Last updated on December 29th, 2023 at 12:51 pm
When I originally wrote this topic, it was included within another blog. This made the original post long and this section buried within the blog, which made it hard to find. But over the years I have to reference this one section and as such it make sense to make it a stand-alone topic to help out Configuration Manage (CM / ConfigMgr / SCCM) admin with Role Base Administration (RBA also called BRAC). Since I’m updating the set to add more details and to add videos to each topic. I thought that I would break this out into its own topic. Not only for the to help with migration for HTTP to HTTPS for Power BI Report server (PBRS) or SQL Server Reporting Services (SSRS) but for other reasons such as the problems that I see when people (in Reddit) use the virtual service account. This article will cover How to Configure PBRS To Network Service Account.
To make it clear this blog applies to blog SQL Server Reporting Service (SSRS) or Power BI Report Server (PBRS), the steps are the same. In the video, you will see that I’m using PBRS.
Why Change from Virtual Service Account?
This is great question, when ConfigMgr first came out with RBA back in the SSCM 2012 R2 days. If the SSRS service account was using the Virtual Service, in many cases the built-in reports would fail due to a logon issue error. This of course didn’t make sense. However, if you change SSRS to use the Network Service the Built in ConfigMgr reports worked. In hided sight this was likely due to the account not having account to User objects in AD e.g. solved by adding the account to Windows Authorization Access Group. RBA for ConfigMgr reporting required access to the user’s Token to compare User SIDs and Group SIDs to ConfigMgr access.
While reviewing and updating the whole Certificate blog set for Power BI Report Server and testing again with the Virtual account. The reports work correctly with the Virtual Service account. This maybe do the changes Microsoft has made to the virtual account or to my environment not being locked down as much. Either way at this time this is an option change to either PBRS or SSRS. All of this is to say if you find your ConfigMgr built-in report failing with a logon issue. Try changing to the Network Service account. The error will look similar to the following:
The Default Value expression for the report parameter ‘UserTokenSIDs’ contains an error: The specified directory service attribute or value does not exist.
HOW TO CONFIGURE PBRS TO USE NETWORK Service ACCOUNT
Open Report Server Configuration Manager. On the Report Server Configuration Connection window, click on the Connect button.
Back on the Report Server Configuration Manager window, select Service Account.
Set the account to Network Service.
NOTE: If the Report Server Service Account is already listed as the Network Service, you do not need to complete the remainder of the steps in this blog.
Once the account is set to Network Service, click Apply.
Click on the “…” button.
Give the encryption key a name and save the file to your desktop. Click on the Save button to continue.
Enter and confirm the password before clicking on the OK button.
NOTE: This password must be complex.
Notice in the results section that the encryption key was backed up. Also, notice that the SQL Server Connection Dialog window pops-up. Click OK to continue.
Wait for the results to complete (about a minute).
With that last step done, you have change PBRS to leverage the Network service account. This will help with any RBA issue that you might see with ConfigMgr and PBRS or SSRS. Again, remember this is an optional step.
The video shows the step-by-step process that I took for configurating PBRS to use the network service account.
Finally, don’t forget that you can subscribe to my YouTube channel and newsletter to stay on top of the latest trips and tricks. Additionally, if you have any questions, please feel free to touch base @Garthmj.