SSRS Service Account (Breaks SSRS when not using Network Service)

Question

Hi guys, our SSRS works great when accessing the reports from the local network when I select "Network Service" under Service Account in the Report Server Configuration Manager.

However, the moment I select "Use Another Account" and enter in credentials from an account (this one is a domain account with admin's privs) it breaks it completely. When I go to the URL internally when doing this, it'll ask me to login 3 or 4 times and gives an HTTP 401 error.

If I switch back to "Network Server" everything begins working fine again. What am I doing wrong? The account I am trying to use is an admin Domain User. I'm not sure why everything stops working when using that account. This account was not the original account used to setup SSRS if that has anything to do with it.

Answer 1

Hi @Cross
I did a test, created a new user "Administrator2" and added it to the local administrator group. When I use this account in configuration manager it works fine.

Can you open the trace log to see more detailed error messages? Its path is typically "C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\LogFiles" or "C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\LogFiles".

From what I've searched, 401 errors generally occur when the user is not authorized by the report server or authenticated with Kerberos but not registered with the SPN. So make sure your account is connected to the report server or Kerberos is properly configured.

Best regards,
Aniya

Answer 2

Hi Tang! So, the account works fine in the Report Manager. I don't get any errors or anything of the sort, however, even though everything works fine in Report Manager, my Internal URL to the SSRS website wont let me authenticate in with any user accounts at all. It just keeps asking for me to login. I have to switch it back to Network Server.

Do I need to register the SPN with the admin account I am trying to use?

Answer 3

Hi @Cross
If you don't need to use Kerberos, you can try the following:

1. Try adding the Report Manager/Report Server URL to Trusted sites.
   Open IE-Go to Tools-Internet Options-Security-Trusted sites.
2. Remove RSWindowsNegotiate from the RSReportServer.config file and verify that only RSWindowsNTLM is specified.
   Restart SSRS and access the url.
   For more details, you can refer to this link: how-to-troubleshoot-ssrs-prompting-for-user-namepa.html
   Best regards,
   Aniya

Answer 4

Hi, I definitely need Kerberos to work. I am ultimately going to use Azure App Proxy, so I do need Kerberos.

Answer 5

Hi @Cross
I understand your needs now, you need to configure Kerberos correctly. I found this official documentation for you: configure-kerberos-powerbi-reports. Although it's configuring Kerberos to use Power BI reports, it's much the same process as configuring Kerberos to use SSRS reports.
Regards,
Aniya