You might see a scenario where data refresh with PivotTables or slicers or Data > Refresh All Connections are not working, and you are seeing an error in the browser like this:
You may also find a corresponding error in the SharePoint logs like this one:
“MossHost.TryGetWindowsIdentity: Current identity is ClaimsIdentity. We need to get a WindowsIdentity”
With PowerPivot workbooks viewed in the browser via Excel Services, in order for PivotTables or slicers or Data > Refresh All Connections to work, the C2WTS is utilized. If the C2WTS is being run by a domain account (Microsoft recommended best practice), then that domain account needs a few certain permissions on each of the SharePoint servers where it is running:
- The C2WTS domain account must be in the local Administrators group on the SharePoint servers where C2WTS is running
- For the SharePoint servers where C2WTS is running, in the server’s local security policy, the C2WTS domain account needs these permissions:
- Act as part of the operating system
- Impersonate a client after authentication
- Log on as a service
To access a server’s Local Security Policy, go to Start > Administrative Tools > Local Security Policy > Local Policies > User Rights Assignment
If you do add any of the permissions above for the account that is running the C2WTS, then you will need to restart the C2WTS on each of the SharePoint servers where it is running.
If the account that is running the C2WTS is LOCAL SYSTEM (not recommended), then no further permissions are required.