January 21, 2009 at 8:28 am
Good day,
I've got over 100 domain accounts for which I need to configure permissions. I know I can add each account individually in either Management Studio or Report Manager, but I'm thinking there's got to be an easier way.
In the past, when I've needed to do this on the Database Engine side, I would loop through a table of accounts I created and then EXEC sp_grantlogin and then EXEC sp_grantdbaccess and then EXEC sp_addrolemember and I'd be all set.
I initially thought I could do something similar by adding users to the ReportServer database, but it doesn't appear that's how it works. Instead it appears when you add users they wind up in the ReportServer.dbo.users table. (Oddly though, when you remove a user they are not dropped from this table.)
Any suggestions would be appreciated.
Thanks.
January 21, 2009 at 8:30 am
My suggestion is get domain groups set up and add them, instead of individual accounts. That's usually MUCH faster and easier to manage.
- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread
"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon
January 21, 2009 at 8:37 am
Thanks for the reply.
Yes, I'm aware we can do that but for whatever reasons the Active Directory team preferred that the SQL team manage the roles / groups.
January 21, 2009 at 8:43 am
.... for whatever reasons?
Looks like the active directory team wants to pass the buck and have you do all the work.
For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help[/url]
January 21, 2009 at 8:49 am
In fairness to the AD guys, whether it's them or us, someone's putting these folks in groups. Truth be told, I've never minded because I like the increased visibility / control.
February 13, 2009 at 1:04 pm
Well if you want to keep using groups to maintain the servers ssrs security and dont' want to manually add them via SSMS, you could always create a local group on your reporting server and add the domain accounts to it.
Think of it like using a local resource domain from those scary old BAD (Before Active Directory) days. Obviously this doesn't scale terribly well, but once they are in that list the AD guys can script them out with PowerShell, WMI or various other means.
-Luke.
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply