Required Security for Report Viewer on Windows 2003 SP1 Web Server

When trying to run a local report using the RS Report Viewer for VS
2005 we get the below exception when the User Account for the
Application Pool we are using is not in the Administrators Group of the
web server.
Does anybody have any suggestions as to what specific security is
needed to use the Report Viewer?
Could this be because we built the application as a "Web Project"
instead of a "Web Site"?
Microsoft.Reporting.WebForms.LocalProcessingException: An error
occurred during local report processing. -->
Microsoft.Reporting.DefinitionInvalidException: The definition of the
report 'Main Report' is invalid. -->
Microsoft.ReportingServices.ReportProcessing.ReportProcessingException:
An unexpected error occurred while compiling expressions. Native
compiler return value: '[BC2001] file 'C:\WINDOWS\TEMP\n_rkco4n.0.vb'
could not be found'. -- End of inner exception stack trace -- at
AMR.AdvertiserClientList.RefreshReport() in C:\Documents and
Settings\god\My Documents\Visual Studio
2005\Projects\AMR\AdvertiserClientList.aspx.vb:line 192 at
AMR.AdvertiserClientList.RUNREPORT_Click(Object sender, EventArgs e) in
C:\Documents and Settings\God\My Documents\Visual Studio
2005\Projects\AMR\AdvertiserClientList.aspx.vb:line 50 ::
InnerException: Microsoft.Reporting.DefinitionInvalidException: The
definition of the report 'Main Report' is invalid. -->
Microsoft.ReportingServices.ReportProcessing.ReportProcessingException:
An unexpected error occurred while compiling expressions. Native
compiler return value: '[BC2001] file 'C:\WINDOWS\TEMP\n_rkco4n.0.vb'
could not be found'.This error is also logged in the system event viewer, however granting
access NETMAN in the DCOM manager only keeps the errors from showing
and does not fix the problem. The CLSID refers to tthe Network
Connection Manager Class (under the NETMAN application).
The application-specific permission settings do not grant Local
Activation permission for the COM Server application with CLSID
{BA126AD1-2166-11D1-B1D0-00805FC1270E}
to the user AMI\srvAcctAppAccessDEV SID
(S-1-5-21-2975352776-793034493-3225607600-10632). This security
permission can be modified using the Component Services administrative
tool.
tfelber@.gmail.com wrote:
> When trying to run a local report using the RS Report Viewer for VS
> 2005 we get the below exception when the User Account for the
> Application Pool we are using is not in the Administrators Group of the
> web server.
> Does anybody have any suggestions as to what specific security is
> needed to use the Report Viewer?
> Could this be because we built the application as a "Web Project"
> instead of a "Web Site"?
> Microsoft.Reporting.WebForms.LocalProcessingException: An error
> occurred during local report processing. -->
> Microsoft.Reporting.DefinitionInvalidException: The definition of the
> report 'Main Report' is invalid. -->
> Microsoft.ReportingServices.ReportProcessing.ReportProcessingException:
> An unexpected error occurred while compiling expressions. Native
> compiler return value: '[BC2001] file 'C:\WINDOWS\TEMP\n_rkco4n.0.vb'
> could not be found'. -- End of inner exception stack trace -- at
> AMR.AdvertiserClientList.RefreshReport() in C:\Documents and
> Settings\god\My Documents\Visual Studio
> 2005\Projects\AMR\AdvertiserClientList.aspx.vb:line 192 at
> AMR.AdvertiserClientList.RUNREPORT_Click(Object sender, EventArgs e) in
> C:\Documents and Settings\God\My Documents\Visual Studio
> 2005\Projects\AMR\AdvertiserClientList.aspx.vb:line 50 ::
> InnerException: Microsoft.Reporting.DefinitionInvalidException: The
> definition of the report 'Main Report' is invalid. -->
> Microsoft.ReportingServices.ReportProcessing.ReportProcessingException:
> An unexpected error occurred while compiling expressions. Native
> compiler return value: '[BC2001] file 'C:\WINDOWS\TEMP\n_rkco4n.0.vb'
> could not be found'.|||Finally figured it out.
The configurable identity that our application pool was using under
IIS 6.0 needed read/write access to the c:\Windows\Temp directory.
(Explains why we could get this to work when the account was part of
the Administrators or Power Users Group). I suppose this is to give it
temp space when rendering large reports.
Hopefully this helps somebody else out one day.
tfelber@.gmail.com wrote:
> This error is also logged in the system event viewer, however granting
> access NETMAN in the DCOM manager only keeps the errors from showing
> and does not fix the problem. The CLSID refers to tthe Network
> Connection Manager Class (under the NETMAN application).
> The application-specific permission settings do not grant Local
> Activation permission for the COM Server application with CLSID
> {BA126AD1-2166-11D1-B1D0-00805FC1270E}
> to the user AMI\srvAcctAppAccessDEV SID
> (S-1-5-21-2975352776-793034493-3225607600-10632). This security
> permission can be modified using the Component Services administrative
> tool.
>
> tfelber@.gmail.com wrote:
> > When trying to run a local report using the RS Report Viewer for VS
> > 2005 we get the below exception when the User Account for the
> > Application Pool we are using is not in the Administrators Group of the
> > web server.
> >
> > Does anybody have any suggestions as to what specific security is
> > needed to use the Report Viewer?
> >
> > Could this be because we built the application as a "Web Project"
> > instead of a "Web Site"?
> >
> > Microsoft.Reporting.WebForms.LocalProcessingException: An error
> > occurred during local report processing. -->
> > Microsoft.Reporting.DefinitionInvalidException: The definition of the
> > report 'Main Report' is invalid. -->
> > Microsoft.ReportingServices.ReportProcessing.ReportProcessingException:
> > An unexpected error occurred while compiling expressions. Native
> > compiler return value: '[BC2001] file 'C:\WINDOWS\TEMP\n_rkco4n.0.vb'
> > could not be found'. -- End of inner exception stack trace -- at
> > AMR.AdvertiserClientList.RefreshReport() in C:\Documents and
> > Settings\god\My Documents\Visual Studio
> > 2005\Projects\AMR\AdvertiserClientList.aspx.vb:line 192 at
> > AMR.AdvertiserClientList.RUNREPORT_Click(Object sender, EventArgs e) in
> > C:\Documents and Settings\God\My Documents\Visual Studio
> > 2005\Projects\AMR\AdvertiserClientList.aspx.vb:line 50 ::
> > InnerException: Microsoft.Reporting.DefinitionInvalidException: The
> > definition of the report 'Main Report' is invalid. -->
> > Microsoft.ReportingServices.ReportProcessing.ReportProcessingException:
> > An unexpected error occurred while compiling expressions. Native
> > compiler return value: '[BC2001] file 'C:\WINDOWS\TEMP\n_rkco4n.0.vb'
> > could not be found'.

Required Role for SQL 2005 Security operations

We need a user with db_owner permissions plus permission for these
operations:
Create db master key
Create certificate
Create symmetric key
And decrypt / encrypt by key
should it be securityadmin?
YanivHi ,Yaniv
BOL says , if you want the user to perfom CREATE CERTIFICATE for example
,so
'Requires CREATE CERTIFICATE permission on the database.'
Read the BOL for each statement that you need and make a decision. You may
want to consider create a ROLE which will contain all those requierd
permissions
<yaniv.harpaz@.gmail.com> wrote in message
news:1153658166.225912.167740@.p79g2000cwp.googlegroups.com...
> We need a user with db_owner permissions plus permission for these
> operations:
> Create db master key
> Create certificate
> Create symmetric key
> And decrypt / encrypt by key
> should it be securityadmin?
> Yaniv
>|||Thank You Uri,
Yaniv
Uri Dimant wrote:
> Hi ,Yaniv
> BOL says , if you want the user to perfom CREATE CERTIFICATE for example
> ,so
> 'Requires CREATE CERTIFICATE permission on the database.'
> Read the BOL for each statement that you need and make a decision. You may
> want to consider create a ROLE which will contain all those requierd
> permissions
>
>
>
>
>
> <yaniv.harpaz@.gmail.com> wrote in message
> news:1153658166.225912.167740@.p79g2000cwp.googlegroups.com...
> > We need a user with db_owner permissions plus permission for these
> > operations:
> > Create db master key
> > Create certificate
> > Create symmetric key
> > And decrypt / encrypt by key
> >
> > should it be securityadmin?
> >
> > Yaniv
> >

Repost: Security level already for "RosettaMgr"

As an MSDN subscriber, I though I was supposed to get a guaranteed response
here. I am reposting this since no one responded to my 1st inquiry.
Out of the blue this morning our Report Server stopped working with the
following error:
Configuration Error
...
Parser Error Message: Security Level already defined for RosettaMgr
Source Error:
Line 22: <securityPolicy>
Line 23: <trustlevel name="RosettaMgr"
policyFile="rsmgrpolicy.config" />
Line 24: </securityPolicy>
line 24: <trust level="RosettaMgr" originUrl="" />
Removing the offending lines from web.config resolved the problem but I'm
unclear why this happened suddenly. I'm also leery of removing these
settings without fully understanding the implications. If anyone has any
insight as to the cause of this error or can intelligently explain the
<securityPolicy> and <trust level> settings I sure would appreciate a little
feedback.
Thanks,
Rich BakosHi Rich,
Sorry that you're encountering trouble. Not sure where your expectation was
set regarding guaranteed response If you could let me know that would be
very helpful. AFAIK, MS doesn't guarantee responses on this newsgroup -
you're actually talking with many folks on the product team directly. Though
we'd love to answer all questions, we're also trying to ship an awesome
product as part of SQL Server 2005. I'm sure you understand our quandry
:-).
Now your question:
Report Manager ships with a default security group called RosettaMgr.
Removing this line is not desired. The relevant section of the file reads:
<securityPolicy>
<trustLevel name="RosettaMgr" policyFile="rsmgrpolicy.config"/>
</securityPolicy>
<trust level="RosettaMgr" originUrl=""/>
What this line does is it ensure that the report manager loads code, that it
assigns the code the correct permission defined in the rsmgrpolicy.config
file.
This is a shot in the dark but the web.config file included with an
application follows a hierarchy based on other web.config files that come
before it. You can read up on this here:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secmod/html/secmod92.asp
Are you running another application that also uses ASP.Net on the same
server? Has any web.config changed on your server shortly before your
application started to fail?
One other questions - did you move/copy the report manager virtual
directory?
-Lukasz
"Richard Bakos" <bakos@.nospam.nospam> wrote in message
news:%23PAol8DGFHA.444@.TK2MSFTNGP15.phx.gbl...
> As an MSDN subscriber, I though I was supposed to get a guaranteed
> response
> here. I am reposting this since no one responded to my 1st inquiry.
> Out of the blue this morning our Report Server stopped working with the
> following error:
> Configuration Error
> ...
> Parser Error Message: Security Level already defined for RosettaMgr
>
> Source Error:
> Line 22: <securityPolicy>
> Line 23: <trustlevel name="RosettaMgr"
> policyFile="rsmgrpolicy.config" />
> Line 24: </securityPolicy>
> line 24: <trust level="RosettaMgr" originUrl="" />
> Removing the offending lines from web.config resolved the problem but I'm
> unclear why this happened suddenly. I'm also leery of removing these
> settings without fully understanding the implications. If anyone has any
> insight as to the cause of this error or can intelligently explain the
> <securityPolicy> and <trust level> settings I sure would appreciate a
> little
> feedback.
> Thanks,
> Rich Bakos
>
>|||Lukasz Pawlowski [MSFT] wrote:
Hi Lukasz.
Thanks for you response.
> Sorry that you're encountering trouble. Not sure where your
> expectation was set regarding guaranteed response If you could let
> me know that would be very helpful.
My mistake, the page says a "commitment" to respond rather than a guarantee.
http://msdn.microsoft.com/newsgroups/managed/
> <securityPolicy>
> <trustLevel name="RosettaMgr" policyFile="rsmgrpolicy.config"/>
> </securityPolicy>
> <trust level="RosettaMgr" originUrl=""/>
Yes. Those are the offending lines and the server will not run with those
elements defined. To add to the problem, we can not move reports to
different folders or update definitions since removing the offending
elements. Everything else appears to work correctly.
Here is the exact text of the error:
Description: An error occurred during the processing of a configuration file
required to service this request. Please review the specific error details
below and modify your configuration file appropriately.
Parser Error Message: Security level already defined for 'RosettaMgr'.
Source Error:
Line 21: <httpRuntime executionTimeout="9000"/>
Line 22: <securityPolicy>
Line 23: <trustLevel name="RosettaMgr" policyFile="rsmgrpolicy.config"/>
Line 24: </securityPolicy>
Line 25: <trust level="RosettaMgr" originUrl=""/>
Source File: C:\Program Files\Microsoft SQL Server\MSSQL\Reporting
Services\ReportManager\web.config Line: 23
----
Version Information: Microsoft .NET Framework Version:1.1.4322.573; ASP.NET
Version:1.1.4322.573
> What this line does is it ensure that the report manager loads code,
> that it assigns the code the correct permission defined in the
> rsmgrpolicy.config file.
Thanks for the explaination but this doesn't explain why I'm getting a parse
error complaining that a Security level is already defined. My web.config
files had not been changed until the day I removed the offending elements.
> Are you running another application that also uses ASP.Net on the same
> server?
No. However, the web.config for the report server also contains the elements
sin question.
>Has any web.config changed on your server shortly before
> your application started to fail?
No.
> One other questions - did you move/copy the report manager virtual
> directory?
No.
Any other insight you might have certainly would be helpful.
Thanks,
Rich Bakos|||Richard Bakos wrote:
> No. However, the web.config for the report server also contains the
> elements sin question.
My mistake. The element definitions are not identical. Once defines
RosettaMgr while the other defines RosettaSrv.
Rich|||The solution to your problem is to install the ASP.Net hotfix for a
canonicalization issue. You can do this from the following KB article:
http://support.microsoft.com/kb/887787
-Lukasz
This posting is provided "AS IS" with no warranties, and confers no rights.
"Richard Bakos" <bakos@.nospam.nospam> wrote in message
news:uYe6DZKGFHA.560@.TK2MSFTNGP15.phx.gbl...
> Richard Bakos wrote:
>> No. However, the web.config for the report server also contains the
>> elements sin question.
> My mistake. The element definitions are not identical. Once defines
> RosettaMgr while the other defines RosettaSrv.
> Rich
>|||Lukasz Pawlowski [MSFT] wrote:
Hi Lukasz,
> The solution to your problem is to install the ASP.Net hotfix for a
> canonicalization issue. You can do this from the following KB
> article:
That made no difference. The problem still exists.
Rich Bakos

Repost - Linked server security - Help!

I have 2 questions.
1. Can I map a local NT group (not a user) to a remote login (SQL account)?
(local server is SQL7, remote server is SQL 2K)
2. I kept add new login mappings from the security tab. Then I clicked OK
and closed it. No error messages. Next time when I opened the tab, it only
shows the first mapping I did. The rest disappears. I used
sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
Can anyone help?
Thank you!
Hi
Is this a SQL 7 instance linked to SQL 2000 or vice versa? Which version of
EM are you using to do this?
Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>I have 2 questions.
> 1. Can I map a local NT group (not a user) to a remote login (SQL
> account)?
> (local server is SQL7, remote server is SQL 2K)
> 2. I kept add new login mappings from the security tab. Then I clicked OK
> and closed it. No error messages. Next time when I opened the tab, it only
> shows the first mapping I did. The rest disappears. I used
> sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
> Can anyone help?
> Thank you!
>
|||Local server is sql 7. linked server is sql 2k. I checked the version of the
EM, which is 8.0
"John Bell" wrote:

> Hi
> Is this a SQL 7 instance linked to SQL 2000 or vice versa? Which version of
> EM are you using to do this?
> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>
>
|||Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did not
show it. If I add thru EM, it will only show the first mapping. Even
sp_helplinkedsrvlogin will not show it. I have done test to prove that the
mapping was added. However neither thru EM or SP, I can see it.

> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>
>
|||Hi
You may want to check on a system that has the SQL 7 tools.
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...[vbcol=seagreen]
> Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did
> not
> show it. If I add thru EM, it will only show the first mapping. Even
> sp_helplinkedsrvlogin will not show it. I have done test to prove that the
> mapping was added. However neither thru EM or SP, I can see it.
|||Thanks! I will check. Do you know the asnwer to my first question?
1. Can I map a local NT group (not a user) to a remote login (SQL account)?
(local server is SQL7, remote server is SQL 2K)
Thanks again.
"John Bell" wrote:

> Hi
> You may want to check on a system that has the SQL 7 tools.
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...
>
>
|||Hi
You should be able to do this, but I don't have a system I can check it on!
In general my preference is to use NT groups wherever possible then when a
new user comes along it is part of the NT administration to set them up
(without touching the databases!).
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:80ACE6F9-9F60-471C-8E2C-A1A2D3E47534@.microsoft.com...[vbcol=seagreen]
> Thanks! I will check. Do you know the asnwer to my first question?
> 1. Can I map a local NT group (not a user) to a remote login (SQL
> account)?
> (local server is SQL7, remote server is SQL 2K)
> Thanks again.
> "John Bell" wrote:
|||Thanks for the reply. I tried. It was mapped OK but did not work. A user
belongs to the NT group connects to the remote server as the generic account
I have (which is for everyone not in the mapping table). After couple tests,
it seems that I can only map a NT user to a remote SQL account.
"John Bell" wrote:

> Hi
> You should be able to do this, but I don't have a system I can check it on!
> In general my preference is to use NT groups wherever possible then when a
> new user comes along it is part of the NT administration to set them up
> (without touching the databases!).
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:80ACE6F9-9F60-471C-8E2C-A1A2D3E47534@.microsoft.com...
>
>

Repost - Linked server security - Help!

I have 2 questions.
1. Can I map a local NT group (not a user) to a remote login (SQL account)?
(local server is SQL7, remote server is SQL 2K)
2. I kept add new login mappings from the security tab. Then I clicked OK
and closed it. No error messages. Next time when I opened the tab, it only
shows the first mapping I did. The rest disappears. I used
sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
Can anyone help?
Thank you!Hi
Is this a SQL 7 instance linked to SQL 2000 or vice versa? Which version of
EM are you using to do this?
Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>I have 2 questions.
> 1. Can I map a local NT group (not a user) to a remote login (SQL
> account)?
> (local server is SQL7, remote server is SQL 2K)
> 2. I kept add new login mappings from the security tab. Then I clicked OK
> and closed it. No error messages. Next time when I opened the tab, it only
> shows the first mapping I did. The rest disappears. I used
> sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
> Can anyone help?
> Thank you!
>|||Local server is sql 7. linked server is sql 2k. I checked the version of the
EM, which is 8.0
"John Bell" wrote:
> Hi
> Is this a SQL 7 instance linked to SQL 2000 or vice versa? Which version of
> EM are you using to do this?
> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
> >I have 2 questions.
> >
> > 1. Can I map a local NT group (not a user) to a remote login (SQL
> > account)?
> > (local server is SQL7, remote server is SQL 2K)
> >
> > 2. I kept add new login mappings from the security tab. Then I clicked OK
> > and closed it. No error messages. Next time when I opened the tab, it only
> > shows the first mapping I did. The rest disappears. I used
> > sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
> >
> > Can anyone help?
> >
> > Thank you!
> >
>
>|||Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did not
show it. If I add thru EM, it will only show the first mapping. Even
sp_helplinkedsrvlogin will not show it. I have done test to prove that the
mapping was added. However neither thru EM or SP, I can see it.
> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
> >I have 2 questions.
> >
> > 1. Can I map a local NT group (not a user) to a remote login (SQL
> > account)?
> > (local server is SQL7, remote server is SQL 2K)
> >
> > 2. I kept add new login mappings from the security tab. Then I clicked OK
> > and closed it. No error messages. Next time when I opened the tab, it only
> > shows the first mapping I did. The rest disappears. I used
> > sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
> >
> > Can anyone help?
> >
> > Thank you!
> >
>
>|||Hi
You may want to check on a system that has the SQL 7 tools.
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...
> Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did
> not
> show it. If I add thru EM, it will only show the first mapping. Even
> sp_helplinkedsrvlogin will not show it. I have done test to prove that the
> mapping was added. However neither thru EM or SP, I can see it.
>> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
>> John
>> "Min" <Min@.discussions.microsoft.com> wrote in message
>> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>> >I have 2 questions.
>> >
>> > 1. Can I map a local NT group (not a user) to a remote login (SQL
>> > account)?
>> > (local server is SQL7, remote server is SQL 2K)
>> >
>> > 2. I kept add new login mappings from the security tab. Then I clicked
>> > OK
>> > and closed it. No error messages. Next time when I opened the tab, it
>> > only
>> > shows the first mapping I did. The rest disappears. I used
>> > sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a
>> > bug?
>> >
>> > Can anyone help?
>> >
>> > Thank you!
>> >
>>|||Thanks! I will check. Do you know the asnwer to my first question?
1. Can I map a local NT group (not a user) to a remote login (SQL account)?
(local server is SQL7, remote server is SQL 2K)
Thanks again.
"John Bell" wrote:
> Hi
> You may want to check on a system that has the SQL 7 tools.
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...
> > Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did
> > not
> > show it. If I add thru EM, it will only show the first mapping. Even
> > sp_helplinkedsrvlogin will not show it. I have done test to prove that the
> > mapping was added. However neither thru EM or SP, I can see it.
> >
> >> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> >>
> >> John
> >>
> >> "Min" <Min@.discussions.microsoft.com> wrote in message
> >> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
> >> >I have 2 questions.
> >> >
> >> > 1. Can I map a local NT group (not a user) to a remote login (SQL
> >> > account)?
> >> > (local server is SQL7, remote server is SQL 2K)
> >> >
> >> > 2. I kept add new login mappings from the security tab. Then I clicked
> >> > OK
> >> > and closed it. No error messages. Next time when I opened the tab, it
> >> > only
> >> > shows the first mapping I did. The rest disappears. I used
> >> > sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a
> >> > bug?
> >> >
> >> > Can anyone help?
> >> >
> >> > Thank you!
> >> >
> >>
> >>
> >>
>
>|||Hi
You should be able to do this, but I don't have a system I can check it on!
In general my preference is to use NT groups wherever possible then when a
new user comes along it is part of the NT administration to set them up
(without touching the databases!).
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:80ACE6F9-9F60-471C-8E2C-A1A2D3E47534@.microsoft.com...
> Thanks! I will check. Do you know the asnwer to my first question?
> 1. Can I map a local NT group (not a user) to a remote login (SQL
> account)?
> (local server is SQL7, remote server is SQL 2K)
> Thanks again.
> "John Bell" wrote:
>> Hi
>> You may want to check on a system that has the SQL 7 tools.
>> John
>> "Min" <Min@.discussions.microsoft.com> wrote in message
>> news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...
>> > Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did
>> > not
>> > show it. If I add thru EM, it will only show the first mapping. Even
>> > sp_helplinkedsrvlogin will not show it. I have done test to prove that
>> > the
>> > mapping was added. However neither thru EM or SP, I can see it.
>> >
>> >> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
>> >>
>> >> John
>> >>
>> >> "Min" <Min@.discussions.microsoft.com> wrote in message
>> >> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>> >> >I have 2 questions.
>> >> >
>> >> > 1. Can I map a local NT group (not a user) to a remote login (SQL
>> >> > account)?
>> >> > (local server is SQL7, remote server is SQL 2K)
>> >> >
>> >> > 2. I kept add new login mappings from the security tab. Then I
>> >> > clicked
>> >> > OK
>> >> > and closed it. No error messages. Next time when I opened the tab,
>> >> > it
>> >> > only
>> >> > shows the first mapping I did. The rest disappears. I used
>> >> > sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a
>> >> > bug?
>> >> >
>> >> > Can anyone help?
>> >> >
>> >> > Thank you!
>> >> >
>> >>
>> >>
>> >>
>>|||Thanks for the reply. I tried. It was mapped OK but did not work. A user
belongs to the NT group connects to the remote server as the generic account
I have (which is for everyone not in the mapping table). After couple tests,
it seems that I can only map a NT user to a remote SQL account.
"John Bell" wrote:
> Hi
> You should be able to do this, but I don't have a system I can check it on!
> In general my preference is to use NT groups wherever possible then when a
> new user comes along it is part of the NT administration to set them up
> (without touching the databases!).
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:80ACE6F9-9F60-471C-8E2C-A1A2D3E47534@.microsoft.com...
> > Thanks! I will check. Do you know the asnwer to my first question?
> >
> > 1. Can I map a local NT group (not a user) to a remote login (SQL
> > account)?
> > (local server is SQL7, remote server is SQL 2K)
> >
> > Thanks again.
> >
> > "John Bell" wrote:
> >
> >> Hi
> >>
> >> You may want to check on a system that has the SQL 7 tools.
> >>
> >> John
> >>
> >> "Min" <Min@.discussions.microsoft.com> wrote in message
> >> news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...
> >> > Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did
> >> > not
> >> > show it. If I add thru EM, it will only show the first mapping. Even
> >> > sp_helplinkedsrvlogin will not show it. I have done test to prove that
> >> > the
> >> > mapping was added. However neither thru EM or SP, I can see it.
> >> >
> >> >> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> >> >>
> >> >> John
> >> >>
> >> >> "Min" <Min@.discussions.microsoft.com> wrote in message
> >> >> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
> >> >> >I have 2 questions.
> >> >> >
> >> >> > 1. Can I map a local NT group (not a user) to a remote login (SQL
> >> >> > account)?
> >> >> > (local server is SQL7, remote server is SQL 2K)
> >> >> >
> >> >> > 2. I kept add new login mappings from the security tab. Then I
> >> >> > clicked
> >> >> > OK
> >> >> > and closed it. No error messages. Next time when I opened the tab,
> >> >> > it
> >> >> > only
> >> >> > shows the first mapping I did. The rest disappears. I used
> >> >> > sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a
> >> >> > bug?
> >> >> >
> >> >> > Can anyone help?
> >> >> >
> >> >> > Thank you!
> >> >> >
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>
>
>

Repost - Linked server security - Help!

I have 2 questions.
1. Can I map a local NT group (not a user) to a remote login (SQL account)?
(local server is SQL7, remote server is SQL 2K)
2. I kept add new login mappings from the security tab. Then I clicked OK
and closed it. No error messages. Next time when I opened the tab, it only
shows the first mapping I did. The rest disappears. I used
sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
Can anyone help?
Thank you!Hi
Is this a SQL 7 instance linked to SQL 2000 or vice versa? Which version of
EM are you using to do this?
Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>I have 2 questions.
> 1. Can I map a local NT group (not a user) to a remote login (SQL
> account)?
> (local server is SQL7, remote server is SQL 2K)
> 2. I kept add new login mappings from the security tab. Then I clicked OK
> and closed it. No error messages. Next time when I opened the tab, it only
> shows the first mapping I did. The rest disappears. I used
> sp_helplinkedsrvlogin, which still does NOT show the rest. Is this a bug?
> Can anyone help?
> Thank you!
>|||Local server is sql 7. linked server is sql 2k. I checked the version of the
EM, which is 8.0
"John Bell" wrote:

> Hi
> Is this a SQL 7 instance linked to SQL 2000 or vice versa? Which version o
f
> EM are you using to do this?
> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>
>|||Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did not
show it. If I add thru EM, it will only show the first mapping. Even
sp_helplinkedsrvlogin will not show it. I have done test to prove that the
mapping was added. However neither thru EM or SP, I can see it.

> Can you use Query Analyser (sp_addlinkedsrvlogin) to add this login?
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:97B19B1E-B858-4433-8642-F9DE841DB341@.microsoft.com...
>
>|||Hi
You may want to check on a system that has the SQL 7 tools.
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...[vbcol=seagreen]
> Yes. I can use sp_addlinkedsrvlogin to add login, although EM still did
> not
> show it. If I add thru EM, it will only show the first mapping. Even
> sp_helplinkedsrvlogin will not show it. I have done test to prove that the
> mapping was added. However neither thru EM or SP, I can see it.
>|||Thanks! I will check. Do you know the asnwer to my first question?
1. Can I map a local NT group (not a user) to a remote login (SQL account)?
(local server is SQL7, remote server is SQL 2K)
Thanks again.
"John Bell" wrote:

> Hi
> You may want to check on a system that has the SQL 7 tools.
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:7290F8F4-58AD-4FFC-A4B6-E9600767D23C@.microsoft.com...
>
>|||Hi
You should be able to do this, but I don't have a system I can check it on!
In general my preference is to use NT groups wherever possible then when a
new user comes along it is part of the NT administration to set them up
(without touching the databases!).
John
"Min" <Min@.discussions.microsoft.com> wrote in message
news:80ACE6F9-9F60-471C-8E2C-A1A2D3E47534@.microsoft.com...[vbcol=seagreen]
> Thanks! I will check. Do you know the asnwer to my first question?
> 1. Can I map a local NT group (not a user) to a remote login (SQL
> account)?
> (local server is SQL7, remote server is SQL 2K)
> Thanks again.
> "John Bell" wrote:
>|||Thanks for the reply. I tried. It was mapped OK but did not work. A user
belongs to the NT group connects to the remote server as the generic account
I have (which is for everyone not in the mapping table). After couple tests,
it seems that I can only map a NT user to a remote SQL account.
"John Bell" wrote:

> Hi
> You should be able to do this, but I don't have a system I can check it on
!
> In general my preference is to use NT groups wherever possible then when a
> new user comes along it is part of the NT administration to set them up
> (without touching the databases!).
> John
> "Min" <Min@.discussions.microsoft.com> wrote in message
> news:80ACE6F9-9F60-471C-8E2C-A1A2D3E47534@.microsoft.com...
>
>