Here is crystal's official take on this:

I'm glad your problem is solved. The reason you had to change settings in the web.config has to do with ASP.NET security settings. Usually asp.net takes its settings from the web.config in the project directory, which overrides any web.config files in higher directories. If one can't be found there, it's taken from a higher directory. Occasionally we see a problem where asp.net ignores the current web.config and takes one from higher up in the directory structure - again, this will depend on how you have your asp.net security set up, and has nothing to do with Crystal Reports itself.
Here's a link on one of their article pertaining to the web.config modifications.

http://support.businessobjects.com/l...s/c2013128.asp