Check following:
1, The SPN listings are correct.
2, The group nesting shouldn’t be performed
– all accounts needs
to be added directly into the
CRM groups and not via another AD group
3, The group membership goes like this:
PrivReportingGroup
– This should always contain the account running SSRS service.
PrivUserGroup – This should always contain the account running CRMAppPool.
This should always contain the account running SSRS service
The account running email router also should be a member of this group.
The account running CRM Asynchronous service also should be a member of this group.
ReportingGroup – All CRM users should be a member of “ReportingGroup”.
SQL Access Group - The account running CRMAppPool needs
to be a member of this group
The account running CRM Asynchronous service also should be a member of this group.
4, The scope of all these groups should be
“Domain Local” so that
CRM can be used across domains.
5, The
“SharedReports\5.0.xxxx” folder which contains all out of box reports should be given the following “Role Assignments” which in turn will be inherited down. Please ensure that you give
it at this level (open reports URL, click “SharedReports”, then click to open “5.0.xxxx” folder and this will list all reports, now click “Folder Settings |
Security”) so that it inherits down. Click “New Role Assignment” to add new roles.
The required roles are:
1), BUILTIN\Administrators
–
“Content Manager”
2), PrivReportingGroup – “Browser for Microsoft
CRM”
3), ReportingGroup – “Browser for Microsoft
CRM”
4), SQLAccessGroup – “Publisher for Microsoft
CRM”
6, The permissions given in SQL should be as follows:
1), PrivReportingGroup
– This should have
“CRMReaderRole” and
“Public” database roles for all
CRM organization databases and also for MSCRM_CONFIG database.
2), ReportingGroup - This should have “Public” database role and “CRMReaderRole” for all
CRM organization databases.
3), SQLAccessGroup - This should have “db_owner” and “Public” database roles for all
CRM organization databases and also for MSCRM_CONFIG database.
4), The SSRS Service account – On “ReportServer” database and on “ReportServerTempDB” database this account should have “Public” and “db_owner” role.
On “master” database this account should have “public” and “RSExecRole”
On “msdb” databases this account should have “public” , “RSExecRole” – let the remaining roles be there.
Crm Dynamics 2011 Report Error
