User Account for MSAS Authentication is Locked in Active Directory When Published Workbook is Viewed

Published: 20 May 2016
Last Modified Date: 10 Apr 2018


The user account used to authenticate to the Microsoft SQL Server Analysis Services (MSAS) database might become locked in the Active Directory under the following conditions:
  • The workbook viewed was created in Tableau Desktop 9.2, or an earlier version, with Windows Active Directory authentication (published with Server Run As, Impersonate, or Viewer Credentials).
  • This workbook has been edited in Tableau Desktop 9.3 and the authentication is changed to Specific Username and Password (published with Prompt Users or Embedded Username/Password).
  • The upgraded workbook is published to Tableau Server.
  • The published workbook is viewed.


  • Tableau Server 9.3.0-9.3.5
  • Microsoft SQL Server Analysis Services (MSAS)
  • Database authentication via Windows Active Directory (AD)


Option 1

To resolve, upgrade to Tableau Server 9.3.6.

Option 2:
Use one of the following workarounds:
  • Continue using Windows Active Directory (AD) with the upgraded workbooks. Issue is only seen when the authentication is changed from Windows AD to Specific Username and Password.
  • Rebuild the workbooks using Tableau Desktop 9.3. Issue is specific to workbooks that were created in Tableau Desktop 9.2 or earlier and edited in Tableau Desktop 9.3.


This behavior is related to a known issue which has been corrected.

Additional Information

  • When published with Prompt Users, the Active Directory (AD) lock occurs within a few minutes even if no credentials are entered in the Prompt Users dialogue box.
  • The AD lock is specific to the username used when authenticating to the database in Tableau Desktop (these credentials may be different from the publisher of the workbook or data source).
  • This issue is specific to workbooks created in a previous version, edited in Tableau Desktop 9.3 and published to Tableau Server 9.3.  
  • Migrated workbooks should be unaffected.
Did this article resolve the issue?