BUG: You cannot connect to a SQL Server 2000 Analysis Services computer after you install Analysis Services Service Pack 3 (826310)


The information in this article applies to:

  • Microsoft SQL Server 2000 Analysis Services SP3, when used with:
    • Microsoft Windows NT 4.0
BUG #: 13921 (Plato7x)

Plato 7x:13921

SYMPTOMS

After you install Microsoft SQL Server 2000 Analysis Services Service Pack 3 (SP3) on a domain controller computer that is running Microsoft Windows NT 4.0 Server, a Windows user account that is not a member of the Domain Administrators group in the Windows domain cannot access the Analysis server computer. This problem may occur even if the Windows user account is a member of a security role that is defined on the Analysis server computer.

You notice similar behavior when you try to connect to the Analysis server computer by using Windows user accounts of other trusted domains. You do not notice this behavior if the Windows user account of the trusted domain is a member of the Domain Administrators group of the Analysis server computer's Windows domain.

Note Do not add users of trusted domains to the Domain Administrators group of a Windows domain. Doing so may lead to security-related issues on the Windows domain.

CAUSE

Installing Microsoft SQL Server 2000 Analysis Services SP3 may modify the security roles of the Windows user accounts on the Analysis server computer.

WORKAROUND

To work around the problem, follow these steps:
  1. Drop the existing security roles on the Analysis server computer.
  2. Re-create the security roles.
  3. Add the respective Windows user accounts and the groups to the security roles.
  4. Assign the security roles to cubes.

MORE INFORMATION

Steps to Reproduce the Behavior

  1. Install Windows NT Server 4.0 on two computers, and name the computers DOM1 and DOM2. Configure the two computers as the domain controllers of the Windows domain.
  2. On the computer that is named DOM1, create a Windows user account DOM1\DOMADMIN1, and then add the user account as a member of the Domain Admins group.
  3. On the computer that is named DOM2, create a user account DOM2\DOMUSER, and then add the user account as a member of the Users group.
  4. Install Microsoft SQL Server 2000 Analysis Services on DOM1 and on DOM2.
  5. On the computer that is named DOM1, use Analysis Manager to edit the All Users security role in the FoodMart 2000 sample database. Perform the following actions on the All Users security role:
    1. Remove the user account Everyone.
    2. Add the user account DOM2\DOMUSER.
  6. Log on to the computer that is named DOM2 by using the Windows user account DOM2\DOMUSER.
  7. Open the Analysis Services MDX sample application, and then connect to the FoodMart 2000 sample database on the Analysis server computer that is named DOM1.

    Note You can connect successfully and you can query the data from the cubes on the Analysis server computer that is named DOM1.
  8. Install Microsoft SQL Server 2000 Analysis Services Service Pack 3 (SP3) on the Analysis server computers DOM1 and DOM2.
  9. Log on to the computer that is named DOM2 by using the Windows user account DOM2\DOMUSER.
  10. Open the Analysis Services MDX sample application, and then connect to the FoodMart 2000 sample database on the Analysis server computer that is named DOM1.

    Note You cannot connect to the Analysis server computer that is named DOM1.
  11. Using Windows NT User Manager, add the user account DOM2\DOMUSER as a member of the Domain Admins group in the Windows domain.
  12. Open the Analysis Services MDX sample application, and then connect to the FoodMart 2000 sample database on the Analysis server computer that is named DOM1.

    Note You can connect successfully and you can query the data from the cubes on the Analysis server computer that is named DOM1.

Note You can also use the Drillthrough.htm file that is available with the Microsoft Office Web Components Toolkit to connect to the Analysis server computer and to query data from the cubes.

REFERENCES

For additional information about running OLAP services on a domain controller, click the following article number to view the article in the Microsoft Knowledge Base:

273836 INF: Running OLAP Services on a Domain Controller

Modification Type:MajorLast Reviewed:2/10/2004
Keywords:kbSecurity kbUser kbAuthentication kbServer kbDatabase kbprb KB826310 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.