Sql-server – What am I missing for the SSRS Service account local server permissions

permissionsservice-accountssql serversql-server-2008-r2ssrs-2008-r2

I have a relatively new instance on SSRS 2008R2 SP3 running on Windows Server 2008 R2. I am trying to set up separate domain service accounts for the separate SQL Services i.e. agent, engine, reporting, etc. I have done this successfully for the Agent and Engine services using simple Domain accounts and following the required permissions from docs.microsoft.com.

At first I had made local accounts for all services because of a video I watched that used that as an example. So now that I actually wanted to start using reporting services I switch the account to a newly created Domain account. Using the pertinent section in the above article I configured, via GPO, the account to have "Log On As A Service" right. I ensured that right is present in the groups I created.

I then went into the Reporting Services Configuration Manager to change the account which was successful except that the step for starting the service ended in error. 

System.InvalidOperationException: Cannot start service ReportServer on computer 'SQLSERVER01'. ---> System.ComponentModel.Win32Exception: Access is denied
   --- End of inner exception stack trace ---
   at System.ServiceProcess.ServiceController.Start(String[] args)
   at System.ServiceProcess.ServiceController.Start()
   at ReportServicesConfigUI.Panels.ServerInformationPanel.StartStopServiceTask(Boolean start)

Event Viewer has a similar error which I include to save the questions.

The SQL Server Reporting Services (MSSQLSERVER) service failed to start due to the following error: 
Access is denied.

So this is a Windows permission issue but I don't see what the problem could be since the Log On As a Service permissions are set correctly. That is verified by the security logs that show a successful logon of the account. If I make my service account a local admin on the server then the service starts correctly but I should not have to do that.

Best Answer

As part of the troubleshooting I was doing to try and address the issue I ran Process Monitor while I was trying to start the service.

I tracked as event that also had a result of "Access Denied" which was the service trying to read files inside the directory where reporting services was installed an running from. In my case it was: "C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services"

I check the security of the folder and the service account I was using had no rights to the folder. That is why giving it local admin rights fixed it because that group did have access.

I gave my service account Modify access to the folder and its contents. After that I was able to start the service.

Related Question