Server Properties (Security Page) - Reporting Services
Use this page to turn off features that can potentially compromise a report server. Turning off these features will limit some functionality, but can improve the overall security of the report server by mitigating specific threats.
To open this page, start SQL Server Management Studio, connect to a report server instance, right-click the report server name, and select Properties. Click Security to open this page.
Options
Enable Windows integrated security for report data sources
Specify whether a connection to a report data source can be made using the Windows security token of the user who requested the report.If you turn off this feature, the Windows Integrated Security feature in the report data source property pages will be unavailable. If report data sources are configured for Windows integrated security and you subsequently turn off this feature, the report server will immediately update all data source connection properties to prompt for credentials.
For more information about why you might want to turn off this feature, see Integrated Security and Elevated Permissions.
Enable Ad Hoc Reporting
Specify whether users can perform ad hoc queries from a Report Builder report, where new reports are automatically generated when a user clicks data of interest.Setting this option determines whether the EnableLoadReportDefinition property on the report server is set to True or False. If you clear this option, the property will be set to False and report server will not generate clickthrough reports that are created during data exploration. All calls to the LoadReportDefinition method will be blocked.
Turning off this option mitigates a threat whereby a malicious user launches a denial of service attack by overloading the report server with LoadReportDefinition requests.