RetrievePrivilegeForUser failed - no roles are assigned to user

Hopefully you are fortunate enough to never experience this in the field, however when some smart aleck decides to add the CRM App Pool service account as an actual CRM System User. You will get an error similar to this:

Exception information: 
    Exception type: CrmException 
    Exception message: SecLib::RetrievePrivilegeForUser failed - no roles are assigned to user. Returned hr = -2147209463, User: b1eda2c8-dbbd-e511-b14d-0050569b5b86
   at Microsoft.Crm.Application.Platform.ServiceCommands.PlatformCommand.XrmExecuteInternal()
   at Microsoft.Crm.Application.Platform.ServiceCommands.RetrieveMultipleCommand.Execute()
   at Microsoft.Crm.Application.Caching.CustomResourceLoader.GetCustomResources(IOrganizationContext context, Int32 cacheKey)
   at Microsoft.Crm.Application.Caching.CustomResourceLoader.LoadCacheData(Int32 key, IOrganizationContext context)
   at Microsoft.Crm.Caching.CrmMultiOrgCacheBase`2.LookupEntry(TKey key, IOrganizationContext context)
   at Microsoft.Crm.Application.ResourceManager.CustomResourceManager.TryGetCultureString(String name, CultureInfo culture, Boolean getSystemString, IOrganizationContext context)
   at Microsoft.Crm.Application.ResourceManager.CustomResourceManager.TryGetCultureString(String name, CultureInfo culture, IOrganizationContext context)
   at Microsoft.Crm.Application.ResourceManager.BasicResourceManager.GetCultureString(String name, CultureInfo culture, IOrganizationContext context)
   at Microsoft.Crm.Controls.Header..ctor(Boolean isControlHeader)
   at Microsoft.Crm.Controls.BasicHeader..ctor()
   at Microsoft.Crm.Application.Controls.AppHeader..ctor()
   at ASP.dynamicsqa_default_aspx.__BuildControlcrmHeader()
   at ASP.dynamicsqa_default_aspx.__BuildControlTree(dynamicsqa_default_aspx __ctrl)
   at ASP.dynamicsqa_default_aspx.FrameworkInitialize()
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

The cause is due to the service account now existing as a CRM user. The service account is responsible for running and acting as the service identity for the CRM web application within IIS. This can have severe security implications, in this specific scenario users could no longer log into Dynamics CRM.

According to https://support.microsoft.com/en-us/kb/2593042 there are other issues that this can also introduce.

• Data Import may fail
• CRM Outlook Clients may not configure
• Async Operations may have unexpected behavior including Workflows stopping with a Failed status
• No users can access CRM
• IFD access may fail for some or all users
• Date/Time fields may not display correct timezone offset

The Fix

1. Change the CRM service account, which will further involve creating new SPN's etc
2. Remove the user from the CRM Sql Database, which is unsupported and will be very tricky to perform.
3. In our case we resolved this by marking the specific accounts record as "IsDeleted" within the MSCRM_CONFIG.SystemUserAuthentication table

How to get the Object Type Code of an Entity?

Each system and custom entity within Dynamics CRM comes with an array of unique attributes. These include an Entity ID, Logical Name and Object Type Code. Identifying the logical name is pretty easy, however tracking down the rest can be a little tricky.

• Custom entities will have a Object Type Code greater than 10000. You should also note that the OTC of a custom entity can change when importing the entity to a different system. This is likely when an existing entity on the target system is already using the OTC number.
• Any system entities will use a Object Type Code less than 10000. This range is reserved for all built in entities.

Using SQL
Execute the following statement against the target CRM Organization database.

SELECT ObjectTypeCode,* FROM ENTITYVIEW 

Using JScript
You can access the "etc" query string parameter from the open entity window within CRM.

Xrm.Page.context.getQueryStringParameters().etc

MS CRM 2013 - Reporting Extensions Setup (Blank/Empty SSRS Instance)

When installing CRM 2013 Reporting Extensions, you may experience the "Empty SSRS Instance" dropdown on the second install wizard screen as displayed below:

This can be caused by any of the following reasons:

• You are trying to install "Reporting Extensions" on the incorrect server, you should be running the installer on the SQL Server not the CRM Server.
• SSRS is incorrectly configured, it is not configured or pointing to a Report Server database, a permisions or virtual directory issue. Try loading the Reports web page using IE to check that the Reporting URL can be reached.
• You have installed an unsupported version of SQL Server

In my experience, the 3rd is the most likely cause where by an x86 version of SQL has been installed. Once you have resolved the cause, you should now see the SSRS instance within the dropdown:

How to Identify AD Groups for CRM Organization

Each organization within MS CRM, will have there own set of unique groups within active directory. You can either pre-create these groups or allow the "Deployment Manager" to create these as part of the creation process.

Regardless which option you use, you should have the following 3 groups:

• SqlAccessGroup
• PrivReportingGroup
• ReportingGroup

Eventually you will discover that active directory will soon become overun with these groups and it can become difficult to identify which groupds are associated with which CRM organization.

Being able to identify these groups is very useful when investigating permissions and security related issues. You can use a simple SQL query against the "Organization_MSCRM" database.

select ReportingGroupName, SqlAccessGroupName, PrivReportingGroupName from Organization

MS CRM - Sandbox Timeout

MS Dynamics CRM imposes several limitations and restrictions to all plugins registered to operate within the CRM Sandbox. 

The most common pitfall experienced by developers is the Sandbox Timeout, which by default is set to 2 minutes. Any business logic that executes longer than this will result in a exception e.g:

• 0x80044172; message: The plug-in execution failed because the operation has timed-out at the Sandbox Host

• 0x80044171; message: The plug-in execution failed because the operation has timed-out at the Sandbox Client

In order to increase the timeout period, there are several registry settings below which can be used as follows:

• HKLM\Software\Microsoft\MSCRM\SandboxClientOperationTimeoutInSec
• HKLM\Software\Microsoft\MSCRM\SandboxHostOperationTimeoutInSec
• HKLM\Software\Microsoft\MSCRM\SandboxWorkerOperationTimeoutInSec

The screenshot below shows the three registry settings, by default they are all set to 120 seconds (2 minutes). Changing these settings can be used to either decrease or increase the sandbox timeout.

Microsoft Dynamics CRM Reporting Extensions Error - Requested value ‘Geo’ was not found

When attempting the SRS Data Connector Installation, you may encounter the following error:

The error is Microsoft.Crm.Setup.SrsDataConnector.RegisterServerAction failed.

Requested value ‘Geo’ was not found

Solution
To fix this issue and complete the installation, follow these steps:

1. Download CRM 2011 Update Rollup 6
2. Install the SrsDataConnector that came with your CRM ISO. Click the Cancel button when the error message appears.
3. Install the SrsDataConnector from the UR 6 download
4. Go to the directory where the SRS Data Connector is installed e.g. C:\Program Files\Microsoft Dynamics CRM Reporting Extensions
5. Start SetupSrsDataConnector.exe, select Repair and click Next

Microsoft Dynamics CRM Reporting Extensions Install Error

You may receive this error when trying to install the Microsoft Dynamics CRM Reporting Extensions (SSRS Data connector):

A Microsoft Dynamics CRM Server component is using the same account as the instance of SQL Server Reporting Services

Solution
Add a new Registry key to the computer that is running the SSRS Data Connector installation:

1. Start, Click Run, type regedit, and then click OK.
2. In the registry, find: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM
3. Right click MSCRM, and create a new DWORD Value with the name IgnoreChecks
4. Double click IgnoreChecks, and enter 1 in the Value data field.