< Blog

Configuration Manager 2012 R2, SSRS and Windows Authorization Access Group

By Garth Jones

In order for Configuration Manager 2012 R2 (CM12 R2) to use the Role-Based Administration (RBA) feature within SQL Server Reporting Services (SSRS), the SSRS execution account (EA) needs to be able to determine who is running the report. Then the EA will determine what CM12 rights the user has before displaying the report results. In some cases after upgrading to CM12 R2 or one of its Cumulative Updates (CU), when you run a SSRS report you may receive the error message below.

The DefaultValue expression for the report parameter ‘UserTokenSIDs’ contains an error: The specified directory service attribute or value does not exist.

The solution to this problem is to add your execution or computer account to the Windows Authorization Access Group (Active Directory (AD) security group).

Use the following steps to perform this task.

Configuration Manager 2012 R2, SSRS and Windows Authorization Access Group - Builtin

Open Active Directory Users and Computers (ADUC), and browse to the Builtin container. Double-click on the Windows Authorization Access Group.

Configuration Manager 2012 R2, SSRS and Windows Authorization Access Group - Members Tab

Click the Members tab.

Configuration Manager 2012 R2, SSRS and Windows Authorization Access Group - Add

Click Add

Configuration Manager 2012 R2, SSRS and Windows Authorization Access Group - Account

Add your execution account and click OK twice to return back to the ADUC.

From this point forward your Configuration Manager 2012 R2 SSRS account will be able to read the access token from AD and therefore RBA reports will work correctly.