SQL 2008 R2 SSRS Security Problems

Question

Hello,
We have SSRS running on SQL 2008 R2, using a Windows 2008 R2 Standard Server. When we setup Systems users and also roles such as Browser all that goes through. The issue is, the security does not take effect on the system. 
For example <domainuser>\<domainuser> can login to the site and traverse ANY folders, even ones that have folder security set, not inheritening permissions. I've came to realize it seems the Windows Group "Users" applies to who can
get into the server. If we do not have domain users or specific logins in the Windows group you just keep getting a popup for login going to the main SSRS home. 
I do not the behavior concerning windows group by design but at any rate adding all domain users we then perceive the folder and site settings apply to folders and report access on the Report manager. It does not simply work. Any users  can get into
the admin folder (Which has only 3-4 people with access) and run anything. It is as if the SSRS permissions simply do not work. I've tried using a server account and also Network Service (Which it is set to now). 
Has anyone ran into this issue and have any ideas how to resolve it? I understand the BROWSER role has access to "View Folders" but I see no granular other than folder and item permissions being set to not allow specific folders to be accessed. 
I appreciate your time,
KT

Answer 1

Hi KT,
Per my understanding that you have set the security in the report server but the some of the user still get some extra permission, right?
Generally, Reporting Services uses role-based security to grant user access to a report server, and there are two types of roles:
Item-level roles and System-level roles.
By default, Reporting Services has assigned both System Administrator roles (System-level) and the Content Manager role (Item-level) to the BUILTIN\Administrators group. So, the user that is in the local administrators group will
perform the role  as ”Content Manager” without extra settings, you can check if the users who have extra permissions was in this group，if the domain user in this group, please try to remove it and add it in the Local Users and Groups other
then Administrators group :
You have menioned that the user shouldn't have permission to the Admin folder but now they have access.
Please check the security of the admin folder to make sure the users were not in the list of the groups and users as below:
If the issue still exists, please check all the folder one by one to make sure this is not any inheried problem and re-set the security.
Similar thread for your reference:
How to remove the DELETE item from the Running report context
list box
If you still have any question, please feel free to ask.
Regards
Vicky Liu
Vicky Liu
TechNet Community Support