Setup Report Service Administration Accounts

Previous Backup Report Service Encryption Keys	Manual Configuration	Configure Report Service Unattended Execution Account Next

FineBuild can configure the Administration accounts that are needed by the Report Service. Thios applies to both SSRS and PowerBI.

When Report Service is installed, the Windows local Administrators group has authority to perform all tasks. This section replaces the local Administrators group with the DBA sysadmin group. It also adds the DBA Non-Admin group to the System User group, giving this group read-only rights to many aspects of the Report Service.

It is not possible to prevent members of the local Administrators group making their own changes to Report Service security. However, if the local Administrators group was reinstated into Report Services, this would be apparent during a security audit.

Security Compliance

Report Service Administration Accounts configuration helps to focus Report Service administration rights on to the DBA Team. If you setup Security Compliance then Report Service Administration Accounts configuration will always be implemented.

FineBuild Configure Report Services Administration Accounts

The Report Services Administration Accounts configuration relates to Process Id 4RAM and is controlled by the parameters below:

SQL Version	Parameter	FULL Build	WORKSTATION Build	CLIENT Build
SQL2019	/SetupRSAdmin:	Yes	Yes	N/A
SQL2017	/SetupRSAdmin:	Yes	Yes	N/A
SQL2016	/SetupRSAdmin:	Yes	Yes	N/A
SQL2014	/SetupRSAdmin:	Yes	Yes	N/A
SQL2012	/SetupRSAdmin:	Yes	Yes	N/A
SQL2008R2	/SetupRSAdmin:	Yes	Yes	N/A
SQL2008	/SetupRSAdmin:	Yes	Yes	N/A
SQL2005	/SetupRSAdmin:	Yes	Yes	N/A

In order to maintain compatibility with older versions of SQL FineBuild, the parameter /ConfigRSAdmin: can also be used.

FineBuild also uses the following parameters to help Configure Report Service Administration Accounts:

Parameter	Default Value	Description
/GroupDBA:	none	Number of User Accounts to process
/GroupDBANonSA:	none	Name of Windows Account to add to SQL Server

FineBuild will automatically configure the Report Services Administration Accounts.

Top

Manual Configure Report Service Administration Accounts

The following steps show what you would have to do for manual Report Services Administration Accounts configuration. FineBuild does all of this work for you automatically.

Start Report Manager

This can be done by starting Internet Explorer and typing the URL http://localhost/reports
Click on Site Settings

Next, click on New Role Assignment
Enter the name of the DBA sysadmin group and set the role as System Administrator

Click OK to continue
Check the local Administrators group (BUILTIN\Administrators)

Click on Delete

Click OK to conform the deletion
Repeat steps 2) and 3)

This time specify the DBA Non-Admin group and the role System User
Click on Home and on Properties

Click on New role Assignment
Enter the name of the DBA sysadmin group and set the role as Content Manager

Click OK to continue
Remove the local Administrators group from the Content Manager role
Report Manager can now be closed