How to Fix SSRS IIS7 permissions granted 'NT AUTHORITY\NETWORK SERVICE' are insufficient Error

A way to deal with the SQL Server Reporting Services rsAccessDenied issue when running ASP.NET website in IIS7
by Updated August 27, 2010

SQL Server Reporting Services can be a pain in the arse to set up correctly for the first time.  Even after you've got things running correctly, you can sometimes run into issues, which is exactly what happened to me recently. 

I had setup my local development machine to use the built-in 'Local System' account to run the report server service via the Reporting Services Configuration Manager.  Every thing was working fine when I accessed the Report Manager at the virtual directory url: http://localhost/Reports/ (I assigned the BUILTIN\Administrators account the System Administrator Role from the Site Settings -> Security section of the Report Manager.)  So everything also worked fine when I viewed my reports using the ReportViewer control with my ASP.NET website using Visual Studio.net's Development server.  

However, once I switched my ASP.NET site over to run in Internet Information Services 7 (IIS7), I began getting an rsAccessDenied error message from a webform page that was using the ReportViewer control to access SSRS reports.  I was greeted with the folloing error message:

The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are insufficient for performing this operation. (rsAccessDenied)

What I discovered in my case was that this SSRS error can occur in a IIS7 / ASP.NET website using the ReportViewer control when the LocalSystem account is not being used as the ApplicationPool Identity, but the Report Server Service Account is setup to use the Local System account to run the report server service.

Essentially, if your Report Server Service Account is set to use 'Local System' built-in account, then you'll want to make sure you're IIS7 / ASP.NET website has the ApplicationPool's (Process Model) Identity set to 'LocalSystem' as well.

 To create a new Application Pool with LocalSystem as the Identity follow these steps:

  1. Open Internet Information Services (IIS) Manger.
  2. In the Connections sidebar, click on Application Pools.
  3. Then in the right hand Actions sidebar, click Add Application Pool... and then in the pop-up box Name your AppPool, select the .NET Framework version and Managed pipeline mode, then click OK.
  4. Now right-click on the Application Pool you just created, and select Advanced Settings... from the menu.
  5. In the Advanced Settings pop-up box, locate the Process Model -> Identity section and click on the Application Pool Identity. 
  6. In the Application Pool Identity pop-up box, change the Built-in account to LocalSystem, then click OK, and click OK again to save your Advanced Settings changes.

To change the Application Pool that your IIS7 website uses follow these steps:

  1. Open Internet Information Services (IIS) Manger.
  2. In the Connections sidebar, expand the Sites folder and then find and click on your website application.
  3. With your website selected and the Features View selected, right-click on Authentication, and then click Basic Settings
  4. In the Edit Application pop-up box, click on the Select... button.  Now in the Select Application Pool pop-up box use the drop down menu to choose the Application pool you want to use for your website, then click OK, and click OK again to save your changes.

So essentially, by matching up the Report Server Service account with the IIS7 Application Pool Identity, I was able to access SSRS reports from my ASP.NET website using the ReportViewer control in IIS7.  Hope this helps solve your The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are insufficient for performing this operation. (rsAccessDenied) error message... 

Keep in mind this is just one way to solve the rsAccessDenied error when using IIS7 and the ReportViewer control for ASP.NET.  I ran into the rsAccessDenied error numerous times when setting up SSRS for the first time and was not using IIS7 at the time, so I know how much of a pain it can be to figure out what exactly is causing the rsAccessDenied error message.  At any rate, I hope this helps you solve your SSRS rsAccessDenied issue!

 


0
23

23 Comments

anonymous by Edwin Pacheco on 6/25/2010
Excelent Post
anonymous by Rick Pargeter on 8/10/2010
This worked great, thanks so much!
anonymous by sgcino on 8/27/2010
Thanks for the good article you have just solved my problem, thanks a lot. There are so many people who need this thank you
anonymous by Mike in L.A. on 9/20/2010
Great post; solved my problem. Thanks for taking the time to explain it.
anonymous by Kelvin in NZ on 12/3/2010
Solved my problem also. Thanks, you are a good man.
anonymous by Martha Becerra on 6/9/2011
Thanks so much, you post solved my problem :D
anonymous by Parag on 6/18/2011
Thnx for the post.....
anonymous by Muralitharan on 6/20/2011
Thanks for the post
anonymous by Cam on 6/27/2011
I still don't fully understand the problem. Could you point me to a place where I can learn more about this issue?
Your solution helped! Thanks!
anonymous by Suresh Subramanian on 8/20/2011
Thank you so much for this post !!!
anonymous by Eder Nucci on 8/23/2011
Thanks a lot for this post!
anonymous by Dave on 9/1/2011
THANK YOU! I've been struggling with SSRS permissions issues for a few days now.
anonymous by Philip S on 10/6/2011
Thanks! This was most helpful.
anonymous by Prashant B on 1/3/2012
Hey ......It works for me.
Thanks a lot :)
anonymous by prash on 2/7/2012
GR8 man after visiting dozens of post .. this one was the solution
anonymous by Will M on 2/29/2012
Good post but you can also allow the NT AUTHORITY\NETWORK user in the SSRS security settings via the report manager.
anonymous by Mayur on 4/6/2012
i still getting same issue. even after creating new application pool and assigned it to my reporserver application.

please suggest me ...what to do?
anonymous by sherwinK on 8/8/2012
working is SSRS web. Classic.net appPool / Identity :local System
anonymous by sagar makde on 10/4/2012
This article is very helpful.

Thanks a lot..
anonymous by Juarrios on 11/29/2012
Thanks for saving me time to solve a frustrating situation
anonymous by Aman Gupta on 2/6/2013
I have done all the steps mentioned by you...
But reports are running from Administrator account only not from other users...

Please help...
anonymous by Ziki on 8/15/2013
Tank you, solved my problem!
anonymous by Parthiban on 12/22/2014

Thank u very much for this solution to provide every one

Add your comment

by Anonymous - Already have an account? Login now!
Your Name:  

Comment:  
Enter the text you see in the image below
What do you see?
Can't read the image? View a new one.
Your comment will appear after being approved.

Related Posts


I recently dealt with an issue of external images not showing in Reporting Services (SSRS) report viewer control within an IIS7 website. When the IIS7 website had it's Application Pool's Managed Pipeline Mode set to "Classic", the external images showed...  more »

If you are getting the following error while trying to access or deploy a SQL Services Reporting Services (ssrs) report server on your localhost: The permissions granted to user 'domain\username' are insufficient for performing this operation....  more »

After running a ASP.NET website on IIS 7.5 for the first time on a Windows 7 computer, I was faced with the following error message: Login failed for user 'IIS APPPOOL\ASP.NET v4.0'. Description: An unhandled exception occurred during the execution of the...  more »

I recently upgraded from Microsoft SQL Server 2005 to Microsoft SQL Server 2008 on my Windows Vista computer. After successfully installing SQL Server 2008, I could not find the Reporting Services instance installed. I have a feeling this was due to the...  more »