Reporting Services error 503: Error creating HTTP endpoint – Access is Denied

We had a case come in where they were seeing a blank page when they went to Report Manager for Reporting Services.  You may also see an HTTP 503 error.  This just means that the service had a problem and there was probably an exception that occurred under the hoods.

In this case, the issue was with SQL 2008 R2.  When looking at the Reporting Services Logs, we can see the following exception when the service starts.

rshost!rshost!1380!03/13/2015-14:52:11:: e ERROR: Failed to register url=http://+:80/ReportServer_RS2008R2/ for endpoint 2, error=5. <—5 = Access Denied
rshost!rshost!1380!03/13/2015-14:52:11:: w WARN: Endpoint 2 is enabled but no url is registered for vdir=/ReportServer_RS2008R2, pdir=C:\Program Files\Microsoft SQL Server\MSRS10_50.RS2008R2\Reporting Services\ReportServer.
servicecontroller!DefaultDomain!1a20!03/13/2015-14:52:11:: e ERROR: Error creating HTTP endpoint. System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
at Microsoft.ReportingServices.HostingInterfaces.IRsUnmanagedCallback.CreateHttpEndpoint(RsAppDomainType application, String[] urlPrefixes, Int32 cPrefixes, String[] hosts, Int32 cHosts, Boolean wildCardPresent, String virtualDirectory, String filePath, Int32 authType, Int32 logonMethod, String authDomain, String authRealm, Boolean authPersist, Int32 extendedProtectionLevel, Int32 extendedProtectionScenario, Boolean enabled)
at Microsoft.ReportingServices.Library.ServiceAppDomainController.SetWebConfiguration(RunningApplication rsApplication, Boolean enabled, String folder)


You can find log files here:

In SQL Server Reporting Services 2016 or earlier: C:\Program Files\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\LogFiles

In SQL Server Reporting Services 2017: C:\Program Files\Microsoft SQL Server Reporting Services\SSRS\LogFiles

This comes down to understanding URL Reservations and Reporting Services starting with RS 2008 and later.

About URL Reservations and Registration

What is happening here is that the Service Account was changed outside of Reporting Services Configuration Manager.  On my system, if we look, we see that the service is currently set to my RSService account.

thumbnail image 1 of blog post titled Reporting Services: Error creating HTTP endpoint - Access is Denied

However, if we look at the URL Reservations that are currently registered we will see that they are configured for the Network Service account.  You can see this by running the following command from an Admin Command Prompt.

thumbnail image 2 of blog post titled Reporting Services: Error creating HTTP endpoint - Access is Denied

The problem here is that the service account was changed within the Services area and not from within Reporting Services Configuration Manager.  As a result the URL Reservation permissions were not updated to the new service account.  So, when we try to use the reservation, we get an Access Denied because the RSService account doesn’t have permissions.  The Network Service Account does.

You could also encounter other issues by doing this.  For example, you would probably not have had the Encryption Key, so if you had Data Sources and what not present, you wouldn’t be able to use the encrypted content.

How to fix SSRS 503 error?

We can go back to the services area, and change the account back to what it was before.  If Network Services doesn’t work, you can use the netsh command above to see what account is actually listed and change it back to that account.

Once the account is back, you can then go into Reporting Services Configuration Manager and change the account on the Service Account Tab to the one you want.  This will also prompt you to make a backup of the Encryption key.

thumbnail image 3 of blog post titled Reporting Services: Error creating HTTP endpoint - Access is Denied

You will also see, when you do it this way, that it will remove the reservations and re-add them.

thumbnail image 4 of blog post titled Reporting Services: Error creating HTTP endpoint - Access is Denied

Running the netsh command, we can also see the correct service account is applied.

thumbnail image 5 of blog post titled Reporting Services: Error creating HTTP endpoint - Access is Denied

NOTE: Changing the service account from Network Service to a domain user account will add the RSWindowsNegotiate tab into the authentication types within the rsreportserver.config.  So, if you don’t have Kerberos configured, you may get prompted 3 times followed by a 401 error when you go to Report Manager.

Good luck!

Want me to do this for you? Drop me a line: itgalaxyzzz {at} gmail [dot] com