Reporting services on another machine

The database server doesn't have to be running on the same server as the CRM application itself. If you follow the installation guide, then everything should work fine. But... Avanade has done this for several clients and sometimes it appears that the reporting might not work. The error message will be:

“An error has occurred. For more information, contact your system administrator”
"error 401 – Unauthorized access"

If this is the case in your situation as well, then take a look at the following steps.

First you have to enable Kerberos Authentication for IIS on the CRM Server.
- Open a DOS box and browse to c:\inetpub\adminscripts
- Run the command: cscript adsutil.vbs set w3svc/1/NTAuthenticationProviders "Negotiate,NTLM" (If only one website is running you can use 1 in the commandline. Otherwise you have to check the logfile directory to see what number you should use)

If your services run with the "network service" account you have to open ADSIEDIT and open the propeties of the CRM server. Go to SPN settings and add the next lines:
(Computername is your CRM server and FQDN is your Fully Qualified Domain Name)


You have to do a similar action on the SQL Server, the default instance uses port 1433

Finally, on the client computer check if in Internet Explorer "Integrated Windows Authentication" is activated (under the advanced settings of the internet options)

Hope this helps you to get reporting to work as well!


Anonymous said...

I have this problem, but I have installed the CRM Server and the Reporting Services with the Administrator Account.
I try to log in as Administrator and get the same error (Unauthorized) like under another user.

Ronald Lemmen said...


The account which you have used to install CRM should still have access to CRM. Did you remove the roles for this user?
Did this admin user have access to reports before? Have you moved the reporting server afterwards or while installing?

Mike said...

I have 4 web sites running on the CRM server. I've looked in the LogFiles directory and see 4 separate log folders. I've narrowed down the choices to 2 of them, one being the log files for the ReportServer, the other being the log files for the MSCRMService. Which web site needs to have kerberos enabled?

Mike Abrahamson