April 21, 2009 at 11:23 am
I'm trying to setup remote administration of a Report Server but i don't succeed.
My configuration looks like this:
- Server1: Windows Server 2008 x64 Enterprise with SP1, SQL Server 2008 x64 Enterprise with SP1 running DB Engine, SSIS and SSAS.
- Server2: Windows Server 2008 x64 Enterprise with SP1, SQL Server 2008 x64 Enterprise with SP1 running SSRS.
I have a domain user (mydomain\SqlSrvrAdmin) and want this user to be able to manage all SQL Server components from a single machine (Server1).
If I make SqlSrvrAdmin a member of the local administrators group on Server2, everything works fine: I'm able to run the Report Server Configuration Manager from Server1. But for security reasons, this is not allowed.
Now, if I remove SqlSrvrAdmin from the local administrators group on Server2, put it in the Users group and setup DCOM permissions to enable remote WMI access for a non-administrator and set permissions on the Server2 WMI namespace for non-administrator (according to document How to: Configure a Report Server for Remote Administration, all I get when trying to connect from my Report Server Configuration Manager is:
A connection to the computer cannot be established. Details: Access denied. (no error code!)
Has any one of you had the same problem? What is the solution, if any?
Thanks for your help.
Luc Magnée
MCTS BI
Antwerp - Belgium
April 21, 2009 at 12:19 pm
Check if there is a firewall issue betweeen the 2 servers. SSRS requires tcp port 135 and potentially TCP high ports 1024 to 65535 to be open between the 2 servers.
i had this same issue and it was resolved when these ports were opened.
Francis
April 21, 2009 at 12:42 pm
Hi Francis,
Thanks for your prompt answer.
A firewall problem is the very first thing I was thinking about, so I tried to make the connection after setting the Firewalls on both Server1 and Server2 off: this doesn't solve the problem, I keep getting the same message: Unable to connect to the report server WMI provider. Details: Access denied.
Also, would this be a Firewall problem, don't you think I would get the same result, SQLSrvrAdmin being, or not, a member of the local administrators group on Server2?
What surprises me is that doing exactly what Microsoft suggest just doesn't seem to work...
Just to be sure, the firewall settings on Server1 are:
TCP 1433 (SQL Server ) enabled
TCP 2383 (AS) enabled
TCP 135 (RPC) enabled
Remote Admin enabled
And on Server2:
TCP 80 (RS) enabled
TCP 135 (RPC) enabled
Remote Admin enabled
DCOM permissions for SQLSrvrAdmin: Allow Remote Launch and Remote Actvation
WMI namespace for SQLSrvrAdmin: Allow Enable Account, Remote Enable, Read Security
Luc Magnée
MCTS BI
Antwerp - Belgium
April 21, 2009 at 12:52 pm
This problem for me was only resolved for me when both port 135 and TCP high ports 1024 to 65535 were opened. The firewall guys wersn't happy about opening a range but apparently SSRS uses random ports between 1024 and 65535.
Francis
April 22, 2009 at 3:00 am
Hi Francis,
Thanks again for your answer.
I'm a bit like your firewall guys: not very happy with opening the full range of ports from 1024 to 65535!
So, I've been searching the web for information about the subject and I found a document "How to configure RPC dynamic port allocation to work with firewalls"[/url] that should make those guys a lot happier: there is no need to open the full range of high ports! Opening 100 ports between 1024 and 65535 (systems up to Win Server 2003 - Win XP) or between 49152 and 65535 (Win server 2008 - Win Vista) should do it in most environments.
Now, one last request: could you please inform with your firewall specialists about how they manage to open such a range of ports? I presume they didn't do it one by one in the Windows Firewall GUI...:-) I will try this on my test environment and, if you're interested, keep you informed of the results.
Have a nice day,
Luc
Luc Magnée
MCTS BI
Antwerp - Belgium
April 22, 2009 at 11:27 am
By the way I noticed my previous posts were wrong about the ports used. Posts 135 and the high range of ports 1024-65000 are used by SQL integration services not SSRS. SSRS uses port 80 so opening port 80 and port 1433 is sufficient. But for Integration services we can open the range of ports 135 and 1024-65000 using the firewall software we use which is NOT Windows firewall.
Luc: Thanks for the link and the tip about reducing this range. I will look into this. We use SSIS as well as SSRS and I got confused about the firewall ports required for each.
Francis
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply