Unable to create CRM 2013 Organisation RRS feed

  • Question

  • Hi,

    I am attempting to setup CRM in the following topology:

    • 1 Front End Server (Running Deployment Web Service and Deployment Tools + Front End Roles)
    • 1 Back End Server (Running VSS Service + Back End Roles)
    • 1 SQL Server
    • Active Directory Server

    All the servers are in the same domain. So, I install CRM using the command line procedure and configuration XML. Everything goes smooth, the CRM roles are installed, reporting services is installed in SQL Server. Log files states that installation is successful. I also check that the Groups are created in AD and respective users (for roles) are added to them.

    Now I proceed to create the Organisation (since it's not created by default when roles are installed separately), and bam I hit upon an error! The error says " The current user does not have required permissions (read/write) for the
    following Active Directory group: CN=ReportingGroup {9b986a8f-8584-48f0-b5e0-4999df345f57},OU=CRM,DC=DOMAINNAME,DC=loc"

    I have been doing the entire installation using the Domain Administrator, and it definitely has rights to read/write in the ReportingGroup! I have checked this link and the Account has ALL permissions and rights! I have been digging my brain over this for hours now and still haven't figured out what the F is wrong!

    Admin QuikView Solution for CRM 2013

    Wednesday, March 26, 2014 6:40 PM

All replies

  • See if you also have delegated rights on the OU - try giving them to "yourself" using the AD users & computers GUI
    Thursday, March 27, 2014 8:01 AM
  • Hi TZ00Kl,

    I have tried that as well, but have had no luck! That wasn't necessary anyways, since the account is the Domain Administrator and if the groups were created while CRM installation by that user, then definitely it should be able to read/write the Reporting Group.

    I simply don't get it what exactly is wrong!

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 9:29 AM
  • Did you check that the GUID is correct? 9b986a8f-8584-48f0-b5e0-4999df345f57

    Thursday, March 27, 2014 9:31 AM
  • Hi TZ00Kl,

    Yes, it is correct. Now there's something I did that might be the reason, though not sure.

    That is initially I installed SsrsConnector using the XML config file that had "autogroupmanagementoff" set to false. Then after I got this error, I read in a blog that the SsrsConnector needs to be installed with "autogroupmanagementoff" set to true. So, I uninstalled the SsrsConnector and installed it again with "autogroupmanagementoff" set to true this time. Installation was without any errors. Just wondering if installing the Connector initially with the value false messed up something?

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 9:41 AM
  • I tried repairing CRM and reinstalling SsrsConnector, but it still gives me the damn error! I am going nuts over this issue!

    Update: Getting frustrated over the same error over and over again, I decided to try creating an Organisation using the Deployment Manager, and as usual it failed. I started digging into the log file and found a new error this time. It says "System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Data.SqlClient.SqlException: Cannot find the symmetric key 'CrmSymmetricKey', because it does not exist or you do not have permission.". What does this mean? Different errors different times? I really don't understand!

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 10:44 AM
  • Hi,

    Even i have same issue with exception symmetric key 'CrmSymmetricKey' with in CRM 2013. May i know what changes you have applied to effected data base.

    Have a look in below URL :



    Vinay Kumar.

    Thursday, March 27, 2014 11:36 AM
  • Hi Vinay,

    I made no changes. After CRM installation was done, I simply went ahead to create a new Organisation. I had to create a new organisation because when you install roles separately, the organisation isn't created. And I am stuck there, tried everything possible. I am running Deployment Administrator with a Domain Admin account which has rights to EVERYTHING! And I still get this stupid error and I am stranded here like a dead duck! I am going nuts with this issue and simply cannot figure out what is wrong!!!

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 11:49 AM
  • Hi,

    I would suggest you to take back up of both ORG_MSCRM and MSCRM_CONFIG and place a side, next un-install everything and re install CRM from starting with out going choosing for connect to the existing data base i mean (MSCRM_CONFIG).

    Check the Gide for Installation if you missed anything



    Vinay Kumar.

    Thursday, March 27, 2014 12:07 PM
  • Hi Vinay,

    I am doing exactly that as I write. I have uninstalled everything, deleted the Config database, Groups created by CRM in OU in AD and I am installing CRM from scratch again using the command line process. Will keep you posted on what I encounter next! Phew!

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 12:23 PM
  • Hi,

    After creating OU in your AD, give delegate control (full read and write) for user currently using.

    1. Right click CRM and click on Delegate Control/

    2. Select the user with which you installing CRM2011.

    Click Next->Select Create a custom task delegate.

    Click Next-> Select Delegate Control of: This folder, existing objects in this folder, and creation of new objects in this folder.


    Vinay Kumar.

    Thursday, March 27, 2014 1:11 PM
  • Hi Vinay,

    Already tried that earlier, didn't work.

    Now after I have installed CRM again, I AM able to create an Organisation via the Deployment Manager, but sadly the reports don't work now. It gives "rsProcessAborted" or something like that. I am troubleshooting it now. While installing CRM this time, I made some changes in the Config XMLs.

    Also, I tried creating Organisations using PowerShell, gives me that same stupid error! But it works via Deployment Manager. Need to check what's wrong with the Reporting.

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 1:14 PM
  • Try this for the reporting:


    Usually the problem is incorrect data source type

    Thursday, March 27, 2014 1:57 PM
  • Hi, 

    Are you able access your report server ???? 


    Add the user in SQL security groups which is in local sys users and groups.


    Vinay Kumar.

    Thursday, March 27, 2014 2:01 PM
  • Hi Vinay,

    I can access the Report Server, but unfortunately your solution didn't work.

    Hi TZ00Kl,

    Thanks it worked; but only after I did some more changes going into the OU in AD. I added the SQL Server Name to the following groups:

    • PrivReportingGroup
    • PrivuserGroup
    • SQLAccessGroup

    This didn't happen during SsrsConnector installation because I modified the "autogroupmanagementoff" to true, I believe. Thanks again the reports work now!

    I am not marking TZ00Kl's post as answer yet, because I still need to figure out the PowerShell thing for creating Organisation. Once I get that thing going, I'll mark several posts as answers.

    The bloody powershell doesn't seem to work no matter what I try! Has anyone even tried out if the CRM Organisation create via PowerShell works at all? o.O

    Admin QuikView Solution for CRM 2013

    Thursday, March 27, 2014 3:17 PM

    thank you for using Dynamics Forums and Communities. I am sorry to hear that you were experiencing these issues. I can confirm that it is possible to create a new CRM organization in the Microsoft Dynamics CRM deployment, using the Deployment Manager or the CRM PowerShell tools, following the documented steps at  http://technet.microsoft.com/en-us/library/gg197677.aspx

    Have you used these steps before? If not, I will recommend you to follow them and see if this will work in your specific environment.

    Please let us know if this helps.

    Nina Peneva

    Support Engineer

    Microsoft Dynamics CRM

    Friday, April 11, 2014 9:37 AM
  • Hi Nina,

    Thanks for your reply. This still doesn't work. Out of the several times (around 10+ times) that I have installed Dynamics CRM, only ONCE has the PowerShell worked. (for creating Organisation)

    And yes, I DID try the steps you provided a link to. I was following those exact same steps from the very first attempt and the same error message appears every time.

    Admin QuikView Solution for CRM 2013

    Monday, May 12, 2014 10:48 AM
  • Hi,

    I was facing the same issue and resolved it by doing a clean install without the ConfigDB section in de configuration xml file.

    At first we installed Dynamics CRM 2013 with a ConfigDB section, and received the following error:

    Cannot find the symmetric key 'CrmSymmetricKey', because it does not exist or you do not have permission.

    After deleting the ConfigDB section in the configuration xml file and perform a re-install of Dynamics CRM

    - Delete all CRM Databases
    - Delete all installatie files.
    - Un-install reporting server extensions.

    I was able to create an Organization.

    Hope this helps.

    Kind regards,

    Rick Basten
    Avanade Netherlands B.V.

    Friday, June 6, 2014 8:20 AM
  • Hi,

    Can you please explain how did you the issue above The current user does not have required permissions (read/write) for the following Active Directory group: CN=ReportingGroup. I am facing the same error while creating a new OU but according to the IT team my user has all permission on OU.

    Tuesday, July 8, 2014 4:35 PM
  • Hi Averil,

    I never fixed it. Only once out of 10-12 installations was I able to create the Organisation using PowerShell. And in that case, nothing was different. Still wondering if someone else had a similar issue and was able to fix it.

    Admin QuikView Solution for CRM 2013

    Tuesday, July 8, 2014 7:20 PM