SMS 2003 - Site Configuration - Reporting Site Permission Setup

This has to be the single most pain the arse thing to do with SMS 2003. You would think that adding a user or group to the local "SMS Reporting Users" group and then assigning permissions within the console would be enough.... but NooOOooooooo.

So... here we go: (I'll list out what permissions give what access also)

1. Open a command prompt and type "dcomcnfg" then press the ENTER key. From the console root, expand "Component Services," "Computers," "My Computer," and finally "DCOM Config." Scroll down to "SMS_REPORTING_POINT," right-click and select "Properties." Select the "Security" tab, change the "Launch and Activation Permissions" radio button to "Customize" and then click the "Edit" button. Here is where you save future time by just adding in the local system group, "SMS Reporting Users." Give the group "Local Activation" permissions and then click the "OK" button on both dialog boxes. Close out of the Component Services box. This setting gives all users and groups within the local security group access to the reports.asp page, which is the default web page for SMS reporting.
2. Right-click on "My Computer" and select "Manage." Expand "Local Users and Groups" and then select the "Groups" folder. Double-click on the "SMS Reporting Users" local security group and add whatever users or groups you want to have access to SMS Reporting. This setting actually gives the user or group access to the SMS Reports menu itself.
3. Lastly, open up theSMS console, expand it and find the folder titled "Security Rights." Right-click on this and select "New > Class Security Right." Add the user or group into the "User name:" field box. Select "Report" from the drop-down box underneath here. Finally, you must select, at minimum, "Read" permissions from the check boxes at the bottom of the dialog box. This actually fills in the menus on the SMS Reports site. If you do not assign these rights, the user will get the SMS Report menu but none of the boxes will be expandable.

Now, go and click away on things and have a good reporting time.

*** Common Problems ***

"You are not authorized to view this page"

If you have either upgrading to the Server 2003 SP1, SMS 2003 SP1 or installed the ITMU, you may get the following error when trying to access your Reporting Site:

Don't pull your hair out just yet... any of those installations seem to "hork" IIS. Opening up your IIS Manager, expand the local server, "Web Sites," and the "Default Web Site." Right click on your SMSReporting_XXX component and select "Properties." Check the "Directory" tab in the "Local path:" field. It SHOULD have a long string conatining \inetpub\wwwroot\ etc... if it does not, your SMS Reporting site went bloowie.

Open up your SMS Console, expand "Site Hierarchy," expand your site, expand "Site Settings," and select "Site Systems." Right-click on the server containing your reporting site in the box on the right and select "Properties." Select the "Reporting Point" tab and uncheck the box next to "Use this site system as a reporting point." Don't worry, you are going to put it back later.

Open up SMSTrace from your toolkit and watch the logfile rsetup.log. You'll see SMS deinstall the reporting point. When it is finished, go back into the SMS console and check that box to use the server as a reporting point. Watch the log file again and make sure it finished the reinstallation of the reporting point. Now you can go to step one and start adding permissions.

"I am getting to the Reports menu, but none of the selections will expand!"

Another fun and common problem that is easy to solve. Got straight to step three above and add in the user or group that is affected.

"AHHHHHH - what is this???!?!?!?"

Server object error 'ASP 0178 : 80070005'
Server.CreateObject Access Error
/smsreporting_xxx/ReportsNav.asp, line 1055
The call to Server.CreateObject failed while checking permissions. Access is denied to this object.

This one was not fun to see, but I learned a lot trying to find out what it was. Although I found many references to the actual error message, I could not find any web sites explaining what to do. THEN.... I found the Microsoft page on the subject, written completely in kanji - oh joy. Searched for two days for the English version to no avail, so I guessed, and to my surprise I was correct. (Of course now, there are plenty of sites illustrating what to do to correct this, but that's now, my problem occurred before now.)

To correct this problem.... go straight to step 1 above.

Well, that's all for this one. Enjoy!