When you run a report in Microsoft Dynamics CRM 3.0 by clicking Run Report in the Report Review page, you receive the following error message:

Back to the top

Cause 1

The NTAuthenticationProviders property is not set on the SQL Server Reporting Services (SSRS) Web site. See Resolution 1.

Back to the top

Cause 2

The Integrated Windows Authentication feature is not enabled in Windows Internet Explorer. See Resolution 2.

Back to the top

Cause 3

Duplicate service principal name (SPN) values exist. See Resolution 3.

Note If this condition causes this problem, the following error message is logged in the Application log on one or more of the domain controllers:

Event Type: Error
Event Source: KDC
Event Category: None
Event ID: 11
Description: There are multiple accounts with name host/ServerName.microsoft.com of type10.

Back to the top

Cause 4

Reports are waiting to be republished. See Resolution 4.

Back to the top

Cause 5

The domainname value in the SystemUserBase table of the MSCRM database is set to "FQDN\User_name" instead of "Domain_Name\User_name." See Resolution 5.

Notes

•	The FQDN placeholder represents the fully qualified domain name (FQDN). For example, the FQDN could be "adventureworks.local."
•	The Domain_name placeholder represents the domain name. For example, the domain name could be "adventureworks."
•	The User_name placeholder represents the user name. For example, the user name could be "crmadmin."

Back to the top

To resolve this problem, use one or more of the following resolutions.

Back to the top

Resolution 1

Set the correct NTAuthenticationProviders property in the Internet Information Services (IIS) metabase for the Reporting Services Web site. To do this, follow these steps:

1.	Set the correct NTAuthenticationProviders property at the root level. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 215383 (http://support.microsoft.com/kb/215383/) How to configure IIS to support both the Kerberos protocol and the NTLM protocol for network authentication
2.	Determine the Web site identifier for the Reporting Services Web site. To do this, follow these steps: a. Start Internet Information Services (IIS) Manager. b. Expand the server name, and then click Web Sites. c. Note the value in the Identifier column of the Web site that is hosted by the Microsoft Dynamics CRM 3.0 server. Note Reporting Services is installed on this server.
3.	Click Start, click Run, type cmd, and then click OK.
4.	At the command prompt, locate the directory that contains the Adsutil.vbs file. The following directory is the default directory: C:\Inetpub\Adminscripts
5.	Use the Web site identifier that you noted in step 2 to set the NTAuthenticationProviders property for the Web-site level. To do this, run the following commands: • cscript adsutil.vbs set w3svc/SRS_WEB_SITE_ID/NTAuthenticationProviders "Negotiate,NTLM" • cscript adsutil.vbs set w3svc/NTAuthenticationProviders "Negotiate,NTLM" Note In the commands, the SRS_WEB_SITE_ID placeholder represents the Web site identifier that you noted in step 2.

Back to the top

Resolution 2

Enable the Integrated Windows Authentication feature. To do this, follow these steps:

1.	Start Windows Internet Explorer.
2.	On the Tools menu, click Internet Options.
3.	In the Internet Options dialog box, click the Advanced tab, and then make sure that the Enable Integrated Windows Authentication check box is selected.
4.	Restart Windows Internet Explorer.
5.	On the Tools menu, click Internet Options.
6.	In the Internet Options dialog box, click the Security tab.
7.	Click Local intranet, and then click Sites.
8.	In the Local intranet dialog box, click Advanced.
9.	In the Add this Web site to the zone box, type the address of the Microsoft Dynamics CRM Web site, and then click Add.
10.	If you do not use the Secure Socket Layer (SSL) protocol, click to clear the Require server verification (https:) for all sites in this zone check box.
11.	Click Close, and then click OK.

Back to the top

Resolution 3

Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.

Delete the duplicate SPN values. To do this, follow these steps:

1.

Use the LDP utility to determine the exact locations of the duplicate SPN values. Notes • Only experienced administrators can use the LDP utility. • Typically, the duplicate SPN values are located in the ServicePrincipleName attribute of the User container. The user account of the User container is the user account under which Microsoft Dynamics CRM 3.0 is installed. For more information about how to determine the duplicate SPN values, click the following article number to view the article in the Microsoft Knowledge Base: 321044 (http://support.microsoft.com/kb/321044/) Event ID 11 in the System log of domain controllers

2.

Use the ADSI Edit snap-in to delete the duplicate SPN values. To do this, follow these steps. Notes • Only experienced administrators can use the ADSI Edit snap-in. • The ADSI Edit snap-in is included with the Microsoft Windows Support Tools on the Windows installation CD. a. Click Start, click Run, type mmc, and then click OK. b. On the File menu, click Add/Remove Snap-in. c. Click Add, click ADSI Edit in the Snap-in list, click Add, and then click Close. d. Right-click ADSI Edit, and then click Connect To to connect to the domain. e. Expand the domain node, right-click the user account under which Microsoft Dynamics CRM 3.0 is installed, and then click Properties. Note If you want to delete the duplicate SPN values in a computer account, you can right-click the computer account in this step. f. In the Attributes column, double-click ServicePrincipleName. g. In the Values dialog box, remove all the values that begin with "HOST/ServerName." Note The error message in the Application log shows these values.

Back to the top

Resolution 4

Republish the reports. To do this, follow these steps:

1.	Click Start, click Run, type cmd, and then click OK.
2.	At the command prompt, locate the directory that contains the reports. The following directory is the default directory: C:\Program Files\Microsoft CRM\Reports
3.	Run the following command: publishreports.exe "company_name" "domain\reportinggroup {GUID}" Notes • The company_name placeholder represents the name of the company. • The domain placeholder represents the name of the domain. • The GUID placeholder represents the actual ID of the pre-Windows compatible name of the ReportingGroup group in Active Directory. For example, the GUID resembles 74c1d4cf-5c5f-4531-bb7f-14d75dd33857.

Back to the top

Resolution 5

Run the following Microsoft SQL Server statement, and then send the result to technical support for Microsoft Dynamics CRM.

select domainname from systemuserbase

For more information about how to obtain technical support for Microsoft Dynamics CRM, visit the following Microsoft Web site:

Back to the top