Installing SQL Server Reporting Services on Windows 2000 Server SP4 Domain Controller
As luck would have it, my first actual field-install of SQL Server Reporting Services was on a Windows 2000 Server SP4 Domain Controller. After installation, I got an error stating that the ReportServer could not be initialized. It took most of the day--but the solution is actually in the ReadMe file. Below is the excerpt from the ReadMe file that is relevant, along with the WorkAround proposed in the related Knowledge Base Article.
1.8. Reporting Services on a domain controller requires manual configuration after setupOn Windows 2003 server, no manual configuration is necessary in order for Reporting Services to install and run properly on a computer that is also a domain controller. On Windows 2000 server, Reporting Services installs properly on a domain controller, but is not activated. Do the following either before or after running setup in order to properly configure Reporting Services to run on a domain controller:
Grant Impersonate Privilege to the IWAM_<machine> account. For more information, see the Knowledge Base Article "IWAM Account Is Not Granted the Impersonate Privilege for ASP.NET 1.1 on a Windows 2000 Domain Controller with SP4" (KB 824308).
CAUSE
You may experience the behavior when the user account that you use to run the program does not have the Impersonate a client after authentication user right (the SeImpersonatePrivilege function). When you upgrade Windows 2000 Server Domain Controller to SP4, the user account (IWAM) is not granted SeImpersonatePrivilege, and then programs that use impersonation may not work correctly.
WORKAROUND
To work around the problem, manually assign Impersonate a client after authentication to the IWAM account. To do so, follow these steps:
Click Start, point to Programs, point to Administrative Tools, and then click Domain Controller Security Policy.
Click Security Settings.
Click Local Policies, and then click User Rights Assignment.
In the right pane, double-click Impersonate a client after authentication.
In the Security Policy Setting window, click Define these policy settings.
Click Add, and then click Browse.
In the Select Users or Groups window, select the IWAM account name, click Add, and then click OK.
Click OK, and then click OK again.
To enforce an update of computer policy, type the following command:
secedit /refreshpolicy machine_policy /enforce
At a command prompt, type iisreset.
------steps not in the readme------
Remove the IWAM_<machine> account from the Guest group. Guest users cannot store or maintain encrypted content. For more information, see the Knowledge Base Article "Roaming Profiles Cannot Create Key Containers" (KB 265357).
Reboot the computer.
On both Windows 2000 and Windows 2003, if you are using a Windows account to connect to the report server database, the Windows user must be granted the privilege to log on locally to the domain controller on which the report server is running, even if the report server database is on a different computer. Domain users are not granted this permission by default. If any of the above steps are performed after setup is completed, run rsactivate.exe to activate your installation of Reporting Services.
Hopefully, this will save someone else from wasting a day trying to resolve this problem.
Happy Reporting!