rights from user NETWORK SERVICE Crystal Reports

[Former Member]

Hi,

I have a Windows Server 2003, IIS 6 with Crystal Reports Basic Runtime for Visual Studio 2008 installed.

The reports works fine, but my ​​security risk area has asked me to remove rights from user NETWORK SERVICE to C: \, if I try to run the report without rights, the following error occurs: "Load report failed", there is a workaround for this issue?

It was the permissions on "c:\". I added "network Service" to have read on this folder and the problem went away.

You can easily re-create this error by ensuring that the identity for the app pool in IIS has no permissions on this folder. As a result, crystal reports spews out the same error.

After enabling this I ran the ProcMon again but I can't see what CR is after. It just shows that it opens c:\ for read.

Since normally, and especially in the case of locked down servers, it is not very common to have "Network Service" or "Local Service" having any privileges on the root drive, I would like this to be treated as a defect and reported to the appropriate team.

Tks.

[former_member183750 · Accepted solution]

Make sure you are on SP1:

https://smpdl.sap-ag.de/~sapidp/012002523100009351512008E/crbasic2008sp1.exe

CRRedist2008_ia64.msi

https://smpdl.sap-ag.de/~sapidp/012002523100006255262008E/CRRedist2008_ia64.zip

CRRedist2008_x64.msi

https://smpdl.sap-ag.de/~sapidp/012002523100006255272008E/CRRedist2008_x64.zip

CRRedist2008_x86.msi

https://smpdl.sap-ag.de/~sapidp/012002523100009351342008E/CRBasicVS2008_redist_x86.zip

You will not be able to lock down all of drive C. The report engine needs to write and read files to c:\win\temp and you'll need to at minimum give read \ write right here.

ProcMon should give you "Access Denied" messages if there are right needed on a particular folder or reg key. It is up to you to then give the corect rights to the process running the report.

Ludek

Follow us on Twitter http://twitter.com/SAPCRNetSup

Got Enhancement ideas? Try the [SAP Idea Place|https://ideas.sap.com/community/products_and_solutions/crystalreports]

[Former Member · Accepted solution]

Hi Ludek,

I've installed the SP1 and now I'm getting this error (with or without NETWORK SERVICE user):

The type initializer for 'CrystalDecisions.CrystalReports.Engine.ReportDocument' threw an exception

What do you suggest?

[former_member183750 · Accepted solution]

Not having the full error, it's a bit hard to say, but typically an error with "The type initializer for 'CrystalDecisions.CrystalReports.Engine.ReportDocument' threw an exception" in it means the app is not able to find the correct CR runtime. Run [Modules|https://smpdl.sap-ag.de/~sapidp/012002523100006252802008E/module.tzip] with the error on the screen. Do you see any CR files loaded? Run Process Monitor - does it show that the app is trying to load CR files and not finding them?

Ludek

[Former Member · Accepted solution]

HI,

I found the same problem, maybe help you:

tks.

[Former Member · Accepted solution]

This post:

jeffs-wm

Posts: 21

Registered: 4/21/09

Forum Points: 0

Re: "Invalid file name" error when trying to load the report in IIS/CR 2008

Posted: Nov 27, 2009 3:20 PM in response to: Ludek Uher Reply

It was the permissions on "c:\". I added "network Service" to have read+execute on this folder and the problem went away.

You can easily re-create this error by ensuring that the identity for the app pool in IIS has no permissions on this folder. As a result, crystal reports spews out the same error.

After enabling this I ran the ProcMon again but I can't see what CR is after. It just shows that it opens c:\ for read.

Since normally, and especially in the case of locked down servers, it is not very common to have "Network Service" or "Local Service" having any privileges on the root drive, I would like this to be treated as a defect and reported to the appropriate team.

thanks