< Blog

Creating Configuration Manager 2012 Report Reader AD Security Groups

By Garth Jones

In my previous blog post I told you about how I decided to update Brian Mason’s Report User Security Role tool instead of having to adjust the permissions each time. I discovered that this extra step was required when trying to allow a non-CM12 administrator to read SSRS reports in CM12 R2.

In order to grant users access to CM12 SSRS reports without having them leverage the bulky CM12 console, you can use the new Enhansoft Report Readers tool to set up a report reader AD security group.

This blog post will guide you through the step-by-step process.

1. In Active Directory Users and Computers (ADUC), right-click on the appropriate Organization Unit (OU) (Users in the example below), point to New and then click Group.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Group

2. Enter the Group name and click OK.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Group Name

3. Double click on the Group name that was created, next click on the Members tab, and then click Add.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Members Tab - Add

4. Add the appropriate users, then click OK twice.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Select Appropriate Users 

5. Download the CM12 report reader permissions tool zip file.

CM12 https://www.enhansoft.com/downloads/CM12/ESRR-CM12.zip

CM12 R2 https://www.enhansoft.com/downloads/CM12/ESRR-CM12R2.zip

6. After un-zipping and extracting the XML file, open the CM12 console. Browse to Administration | Overview | Security | Security Roles then right-click and select Import Security Role.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Import Security Role

7. Browse to the XML file’s location. Select it and click Open.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Enhansoft Report Readers XML 

8. Once imported, browse to Administration | Overview | Security | Administrative Users then right-click and select Add User or Group.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Add User or Group

9. Click Browse.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Browse

10. Add the Group name and click OK.

Creating Configuration Manager 2012 Report Reader AD Security Groups - OK

11. Click Add…

Creating Configuration Manager 2012 Report Reader AD Security Groups - Add

12. Select Enhansoft Report Readers and click OK.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Enhansoft Report Readers

13. Click OK to continue.

Note: If you want to restrict which computers or users this security group can see, you can do that within the Assigned security scopes and collections section.

Creating Configuration Manager 2012 Report Reader AD Security Groups - Last Step 

With that last step you have now created a security group which has permission to see all of the computers and users within CM12, and they can access all reports via the web interface to SSRS. The web URL is generally http://<server name>/reports. For my lab environment it is http://cm12-cm4/reports.