Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have installed SQL Server 2008 ReportServer on dozens of servers, all virtually identical. It was always possible to configure it to use a domain account (the same one on all those servers). However, on MYSERVERNAME I get the following error:

System.InvalidOperationException: Cannot start service ReportServer on computer 'MYSERVERNAME'. ---> System.ComponentModel.Win32Exception: Access is denied


  --- End of inner exception stack trace ---
   at System.ServiceProcess.ServiceController.Start(String[] args)
   at System.ServiceProcess.ServiceController.Start()
   at ReportServicesConfigUI.Panels.WindowsServiceIdentityPanel.StartWindowsServicePostChangeWindowsServiceIdentity(ServiceController rsService)

This also happened after removing and re-installing ReportServer. The error goes away when I add the domain account to the administrators groups.

Any ideas?

Update:

From event viewer at same time:

Event Type: Failure Audit
Event Source:   Security
Event Category: Logon/Logoff 
Event ID:   537
Date:   	[current]
Time:   	[current]
User:   	NT AUTHORITY\SYSTEM
Computer:   MYSERVERNAME
Description:
Logon Failure:
    Reason:		An error occurred during logon
    User Name:	
    Domain:		
    Logon Type:	3
    Logon Process:	Authz   
    Authentication Package:	Kerberos
    Workstation Name:	MYSERVERNAME
    Status code:	0xC000018B
    Substatus code:	0x0
    Caller User Name:	MYSERVERNAME$
    Caller Domain:	MYDOMAIN
    Caller Logon ID:	(0x0,0x3E7)
    Caller Process ID:	824
    Transited Services:	-
    Source Network Address:	-
    Source Port:	-


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Another update: I tried giving full control to individual and all drives to the domain account in question, but those were apparently not the permissions it is craving.

Another another update: I found out that all services fail to run using any domain account, all with the error "Access is denied", so it's not really a reportserver problem (added new tag). I have a "pure" service that doesn't do anything except be a service and it fails to run using domain accounts. I have also removed and added the computer from/to the domain since then with no change of symptoms.

share|improve this question

5 Answers 5

The domain account probably doesn't have the privilege to run as a service. Click Start, Run, type secpol.msc, go into Local Policies, User Rights Assignment. Double-click on "Log on as a service" and add the account there.

If that doesn't do it, go into Administrative Tools, Event Viewer. Look at the errors in the Security event log, copy/paste those into here, and we can troubleshoot those.

Also, just to be clear - you aren't trying to change the account after setting up SQL Server, right? You need to specify the account name during the SQL Server setup process. The setup does a lot more than just this piece. Changing the service account after installation is pretty risky.

share|improve this answer
    
Sounds good, but ReportServer actually adds the account to that permission. And the account is indeed listed in "Log on as a service", together with another domain account I tried to use and my own. I installed ReportServer using local service account first and then change to the domain account in Reporting Services Configuration Manager because that's how the incoming documentation specifies it should be done (it has also worked for years and on all the other servers). –  Andrew J. Brehm Jun 17 '09 at 9:46
    
OK, what happens if you try to log in locally with that account? Log out, and log into the desktop (RDP or console) with that account to see what happens. –  Brent Ozar Jun 17 '09 at 10:49
    
The account works. I did a runas/user:thatdomain\thataccount cmd and the account seems fine. –  Andrew J. Brehm Jun 17 '09 at 14:41

Is the time right on the server as compared with the DC? Are there any issues talking to the DCs in the system event log? The reason I ask is the status code (0xC000018B) indicates that the system isn't able to get a Kerberos ticket.

share|improve this answer

I would also check whether the user account requires the 'Act as a part of the OS' privilege by comparing the account with a working server. I have seen a number of different software packages that require this privilege. This can be checked by Start -> Run -> secpol.msc -> Local Policies -> User Rights Assignment -> 'Act as a part of the OS'.

Alternativly, you could also try running Sysinternals Process Monitor and see if there are any resources it is trying to access that are generating access denied.

share|improve this answer
up vote 0 down vote accepted

Solved by upgrading everything to SQL 2008...

share|improve this answer

The SQL Server Reporting Services (MSSQLSERVER) service failed to start due to the following error: The service did not start due to a logon failure.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.