Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Set-RsUrlReservation

Reserves a URL for a Reporting Services endpoint the RS-native way — RS applies the correct service-account permission automatically, so you never compute...

Domain: SSRS / PBIRS · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

Before a report server can answer at a web address, that address has to be “reserved” for it. Done by hand with netsh, this is the single most error-prone step — you have to hand-compute a permission string, and a wrong one means the site won’t start. This command lets Reporting Services do it, so the permission is always correct.

Calls ReserveURL on the RS WMI configuration class. RS applies the correct ACL for its own service account automatically — you never supply an SDDL/SID. Use the strong wildcard https://+:443 (default) to serve every host name that resolves to the box from one reservation; use a host-specific string only to deliberately restrict access. Never throws.

Recipe 01 — Reserve a vanity name for PBIRS

Set-RsUrlReservation -RsInstance 'PBIRS' -UrlString 'https://reports.example.com:443'

RS applies the service-account ACL automatically.

Recipe 02 — Strong wildcard for the SSRS web portal (covers every name that resolves)

Set-RsUrlReservation -RsInstance 'SSRS' -Application ReportServerWebApp

Defaults to https://+:443, covering machine name, vanity, cluster listener, and IP in one reservation.

Recipe 03 — Remote node with credentials

Set-RsUrlReservation -RsInstance 'SSRS' -UrlString 'https://reports.example.com:443' `
    -ComputerName RS02 -Credential $cred

A “URL reservation” tells Windows: traffic for this web address belongs to this service. Reporting Services needs one before it can serve HTTPS.

The hard part, historically, is a permission string tied to the service account — get it wrong and the site fails to start. This command sidesteps all of that by asking Reporting Services to make the reservation itself; RS knows its own account and sets the permission correctly.

Question Answer
Outbound calls? None. A WMI call to the local (or named) RS server.
What it changes Adds a URL reservation in HTTP.sys via the RS configuration API.
Privileges RS admin + local admin; WinRM for remote.
Manual-netsh avoided Yes — no hand-computed SID/SDDL.
Dependency Why Required?
SSRS 2016+ or PBIRS The service being configured. Yes
The RS virtual directory ReserveURL requires one; the command ensures it (idempotent). Handled
WinRM to remote nodes Only for remote targets. No (local)
  • The service-account ACL is applied by RS itself — removing the classic manual-netsh mistake of an over-broad or incorrect URL permission.
  • A host-specific reservation can deliberately restrict which names the server answers, when that’s a requirement.
  • Keeps HTTP.sys and RS configuration in sync, so what’s reserved matches what RS believes is reserved — nothing hidden from a review.