Any way to do this?

Dave Wickert, if you're out there...
I posted this question before, but would like to know if there is a way to
keep domain admins from viewing cube data from Excel. I tried creating roles
and preventing access by restricting dimensions in MDX expressions, but they
can still see the data, regardless of how I construct the role. They are not
OLAP administrators, so can someone who knows, please tell me what's going o
n
here behind the scenes?
ThanksI think I may have posted to your previous question, but since then I
have found the answer.
There is a registry setting that was introduced for SP4 that allows you
to exclude the machine admins from the OLAP Administrators.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OL
AP Server
\CurrentVersionExcludeMachineAdminFromOL
APAdmin
Creating a Dword entry and setting it to a value of 1 should fix your
issue. (I assume you may need to restart the service after setting this
value)
There is a list of all the Analysis Services registry entries here:
http://msdn.microsoft.com/library/d...rl=/library/en-
us/dnsql2k/html/sql2k_anservregsettings.asp
Below is the section of that page that refers to this new key.
<snip>
The ExcludeMachineAdminFromOLAPAdmin entry controls the inclusion of the
local Administrators group as administrators of the Analysis Services
server.
This entry is not installed in the registry during the setup process.
This entry was added for SP4.
<snip>
Regards
Darren Gosbell [MCSD]
<dgosbell_at_yahoo_dot_com>
Blog: http://www.geekswithblogs.net/darrengosbell|||Yep. That's what I was looking for. Thanks.
"Darren Gosbell" wrote:

> I think I may have posted to your previous question, but since then I
> have found the answer.
> There is a registry setting that was introduced for SP4 that allows you
> to exclude the machine admins from the OLAP Administrators.
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OL
AP Server
> \CurrentVersionExcludeMachineAdminFromOL
APAdmin
> Creating a Dword entry and setting it to a value of 1 should fix your
> issue. (I assume you may need to restart the service after setting this
> value)
> There is a list of all the Analysis Services registry entries here:
> http://msdn.microsoft.com/library/d...rl=/library/en-
> us/dnsql2k/html/sql2k_anservregsettings.asp
> Below is the section of that page that refers to this new key.
> <snip>
> The ExcludeMachineAdminFromOLAPAdmin entry controls the inclusion of the
> local Administrators group as administrators of the Analysis Services
> server.
> This entry is not installed in the registry during the setup process.
> This entry was added for SP4.
> <snip>
> --
> Regards
> Darren Gosbell [MCSD]
> <dgosbell_at_yahoo_dot_com>
> Blog: http://www.geekswithblogs.net/darrengosbell
>|||I'll point out the obvious that an Administrator can always add him/her to
the OLAP Administrators group, perform whatever query they want, and then
remove themselves. So if you are going to go down this route, and you really
want a secure system, you need to put auditing of groups into place.
--
Dave Wickert [MSFT]
dwickert@.online.microsoft.com
Program Manager
BI Systems Team
SQL BI Product Unit (Analysis Services)
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"Tom" <Tom@.discussions.microsoft.com> wrote in message
news:115E132E-E4DC-4CB5-BADD-06EA7F44EFE1@.microsoft.com...[vbcol=seagreen]
> Yep. That's what I was looking for. Thanks.
> "Darren Gosbell" wrote:
>