We are getting ready to roll out a product with one of my clients based on Analysis Services 2005. The product is one of their first that requires Active Directory integration. This is mainly predicated by the fact that for some reason Analysis Services 2005 will only work with Active Directory based authentication. So we had to create a whole new credential store just for this addin.
As we were doing it we decided that we would create a group for each cube and then add members to the group to grant access to the cube.
This worked great in Development but when we went to deploy it to our QA environment failed. The users never had access to Analysis Services. It drove us bonkers trying to figure it out.
After some time on the phone with Microsoft PSS we found the issue to be the fact that we had used a Domain Local Group. Come to find out these groups are only intended for use on Domain Controllers. I had neve seen this distinction and must admit I had always wondered the difference between the two group types.
Our development machine was not a domain controller but for some reason the groups worked there. The solution? Move to Domain Global Groups which will work on any machine in the domain.