SCOM Reporting Server install fails

Question

Hi there,
I have successfully installed System Center OpsMgr 2012 R2, but my attempts to install the Reporting Services component have failed. Systems are on the same subnet and firewalls are presently turned off.
The main error I'm receiving seems to be this one:
[15:46:45]: Warn:
:Message:SRSPolicySetter SoapException Exception: System.Web.Services.Protocols.SoapException: An error occurred when invoking the authorization extension. ---> Microsoft.ReportingServices.Diagnostics.Utilities.AuthorizationExtensionException: An
error occurred when invoking the authorization extension. ---> System.ServiceModel.FaultException`1[[System.ServiceModel.ExceptionDetail, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]: Access is denied. (Exception
from HRESULT: 0x80070005 (E_ACCESSDENIED))
   at Microsoft.ReportingServices.Library.ReportingService2005Impl.GetRoleProperties(String Name, Task[]& Tasks, String& Description)
   at Microsoft.ReportingServices.WebServer.ReportingService2005.GetRoleProperties(String Name, Task[]& Tasks, String& Description). Will retry..
[15:46:45]: Warn:
:Extra data:<detail><ErrorCode xmlns="http://www.microsoft.com/sql/reportingservices">rsAuthorizationExtensionError</ErrorCode><HttpStatus xmlns="http://www.microsoft.com/sql/reportingservices">400</HttpStatus><Message
xmlns="http://www.microsoft.com/sql/reportingservices">An error occurred when invoking the authorization extension.</Message><HelpLink xmlns="http://www.microsoft.com/sql/reportingservices">http://go.microsoft.com/fwlink/?LinkId=20476&amp;EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&amp;EvtID=rsAuthorizationExtensionError&amp;ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&amp;ProdVer=11.0.2100.60</HelpLink><ProductName
xmlns="http://www.microsoft.com/sql/reportingservices">Microsoft SQL Server Reporting Services</ProductName><ProductVersion xmlns="http://www.microsoft.com/sql/reportingservices">11.0.2100.60</ProductVersion><ProductLocaleId
xmlns="http://www.microsoft.com/sql/reportingservices">127</ProductLocaleId><OperatingSystem xmlns="http://www.microsoft.com/sql/reportingservices">OsIndependent</OperatingSystem><CountryLocaleId xmlns="http://www.microsoft.com/sql/reportingservices">1033</CountryLocaleId><MoreInformation
xmlns="http://www.microsoft.com/sql/reportingservices"><Source>Microsoft.ReportingServices.Diagnostics</Source><Message msrs:ErrorCode="rsAuthorizationExtensionError" msrs:HelpLink="http://go.microsoft.com/fwlink/?LinkId=20476&amp;EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&amp;EvtID=rsAuthorizationExtensionError&amp;ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&amp;ProdVer=11.0.2100.60"
xmlns:msrs="http://www.microsoft.com/sql/reportingservices">An error occurred when invoking the authorization extension.</Message><MoreInformation><Source>mscorlib</Source><Message>Access is denied. (Exception from
HRESULT: 0x80070005 (E_ACCESSDENIED))</Message></MoreInformation></MoreInformation><Warnings xmlns="http://www.microsoft.com/sql/reportingservices" /></detail>
Interestingly, even thought I've registered the SPN's for mt SQL and OpsMgr service accounts this still comes up in the System logs:
A Kerberos Error Message was received:
 on logon session 
 Client Time: 
 Server Time: 22:39:13.0000 4/4/2014 Z
 Error Code: 0x7  KDC_ERR_S_PRINCIPAL_UNKNOWN
 Extended Error: 0xc0000035 KLIN(0)
 Client Realm: 
 Client Name: 
 Server Realm: DOMAIN.COM
 Server Name: MSOMSdkSvc/SASCM.DOMAIN.COM
 Target Name: MSOMSdkSvc/[email protected]
 Error Text: 
 File: 9
 Line: f09
 Error Data is in record data.
Kind of hit a wall here, looking forward to your suggestions. Thanks in advance,
Riki

Answer 1

To resolve this problem, add the SDK service account to the Windows Authorization Access group. To do this, follow these steps:
Click Start, point to Administrative Tools, and then click
Active Directory Users and Computers.
In Active Directory Users and Computers, click Builtin, and then double-click
Windows Authorization Access Group.
Click the Members tab, and then add the SDK service account to the members list.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"