Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

The ultimate Microsoft Fabric, Power BI, Azure AI & SQL learning event! Join us in Las Vegas from March 26-28, 2024. Use code MSCUST for a $100 discount. Register Now

Reply
Vosaxalo
Frequent Visitor

Power BI Report Server on Prem and BUILTIN\administrators rights issue

Hi,

we have a new installation of the Power BI Report Server (October 2017) on Windows 2016 Server.

As expected, by default in the security settings of the web portal, there is the group BUILTIN\administrators that has the following roles assigned:

  • Site level: System Administrator
  • Items level: Content Manager

During the installation this is ok, but afterward the administrators have no reason to access the content on the web portal.

So, I thought that all I had to do was to add another user with the same roles, and then delete the group BUILTIN\administrators from the security. I have done so, but the problem is that a user with administrator rights on the server can still access the web portal content, and can still manage the security. In other words, even if I have denied all the rights to this group, one of these users can still manage to give itself all the permissions.

I don't know if we are missing something, or if the SSRS's security engine, that is used on the Power BI Report Server, has this behavior. If the latter is correct, why the administrator are allowed anyway to access the web portal? How can we manage this situation and be able to deny the access also to the administrators?

 

Thanks for any help or idea.

4 REPLIES 4
v-qiuyu-msft
Community Support
Community Support

Hi @Vosaxalo,

 

I have confirmed internally that local admins always have permission, regardless of whether they're explicitly granted permission.

 

And we can't remove permission for local administrators to access report server. We can delete the explicit role assignment, but they always have implicit permission.

 

Best Regards,
Qiuyun Yu

Community Support Team _ Qiuyun Yu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Hi @v-qiuyu-msft,

 

thank you for the confirmation.

So, if I understand correctly, I have to find a solution "outside" the Report Server platform. I don't know how all around the world other people deal with this situation, but I believe that I'm not the only one that want to deny the access to the web portal to the administrators.

 

Thank you anyway for your support.

 

Best Regards

 

 

v-qiuyu-msft
Community Support
Community Support

Hi @Vosaxalo,

 

I can reproduce the issue on my side. Already sent a email to consult this issue internally, will update here once I get any information. 

 

Best Regards,
Qiuyun Yu 

Community Support Team _ Qiuyun Yu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

@v-qiuyu-msft  I am listed as a System Admin in PBRS portal under site setting but not able to manage site. I was part of local admin group but they removed me from that after installation. Do you know the reason?

Helpful resources

Announcements
Fabric Community Conference

Microsoft Fabric Community Conference

Join us at our first-ever Microsoft Fabric Community Conference, March 26-28, 2024 in Las Vegas with 100+ sessions by community experts and Microsoft engineering.

Fabric Career Hub

Microsoft Fabric Career Hub

Explore career paths and learn resources in Fabric.

Fabric Partner Community

Microsoft Fabric Partner Community

Engage with the Fabric engineering team, hear of product updates, business opportunities, and resources in the Fabric Partner Community.

Power BI Header Change

Power BI Header Update

Read about the exciting updates for the Power BI forum.