1

I have inherited an SSRS environment which is a mess; Folders named only with numbers, hundreds of reports not accessed in the last 2 months (I checked ExecutionLog), etc..

I wanted to achieve two things…

  1. Because every other day someone asks for read access to random reports, is there any way of making it “public”, meaning anyone can read and open ANY report?

  2. I want to revoke “folder/report creation/move” access to everyone; can it be done without going folder by folder?

Related to it, the other day I found another SSRS box, that had this access?! What is that “everyone” is it a group inside my domain, or is it an SSRS feature that you can make it public so anyone can access? enter image description here

iamdave
  • 12,023
  • 3
  • 24
  • 53
Chicago1988
  • 970
  • 3
  • 14
  • 35

2 Answers2

0

That Everyone group looks like a domain account that your organisation has created. At least, I have never come across it.

To grant access to everyone that has a windows login, you can use NT AUTHORITY\Authenticated Users and set their permission to just Browser which will prevent creation or modification of Folders or Reports.

Regarding removing permissions from your items, your options are to either go item by item or bulk update the ReportServer database, which is not supported by Microsoft. You break something, you're one your own.

A big thing you will need to watch out for with opening up every report to every user is whether or not there is any confidential or sensitive information in any of the reports. Your organisation will not want low level staff looking at executive, cross company summaries nor will HR want their reports visible to anyone other than themselves.

iamdave
  • 12,023
  • 3
  • 24
  • 53
  • How can I retrieve a list of higher permissions than read (at least to know which reports I should access and edit individually) – Chicago1988 Jun 02 '17 at 15:12
  • @Chicago1988 Something like this should get you where you need to be: https://stackoverflow.com/a/6607011/1350987 – iamdave Jun 02 '17 at 15:23
0

You can export ALL permissions from SSRS using PowerShell.

I've also detailed a script that allows you to revert every folder to "inherit parent security" so you can control every folder by simply setting the home folder security. Sorry for the shameless plug but I blogged about both in April on SQLShack actually Managing SSRS Security using PowerShell

Both scripts are in that post. I hope that helps

CPorteous
  • 957
  • 6
  • 10