tee_user5


Previously, a windows group was added to a 'full access users' role. It was removed and the cube was processed and deployed, replacing rights, but people in that group still have rights to see the data. They are not listed in any roles.

I've looked through all local windows groups on the supporting server and the group in question is not in any groups (ie, if they were in administrators, then they'd have full access through that). The people in the group are not administrators or domain administrators either.

Is there somewhere else I could check on the machine to better find the source of the problem and get the group removed




Re: Permissions issue- a previous windows group still has full cube rights

Edward Melomed


Several places to check.

See if you allowed anonymous access to your cubes.
Check memebership of server-wide Admnistrators role.

It is sometimes little hard to track down amongst several groups what exactly is going on. To make sure you are looking at last version of data use SQL Management Studio to verify roles and memberships.

Edward.
--
This posting is provided "AS IS" with no warranties, and confers no rights.







Re: Permissions issue- a previous windows group still has full cube rights

tee_user5

I just checked if other users that never had rights could see the cube and they can't. Anonymous access cannot be allowed.

The windows group "Adminstrators" was checked, but I don't see the admin role present in the dwproj area.
Where would one look besides the roles folder in the solution explorer or this kb: http://msdn2.microsoft.com/en-us/library/ms174561.aspx The group is not in any of these areas.

sql mgmt studio was used for examination - the cube was scripted to a file and scanned for groups and user names.






Re: Permissions issue- a previous windows group still has full cube rights

Edward Melomed

In general there are 2 places to check:
One- role membership. And you check that on database role
Second - access permissions. There are several permissions on different objects. Cube, dimension ...

I also suggested you take a look at memebership of Analysis Server Administrators role and not OS Administrators group.

To access AS Administrators role right click on the Server name in SQL Management Studio and select properties and click on the Security node.

HTH

Edward.
--
This posting is provided "AS IS" with no warranties, and confers no rights.






Re: Permissions issue- a previous windows group still has full cube rights

tee_user5

It seems like all of these have been checked. The server security was examined and the cube's xmla was parsed - this should cover any cube/dimension security, right



Re: Permissions issue- a previous windows group still has full cube rights

Edward Melomed

2 more things.

Make sure you installed latest product update.

And finally. It is good idea to get your security model examined by someone with good knowlege of Analysis Services 2005.

Edward.
--
This posting is provided "AS IS" with no warranties, and confers no rights.






Re: Permissions issue- a previous windows group still has full cube rights

tee_user5

For product updates, we are on sp1. I could not find any hot fixes related to this.
I will keep investigating and will see if the problem can be recreated on a copy of the cube.