Who can run the capacity reports, and "EXECUTE permission was denied"
Which SCOM roles and SQL Server permissions the OpsLogix capacity reports use, and how to fix an EXECUTE permission denied error on the OpsLogixCapacityReports procedures.
Applies to: OpsLogix Capacity trending reports 1.0.13 and later · SCOM 2019, 2022, 2025
Last updated: October 2026 · Reading time: 4 minutes
Who can run and schedule the reports
The capacity reports follow the normal SCOM reporting security. Users who can see the Reporting workspace, such as members of a Report Operator role, can run the reports, schedule them and publish them. No extra rights are needed.
How the reports read the data warehouse
When a report runs, Reporting Services connects to the data warehouse with the SCOM Data Warehouse reader account, through the shared data source of SCOM. That account is a member of the database role OpsMgrReader in the data warehouse. The capacity management pack grants this role EXECUTE on its 14 stored procedures; the forecasting functions and tables are reached through those procedures.
Error: EXECUTE permission was denied
A report fails with a message like:
The EXECUTE permission was denied on the object 'OpsLogixCapacityReports_GETLRFleetDS',
database 'OperationsManagerDW', schema 'dbo'.This happens when the grants or the role membership are missing, for example after the data warehouse was moved to a new SQL Server or rebuilt from scripts. Check both in the data warehouse database:
-- members of OpsMgrReader: the Data Warehouse reader account must be listed
SELECT m.name AS Member
FROM sys.database_role_members rm
JOIN sys.database_principals r ON r.principal_id = rm.role_principal_id
JOIN sys.database_principals m ON m.principal_id = rm.member_principal_id
WHERE r.name = 'OpsMgrReader';
-- EXECUTE grants on the capacity procedures: expect 14 rows
SELECT OBJECT_NAME(major_id) AS ProcedureName
FROM sys.database_permissions
WHERE grantee_principal_id = DATABASE_PRINCIPAL_ID('OpsMgrReader')
AND permission_name = 'EXECUTE'
AND OBJECT_NAME(major_id) LIKE 'OpsLogixCapacityReports[_]%';If grants are missing, restore them:
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETCounterDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETCustomLogoImg TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETInstanceDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETLanguageDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETLRDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETLRGroupsDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETLRCore TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETLRFleetDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_SummarizeForecast TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETProfilesDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETProfileDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETManagedEntityDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETObjDS TO OpsMgrReader;
GRANT EXECUTE ON dbo.OpsLogixCapacityReports_GETRuleDS TO OpsMgrReader;If the reader account is missing from the role, the SCOM reporting configuration itself is affected, and other SCOM reports fail too. Repair that first, following Microsoft's documentation for the Data Warehouse reader account.