SSRS Install Fails because Access Control List is not in Canonical Form

Question

SSRS Install Fails because Access Control List is not in Canonical Form

Loc750-2546 1

We are upgrading SQL server from 2016 to 2017, which means SSRS is now a separate installation. The OS is Windows Server 2019. We ran the 2017 version of SQLServerReportingServices.exe and the main installation log reports,

"UnexpectedError: Burn engine encountered error. PackageId: SSReportingServicesSetup.msi, ErrorType: WindowsInstaller, ErrorCode: -2147483648, Data: , ErrorMessage: Something went wrong, please find details in setup logs.CallStack:"

SSReportingServicesSetup.msi.log reports,

"1|----| Install Microsoft.BIServer.Setup.UpdateConfigFileStep |----------------

1|Reading Config File [F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\rsreportserver.config]

1|Setting Installation ID to 50778157-1ab9-4e34-9a86-451ae47a3480

1|Writing ConfigReader File [F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\rsreportserver.config]

1|----| Install Microsoft.BIServer.Setup.UpdateConfigFileStep | END |----------

1|----| Install Microsoft.BIServer.Setup.UpdateWebConfigFileStep |----------------

1|Reading Web Config File [F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\web.config]

1|Updating temp directory [F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\RSTempFiles]

1|Writing Web Config File [F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\web.config]

1|----| Install Microsoft.BIServer.Setup.UpdateWebConfigFileStep | END |----------

1|----| Install Microsoft.BIServer.Setup.ConfigureDirectoriesStep |----------------

1|Install Step Microsoft.BIServer.Setup.ConfigureDirectoriesStep threw exception. System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified.

at System.Security.AccessControl.CommonAcl.ThrowIfNotCanonical()

at System.Security.AccessControl.CommonAcl.RemoveInheritedAces()

at System.Security.AccessControl.CommonSecurityDescriptor.SetDiscretionaryAclProtection(Boolean isProtected, Boolean preserveInheritance)

at System.Security.AccessControl.ObjectSecurity.SetAccessRuleProtection(Boolean isProtected, Boolean preserveInheritance)

at Microsoft.BIServer.Setup.ConfigureDirectoriesStep.RootDirectorySetAcls(DirectoryInfo rootDirectory)

at Microsoft.BIServer.Setup.ConfigureDirectoriesStep.CreateDirectoriesAndSetAcls()

at SetupEngine.Install()

1|Attempting to roll back..."

F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\rsreportserver.config is ok, but F:\Program Files\Microsoft SQL Server Reporting Services\SSRS\ReportServer\web.config has an ACL error. Icacls "f:\program files" /verify reported no errors. The rest of the folders in the path do not exist until the installer adds them. We tried the 2019 version of SSRS and got the same error. Does anyone know a fix for this?

Lakshmi Narayana Garikapati 1,300 Reputation points Microsoft External Staff Moderator

2026-03-17T11:30:43.35+00:00

Hi Loc750-2546,

It looks like the installer is failing when it tries to set ACLs on the ReportServer directory. The key part of the log is:

System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified.

That means the ACLs on your F:\Program Files path aren’t in canonical order, so the SSRS setup can’t apply its permissions. Even though icacls /verify didn’t show errors, the ACLs can still be out of order.

Things you can try:

Reset ACLs on the parent folder

Run from an elevated prompt:

icacls "F:\Program Files" /reset /T /C

This will reapply default inherited permissions and fix the canonical order.

Use Explorer to fix ACLs

Right‑click F:\Program Files → Properties → Security → Advanced. If Windows detects a non‑canonical ACL, it will prompt you to correct it. Apply changes and retry the installer.

Backup before resetting

If you’re concerned about losing custom permissions, back them up first:

icacls "F:\Program Files" /save acl_backup.txt /T

Alternative workaround

If you don’t want to touch ACLs on Program Files, install SSRS into a different folder (e.g. F:\SSRS) where permissions are clean.

thanks,

Lakshmi.
Lakshmi Narayana Garikapati 1,300 Reputation points Microsoft External Staff Moderator

2026-03-23T10:13:49.9366667+00:00

Good to hear SSRS installed fine after the ACL reset. You’re right — when you upgrade SQL Server, the setup usually puts back any permissions it needs for its service accounts. If something was removed, the upgrade should fix it. Keeping the backup from icacls /save until after the upgrade is a smart move. Looks like you’re ready for the next step

Thanks

Lakshmi.
Lakshmi Narayana Garikapati 1,300 Reputation points Microsoft External Staff Moderator

2026-03-26T11:35:34.0566667+00:00

Hi Loc750-2546,

Following up to confirm if the earlier responses addressed your query. If not, please share your questions and we’ll assist further

Thanks,

Lakshmi.

Answer recommended by moderator

0 additional answers

Your answer

Lakshmi Narayana Garikapati 1,300 Reputation points Microsoft External Staff Moderator

2026-03-17T11:30:43.35+00:00

Hi Loc750-2546,

It looks like the installer is failing when it tries to set ACLs on the ReportServer directory. The key part of the log is:

System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified.

That means the ACLs on your F:\Program Files path aren’t in canonical order, so the SSRS setup can’t apply its permissions. Even though icacls /verify didn’t show errors, the ACLs can still be out of order.

Things you can try:

Reset ACLs on the parent folder

Run from an elevated prompt:

icacls "F:\Program Files" /reset /T /C

This will reapply default inherited permissions and fix the canonical order.

Use Explorer to fix ACLs

Right‑click F:\Program Files → Properties → Security → Advanced. If Windows detects a non‑canonical ACL, it will prompt you to correct it. Apply changes and retry the installer.

Backup before resetting

If you’re concerned about losing custom permissions, back them up first:

icacls "F:\Program Files" /save acl_backup.txt /T

Alternative workaround

If you don’t want to touch ACLs on Program Files, install SSRS into a different folder (e.g. F:\SSRS) where permissions are clean.

thanks,

Lakshmi.
Lakshmi Narayana Garikapati 1,300 Reputation points Microsoft External Staff Moderator

2026-03-23T10:13:49.9366667+00:00

Good to hear SSRS installed fine after the ACL reset. You’re right — when you upgrade SQL Server, the setup usually puts back any permissions it needs for its service accounts. If something was removed, the upgrade should fix it. Keeping the backup from icacls /save until after the upgrade is a smart move. Looks like you’re ready for the next step

Thanks

Lakshmi.
Lakshmi Narayana Garikapati 1,300 Reputation points Microsoft External Staff Moderator

2026-03-26T11:35:34.0566667+00:00

Hi Loc750-2546,

Following up to confirm if the earlier responses addressed your query. If not, please share your questions and we’ll assist further

Thanks,

Lakshmi.

Answer 1

Loc750-2546 1

Checking for non‑canonical ACL with Windows Explorer detected no issues. Ran the icacls /save and then /reset commands. I was able to install SSRS to F:\Program Files. SQL is also in F:\Program Files, but we are about to upgrade SQL so my hope is that if the icacls /reset command modified any permissions SQL needs then its upgrader will fix them. Thank you for your help.

0 comments

Share via

SSRS Install Fails because Access Control List is not in Canonical Form

0 additional answers

Your answer