This project has moved. For the latest updates, please go here.

Previous Configure User Accounts Manual Configuration Configure Reporting Services Unattended Execution Account Next

Configure Reporting Services Administration Accounts

FineBuild can configure the Administration accounts that are needed by Reporting Services.

When Reporting Services is installed, the Windows local Administrators group has authority to perform all tasks. This section replaces the local Administrators group with the DBA sysadmin group. It also adds the DBA Non-Admin group to the System User group, giving this group read-only rights to many aspects of Reporting Services.

It is not possible to prevent members of the local Administrators group making their own changes to Reporting Services security. However, if the local Administrators group was reinstated into Reporting Services, this would be apparent during a security audit.

Security Compliance

Reporting Services Administration Accounts configuration helps to focus Reporting Services administration rights on to the DBA Team. If you setup Security Compliance then Reporting Services Administration Accounts configuration will always be implemented.

FineBuild Configure Reporting Services Administration Accounts

The Reporting Services Administration Accounts configuration relates to Process Id 5CHA and is controlled by the parameters below:

Parameter Build SQL2005 SQL2008 SQL2008 R2 SQL2012 SQL2014 SQL2016
SetupRSAdmin FULL Yes Yes Yes Yes Yes Yes
SetupRSAdmin WORKSTATION Yes Yes Yes Yes Yes Yes
SetupRSAdmin CLIENT N/A N/A N/A N/A N/A N/A

In order to maintain compatibility with older versions of SQL FineBuild, the parameter ConfigRSAdmin can also be used.

FineBuild also uses the following parameters to help Configure Reporting Services Administration Accounts:
Parameter Default Value Description
GroupDBA none Number of User Accounts to process
GroupDBANonSA none Name of Windows Account to add to SQL Server

FineBuild will automatically configure the Report Services Administration Accounts.
Top

Manual Configure Reporting Services Administration Accounts

The following steps show what you would have to do for manual Reporting Services Administration Accounts configuration. FineBuild does all of this work for you automatically.

1) Start Report Manager.

This can be done by starting Internet Explorer and typing the URL http://localhost/reports
ReportManagerStart.png
2) Click on Site Settings and then click on New Role Assignment.
NewRoleAssignment.png
3) Enter the name of the DBA sysadmin group and set the role as System Administrator. Click OK to continue.
SystemAdmin.png
4) Check the local Administrators group (BUILTIN\Administrators) and click on Delete.
DeleteBuiltinAdmin.png
Click OK to conform the deletion
DeleteConfirm.png
5) Repeat steps 2) and 3), but this time specify the DBA Non-Admin group and the role System User.
SystemUser.png
6) Click on Home and on Properties. Then click on New role Assignment.
ContentRoleAssignment.png
7) Enter the name of the DBA sysadmin group and set the role as Content Manager. Click OK to continue.
ContentManager.png
8) Remove the local Administrators group from the Content Manager role.

9) Report Manager can now be closed.

Copyright FineBuild Team © 2013 - 2015. License and Acknowledgements
Previous Configure User Accounts Top Configure Reporting Services Unattended Execution Account Next

Last edited Jul 8, 2015 at 10:53 AM by EdVassie, version 5