Roman Rehak

SQL Server and things not related

<August 2008>
SuMoTuWeThFrSa
272829303112
3456789
10111213141516
17181920212223
24252627282930
31123456


Navigation

SQL Server Sites

Subscriptions

News

eXTReMe Tracker

Post Categories



Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services

IIS 6.0 allows you to create application pools, then each application pool can be configured to run under a separate identity. When my company deploys web sites, our practice is to create an account for each web application and then create a new application pool to run under that account. This approach however doesn't work with Reporting Services, you might end up getting weird errors like:

"The report server cannot decrypt the symmetric key used to access sensitive or encrypted data in a report server database..."

"Key not valid for use in specified state."

This happened to us with our first RS deployment. After many hours of frustration we opened a support call with Microsoft, then it still took some time to finally diagnose the problem. The bottom line is that RS in IIS 6.0 needs to run under the predefined Network Service account, you cannot use a configured account.

posted on Sunday, May 29, 2005 9:35 PM by Roman


# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Tuesday, May 31, 2005 10:20 PM

Hi Roman,

I'm sure that you are aware of this, but right yesterday I changed my RS account and I had to do what is described here:

http://support.microsoft.com/kb/842421

Radim Hampel

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Tuesday, May 31, 2005 11:47 PM

Hi Roman,

This link was helpful for me to resolve the issue. It describes the NTFS rights necessary for the account;

http://weblogs.asp.net/israelio/archive/2004/06/25/165545.aspx

By the way, the different accounts you have mentioned; are they domain accounts or local accounts? I'm facing several problems with running applications on IIS6 App pools under different domain accounts. Because of Kerberos limitations (which is the default setting) , it does not seem possible. Did you experience any problems relating to that?

Ethem Azun

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Wednesday, June 01, 2005 9:40 AM

Radim,

were you able to change the account on Windows 2000 or 2003? I am referring specifically to 2003. Let me know and if it was 2003, I'll try to follow the procedure and see if I can make it work. I based my recommendation on what the MS Support told us last year but maybe that's no longer true and you can switch to a configured account.

Roman Rehak

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Wednesday, June 01, 2005 9:44 AM

Ethem,

We tried both local and domain accounts and it didn't work in either case, that's when we went back to the Network Service account.

Roman Rehak

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Thursday, June 02, 2005 2:09 AM

Hi Roman,

Which account settings do you set on your RS Datasource to access your database? I couldn't find a way to use the Network Service account for that. Do you know anyway of doing this?

I also changed the RS user some weeks ago on a win2003 machine and did also the step Radim mentioned besides setting the NTFS permissions. I remember that additionally I had to remove manually the old key from the RS database Keys table.

Ethem Azun

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Tuesday, June 07, 2005 4:22 AM

Hi Roman,

sorry for late reply, but yes, I followed the procedure described on KB article on Win2003 with success. Now I changed the account back and forth a couple of times without problems. HTH.

Radim

Radim Hampel

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Tuesday, August 09, 2005 6:50 PM

This is not necessairly true ,as I have added RS as a virtual directory to my ASP Applicationand the whole thing is under *one* application pool with a generic account which is not network Service

Reza

# re: Roman's Weekly SQL Server Tip - Application Pool Identity in Reporting Services @ Monday, September 04, 2006 10:51 AM

I have the Identity set to the Network Service account, but my installation of CRM 3.0 says that it isn't. The RS application appears to be working fine. Any thoughts.

Drew




Powered by Dot Net Junkies, by Telligent Systems