PRB: Registry Permission Difference When You Install OLAP Services on Windows 2000

ID: Q241088

This article discusses a Beta release of a Microsoft product. The information in this article is provided as-is and is subject to change without notice.

No formal product support is available from Microsoft for this Beta product. For information about obtaining support for a Beta release, please see the documentation included with the Beta product files, or check the Web location from which you downloaded the release.

The information in this article applies to:

Microsoft SQL Server OLAP Services version 7.0

SYMPTOMS

When you install OLAP Services version 7.0 on a Windows 2000 computer, all of the local computer users receive administrators rights to administer OLAP Services. This occurs because of behavior changes in the defaults of the registry system of Windows 2000. Windows 2000 now inherits the security permission of the parent node in the registry tree, which causes all of the local computer users to have administrators rights.

This means that the server installs and works well on Windows 2000 out of the box. However, now too many people now have too many rights.

CAUSE

The Win32 function SetNamedSecurityInfo works differently in Windows 2000 than in previous versions of Windows NT. A new flag PROTECTED_DACL_SECURITY_INFORMATION has been introduced in Windows 2000 that you need to use in order to prevent registry keys from inheriting a parent key security setting.

WORKAROUND

To work around this behavior, download the following file and run it on your Windows 2000 server:

OLAPRegFix.exe

This utility sets the correct permission for the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\OLAP Server\CurrentVersion\SECURITY - restricts it for special access (Query Value + Read Control) to OLAP Administrators.

HKEY_LOCAL_MACHINE\Software\Microsoft\OLAP Server\Server Connection Info - restricts it for Full Control to OLAP Administrators.

HKEY_LOCAL_MACHINE\Software\Microsoft\OLAP Server\Olap Manager Info - restricts it for Full Control to OLAP Administrators.

Additional query words: win 2k win2k w2k win2000 reg rights permissions

Keywords : kbSQLServ700 kbOLAP
Version : winnt:7.0
Platform : winnt
Issue type : kbprb