SharePoint 2010 SharePoint Administration Service not starting

SharePoint 2010 SharePoint Administration Service (spadminv4) not starting.

This is because of a new security patch that requires access to the internet from the server which in many cases is not available. For those servers the SPAdminv4 service times out while trying to start.

http://social.technet.microsoft.com/Forums/en-US/sharepoint2010setup/thread/850d9823-2c7c-4557-8e85-904a59f73704

KB: http://support.microsoft.com/kb/2677070

Solution:
- Enable internet connectivity from the affected servers via TMG
- Uninstall the patch after checking with security.

SP2010 Claims

WS-Security provides a core function by defining mechanisms for assuring message authenticity, integrity and confidentiality through the use of security tokens. 

WS-SecurityPolicy enables the description of the security requirements of services via assertions about the security mechanisms of the services (i.e. algorithms and types of tokens that the service accepts). Using these assertions web services are able to recognize and assess the types of security tokens and claims that are required for exchanging messages securely. 

WS-Trust provides an additional piece of the foundation for federation by defining a service model, the Security Token Service (STS), and a protocol for requesting/issuing these security tokens which are used by WS-Security and described by WS-SecurityPolicy.

A fundamental goal of WS-Federation is to simplify the development of federated services through cross-realm communication and management of Federation Services by re-using the WS-Trust Security Token Service model and protocol.

WS-Federation does not restrict users to a specific security token format. Instead, WS-Federation builds on the WS-Trust encapsulation mechanism, the RST/RSTR, which allows protocol processing to remain agnostic of the type of token being transmitted.

Access to SharePoint Server running in Claims Mode Authentication utilizes

a Security Token Service (STS) which is essentially an authentication gateway to SharePoint
Server that enables access for Windows Integrated Authentication, Form Based Authentication and Trusted Claims Providers (TRUST).


C2WTS

Some service applications require the use of the Windows Identity Foundation (WIF) Claims-to Windows Token Service (C2WTS) to translate claims within the farm to Windows credentials for outbound authentication. It is important to understand that Service Applications that come with SharePoint Server can leverage the C2WTS only if the incoming authentication method is either Classic mode or Windows claims. 


Claims Augementation

A claims provider in SharePoint Server 2010 can be used to augment claims and provide name resolution. By using claims authentication, you can assign rights based on claims without having to know who users are, or how they are authenticated. You only have to know the attributes of the users. You can, for example, use a piece of corporate metadata that is associated with a person and have the claims provider do a lookup to another system to determine the different identities of a particular person—Windows, forms-based authentication, SAP, CRM, and so on—and map another identifier or set of claims to that identity. Those claims are then used to grant access to resources.

Compund Claims augemenation with AND operator

http://msdn.microsoft.com/en-us/magazine/hh547099.aspx

Claims encoding

http://www.directsharepoint.com/2011/11/claims-encoding.html

Difference between Windows Claims and SAML Claims

http://msdn.microsoft.com/en-us/library/ee534967.aspx

Network load balancer considerations

You need to set network load balancing to single affinity when using claims-based authentication. If you use SAML token-based authentication with AD FS on a SharePoint Server 2010 farm that has multiple Web servers in a load-balanced configuration, there will be an effect on the performance and functionality of client Web-page views. When AD FS provides the authentication token to the client, that token is submitted to SharePoint Server 2010 for each permission-restricted page element. If the load-balanced solution is not using affinity, each secured element is authenticated to more than one SharePoint Server 2010 server, which will result in rejection of the token. After the token is rejected, SharePoint Server 2010 redirects the client to authenticate again back to the AD FS server. After this occurs, an AD FS server will reject multiple requests that are made in a short time period. This behavior is by design, to protect against a denial of service attack. If performance is adversely affected or pages do not load completely, set network load balancing to single affinity. This isolates the requests for SAML tokens to a single Web server.

 

References:

http://msdn.microsoft.com/en-us/library/bb498017.aspx

http://technet.microsoft.com/en-us/library/hh487289.aspx
http://technet.microsoft.com/en-us/library/cc262350.aspx
http://claimsid.codeplex.com/
http://blogs.technet.com/b/speschka/archive/2010/02/13/figuring-out-what-claims-you-have-in-sharepoint-2010.aspx
http://blogs.technet.com/b/speschka/archive/2012/06/02/the-spmigrateusers-tool-for-changing-account-identities-in-sharepoint-2010.aspx
http://blogs.technet.com/b/speschka/

Performance Tuning - RPS

Important parameters to consider for performance monitoring of a SharePoint farm,

• Requests per second (RPS) - Gathered using IISLogs and LogParser
• Disk I/O per second (IOPS)
• Disk Megabytes transferred per second (MBPS)
• Disk I/O latency

References:


Planning guide: http://www.microsoft.com/en-us/download/details.aspx?id=21097
Capacity planning: http://www.microsoft.com/en-us/download/details.aspx?id=21307
Analysis of SharePoint usage using LogParser

http://www.cleverworkarounds.com/2012/05/31/demystifying-sharepoint-performance-management-part-1-how-to-stop-developers-blaming-the-infrastructure/

http://social.technet.microsoft.com/wiki/contents/articles/8666.sharepoint-2010-best-practices-en-us.aspx

SharePoint search - Reduce network traffic

Scenario:
http://hostname1.com is an intranet site is hosted on an internal Server 1. The host file on server has an entry to make sure all requests made to hostname1 points to the same server, 
127.0.0.1 hostname1
However each time the SharePoint search crawler runs all requests made to http://hostname1 is first made to the proxy which then redirects it back to Server 1 which unnecessarily increases load on the network and the proxy introducing performance issues.


Solution:
- Review the corporate proxy script (if you have one) used for IE on the server and make sure it does not send intranet request to the proxy.


- If the above does not solve the problem, follow below steps
        => Grant search content access local server rdp access on Server 1
        => Login to the server with the search content access account 
        => Open IE and uncheck "Automatically detect proxy"
        => Remove the search content access account rdp access to Server 1
I am very sure the above steps can be handled differently by editing the registry for the local machine which is something I was not able to uncover so far.

SP2010 - Developer Dashboard

SP2010 Developer:
http://sharepoint.microsoft.com/Blogs/GetThePoint/Lists/Posts/Post.aspx?ID=457

ULS using Powershell

Control ULS using Powershell:
http://msdn.microsoft.com/en-us/library/ff595318.aspx

SP2010 Export/Import List

Scenario:
Copy a list "ListName" (Title = ListTitle) from source "Site 1" to destination "Site 2" subsites. "Site 2" already has a list with the name "ListName". The title and url both are the same on source and destination.


Solution:


export-spweb "http://hostheader/subsite/site 1" -path "c:\folder_name" -itemurl "/subsite/site 1/listname" -includeusersecurity -nofilecompression -includeversions 4


Open the folder, "folder_name" and edit the Manifest.xml file.
Find and replace "ListName" to something else.
Find and replace "ListTitle" to something else.


Import-SPWeb " http://hostheader/someothersubsite/site 2 " -path "c:\folder_name" -nofilecompression -includeusersecurity

SP2010 Search one-way trust domain

Scenario:
In a multi-domain environment where is one way trust between domanis search does not return security trimmed results for either one of the domains. 


Error in ULS: 
AuthzInitializeContextFromSid failed with ERROR_ACCESS_DENIED. This error indicates that the account under which this process is executing may not have read access to the tokenGroupsGlobalAndUniversal attribute on the querying user's Active Directory object. Query results which require non-Claims Windows authorization will not be returned to this querying user. da324c89-8a72-4b2b-a2b9-ed5cab78c16d


Solution:
This is because the search service accounts do not have required permissions to gather ACLs for the domain account who issued the search query. Resolution is to force search service app to use Claims to store acl information and for security trimming the service account do not need to talk to domain controllers to get acls.


http://support.microsoft.com/kb/2344518 

SP2010 Upgrade

Scenario:
Error while upgrading site with publishing features enabled. Command used is upgrade-spcontentdatabase


Upgrade [SPSite Url=site url] failed. Microsoft.SharePoint.Portal.Upgrade.MossSiteSequence has the ContinueOnFailiure bit set. Moving on to the next object in sequence.
[powershell] [SPUpgradeSession] [ERROR] [5/8/2012 2:16:28 PM]: Inner Exception: Attempted to perform an unauthorized operation.
[powershell] [SPUpgradeSession] [ERROR] [5/8/2012 2:16:28 PM]:    at Microsoft.SharePoint.SPSite.set_AllowMasterPageEditing(Boolean value)
   at Microsoft.SharePoint.Portal.Upgrade.AllowMasterPageEditingAction.Upgrade(SPSite site)
   at Microsoft.Office.Server.Upgrade.SiteAction.Upgrade()
   at Microsoft.SharePoint.Upgrade.SPActionSequence.Upgrade()


Solution:
Make sure all options are enabled for the SharePoint Designer settings at the web application level and re-run the command.

Managed Metadata Service - OfflineTermStorenames

Scenario:
Created a new managed metadata service application and associated it to web apps. When we try to execute the below three lines of powershell, you notice that the metadata service application is listed under offlinetermstorenames and nothing under TermStore or DefaultTermStores. This used to be case even if I created the service application using UI or Powershell.



$site = Get-SPSite $site_url
$session = Get-SPTaxonomySession -site $site
$session



Solution: 

To get offline termstore back:

1. Make sure we have MMS service started on at least one machine in the farm.
2. IIS reset on all WFEs.
3. Wait for about 15 to 20 minutes. [IMP Step]

4. It will back online by itself.

Reference:
http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.taxonomy.taxonomysession.offlinetermstorenames.aspx

Search service is not able to connect to the machine that hosts the administration component

Scenario:
A SP2010 Farm with 1 SSA(Search service application). Trying to provision another SSA using UI or Powershell, either ways results in the same behavior. The provisioning completes successfully however when you navigate to the SSA management page for the particular app, it displays the above message with the GUID of the administration component. Key point to observe here is that the search pool account used by SSA1 is the account under which the OSearchv4 service runs. SSA2 which is being provisioned now uses a different service account.


Solution:
I checked the databases that got created once SSA2 was provisioned and noticed that only the new service account is getting added to them as owner. ULS logs in verbose mode indicates that the OSearchV4 service account is trying to access SSA2's databases and cannot login. Hence the solution to my problem was to simply add the OSearchv4 service account as dbowner to the newly created databases and then wait for some time for the administration component to get provisioned.


Alternatively the below powerhshell can also be executed,
$searchapp=New-SPEnterpriseSearchServiceApplication "SSA2 name"

$searchinstance= Get-SPEnterpriseSearchServiceInstance "servername" 
$searchadmin=Get-SPEnterpriseSearchAdministrationComponent -SearchApplication $searchapp
$searchadmin=Set-SPEnterpriseSearchAdministrationComponent -SearchApplication $searchapp -SearchServiceInstance $searchinstance


Remember to wait at least 5 mins for the provisioning to complete.

Powershell - Get-SPSite Owner, Size

Get-SPSite "url" | select url,owner,@{label="Size in GB";Expression={$_.usage.storage/1GB}} | convertto-csv | set-content test.csv

Design Ideas - Get Latest changes from SharePoint

Requirement: Users need to know new additions, modifications or deletions within a SharePoint site collection during a time range.


Solution options:
1. Use the SharePoint Foundation change log, http://msdn.microsoft.com/en-us/library/bb417456.aspx
2. Query the site collection using SPQuery or SPSiteDataQuery based on Created and Modified columns.

SP2010 Claims

Very interesting tips about SP2010 and claims:
http://msdn.microsoft.com/en-us/library/ff953202.aspx

SharePoint 2010 and Kerberos

Simple cheat sheet to enable kerberos on an existing SP2010 web application configured in Classic Mode and currently using NTLM.


Scenario: Web application host name is xyz.company.com and is hosted over http. Pool account is domain\poolacnt


Steps: 
1. Check if there is a SPN existing in current forest as http\xyz.companyname.com. If the spn is not setup for account domain\poolacnt then we will run into a duplication issue. Hence either the existing SPN needs to be removed or a decision needs to be made on the host name.


For W2008 Server use command setspn -q http/xyz.companyname.com


2. Register SPN for pool account using setspn command


3. Configure SP Authentication Provider in central admin


4. In IIS 7 -> Web Site -> Authentication -> Windows Authentication make sure Negotiate is the first option selected. For testing purpose, remove everything from the listbox and add only Negotiate:Kerberos to the list. This will prevent NTLM fallback


5. Use Fiddler, KerbTray and Windows event logs to troubleshoot and make sure kerberos is the authentication mechanism being used.


Issues faced: Due to a duplicate SPN registered with another service account in AD the behavior I experienced was, the web site was repeatedly prompting for user credentials although the credentials were right and eventually returned HTTP 401. Once we removed the duplicate and waited for replication to complete, this issue was resolved.

References:
http://technet.microsoft.com/en-us/library/cc961976.aspx
http://technet.microsoft.com/en-us/magazine/ee914605.aspx
http://technet.microsoft.com/en-us/library/cc738207(v=ws.10).aspx

SP2010 Managed Account 20 char limit

If you use an account which has more than 20 chars length while registering managed accounts the below error is returned,


The specified user domain\username could not be found. Some or all identity references could not be translated.

SP2010 Upgrade Incoming Email does not work

Scenario:
Configured Incoming email on new SP2010 farm as per technet. Database attach upgraded a SP2007 site collection. The host name has not changed in SP2010 but the incoming email server address changed.
Incoming emails are seen in the drop folder but do not get processed. ULS reports "missing alias" errors for the aliases which were working in SP2007.


Solution:
For the library where the incoming email feature is not working, navigate to list settings -> incoming email settings, disable incoming email and enable with same email address


To identify impact on environment using below SQL query against content database,



SELECT Webs.FullUrl, AllLists.tp_Title, AllLists.tp_EmailAlias
FROM AllLists
Inner join webs on AllLists.tp_WebID = Webs.Id
where AllLists.tp_EmailAlias is not null

When to create a Service Application ?

Scenarios where service application development becomes a requirement


Those that share data across site collections or web applications (such as the Web Analytics or Managed Metadata service applications in SPS 2010)

Those that provide specialized calculations or analytics services (such as Web Analytics, Excel Services, or PerformancePoint Services)

Those that aggregate data (such as Search)

Those that are long-running or very intensive processes (such as Web Analytics, Search, or Word services)

Those that are used for middle-tier applications

Reference: http://msdn.microsoft.com/en-us/library/gg193964.aspx

PostBuild - GACUtil

Here is a handy visual studio post build script to GACassemblies and recycle application pools.

gacutil.exe -if "$(TargetDir)$(TargetFileName)"
iisapp /a SharePointContentAppPool /r

SP2010 Breadcrumb Missing

Scenario:
On sites with /default.aspx as homepage after migration from SP2007 to SP2010, the breadcrumb is missing on homepage. When you click the folder icon in ribbon it says "The page location is:" and does not show anything else below it.


Solution:
Use SPD to remove, “ContentPlaceHolderId="PlaceHolderTitleBreadcrumb" runat="server"/>” from default.aspx.


Reference: http://social.technet.microsoft.com/Forums/en/sharepoint2010setup/thread/632558af-f9f0-4b54-87e4-cc75a0947b2a