< Blog

New Tool for Creating Configuration Manager 2012 Report Reader AD Security Groups

By Garth Jones

Recently I ran into an issue at a client’s where a non-ConfigMgr 2012 Administrator could run all of his organization’s SSRS reports, but none of them were populated with data (see the example screenshot below).

New Tool for Creating Configuration Manager 2012 Report Reader AD Security Groups

I asked them to use Brian Mason’s Report User Security Role tool because I suspected that their reports weren’t populating because they were never granted access to the reports. http://mnscug.org/blogs/brian-mason/162-report-user-role. Unfortunately, this tool didn’t work as I expected it to work, so I had to do some troubleshooting.

First, I changed the user’s security role (Report Reader) to the built-in, “Read-only Analyst,” security role. The reports started working properly, so this confirmed my suspicion that this problem was a permission’s issue.

I then compared the two security roles and determined that in order for any report to work with role-based administration (RBA) (the newly added feature in ConfigMgr 2012 R2) Brian’s Report User Security Role tool needed a few more permissions. Once the read resource permission was added all of the reports worked as expected.

Instead of having to adjust the permissions each time, I decided to update Brian’s tool. Hopefully, this will also save you some time if you need to give non-ConfigMgr 2012 administrators the ability to read SSRS reports.

New Tool for Creating Configuration Manager 2012 Report Reader AD Security Groups - Permissions

If you have ConfigMgr 2012 or ConfigMgr 2012 R2, you can download the new Enhansoft Report Reader tool from our site.

ConfigMgr 2012 https://www.enhansoft.com/downloads/CM12/ESRR-CM12.zip

ConfigMgr 2012 R2 https://www.enhansoft.com/downloads/CM12/ESRR-CM12R2.zip

In tomorrow’s blog post, I will show you step-by-step instructions on how to install and use this tool when setting up a ConfigMgr 2012 report reader AD security group.