1. Start the Reporting Services Configuration tool and connect to the report server.

2. On the Windows Service Identity page, specify the new account and password. Click Apply.

3. When prompted to backup the symmetric key, type a password and file name for the symmetric key backup, and click OK.

1. Create a new domain user account by using the Active Directory Users and Computers tool in Control Panel. Give the account a descriptive name. Clear the User must change password at next logon option and select Password never expires. Assign a strong password for the account. Strong passwords should include at least seven characters and have a mixture of uppercase and lowercase letters, numbers, and other characters such as *, ?, or $.

2. Assign ASP.NET permissions to the new account by running the following command from a command window:

   aspnet_regiis -ga DomainName\AccountName

3. Start IIS Manager.

4. In Application Pools, right-click Report Server and click Properties.

5. Click Identity.

6. Enter the domain user account.

7. Start the Reporting Services Configuration tool and connect to the report server.

8. Open the Web Service Identity page to select the application pool you just configured.

9. Click Apply.

If the network is configured for Kerberos authentication, the domain administrator might need to create a Service Principal Name (SPN) that registers the domain account for the Web site. Otherwise, you might encounter HTTP 401 access denied errors. Be sure that the domain account that you register is the same one used for the application pool. For more information, see Configuring Constrained Delegation for Kerberos (IIS 6.0) on the Microsoft TechNet Web site.

1. Create a new domain user account by using the Active Directory Users and Computers tool in Control Panel. Give the account a descriptive name. Clear the User must change password at next logon options and select Password never expires. Assign a strong password for the account. Strong passwords should include at least seven characters and have a mixture of uppercase and lowercase letters, numbers, and other characters such as *, ?, or $.

2. Store an encrypted copy of the user account and password in the registry. In a subsequent step, you will reference this registry entry in Machine.config file.

   1. Download the aspnet_setreg.exe utility from How to use the ASP NET utility to encrypt credentials and session state connection strings on www.support.microsoft.com.
      
   2. Run the following command from the command line, replacing the domain, user name, and password with values that are valid for the account you created in step 1.
      

      	Copy Code
      aspnet_setreg -k:Software\MyASPNetApp\Identity -u:"domainname\username" -p:"password"

3. Open Machine.config using Microsoft Visual Studio or Notepad. Machine.config is located in the following folder: C:\WINNT\Microsoft.NET\Framework\v1.1.4322\CONFIG. Modify the configuration file to reference the registry key you just created by typing the following:

   1. Find the <identity impersonate="false" userName="" password=""/> element.
      
   2. Replace it with the following entries:
      

      	Copy Code
      <identity impersonate="true" userName="registry:HKLM\Software\MyASPNetApp\Identity\ASPNET_SETREG,userName" password="registry:HKLM\Software\MyASPNetApp\Identity\ASPNET_SETREG,password"/>

4. Run the Registry Editor to grant Read permissions to the account:

   1. Browse to My Computer/HKEY_LOCAL_MACHINE/SOFTWARE/MyASPNetApp/Identity/ASPNET_SETREG
      
   2. Right-click ASPNET_SETREG and click Permissions.
      
   3. Click Add.
      
   4. Enter the user account you created in step 1 and click OK.
      
   5. Select the account, click Full Control and click OK.
      

5. Assign file permissions to the ASP.NET temporary files folder:

   1. Browse to 'C:\WINNT\Microsoft.NET\Framework\V1.0.4322\Temporary ASP.NET Files'.
      
   2. Right-click Temporary ASP.NET Files, click Properties.
      
   3. Click Security, click Add, enter the account, and then select the account so that you can specify permissions on it.
      
   4. Click Write, and click OK.
      

6. Add the account to the report server Windows security groups:

   1. Point to Start, point to Administrator Tools, and click Computer Management.
      
   2. Open Local Users and Groups and select Groups.
      
   3. Right-click SQLServer2005ReportingServicesWebServiceUser$<computer_name>$<instance_name>.
      
   4. Click Add to group.
      
   5. Click Add.
      
   6. Enter the account and click OK.
      

   Note:
   Many of the steps in this procedure are from "Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication" on MSDN. For more information about the steps, search for that document on MSDN. For more information about how to use the aspnet_setreg.exe utility, see How to use the ASP on www.support.microsoft.com.

Tasks

Reference

Concepts