during the SQL Server setup process. The setup does a lot more than just this piece. Changing the service account after installation is pretty risky.

answered Jun 16 '09 at 17:51

Brent Ozar

4,425
18
21

Sounds good, but ReportServer actually adds the account to that permission. And the account is indeed listed in "Log on as a service", together with another domain account I tried to use and my own. I installed ReportServer using local service account first and then change to the domain account in Reporting Services Configuration Manager because that's how the incoming documentation specifies it should be done (it has also worked for years and on all the other servers). – Andrew J. Brehm Jun 17 '09 at 09:46
OK, what happens if you try to log in locally with that account? Log out, and log into the desktop (RDP or console) with that account to see what happens. – Brent Ozar Jun 17 '09 at 10:49
The account works. I did a runas/user:thatdomain\thataccount cmd and the account seems fine. – Andrew J. Brehm Jun 17 '09 at 14:41

score 0 · Answer 3 · answered Aug 14 '09 at 02:21

0

Is the time right on the server as compared with the DC? Are there any issues talking to the DCs in the system event log? The reason I ask is the status code (0xC000018B) indicates that the system isn't able to get a Kerberos ticket.

answered Aug 14 '09 at 02:21

K. Brian Kelley

9,034
32
33

score 0 · Answer 4 · answered Aug 14 '09 at 02:28

I would also check whether the user account requires the 'Act as a part of the OS' privilege by comparing the account with a working server. I have seen a number of different software packages that require this privilege. This can be checked by Start -> Run -> secpol.msc -> Local Policies -> User Rights Assignment -> 'Act as a part of the OS'.

Alternativly, you could also try running Sysinternals Process Monitor and see if there are any resources it is trying to access that are generating access denied.

score 0 · Accepted Answer · answered Oct 14 '09 at 11:22

0

Solved by upgrading everything to SQL 2008...

answered Oct 14 '09 at 11:22

Andrew J. Brehm

1,611
7
37
57

John · Answer 6 · 2016-05-11T10:20:37.780

0

I had this problem with SQL 2012, Windows 8.1 and simply set the User account to "Local System" clicked Apply and report configuration manager managed to start up.

Edit: Had some further issues that were resolved by running the report manager url in Internet Explorer with "run as administrator".

edited May 11 '16 at 10:20

answered May 11 '16 at 06:37

John

156
3

MS ReportServer refuses to work with domain account

6 Answers6