SRS error, "401 unauthorized" trying to add reporting services (4230995)

In this scenario the following is true:

1. You can browse the /reports and /reportserver pages if logged on locally to the server running SQL Reporting Services but you cannot browse to the page remotely (401 unauthorized error).
2. The SQL Reporting Services service is running under the context of a user account
3. The RSReportServer.Config contains the following authentication methods:

<RSWindowsNegotiate/>
<RSWindowsNTLM/>

4. The SQL Reporting Services log files may contain the following two failures surrounding the failed authentication attempts:

- ERROR: HTTP status code --> 500
- ERROR: Microsoft.ReportingServices.UI.FolderPage+InsufficientPermissionsToRoot: User 'domain\user1' does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed.

Authentication is failing due to the service running under a user context and the authentication methods set.

RESOLUTION 1

Remove Negotiate from the RSReportServer.Config file (leaving only NTLM) and restart the SQL Reporting Service service to force NTLM authentication.

RESOLUTION 2

Leave both Negotiate and NTLM and register HTTP Service Principal Name (SPN) to the domain account running the SQL Reporting Service service and restart the SQL Reporting Services to allow Kerberos Authentication.

For more information see the following URLs:

Configuring Windows Authentication on the Report Server:

http://msdn.microsoft.com/en-us/library/cc281253.aspx

Registering a Service Principal Name (SPN) for a Report Server

http://msdn.microsoft.com/en-us/library/cc281382.aspx