Forum Discussion
how to disable ANONYMOUS LOGON
We have PowerBi Report Server installed on a VM which is on the domain.
All functionality with logon and permissions works fine.
However when logging on to the server if no credentials are specified and the signin button is clicked it allows the user to logon as NT AUTHORITY\ANONYMOUS LOGON though with no access to any of the reports.
Is there any way to disable this user logon ?
Ok, so if you have Windows auth setup, but you only allow a subset of your users to access the home folder in PBIRS any other users will see the following browser prompt, this is a standard browser response to a 401 (access denied) challenge
If I access my dev server using an inprivate window I get the prompt above. And if I then do as you suggest and click signin without entering any credentials it gives me the same message you see:
‘Could not load folder contents
You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions.'But this has not logged me in as anonymous or given me access to any reports or folders. It comes up with the error in a modal dialog which cannot be dismissed. And if you check the networking tab in the browser tools all the requests for report content return 403 (forbidden) errors.
So this is really just a custom access denied page - it's not actually logging in the anonymous user or giving them access to anything. I don't believe there is any way to change this - you'd probably have to raise a support ticket with Microsoft to get an engineer to look into this.
The way we prevent this from happening at my work is that we have added the "Domain Users" group with browser permissions to the home folder. Then we put all our reports under one of the top level folders and all security is controlled on the top level folders. So anyone without access to any reports just sees an empty page and no one ever gets prompted for credentials.
3 Replies
By default Power BI Report Server installs with integrated Windows authentication - so there is no signin in button or prompt for credentials, it uses your current windows login. And nobody has access except the local server admins and it's up to the admins to grant access to users or groups.
So the answer to how to disable this depends on how you granted access to it in the first place. What settings have you changed to trigger the login prompt? Have you switched on basic auth or configured a custom authentication extension? Have you checked the permissions on the home folder to make sure they don't include the anonymous login or the "everyone" group?
Authentication is through windows authentication, so as the report server is in the domain, authentication is by domain joined users who have been allowed in powerbi.
We have permissions setup with domain groups and it works fine, there is no access to anonymous users throughout the setup. Windows anonymous access is also blocked by default and I have checked secpol and registry to make sure.
However PowerBi is allowing anonymous users in, which happens if no credentials are entered in the signin box and the signin button is clicked. Once the button is clicked I can see the user name in the top right hand corner says NT AUTHORITY\ANONYMOUS LOGON and a message comes up saying‘Could not load folder contents
You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions.'This is something that’s against our company standards hence the ask if it can be disabled and how
Ok, so if you have Windows auth setup, but you only allow a subset of your users to access the home folder in PBIRS any other users will see the following browser prompt, this is a standard browser response to a 401 (access denied) challenge
If I access my dev server using an inprivate window I get the prompt above. And if I then do as you suggest and click signin without entering any credentials it gives me the same message you see:
‘Could not load folder contents
You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions.'But this has not logged me in as anonymous or given me access to any reports or folders. It comes up with the error in a modal dialog which cannot be dismissed. And if you check the networking tab in the browser tools all the requests for report content return 403 (forbidden) errors.
So this is really just a custom access denied page - it's not actually logging in the anonymous user or giving them access to anything. I don't believe there is any way to change this - you'd probably have to raise a support ticket with Microsoft to get an engineer to look into this.
The way we prevent this from happening at my work is that we have added the "Domain Users" group with browser permissions to the home folder. Then we put all our reports under one of the top level folders and all security is controlled on the top level folders. So anyone without access to any reports just sees an empty page and no one ever gets prompted for credentials.
