How can I set the permission on the CRM Setup Account in AD, so that it has the right to create SPNs

(0) Share

Report

Posted on by Community Member

Hi,

My CRM installation keeps failing on the AD part.

It says that the account that I am using doesn't have the permission to set the SPNs on the MSCRMSandbox and Async Service, and that I should either assign the permission, or run setup again using a Domain Admin account.

I am trying to use a least privileged account.

Do you know how I can set the permission on the account, so that it can create the necessary SPNs?

Thanks

*This post is locked for comments

I have the same question (0)

All responses (3)

Answers (0)

Suggested answer

razdynamics 17,308 User Group Leader on at

Like (0)

Report

Hi Midiman

The most important part of the crm installation is correctly setting up the service accounts and privelidges, here is a link that will help ;technet.microsoft.com/.../hh699825(v=crm.7).aspx

If windows doesnt create the SPN's you can set them yourself, the following will help you

with checking your existing SPNs are set and setting them if they are not;

blogs.msdn.com/.../configuring-service-principal-names.aspx

Does this help? Kindly Verify by ticking 'Yes'

Best Wishes. Raz

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hi Raz,

The problem is that I want to re-use the same user accounts for the CRM Services on other CRM Server builds.

Therefore, I would have to manually register new SPNs for every other Server that I create.

That would be time consuming, and prone to error.

I would rather have the ability for the installation account to be able to set the spns.

This works if I use a Domain Admin account, but I can't find the permission to be able to do it.

The error message tells me to either set the permission, or re-run

Thanks

Was this reply helpful? Yes No
Suggested answer

riaandelange 20 on at

Like (0)

Report
You can give your CRM Service Account for Administration (crm admin) purposes temporary rights to Domain Admins whilst you're doing the install. Make sure you are also logged onto your server with this user account when doing the install.

Remove it again after the install from Domain Admins.

https://docs.microsoft.com/en-us/previous-versions/dynamicscrm-2016/deployment-administrators-guide/hh699825(v%3dcrm.8)

Microsoft Dynamics CRM Server 2016 Setup

The user account used to run Microsoft Dynamics CRM Server 2016 Setup that includes the creation of databases requires the following minimum permissions:

Be a member of the Active Directory Domain Users group. By default, Active Directory Users and Computers adds new users to the Domain Users group.

Be a member of the Administrators group on the local computer where Setup is running.

Have Local Program Files folder read and write permission.

Be a member of the Administrators group on the local computer where the instance of SQL Server is located that will be used to store the Microsoft Dynamics 365 databases.

Have sysadmin membership on the instance of SQL Server that will be used to store the Microsoft Dynamics 365 databases.

Have organizational unit and security group creation and add membership permission to those groups in Active Directory. Alternatively, you can use a Setup XML configuration file to install Microsoft Dynamics CRM Server 2016 when security groups have already been created. For more information, see Use the command prompt to install Microsoft Dynamics Server 365.

If Microsoft SQL Server Reporting Services is installed on a different server, you must add the Content Manager role at the root level for the installing user account. You must also add the System Administrator Role at the site-wide level for the installing user account.

Was this reply helpful? Yes No