SSRS report error - Cannot impersonate user for data source

Question

When running an existing report in SSRS from a web browser, a couple of users get the message below.
Most users can run reports from our reporting site but the error below occurs for a couple of users.
All the reports use a shared data source with Integrated Windows Security from our domain. We have granted permissions to the reports in SSRS via AD groups.
The users that experience the errors have access to the SQL Server data and can run the report queries so I believe the problem occurs when rendering the report. (Parameters can be selected prior to clicking on View Report).

I have completed many searches regarding the message below. All searches have returned several possible issues but the resolutions seem to point to general server configuration but doesn't pinpoint issues for 1 or 2 users while most users have no problems.

An error has occurred during report processing. (rsProcessingAborted)
Cannot impersonate user for data source 'DataSourceName'. (rsErrorImpersonatingUser)
Log on failed. Ensure the user name and password are correct. (rsLogonFailed)
Logon failure: the user has not been granted the requested logon type at this computer

Environment for SQL Server Data Sources and for SSRS Reporting Services is SQL Server 2016 Standard Edition CU 12 for Service Pack 2 (13.0.5698.0).
Both SQL and SSRS servers running on Windows Server 2016 Standard.

Answer 1

Hi @Duane Budnick ,

Please help check if you have chosen this opinion in the shared datasource.(don’t choose the option)

Please also try to grant "Allow log on locally" permissions to domain user accounts.

1.On the report server computer, in Administrative Tools, open Local Security Policy.
2.Under Security Settings, expand Local Policies, and then click User Rights Assignment.
3.In the details pane, right-click Allow log on locally and then right-click Properties.
4.Click Add User or Group.
5.Click Locations, specify a domain or other location that you want to search, and then click OK.
6.Enter the Windows account for which you want to allow interactive login, and then click OK.
7.In the Allow log on locally Properties dialog box, click OK.
8.Verify that the account you selected does not also have deny permissions:
a. Right-click Deny log on locally and then right-click Properties.
b. If the account is listed, select it and then click Remove.

More details please refer specify-credential-and-connection-information-for-report-data-sources

Remember to restart SSRS server and test.Hope it will be helpful.

Regards，
Zoe

---

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

What can I do if my transaction log is full?--- Hot issues November

How to convert Profiler trace into a SQL Server table -- Hot issues November

Answer 2

Sorry for delay in response.
I cannot change the Local Security Policy settings so I am waiting for assistance from our server administrators.
Below are the settings for the data source.

Answer 3

Domain user you in "Log into the data source" - domain\test need to have "Allow logon localy" local policy.
After adding it works.
Of course adding allow log localy for domain group should works as well for all members.