Background

A customer recently experienced a problem when processing a data mining structure that is based on a cube: that is, the data source for the clustering model was queried from the Analysis Services cube rather than the underlying DW.
As part of security procedures,  the customer had changed the configuration file so that the startup account for Analysis Services is no longer a server admin. This change did not cause any problems when processing other models or when processing cubes and dimensions. However, processing of the clustering model failed with the following error:

Errors and Warnings from Response
Internal error: The operation terminated unsuccessfully.
OLE DB error: OLE DB or ODBC error: The UseTransaction and MasterTransaction request properties are reserved for database administrators..
Errors in the OLAP storage engine: An error occurred while processing the 'Internet ~1 ~MG' partition of the 'Internet ~1 ~MG' measure group for the 'Customer Clusters ~MC' cube from the Adventure Works DW 2008R2 database.
Server: The operation has been cancelled.
Errors in the OLAP storage engine: An error occurred while processing the '~CaseDetail ~MG' partition of the '~CaseDetail ~MG' measure group for the 'Customer Clusters ~MC' cube from the Adventure Works DW 2008R2 database.

Explanation

In this case, the Impersonation option for structure and model processing was set to Default.
Using Default causes different credentials to be used, depending on how the data source is accessed. If accessed for processing, the service account credentials will be used to access data. If accessed for querying, the current user credentials will be used, if possible.

When processing a mining structure that is built on a cube, by default Analysis Services uses the service startup account.
If the Analysis Services startup account doesn’t have full permission on the OLAP cube, you cannot process the model.

This article provides more details on why this is the case: http://msdn.microsoft.com/en-us/library/ms187597.aspx.
To summarize, regardless of the DataSourceImpersonationInfo property value, the credentials of the current user will be used for out-of-line bindings, ROLAP queries, local cubes, and data mining models -- which includes querying DM models.

Another option we looked at is to modify the XMLA sent to the server by adding an attribute to the BeginTransaction command.
(http://technet.microsoft.com/en-us/library/ms187133.aspx). This workaround (though undocumented) works for cubes but not when processing mining structures.

Workarounds

[1] Add the service account as database admin
Ensure that the property <ServiceAccountIsServerAdmin> Property is set to 1 (True) .
This property is exposed only in the msmdsrv.ini file. The default location for the msmdsrv.ini file is C:\Program Files\Microsoft SQL Server\MSAS10_50.SQL2008R2\OLAP\Config)
Take a copy of the file, and do not make additional changes.

--- OR --

[2] Add a role for processing

1. Create a new role in the database
2. Grant Full Control to this role
3. Add the Service Account as a member of this role

 

Discussion

In some sense, the first workaround defeats the purpose for having removed the service account from admins!
However, the purpose of not having the service account as an admin is really to prevent querying as that account. To process the model, you still need to be able to read data from the cube, which means special treatment under certain scenario.

Please carefully consider the security implications before using this workaround for OLAP mining models.