A server is running Microsoft Office PerformancePoint Monitoring Server 2007. From a client computer, you create a Microsoft SQL Server Table data source or an Analysis Services 2005 data source in PerformancePoint Dashboard Designer. When you select a database or when you click Test Connection, you receive the following error message: Additionally, the following event is logged in the Application log:

Date: Date
Time: Time
Type: Failure Aud
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: ComputerName
Source: MSSQLSERVER
Category: (4)
Event ID: 18456
Description: Login Failed for user 'NT Authority\Anonymous Logon'. [CLIENT: IPAddress]

This behavior occurs for one of the following reasons.

Cause 1

The account under which the PPSMonitoringWebService application pool is running does not have read permissions for the database that you are trying to access.

Note If this is the cause, this behavior occurs regardless of whether you are using the scenario that described in the "Symptoms" section.

Cause 2

PerformancePoint Monitoring Server 2007 is configured for Kerberos delegation. Additionally, the instance of SQL Server to which PerformancePoint Monitoring Server 2007 tries to establish a connection resides on a different server. If the PPSMonitoring Web site is configured to use only the NTLM protocol, the PPSMonitoring Web site cannot delegate the user credentials from the client computer to the server that is running the instance of SQL Server.

Workaround 1

To work around this problem, follow these steps:

1. Obtain the account under which the PPSMonitoringWebService application pool is running. To do this, follow these steps:
   1. Click Start, click Run, type Inetmgr, and then click OK.
   2. In the Internet Information Services (IIS) Manager console, expand Application Pools, right-click the PPSMonitoringWebService application pool, and then click Properties.
   3. In the PPSMonitoringWebServices Properties dialog box, click the Identity tab.
   4. On the Identity tab, note the account for this application pool under Application pool identity.
2. On the database that you are trying to access, grant read permissions to the account. To do this, follow these steps:
   1. Open SQL Server Management Studio, and then connect to the instance of SQL Server 2005 that holds the database that you are trying to access.
   2. Expand Security, and then expand Logins.
   3. Under Logins, make sure that the account under which the application pool is running appears. If the account does not exist, right-click Logins, click New Login, and the follow the steps to create a login for this account.
   4. Expand Databases, expand the database that you are trying to access, and then expand Security.
   5. Double-click the login for the account. If the login for this account does not appear under Security, follow these steps:
      • Right-click Security, and then click New User.
      • In the Login name box, type the login for the account.
   6. Under Schemas owned by this user, click to select the db_datareader check box, and then click OK.

Workaround 2

To work around this behavior, configure the PPSMonitoring Web site to use the NTLM protocol and the Kerberos protocol. To do this, visit the following Microsoft Web site, and then follow the steps in the "Configure PerformancePoint Monitoring Server Web Services" section:

This behavior is by design.

The scenario that is described in the "Symptoms" section is a double-hop scenario. In a double-hop scenario, the client computer passes the user credentials to a second server that is running PerformancePoint Monitoring Server 2007. Then, the second server passes the user credentials to the server that is running the instance of SQL Server.

We recommend that you configure the identity of the PPSMonitoringWebService application pool to use a domain user account.

For more information how to configure IIS to support the Kerberos protocol and the NTLM protocol, click the following article number to view the article in the Microsoft Knowledge Base: