First off, allow me to state that I am not a SQL Server DBA; I'm a server administrator. I have only a basic understanding of SQL and while I can wander around in SSMS, you probably don't want me administering your databases. Conversely, I’m very comfortable with Windows servers and networking.
At any rate, I have found myself frustrated when trying to work with DBA (using the term loosely) who is configuring SSRS. He is insisting that a service account be a member of the local administrators group, or else things (reports) won't run. I feel this is a case of Lazy Administrator Syndrome in addition to a violation of general "least privilege” practices.
I’ve taken a look at the Reporting Services configuration and have noticed there are three locations where account information is provided:
- Under the “Service Account” option. This appears to be the location where you set Reporting Services service to run under “System” or named credentials. It is currently set to “System”.
- Under the “Database” option, under “Current Report Server Database Credential”. Currently, the service account credentials – which is a member of the local Administrators group – is being used here.
- Under the “Execution Account” option. This value is currently not set.
I’ve been poking around the various documentation found in TechNet and the like, but I feel like I’m searching for a needle in a haystack. I’m hoping that by posing this question to persons much smarter than I, I’ll be able to more quickly resolve this issue.
My question is simple: What needs to be done in order to get this service account removed from the local Administrators group, but still maintain functionality?
I realize that this may be a much bigger answer than what an online forum can facilitate, so if there is some document that I’ve missed which explains the “right” way to do this, please feel free to point me in that direction.
Thanks in advance for everyone’s time!
-Todd