EV Reporting Configuration validation error

[Fremont]

Hi,

We have an sql 2008 R2 clustered server with SSRS dedicated for EV10.  I installed the EV Reporting module on it without errors.  When I try to configure reporting for the first time, I get:

Validation Error: Authentication failed for reporting user.

I am logged in with the VSA and have tried both the VSA as well as the specially created reporting user account with the same result.  I have also tried specifying the FQDN for domain name, but no change.

Anyone have any ideas how to troubleshoot?  Can we turn on any logging?

Thanks,

Fremont

[AndrewB]

i remember this coming up before and the issue was that SRS is not supported in a cluster

[Fremont]

That would be a bummer. 

I do not see any place in the documentation about SSRS not being supported on sql cluster for EV (the only mention is about FSA reporting proxy server).  We are not doing FSA.  This is purely EV exchange archiving.

I am seeing the following error in the EVDeployReports.log:

[2012/03/20 05:15:57:259] Error:Failed to logon user 'domain\vsa' with provided credentials. Please check domain name, user name and password.
[2012/03/20 05:15:57:259] Error Description:Logon failure: the user has not been granted the requested logon type at this computer. (Exception from HRESULT: 0x80070569)

 Weird thing is I am logged in to the sql/ssrs server with the vsa and vsa is in the local admin group.  It is also sysadmin.  So not sure what the complaint is about.

[ManishN]

Can we turn on any logging? 

Comment: You can turn on logging by opening command prompt on Reporting server and access the enterprise vault directory and set dtrace on mmc and w3wp.

[AndrewB]

so the question is how did you install it? did you do a seperate install on each node or are you trying to cluster it as a resource?

[ManishN · Accepted solution]

Exception from HRESULT: 0x80070569 -- seems some security policy issue

[Fremont]

It's a 3 node cluster: node 1 (default) for ev, node 2 for ca and node 3 for da, all active. 

The dba said ssrs is not cluster aware and set up 3 instances of ssrs, one on each node, all pointing to the same report db on node 1 so the db would fail over. 

We installed the ca and da reports successfully on their respective ssrs nodes. 

I installed ev reporting module on node 1 and am trying to configure it there.

Not sure if I should also insall it on nodes 2 and 3.

Regarding runnign dtrace, I did that, but the configuration procedure is not returning any traces.

[TonySterling]

are you trying to use the VSA to config the reports or did you create a generic user as recommended?

In the Active Directory domain, create a Windows user account named, say, "ReportingUser", for Enterprise Vault Reporting to use when accessing the Enterprise Vault databases. This reporting user account does not require a mailbox, and it need not be a member of the Windows Administrators group.

[Fremont]

I've tried both.  Both giving same result.  Will be checking GPO with the AD admin as ManishN had suggested above.   0x80070569 seems to be pointing to it.  Wondering if there are any specific GPOs that are preventing authentication, even though I am logged in with the vsa as required.

Will update after that.

Thanks

[Fremont]

Manish, you were right on!  There is a GPO preventing the following:

• deny logon as a batch job
• deny logon as a service
• deny logon locally

I will mark your answer as the solution once we get the GPO repealed and tested.

I am assuming the issue is with the first one, as the reporting account would probably need to log on as a batch job.

Does anyone know if I also need to give it log as a service and log on locally?

Thanks

[Fremont]

We got the GPO exception.  I also created an sql login for the evreporting account and gave it sysadmin role.  I also added it to the local admin group on the ssrs server.  Configuration finished without a hitch,

Thanks everyone.

Fremont