Server properties (Security page) - Reporting Services
Use this Reporting Services page in SQL Server Management Studio to turn off features that can potentially compromise a report server. Turning off these features limits some functionality, but can improve the overall security of the report server by mitigating specific threats.
To open this page:
- Start SQL Server Management Studio.
- Connect to a report server instance.
- Right-click the report server name, and select Properties.
- Select Security to open this page.
Options
Enable Windows-Integrated Security for report data sources
Specify whether a connection to a report data source uses the Windows security token of the user who requested the report.
If you turn off the feature, the Windows-Integrated Security feature in the report data source property pages becomes unavailable. If your report data sources are configured for Windows-integrated security and you turn off this feature, the report server immediately updates all your data source connection properties to prompt for credentials.
Enable unplanned reporting
Specify whether users can perform unplanned queries from a Report Builder report. In this context, new reports are automatically generated when a user chooses data of interest.
Setting this option determines whether the EnableLoadReportDefinition property on the report server is set to True or False. If you clear this option, the property is set to False and report server doesn't generate clickthrough reports that are created during data exploration. All calls to the LoadReportDefinition method are blocked.
Turning off this option mitigates a threat whereby a malicious user launches a denial of service attack by overloading the report server with LoadReportDefinition requests.