SQL Server Reporting Services can be a pain in the arse to set up correctly for the first time. Even after you've got things running correctly, you can sometimes run into issues, which is exactly what happened to me recently.
I had setup my local development machine to use the built-in 'Local System' account to run the report server service via the Reporting Services Configuration Manager. Every thing was working fine when I accessed the Report Manager at the virtual directory url: http://localhost/Reports/ (I assigned the BUILTIN\Administrators account the System Administrator Role from the Site Settings -> Security section of the Report Manager.) So everything also worked fine when I viewed my reports using the ReportViewer control with my ASP.NET website using Visual Studio.net's Development server.
However, once I switched my ASP.NET site over to run in Internet Information Services 7 (IIS7), I began getting an rsAccessDenied error message from a webform page that was using the ReportViewer control to access SSRS reports. I was greeted with the folloing error message:
The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are insufficient for performing this operation. (rsAccessDenied)
What I discovered in my case was that this SSRS error can occur in a IIS7 / ASP.NET website using the ReportViewer control when the LocalSystem account is not being used as the ApplicationPool Identity, but the Report Server Service Account is setup to use the Local System account to run the report server service.
Essentially, if your Report Server Service Account is set to use 'Local System' built-in account, then you'll want to make sure you're IIS7 / ASP.NET website has the ApplicationPool's (Process Model) Identity set to 'LocalSystem' as well.
To create a new Application Pool with LocalSystem as the Identity follow these steps:
- Open Internet Information Services (IIS) Manger.
- In the Connections sidebar, click on Application Pools.
- Then in the right hand Actions sidebar, click Add Application Pool... and then in the pop-up box Name your AppPool, select the .NET Framework version and Managed pipeline mode, then click OK.
- Now right-click on the Application Pool you just created, and select Advanced Settings... from the menu.
- In the Advanced Settings pop-up box, locate the Process Model -> Identity section and click on the Application Pool Identity.
- In the Application Pool Identity pop-up box, change the Built-in account to LocalSystem, then click OK, and click OK again to save your Advanced Settings changes.
To change the Application Pool that your IIS7 website uses follow these steps:
- Open Internet Information Services (IIS) Manger.
- In the Connections sidebar, expand the Sites folder and then find and click on your website application.
- With your website selected and the Features View selected, right-click on Authentication, and then click Basic Settings.
- In the Edit Application pop-up box, click on the Select... button. Now in the Select Application Pool pop-up box use the drop down menu to choose the Application pool you want to use for your website, then click OK, and click OK again to save your changes.
So essentially, by matching up the Report Server Service account with the IIS7 Application Pool Identity, I was able to access SSRS reports from my ASP.NET website using the ReportViewer control in IIS7. Hope this helps solve your The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are insufficient for performing this operation. (rsAccessDenied) error message...
Keep in mind this is just one way to solve the rsAccessDenied error when using IIS7 and the ReportViewer control for ASP.NET. I ran into the rsAccessDenied error numerous times when setting up SSRS for the first time and was not using IIS7 at the time, so I know how much of a pain it can be to figure out what exactly is causing the rsAccessDenied error message. At any rate, I hope this helps you solve your SSRS rsAccessDenied issue!