John Croson's Blog Home

Image via CrunchBase This was kicking my butt the past couple of days. Up to this point, I'd simply been using the server to schedule and email reports out to people. What I wanted was to allow users to log in with their AD credentials, browse InfoView and run their own reports. Simple, right? This is how I did it. Create a service account in AD. This account doesn't need elevated privileges  Tick the User cannot change password and Password never expires boxes. In my example the account is svc_crs . Use setspn.exe to create the Service Principal Name. Run the command on a DC in a command prompt with elevated privileges. Here is more info on setspn . The convention is setspn -a MySpnName/MySvcAcct.Domain.Com MySvcAcct . In my environment I used setspn.exe -a  CrystalSvr/svc_crs.NETWORK.INTERNAL svc_crs . Open your service account Account Properties in Active Directory Users and Computers , select the Delegation tab, and change delegation to Trust this user for