Power BI Report Server on Prem and BUILTIN\administrators rights issue

[Vosaxalo]

Hi,

we have a new installation of the Power BI Report Server (October 2017) on Windows 2016 Server.

As expected, by default in the security settings of the web portal, there is the group BUILTIN\administrators that has the following roles assigned:

• Site level: System Administrator
• Items level: Content Manager

During the installation this is ok, but afterward the administrators have no reason to access the content on the web portal.

So, I thought that all I had to do was to add another user with the same roles, and then delete the group BUILTIN\administrators from the security. I have done so, but the problem is that a user with administrator rights on the server can still access the web portal content, and can still manage the security. In other words, even if I have denied all the rights to this group, one of these users can still manage to give itself all the permissions.

I don't know if we are missing something, or if the SSRS's security engine, that is used on the Power BI Report Server, has this behavior. If the latter is correct, why the administrator are allowed anyway to access the web portal? How can we manage this situation and be able to deny the access also to the administrators?

Thanks for any help or idea.

[v-qiuyu-msft]

Hi @Vosaxalo,

I have confirmed internally that local admins always have permission, regardless of whether they're explicitly granted permission.

And we can't remove permission for local administrators to access report server. We can delete the explicit role assignment, but they always have implicit permission.

Best Regards,
Qiuyun Yu

[Vosaxalo]

Hi @v-qiuyu-msft,

thank you for the confirmation.

So, if I understand correctly, I have to find a solution "outside" the Report Server platform. I don't know how all around the world other people deal with this situation, but I believe that I'm not the only one that want to deny the access to the web portal to the administrators.

Thank you anyway for your support.

Best Regards

[v-qiuyu-msft]

Hi @Vosaxalo,

I can reproduce the issue on my side. Already sent a email to consult this issue internally, will update here once I get any information. 

Best Regards,
Qiuyun Yu 

[Anonymous]

@v-qiuyu-msft  I am listed as a System Admin in PBRS portal under site setting but not able to manage site. I was part of local admin group but they removed me from that after installation. Do you know the reason?