Search service is not able to connect to the machine that hosts the administration component

Scenario:
A SP2010 Farm with 1 SSA(Search service application). Trying to provision another SSA using UI or Powershell, either ways results in the same behavior. The provisioning completes successfully however when you navigate to the SSA management page for the particular app, it displays the above message with the GUID of the administration component. Key point to observe here is that the search pool account used by SSA1 is the account under which the OSearchv4 service runs. SSA2 which is being provisioned now uses a different service account.


Solution:
I checked the databases that got created once SSA2 was provisioned and noticed that only the new service account is getting added to them as owner. ULS logs in verbose mode indicates that the OSearchV4 service account is trying to access SSA2's databases and cannot login. Hence the solution to my problem was to simply add the OSearchv4 service account as dbowner to the newly created databases and then wait for some time for the administration component to get provisioned.


Alternatively the below powerhshell can also be executed,
$searchapp=New-SPEnterpriseSearchServiceApplication "SSA2 name"

$searchinstance= Get-SPEnterpriseSearchServiceInstance "servername" 
$searchadmin=Get-SPEnterpriseSearchAdministrationComponent -SearchApplication $searchapp
$searchadmin=Set-SPEnterpriseSearchAdministrationComponent -SearchApplication $searchapp -SearchServiceInstance $searchinstance


Remember to wait at least 5 mins for the provisioning to complete.

Powershell - Get-SPSite Owner, Size

Get-SPSite "url" | select url,owner,@{label="Size in GB";Expression={$_.usage.storage/1GB}} | convertto-csv | set-content test.csv

Design Ideas - Get Latest changes from SharePoint

Requirement: Users need to know new additions, modifications or deletions within a SharePoint site collection during a time range.


Solution options:
1. Use the SharePoint Foundation change log, http://msdn.microsoft.com/en-us/library/bb417456.aspx
2. Query the site collection using SPQuery or SPSiteDataQuery based on Created and Modified columns.

SP2010 Claims

Very interesting tips about SP2010 and claims:
http://msdn.microsoft.com/en-us/library/ff953202.aspx

PS2010 Solution Starter - Unauthorized 401

Couple of tools (Bulk Edit / Import) in the Project Server 2010 Solution Starter, http://archive.msdn.microsoft.com/P2010SolutionStarter do not work in a load balanced environment and result in 401 Unauthorized exception.


Solution: This is due to double hop issue arising out of PSI calls in the code.
Here are the various options,
1. Implement Kerberos on the farm (production solution)
2. Implement AAM to point all requests to one of the servers in the farm.
    - Set up public url in the internet zone.
    - Set up IIS bindings on all servers to point to the 1 server which will server content.
    - IIS reset


*Make sure the project web access application pool account is a project server administrator on the pwa instance.

SharePoint 2010 and Kerberos

Simple cheat sheet to enable kerberos on an existing SP2010 web application configured in Classic Mode and currently using NTLM.


Scenario: Web application host name is xyz.company.com and is hosted over http. Pool account is domain\poolacnt


Steps: 
1. Check if there is a SPN existing in current forest as http\xyz.companyname.com. If the spn is not setup for account domain\poolacnt then we will run into a duplication issue. Hence either the existing SPN needs to be removed or a decision needs to be made on the host name.


For W2008 Server use command setspn -q http/xyz.companyname.com


2. Register SPN for pool account using setspn command


3. Configure SP Authentication Provider in central admin


4. In IIS 7 -> Web Site -> Authentication -> Windows Authentication make sure Negotiate is the first option selected. For testing purpose, remove everything from the listbox and add only Negotiate:Kerberos to the list. This will prevent NTLM fallback


5. Use Fiddler, KerbTray and Windows event logs to troubleshoot and make sure kerberos is the authentication mechanism being used.


Issues faced: Due to a duplicate SPN registered with another service account in AD the behavior I experienced was, the web site was repeatedly prompting for user credentials although the credentials were right and eventually returned HTTP 401. Once we removed the duplicate and waited for replication to complete, this issue was resolved.

References:
http://technet.microsoft.com/en-us/library/cc961976.aspx
http://technet.microsoft.com/en-us/magazine/ee914605.aspx
http://technet.microsoft.com/en-us/library/cc738207(v=ws.10).aspx

SP2010 Managed Account 20 char limit

If you use an account which has more than 20 chars length while registering managed accounts the below error is returned,


The specified user domain\username could not be found. Some or all identity references could not be translated.