Friday, June 24, 2011
Why replicate directory changes permission sharepoint 2010 user profile synchronization
Question: Why are replicate-directory-changes permissions needed to synchronize with AD and on what in AD?
Answer: In order to interrogate AD about “what has changed since time xyz”, we need the replicate-directory-changes permissions on partitions being synchronized, for example the domain partition being synchronized. These permissions are needed in particular to be able to read data within the deleted objects container of the partition. Standard users do not have permissions to read the content of this container, and we cannot simply grant rights over that container to the synchronization account.
In RC we also require these permissions on the cn=configuration container, in order to access the netbios information for the domain (we are working to fix this for RTM, so this container permissions will be required only if your netbios name is different than your domain name)
Question: Do the replicate-directory-change permissions allow the holder to modify AD?
Answer: Holder cannot modify AD using these permissions
Question: What additional privileges are granted (beyond the ability to read and inquire of delta changes) with replicate-directory-changes permissions?
Answer: Holder can read all AD data for the domain, except passwords. Note that most of the directory information is by default readable by everyone, including data in the configuration partition.
Reference:
http://social.msdn.microsoft.com/Forums/en-US/sharepoint2010general/thread/398f3553-5de7-456b-b935-4e22cee26b2f
Answer: In order to interrogate AD about “what has changed since time xyz”, we need the replicate-directory-changes permissions on partitions being synchronized, for example the domain partition being synchronized. These permissions are needed in particular to be able to read data within the deleted objects container of the partition. Standard users do not have permissions to read the content of this container, and we cannot simply grant rights over that container to the synchronization account.
In RC we also require these permissions on the cn=configuration container, in order to access the netbios information for the domain (we are working to fix this for RTM, so this container permissions will be required only if your netbios name is different than your domain name)
Question: Do the replicate-directory-change permissions allow the holder to modify AD?
Answer: Holder cannot modify AD using these permissions
Question: What additional privileges are granted (beyond the ability to read and inquire of delta changes) with replicate-directory-changes permissions?
Answer: Holder can read all AD data for the domain, except passwords. Note that most of the directory information is by default readable by everyone, including data in the configuration partition.
Reference:
http://social.msdn.microsoft.com/Forums/en-US/sharepoint2010general/thread/398f3553-5de7-456b-b935-4e22cee26b2f
Tuesday, June 21, 2011
SharePoint Profile Import using AD.
This article explains the detailed steps to import profiles from AD to SharePoint,
http://support.microsoft.com/kb/827754
http://support.microsoft.com/kb/827754
Monday, June 20, 2011
MOSS 2007 search crawler Stopping / Crawling / Crawling Full
Scenario:
Users are complaining that new documents added to SharePoint platform are not being returned in the search results.
Diagnosis:
Search content source crawler is in Crawling/Crawling Full or Stopping state.
FIX:
1. Run the following command on all the Query and Index server one at a time and make sure that there are no errors.
net stop osearch
net start osearch
2. This command does not drop the search index.
3. After this command has executed correctly on all servers then the content source status should be set to Idle and it will start again as per its regular crawl schedule.
The real reason behind why the the crawl stops intermittently is still not determined in our environment. Also we are looking at options to monitor crawl status either using MS SCOM 2007 or writing custom code so that admins are alerted when crawls do not complete in acceptable amount of time.
Some quick links that may help. Please note that some of the steps may actually drop existing search index or call for creating a new SSP,
http://msmvps.com/blogs/shane/archive/2009/04/13/fixing-moss-search.aspx
http://support.microsoft.com/kb/930887/en-us
Users are complaining that new documents added to SharePoint platform are not being returned in the search results.
Diagnosis:
Search content source crawler is in Crawling/Crawling Full or Stopping state.
FIX:
1. Run the following command on all the Query and Index server one at a time and make sure that there are no errors.
net stop osearch
net start osearch
2. This command does not drop the search index.
3. After this command has executed correctly on all servers then the content source status should be set to Idle and it will start again as per its regular crawl schedule.
The real reason behind why the the crawl stops intermittently is still not determined in our environment. Also we are looking at options to monitor crawl status either using MS SCOM 2007 or writing custom code so that admins are alerted when crawls do not complete in acceptable amount of time.
Some quick links that may help. Please note that some of the steps may actually drop existing search index or call for creating a new SSP,
http://msmvps.com/blogs/shane/archive/2009/04/13/fixing-moss-search.aspx
http://support.microsoft.com/kb/930887/en-us
Project Server 2007 - Content Database attach / dettach
Never detach and then attach a content database that hosts project server web access site. It looses its link with the SSP that created it and users will get the below exception when they try to access the web access site,
401 Unauthorized access Exception.
"As best practice maintain all project workspace site collections as part of a different database than the pwa site collection." otherwise they also loose the link the web access.
FIX:
Navigate to SSP which created the PWA
1. Take SQL backups of all PWA databases.
2. Create a new PWA
3. Provide the same name of the pwa that existed along with all the exact same names of databases that are already created.
4. Try to provision the PWA
5. Note that the account used to perform the above activities should be the SSP service account.
Once the PWA is provisioned the site should open fine.
401 Unauthorized access Exception.
"As best practice maintain all project workspace site collections as part of a different database than the pwa site collection." otherwise they also loose the link the web access.
FIX:
Navigate to SSP which created the PWA
1. Take SQL backups of all PWA databases.
2. Create a new PWA
3. Provide the same name of the pwa that existed along with all the exact same names of databases that are already created.
4. Try to provision the PWA
5. Note that the account used to perform the above activities should be the SSP service account.
Once the PWA is provisioned the site should open fine.
Friday, June 17, 2011
People picker - slow performance
Use this people picker setting to configure it read user values from specific forests.
Peoplepicker-searchadforests:
http://technet.microsoft.com/en-us/library/cc263460%28office.12%29.aspx
Peoplepicker-searchadforests:
http://technet.microsoft.com/en-us/library/cc263460%28office.12%29.aspx
Sharepoint guidance no context retrieve configuration
IConfigManager configManager = new HierarchicalConfig();
configManager.GetFromPropertyBag(key, site);
configManager.GetFromPropertyBag
Subscribe to:
Posts (Atom)