Granting full access rights to archiving reports

Hi,
During Monitoring Reports deployment, I've unintentionally granted ReadOnly permission to user administrator. Now I access to https://servername/reports and only view directories. I don't have any buttons, such as "new folder" or "new data
source". I tried to rerun Monitoring Reports deployment - no result. In SQL management console for administrator user I unchecked ReportsReadOnlyRole for databases where this role exists. And also granted administrator user dbowner for all databases -
no result.

Hi,
Is there any update on the issue?
If the issue persists, you can also post the issue on SQL Reporting Services forum as the issue is also related to SQL Report Server permission issue. Thank you for your understanding.
http://social.technet.microsoft.com/Forums/sqlserver/en-US/home?category=sqlserver
Kent Huang
TechNet Community Support

Similar Messages

Grant the access rights to manager run the work flow history report without edit /delete rights

I found that only Team Member / Workspace creator / Administrator can run
the work flow history report. However, we have a Purchase Order request
which need ask the supervisor for 1st approval and manager for 2nd approval.
But those managers want to see who prepare the P.O. and supervisor done the
first approval before their 2nd approval. How can I can grant the access
right to the manager to run the work flow history report for this purpose? I
tried grant the role "team member" to those manager, however, it will also
allow them to modify or delete the entry as they are the team member, but we
only want allow those managers can approve the entry and view the work flow
history without other acces such as add/delete/edit to prevent the human
mistake.
Pls advise how can I do this? Thanks!
Regards

Create a new role in teaming can fulfill this requirement. Thanks!
"Joey" wrote in message news:_Cvqo.66903$[email protected]. .
I found that only Team Member / Workspace creator / Administrator can run
the work flow history report. However, we have a Purchase Order request
which need ask the supervisor for 1st approval and manager for 2nd approval.
But those managers want to see who prepare the P.O. and supervisor done the
first approval before their 2nd approval. How can I can grant the access
right to the manager to run the work flow history report for this purpose? I
tried grant the role "team member" to those manager, however, it will also
allow them to modify or delete the entry as they are the team member, but we
only want allow those managers can approve the entry and view the work flow
history without other acces such as add/delete/edit to prevent the human
mistake.
Pls advise how can I do this? Thanks!
Regards

Unable to grant full access permission

I am trying to grant full access permissions for one user to another users mailbox when I right click on the user the command does not appear to allow this. I have tried using the Add-MailboxPermission CMdlet but this is not recognised either.
My exchange knowledge is relatively limited so it may be something simple, but I would appreciate any assistance.
best regards
James

Turns out someone had saved the wrong credentials in the RDP connection and I was logging in as the wrong user.

Granting/Revoke Access Rights

I have a desktop application which is more of a db management thing. I have different user roles accessing it. Two roles that i am using are as follows:-
NOVICE
ADMIN
Till now, ive implemented:
adding new users,
Logging in for existing users
Ive done this by storing data about users in a table as follows::
NAME
PASSWORD
TYPE ie ADMIN / NOVICE
Now i want to add another functionality. Granting/revoking access rights and priviledges to users. I think a new person,who wants to add himself as ADMIN or NOVICE, would be allowed to do so only if he requests for such a role and is accepted by a SUPER user. This was a thought that came to my mind. Pls guide me in the right direction.
Thanks
Dexter

It's hard to interpret what you're trying to do. However I set up such an access control system recently which might point you in the right direction.
Basically there are three tables. One is a table of users (for efficiently most of these tables have "synthetic keys", unique numeric identifiers for references). In this would probably be the user's name and, perhaps, e-mail address etc.., And a digest of the username and password combined. You don't store the actual password text for security reasons (see MessageDigest class).
The second principal table is a list of roles or actions that are protected, each with a name and description.
Permissions are granted in a third table which is an intersection table between users and roles, each row granting one role to one user (can contain further constraints).
One of these roles is, of course, the ability to grant roles. A user with that permission can grant or revoke a role for another user (or some subset of other users) providiing they have the permission itself.
In the java program you can create a class which extends java.security.Permission, when the user logs in, store them in a PermissionCollection. Then you use the "implies" method when you want to test if the current user has a given permission.
Hope this is something to do with what you're trying to do.

Previous Exchange Admin has somehow granted himself inherited Full access rights to All Exchange Mailboxes -AccessRights -InheritanceType

Good Day,
There is a previous employee that was a Systems Admin and somehow he granted himself access to Every Mailbox item at one point in time and the cleanup has been a bit messy.
When this user is listed as "Full Access Granted" in the Manage Full Access Permissions function, and I delete him, I get a confirmation that he was removed, but then an additional item below it. (This is depicted in the attached photo)
How do I remove the hierarchical inheritance of this user?
the commands in the photo show:
Remove-Mailboxpermission -identity %OU String% -user %user% -inheritancetype 'All' -Accessrights 'FullAccess'
Add-Mailboxpermission -identity %OU String% -user %user% -Deny -Accessrights 'FullAccess'

Hello,
I have removed permission to this user in ADSI Edit Microsoft Exchange Configuration CN and ensured that his name was no where to be found in the ADSI permissions for Exchange. I was running the following command:
Get-Mailbox | Remove-MailboxPermission -User %USER% -AccessRights FullAccess,SendAs,Exter
nalAccount,DeleteItem,ReadPermission,ChangePermission,ChangeOwner -InheritanceType All
and I get a return warning:
WARNING: An inherited access control entry has been specified: [Rights: CreateChild, Delete, ReadControl, WriteDacl,
WriteOwner, ControlType: Allow]
and was ignored on object "CN=%FullAccessUser%"
How can I ensure that this user had NO permissions at all to the exchange mailboxes?

Grant full access object in database

Hi Experts,
I try use sysdba account to grant full object access right to a user. But I got error as
SQL> declare
2 I number;
3 begin
4 FOR I IN (SELECT TABLE_NAME FROM DBA_tables)
5 LOOP
6 EXECUTE IMMEDIATE 'GRANT SELECT ON ' || I.TABLE_NAME || ' TO allselectl';
7 END LOOP;
8 end;
9 /
declare
ERROR at line 1:
ORA-00911: invalid character
ORA-06512: at line 6
I try to user a DBA account (also as a schema owner_ I got error as
SQL> declare
2 I number;
3 begin
4 FOR I IN (SELECT * FROM ALL_tables)
5 LOOP
6 EXECUTE IMMEDIATE 'GRANT SELECT ON ' || I.table_name || ' TO allselect';
7 END LOOP;
8 end;
9 /
declare
ERROR at line 1:
ORA-00942: table or view does not exist
ORA-06512: at line 6
Here allselect is a role that created by dba account.
Could you help me to do this job?
I use oracle 10gR4 in 32 bit window2003
Thanks
JIM
Edited by: user589812 on Jun 2, 2009 8:31 AM

Hi Justine,
Thanks for your help.
It works and get below error.
Error executing grant select on "SYS"."SYS_IOT_OVER_4478" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_4484" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_4488" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_5082" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_5168" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_8691" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_8801" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_9694" TO allselect
Error executing grant select on "WMSYS"."SYS_IOT_OVER_10101" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_40414" TO allselect
Error executing grant select on "CTXSYS"."SYS_IOT_OVER_40888" TO allselect
Error executing grant select on "CTXSYS"."SYS_IOT_OVER_40933" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42452" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42459" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42466" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42469" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42488" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42491" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42494" TO allselect
Error executing grant select on "EXFSYS"."SYS_IOT_OVER_42497" TO allselect
Error executing grant select on "SYSMAN"."SYS_IOT_OVER_153360" TO allselect
Error executing grant select on "SYSMAN"."SYS_IOT_OVER_153363" TO allselect
Error executing grant select on "SYSMAN"."SYS_IOT_OVER_153258" TO allselect
Error executing grant select on "STRMADMIN"."SYS_IOT_OVER_167992" TO allselect
Error executing grant select on "STRMADMIN"."SYS_IOT_OVER_168042" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_60551" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_57132" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_147443" TO allselect
Error executing grant select on "SYS"."SYS_IOT_OVER_147585" TO allselect
how about to access all of other objects in database?
Thanks
JIM

Access Rights Assignment per Report/Layout

Dear SAP Experts,
Could you give me a hint where access rights for reports (smartforms or sapscript) are assigned?
To give more requirement, what if we want to be more specific such that for example, we have 2 companies which are using the same report (e.g. Invoice), but we want to assign a different layout for each company automatically (depends on the company code of the invoice)? Is this "customizable" or should be programmed?
Your advice is highly appreciated.

Hello,
This will be the customized one, create an authorization object like ZXYZ in SU21, and now inform the basis guys to assign the auth object to the required profiles, no win the report program i.e. the print program use Authority-check syntax. If the sy-subrc = then get the one layout or else another layout.

Granting full access and Mailbox Caching

Hi!
We have a Microsoft Server 2008 R2 (terminal server) with Office 2013. The mailboxes are hosted by Microsoft Online. If a user creates a Outlook profile everything goes well. I
even have a policy set up that forces to Cache one month to speed things up.
Now when I give this person 'full access to a colleges mailbox it appears (magically) on its own which is perfect yes? However it starts caching the entire mailbox from that college
and not just a month. What Group Policy should I set? Or should I do this differently.
The only Group Policies which I have set (for Outlook that is) are:
Cached Exchange Mode Sync Settings (1 month)
Use Cached Exchange mode for new and existing Outlook profiles. (enable)

Thank you for sharing your solution and experience here. Have a good time.
Tony Chen
TechNet Community Support

I'm unable to grant full access to 2nd user account. What am I missing

While our MacBook Pro is out for repairs, I need a way to process my wife's emails and other business. So I'm trying to set up a 2nd user account for my wife on our iMac (running 10.7.5 Lion). Unfortunately, every step I've tried has failed to grant permission for her account to access the iMac desktop or launch applications other than Safari.
Here's what I've tried:
1. I created an account with my wife's name and password under Users & Groups in System Preferences.
2. In her Users & Groups account, I granted her Adminstrator privileges.
3. In the Sharing folder in System Preferences, I selected all the folders except those labeled "remote" and "xgrid" (whatever that is). I granted Read & Write privileges for each one. These included two Desktop folders, and I added the folder for Applications.
4. I made sure File Sharing was turned on, along with Printer Sharing, Web Sharing, Screen Sharing, Internet Sharing, etc.
5. Under Sharing Options, I noted a checkmark in the box labeled "Share files and folders using AFP", although the "number of users connected" was 0. I left that alone.
6. Because several sharing choices were listed as "blocked by firewall," I turned the Firewall setting off.
Despite all this, when I log in as my wife, I cannot launch any major applications except Safari, whether from the Dock or Applications folder. In fact, most of the apps in the folder are grayed out. And when I try to access the Desktop, Other Files, and various other folders, I receive a message that her account "does not have permission to see the contents." Why not? What have I overlooked?
This is becoming an urgent problem, because there's business that must be conducted. I have had similar problems with the iMac from the start, when it refused to accept me as the rightful owner of files that were transferred from our older Mac Pro dwesktop. Yikes!
Any help on this will be very much appreciated. Thanks.
Message was edited by: David Henderson7

Hey thomashfrompa,
Thanks for the question. I understand that you are experiencing issues with iTunes for Windows. The following article outlines the error message you are receiving and a potential resolution:
iTunes 11.1.4 for Windows: Unable to install or open
http://support.apple.com/kb/TS5376
Some Windows customers may experience installation issues while trying to install or open iTunes 11.1.4.
Symptoms may include:
"The program can't start because MSVCR80.dll is missing from your computer"
"iTunes was not installed correctly. Please reinstall iTunes. Error 7 (Windows Error 126)”
"Runtime Error: R6034 - An application has made an attempt to load the C runtime library incorrectly"
"Entry point not found: videoTracks@QTMovie@@QBE?AV?$Vector@V?$RefPtr@VQTTrack@@@***@@$0A@VCrashOnOverf low@@***@@XZ could not be located in the dynamic link library C:\Program Files(x86)\Common Files\Apple\Apple Application Support\WebKit.dll”
Resolution
Follow these steps to resolve the issue:
Check for .dll files
1. Go to C:\Program Files (x86)\iTunes and C:\Program Files\iTunes and look for .dll files.
2. If you find QTMovie.DLL, or any other .dll files, move them to the desktop.
3. Reboot your computer.
Note: Depending on your operating system, you may only have one of the listed paths.
Uninstall and reinstall iTunes
1. Uninstall iTunes and all of its related components.
2. Reboot your computer. If you can't uninstall a piece of Apple software, try using the Microsoft Program Install and Uninstall Utility.
3. Re-download and reinstall iTunes 11.1.4.
Thanks,
Matt M.

Script Grant Full Access Permission on Multiple Folders and Sub-Folders

Hi, I'm having a issue trying to run this script.
1.)It provides each folder with "Special" Permission over them. (Read, Write, Modify, Full control). Is there a way of making it "Full Control" Permission instead of special permission?
or
2.) Is there a way to make the Object Apply to "This Folder,sub folders and files" (when i change it manually this it changes to Full Control Access)?
What I tried doing in the following script is removing the inheritance of the folder then applying its level of authentication. I do get some errors and I'm pretty sure it's has to do with some files being password protected.
$domainG = "Domain\Group"
$dir = "X:\Folder\Folder\*\SameName"
$subfolder = Join-Path $dir "\*"
$subsubfolder = Join-Path $subfolder "\*"
$subsubsubfolder = Join-Path $subsubfolder "\*"
$subsubsubsubfolder = Join-Path $subsubsubfolder "\*"
$acl = Get-Item $dir |get-acl
#This removes inheritance
$acl.SetAccessRuleProtection($true,$true)
$acl |Set-Acl
# Gives full control
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($domainG,"FullControl","Allow")
$acl.SetAccessRule($rule)
$acl |Set-Acl
$acl = Get-Item $subfolder |Get-Acl
# This adds full control to the subfolder
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($domainG,"FullControl","Allow")
$acl.SetAccessRule($rule)
$acl |Set-Acl
$acl = Get-Item $subsubfolder |Get-Acl
# This adds full control to the sub sub folder
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($domainG,"FullControl","Allow")
$acl.SetAccessRule($rule)
$acl |Set-Acl
$acl = Get-Item $subsubsubfolder |Get-Acl
# This adds full control to the sub sub subfolder
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($domainG,"FullControl","Allow")
$acl.SetAccessRule($rule)
$acl |Set-Acl
$acl = Get-Item $subsubsubsubfolder |Get-Acl
# This adds full control to the sub sub sub subfolder
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($domainG,"FullControl","Allow")
$acl.SetAccessRule($rule)
$acl |Set-Acl

The constructor you are using for the FileSystemAccessRule will only apply to the object the ACE belongs to. To have it apply to anything else, you'll have to use the constructor with the following arguments:
<Principal>, <Rights>, <InheritanceFlags>, <PropagationFlags>, <Type>
The one you're using doesn't have the flags. Those two flags enumerations control two things that you'll see in the GUI: 'Applies To' and 'Only Applies to this Object'. To have the ACE apply to the folder, subfolders and files (and have it not show as 'Special'
in the GUI), you'll want the InheritanceFlags as 'ContainerInherit, ObjectInherit' and the PropagationFlags as 'None'. Try this:
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule -ArgumentList @($domainG,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
On a side note, check
this module out. It greatly simplifies access control. If you're interested in it and have any questions, let me know.

Need rights to archive mailboxes of users who leave the company.

need rights to archive mailboxes of users who leave the company. Can anyone tell me to which group should I get added so that I can have permissions to archive mailbox ?
Regards, h9ck3r.

Hi,
Here is a duplicate thread:
https://social.technet.microsoft.com/Forums/en-US/383b75df-907d-4a86-8e62-86b2a4b00fb7/how-to-provide-an-exchange-user-permission-for-mailbox-archieve-?forum=exchangesvradmin
If you want to access other's archive mailbox, you need to grant full access permissions to user primary mailbox first, then you can see personal archive from Outlook side.
Best regards,
Belinda Ma
TechNet Community Support

Full access permissions and calendars

Quick question...in Exchange 2007 if you grant full access permissions on a mailbox, does it also give full owner rights to the calendar as well?
So if User A has full access permissions to User B's mailbox, do they also get Owner permissions on the calendar of User B?

Hi,
When you grant the Full Access permission to another user for a mailbox, that user becomes able to log on to the mailbox and access its entire contents. This includes calendar as well.
Grant Full Access permission is different from applying the Owner role to a folder. For more details, you can refer to the following articles.
Add-MailboxPermission:http://technet.microsoft.com/en-us/library/bb124097(v=exchg.150).aspx
Add-MailboxFolderPermission:http://technet.microsoft.com/en-us/library/dd298062(EXCHG.140).aspx
Best regards,
Belinda
Belinda Ma
TechNet Community Support

How to define a new user in Enterprise manager with Specific access rights?

Hi,
I want to create a new user in OEMS 11g who should be able to access only the scheduler jobs section.
How can this be acheived?

You can create new administrators via the Setup --> Administrators page
You can grant certain access rights to targets, you can not however grant priv to only access the job system
Take a look at http://download.oracle.com/docs/cd/E11857_01/em.111/e14586/security3.htm#sthref235
Regards
Rob
http://oemgc.wordpress.com

Access rights in case of a tree-like structure, with inheritance

Hello,
the project I've just started to work on should include an easy way (from the user's point of view) to grant/revoke access rights on a tree-like structure with inheritance.
Basically we are working for several international companies who want to use our application to watch/manage some of their web projects - each project belongs to one company and consisting of several 'campaigns' in several countries (there can be several campaigns per country, but each campaign belongs to exactly one country).
From our point of view this is a tree-like structure, with a 'root' node at the top level, 'companies' at the first level, 'countries' at the second level, 'campaigns' at the third level, and modules of our application (for example a module to display overall stats of the campaing, and so on) at the fourth level. There could be (and probably will be) some more levels, but that's not important at this point - it will always be a tree-like structure.
The customer's reqirements are natural - the administrators should be able to grant/revoke access to 'subtrees' of this structure. For example the top managers should be able to see all the data related to their company, the local managers should be able to see all the data related to their company in the country they work in, etc. On the other hand the relular employees should not see some of the modules (with details about clients of the company).
I wonder whether this can be solved using JAAS in an elegant and flexible manner - from the documents / whitepapers / tutorials I've seen till now it seems to me it seems to me not too suitable.
All the data will be stored in relational database (Oracle, and in some cases PostgreSQL), and it would be nice to have the access rights stored in the same way (but it's not required). We have some ideas how to solve that using a single table containing paths in the tree, but at this point it's only an idea (not a single line of code written).
We are sure somebody has already to solve such a problem - maybe using JAAS, maybe some other technology - and we don't want to reinvent a wheel. Do you have an idea how to solve this (using JAAS or something else)?

Well, I forgot to explain what the 'inheritance' means ...
We do not want to set the access right on each node of the tree - we prefer (as well as the users) to set/store only as much information as needed. We'd like the nodes to inherit the access rights from their parent nodes. For example we'd like granting access to particular project to mean granting access to all campaigns in all countries (related to the project), without the need to set and store these rights for each of the campaigns/countries.

Using security groups to grant Full Mailbox Permissions

Hi, I've of course found several articles discussing granting full mailbox permissions to universal security groups in Exchange 2010, however, most of them are outdated and provide contradicting information.
So I figured I'd ask here to generate a more 'current' discussion of this and get the real answers.
If I do the following:
1. Create a shared mailbox
2. Create a Universal Security group (USG)
3. Add User X to the USG
4. Grant the USG Full Access Permissions to the shared mailbox
Q1: Will the shared mailbox automatically show up in User X's mailbox? I've read posts/articles claiming both NO and YES to this question. Some say you have to still go through the 'open additional mailboxes' setting in Outlook.
Q2: According to the below thread, this is actually still a bug in Exchange 2010 in that when you assign Full Access to a Universal Group, it is supposed to auto-populate, but doesn't. Further, there are claims that USG replication takes a good 12-24 hours
before showing up in the user's Outlook. Some say you actually need to restart the Information Store before it will take affect. This is in stark contrast to granting full access to an individual user account, which takes affect immediately.
So what is the real truth here when using USGs to grant Full Access?
https://social.technet.microsoft.com/Forums/exchange/en-US/9840fd13-daf8-45aa-ab35-4a827f1ba1e0/exchange-2010-unable-to-assign-full-access-permissions-using-a-security-group?forum=exchangesvrgenerallegacy
Thanks,

Hi squishmike,
Thank you for your question.
Q1: Will the shared mailbox automatically show up in User X's mailbox? I've read posts/articles claiming both NO and YES to this question. Some say you have to still go through the 'open additional mailboxes' setting in Outlook.
A: By my testing, we still go through the ‘open addition mailbox’ setting in outlook when we open outlook with new profile.
Q2: According to the below thread, this is actually still a bug in Exchange 2010 in that when you assign Full Access to a Universal Group, it is supposed to auto-populate, but doesn't. Further, there are claims that USG replication takes a good 12-24
hours before showing up in the user's Outlook. Some say you actually need to restart the Information Store before it will take affect. This is in stark contrast to granting full access to an individual user account, which takes affect immediately.
So what is the real truth here when using USGs to grant Full Access?
A: Question 1 has been answered it. It will show share mailbox by ‘open additional mailbox’, we will add shared mailbox manually.
If there are any questions regarding this issue, please be free to let me know.
Best Regard,
Jim

Granting full access rights to archiving reports

Similar Messages

Maybe you are looking for