Have you ever needed to grant non-System Center 2012 Configuration Manager (CM12) administrators (and non-SQL administrators) the right to create/modify CM12 SSRS reports, but weren’t too sure how to go about it? If you answered, “yes,” then this blog post is for you!
Following best practices, these steps only grant the minimum permissions necessary to perform this task.
In this example, an AD group called Gartek\CM12- Report Editors is used.
1. Import the CM12 role XML file.
2. Assign Gartek\CM12- Report Editors to the security role on CM12.
3. Within SQL Server create a logon for Gartek\CM12- Report Editors.
4. On your CM12 database create a new user Gartek\CM12- Report Editors and in the membership setting grant db_Reader and smmschm_user.
5. On the CM server, export the CM certificate.
To export the certificate on the CM server follow these steps:
A. Open MMC on the CM server.
B. Add the certificates snap-in for the local computer.
C. Browse to the personal node.
D. Find the machine certificate for the CM server.
E. Right click and choose export. No need to export the private key.
F. Follow the Wizard steps and save the certificate in CER format.
G. Copy the exported certificate to your work station.
6. Import the certificate on all workstations that will be creating reports with Report Builder.
7. (Optional) Install Report Build 3.0 on your workstations.
8. On your CM12 SSRS site, click site settings on the home page.
9. Select the security tab and add Gartek\CM12- Report Editors as a system user.
This should now enable you to allow non-administrators (CM or SQL) to create/modify SSRS reports.