"Share"-Point

Moeten bedrijven strafrechtelijk vervolgd worden na hack?

2012-02-15T09:48:00.001+01:00

[Apologies to non-Dutch speakers for this Dutch post]

De afgelopen week is bekend geworden dat KPN de dupe is geworden van hackers. Nu meer en meer informatie naar buiten komt, blijkt dat deze hack grotendeels mogelijk is gemaakt doordat ze hun zaakjes niet op orde hadden (http://tweakers.net/nieuws/79918/hack-bij-kpn-kinderlijk-eenvoudig-door-verouderde-software.html). De hackers schijnen zelfs toegang gehad te hebben tot de core componenten van hun netwerk infrastructuur en zouden daar de mogelijkheid gehad hebben om klanten af te luisteren of af te sluiten.

Hacks
De laatste tijd zijn steeds meer bedrijven/instellingen het slachtoffer van hackers. Een aantal pakkende voorbeelden hiervan zijn:

En deze week blijft het maar doorgaan:

Creation Point/Bavaria: http://tweakers.net/nieuws/79987/hacker-krijgt-toegang-tot-database-hostingprovider-bavaria.html
Philips: http://tweakers.net/nieuws/80016/hacker-steelt-e-mailadressen-uit-database-philips.html

In sommige gevallen spelen ze de grote onschuld en plaatsen ze zichzelf in de slachtofferrol. In het geval van Diginotar hebben ze zelfs geprobeerd de hack onder de pet te houden, wat uiteindelijk geresulteerd heeft in hun faillissement. Vaak blijft de waarheid echter anders te liggen.

Oorzaak
Als de achterliggende feiten bekend worden, blijkt het beheer van de IT omgeving abominabel slecht! Alle security best practices worden met voeten getreden, niet heel onlogisch dus dat ze een keer de klos zijn. Slechte wachtwoorden, ongepatche systemen, verouderde systemen, slechte inrichting en slechte code zijn maar een kleine selectie van oorzaken. Vele van de bovenstaande hacks waren te voorkomen geweest als men hun huiswerk had gedaan en zich aan de bekende security best practices had gehouden:

De hack die gebruikt is bij de 50 gemeentes: Het misbruikte probleem (Unicode hack) is al bijna 10 jaar bekend en verholpen in alle nieuwe software sinds 2002/2003.
De hack die gebruikt is bij het Sinterklaasjournaal: Hier werd door een gebruiker ingevoerde gegevens zonder validatie door de website gebruikt (SQL injection), met alle gevolgen van dien. Een best practice die ook al jaren bekend is en hier dus niet gevolgd is.

Met kromme tenen lees ik dan ook de berichten die de afgelopen maanden in het nieuws verschenen. Keer op keer blijkt dat bedrijven hun zaakjes niet op orde hebben. Het is gewoon wachten op het volgende bericht. Welke bedrijf zal de volgende zijn…….

Persoonsgegevens
Veel bedrijven willen tegenwoordig alles van je weten; NAW gegevens, e-mailadressen, gebruikersnaam/wachtwoorden, creditcard gegevens, noem het maar op. En alles wordt in databases opgeslagen. De gevolgen kunnen enorm zijn als deze informatie op straat komt te liggen doordat bedrijven laks met deze gegevens omgaan??

En wat nu?
Wat ik mij op dit moment afvraag: Moeten bedrijven niet strafrechtelijk worden vervolgd als persoonsgegevens door hun nalatigheid op straat komen te liggen?Het toevallige is dat de afgelopen week een vergelijkbaar iets ook publiekelijk afgevraagd word:

“CBP wil bedrijf boete geven bij hackincidenten”: http://www.telegraaf.nl/digitaal/11511512/__CBP_wil_bedrijf_boete_geven_bij_hackincidenten__.html

“Geef KPN megaboete”: http://www.telegraaf.nl/digitaal/11510372/___Geef_KPN_megaboete___.html

Nu hoor ik mensen al roepen
Als ik thuis mijn deur open laat staan en iemand neemt mijn televisie mee, moet ik dan ook vervolgd worden? Dit is echter een andere situatie en is het antwoord dus "nee", voornamelijk doordat je hier alleen jezelf mee heb. Ik ben de enige die geen tv meer kan kijken, niemand anders heeft hier last van.

Ook is het zo dat een gemiddelde fietsverzekering niet uitbetaald als je niet twee originele sleutels kunt overleggen. Zet je hem dus niet op slot, is dat je eigen schuld.

Conclusie
De meeste bedrijven denken veel te licht over beveiliging: http://www.telegraaf.nl/digitaal/11514835/___Bedrijven_denken_te_licht_over_beveiligen___.html

Door persoonlijke gegevens op te slaan, verplichten bedrijven zich tot het veilig houden van deze gegevens. Kunnen of willen ze dit niet, verwijder ze dan na de transactie en voorkom zo dat ze op straat komen te liggen. Echter is het vaak de (commerciële) waarde van deze gegevens voor mailings en andere marketing activiteiten die voorkomt dat deze gegevens verwijderd worden. Business gaat dan voor beveiliging.

NOTE: This article is my personal opinion and does not reflect the opinion of my employer or anybody else.

[SP2010/SPF] Required permissions to run command line tools or other tooling that uses the OM

2012-01-24T12:41:00.000+01:00

[ISSUE]
With SharePoint in many cases the SharePoint administrators also are the Windows of the SQL server and/or SQL administrator. This means that those persons also having loads of permissions in SQL Server, which means that everything will work without issues. They can do anything they want, using any tool they want.

But what about a situation where you don't have permissions on SQL. You will see actions via the Central Administration site work fine, however certain things like console applications (custom like SharePoint Manage or default applications like stsadm), scripts via PowerShell and other tooling (basically everything that uses the object model) won't work.

This is caused by the fact that SharePoint requires the account to have certain permissions on the databases in order for it to work. When using the Central Administration, this is done via the application pool account which has sufficient permissions. When using the object model outside of the Central Administration, this is done under the account the command is executed with.

[SOLUTION]
Then which permissions are required? Here is where it becomes a little tricky!

PowerShell scripts:

When you are running SharePoint 2010 and you are trying to use PowerShell, Microsoft has created a SharePoint internal group called ShellAdmins. By adding your account to this group (Add-SPShellAdmins) your account has sufficient permissions to run PowerShell scripts. Other activities via the object model still don't work.

Other tools:

To enable all object model activities, grant the account the following permissions:

SharePoint (Depending on the activities you are going to do)

Farm Administrator
Permissions in the site collection(s), for example site collection administrator or contributor to a list

Database:

Configuration database: WSS_Content_Application_Pools
Content database:

Db_datareader
Db_datawriter
GRANT EXECUTE
NOTE: An alternative would be db_owner permissions on the content database, however from SQL administration perspective this might be unwanted/against policy

NOTE: I am assuming that the account already has local administrator permissions on the SharePoint server, how else will you be able to run tools or scripts on the SharePoint server :-)

More info: SharePoint 2010 PowerShell Permissions Explainedhttp://sharepoint.microsoft.com/Blogs/zach/Lists/Posts/Post.aspx?ID=56

[SP ALL] Opening a web service is returning a 401.1 "Access Denied" error

2012-01-17T09:24:00.001+01:00

[ISSUE]
Yesterday I was asked to assist in troubleshooting an issue with a SharePoint web service. The SharePoint indexing process failed to work properly for just one web application. Some investigation revealed that the indexer was unable to open the sitedata.asmx web service. When trying to open the same web service via IE, I was prompted for credentials however whatever credentials were entered, after three attempts an "Access Denied" page (401.1 error) was shown.

[SOLUTION]
Unfortunately Process Monitor didn't reveal anything and I noticed that the sitedata web service wasn't the only web service that failed. After some troubleshooting I found out that the cause was in the web config:

The "remove verb *.asmx" line was placed after the "add verb *.asmx" line in the httphandler setting, essentially removing the configuration after adding it. For example:

<add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
....
<remove verb="*" path="*.asmx" />

After correcting this by placing the remove line in front of the add line, all web services started working just fine!

<remove verb="*" path="*.asmx" />
....
<add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />

[EXPLANATION]
Why is this happening? By first placing the remove line, you make sure any declarations that are done in other (global) configuration files are made void. That way you know for sure that no conflicts will occur between two configurations. However after removing the asmx httphandler, you have to declare it again, else SharePoint (or better yet IIS) does not know how to handle the asmx file. The confusing part for this issue is that it will display an authentication prompt to the user, without it actually being an authentication issue.

[SP2010/SPF] SharePoint 2010 Build numbers

2011-12-23T14:25:00.002+01:00

Here a list of build numbers for SharePoint 2010. Based on the build number you can determine which patchlevel your SharePoint environment is on:

14.0.6114.5000 - December '11 CU
14.0.6112.5000 - October '11 CU
14.0.6109.5002 - August '11 CU
14.0.6106.5000 - June '11 CU
14.0.6029.1000 - Service Pack 1
14.0.5138.5001 - April '11 CU
14.0.5136.5002 - February '11 CU
14.0.5130.5002 - December '10 CU
14.0.5128.5003 - October '10 CU
14.0.5128.5000 - October '10 CU (Incorrect package)
14.0.5123.5000 - August '10 CU
14.0.5114.5003 - June '10 CU
14.0.4763.1000 - RTM

[MOSS2007/WSSv3] SharePoint 2007 Build numbers (Updated)

2011-12-23T14:20:00.002+01:00

Here a list of build numbers for SharePoint 2007. This list is updated until the December '11 Cumulative Update:

12.0.6656 - MOSS2007/WSSv3 December '11 Cumulative Update
12.0.6654 - MOSS2007/WSSv3 October '11 Cumulative Update
12.0.6608 - MOSS2007/WSSv3 Service Pack 3
12.0.6565 - MOSS2007/WSSv3 August '11 Cumulative Update
12.0.6562 - MOSS2007/WSSv3 June '11 Cumulative Update
12.0.6557 - MOSS2007/WSSv3 April '11 Cumulative Update
12.0.6554 - MOSS2007/WSSv3 February '11 Cumulative Update
12.0.6550 - MOSS2007/WSSv3 December '10 Cumulative Update
12.0.6548 - MOSS2007/WSSv3 October '10 Cumulative Update
12.0.6545 - MOSS2007/WSSv3 August '10 Cumulative Update
12.0.6539 - MOSS2007/WSSv3 June '10 Cumulative Update
12.0.6535 - MOSS2007/WSSv3 April '10 Cumulative Update
12.0.6529 - MOSS2007/WSSv3 February '10 Cumulative Update
12.0.6524 - MOSS2007/WSSv3 December '09 Cumulative Update
12.0.6520 - MOSS2007/WSSv3 October '09 Cumulative Update
12.0.6514.5004 - (Corrected) MOSS2007/WSSv3 August '09 Cumulative Update
12.0.6514.5000 - MOSS2007/WSSv3 August '09 Cumulative Update
12.0.6510 - MOSS2007/WSSv3 June '09 Cumulative update
12.0.6504 - MOSS2007/WSSv3 April '09 Cumulative update
12.0.6421 - MOSS2007/WSSv3 SP2
12.0.6341 - MOSS2007/WSSv3 February '09 Cumulative update
12.0.6335 - MOSS2007/WSSv3 December '08 Cumulative update
12.0.6327 - MOSS2007/WSSv3 August '08 Cumulative update
12.0.6318 - MOSS2007/WSSv3 Infrastructure Update
12.0.6300 - MOSS2007/WSSv3 post-SP1 hotfix
12.0.6219 - MOSS2007/WSSv3 SP1
12.0.6039 - MOSS2007/WSSv3 October '07 public update
12.0.6036 - MOSS2007/WSSv3 August 24 '07 hotfix package
12.0.4518 - MOSS2007/WSSv3 RTM

You can find the build number of your environment via:
Central Admin > Operations > Servers in Farm

[SP2010] Upgrade to SP2010 issue with missing content types

2011-09-13T13:06:00.000+02:00

[ISSUE]
During a database upgrade from SP2007 to SP2010 I encountered an issue, which blocked a succesful upgrade. Several features could not be upgraded because of an issue with content types.

[ERROR]
[powershell] [SPSiteWssSequence2] [ERROR] [7/15/2011 1:14:56 PM]: Feature upgrade incomplete for Feature 'PublishingSite' (Id: 'f6924d36-2fa8-4f0b-b16d-06b7250180fa') in Site 'http://www.domain.com/sites/sitecollectionname'. Exception: The parent content type specified by content type identifier 0x010100C568DB52D9D0A14D9B2FDCC96666E9F2007948130EC3DB064584E219954237AF39 does not exist.

[CAUSE]
This issue is caused by the fact that:
- The publishing features (“SharePoint Server Publishing Infrastructure” and the features it is depending on) have been enabled and disabled in the past
- Content types have been deleted the incorrect way: Deleted while other components were still using them.

[SOLUTION]
The mentioned content type ID is the ID of the content type “Page”, which does not exist anymore in the Site Content Types. To recreate these, run the following stsadm commands for each site collection that is experiencing the issue (retrieve the list from the upgrade log file):

stsadm -o activatefeature -name PublishingSite -url <url> -force
stsadm -o activatefeature -name PublishingResources -url <url> -force

[SP2010] Service Pack 1 data storage changes

2011-08-10T15:05:00.000+02:00

With the release of Service Pack 1 of SharePoint 2010, Microsoft has changed the Data Storage limitations of SharePoint 2010. The 200GB is no longer a hard limit:

For a SharePoint content database up to 200 GB there are no special requirements and this limit is included for consistency.
For a SharePoint content database up to 4 TB you need to additionally plan for the following two requirements:

Requires disk sub-system performance of 0.25 IOPS per GB, 2 IOPS per GB is recommended for optimal performance.
Requires the customer to have plans for high availability, disaster recovery, future capacity, and performance testing.
And you need to review additional considerations in the TechNet Boundaries and Limits article.

For a SharePoint content database over 4TB specifically for a Document Archive scenario you are required to additionally plan for the following:

SharePoint sites must be based on Document Center or Records Center site templates and must be an archive scenario where less than 5% of content is actively read from each month and less than 1% of content is actively written to.
Do not use alerts, workflows, link fix-ups, or item level security on any SharePoint objects in the content database. Note: document archive content databases can be the recipient of documents as a result of Content Routing workflow.

Other specific limits changes being made at the same time:

A new limit of 60million items in any one SharePoint content database
The specific 5 TB limit per SQL Server instance has been removed. Instead you should work with a SQL Server professional to plan for database storage

The updated limitations are incorporated into the SharePoint Server 2010 capacity management: Software boundaries and limits

Source: http://sharepoint.microsoft.com/blog/Pages/BlogPost.aspx?pID=988

[SP2010] Upgrade SharePoint 2007 content to SharePoint 2010 via the Database Attach method

2011-07-20T14:17:00.001+02:00

Last week I performed an upgrade of SharePoint 2007 to SharePoint 2010 using the Database Attach method. Unfortunately the database upgrade "Completed with errors". However, the site collections were available in SP2010 without errors. Also changing the visual style to SP2010 worked just fine. Detaching the database and reattaching did not give me any error, but it didn't restart or continue the upgrade process. Then how to fix this:

Troubleshoot upgrade errors
Each upgrade process produces an upgrade log file, which displays each error and warning that is found during the upgrade. To successfully complete the upgrade process you will have to fix each error and restart the upgrade process to upgrade the remaining, not yet upgraded, site collections.

Restart/resume the database upgrade
Once you have fixed all upgrade issues, you have to restart the upgrade process. This can be done using the following PowerShell script:
Source: http://technet.microsoft.com/en-us/library/ff382638.aspx

$guid = Get-SPContentDatabase -Identity <dbname>
upgrade-spcontentdatabase -id $guid

However if the database still contains issues, the upgrade will fail again. Review the generated log file to check what the errors are and retrieve more info for troubleshooting.

Verify upgrade status
To verify if all components in the environment are upgraded successfully, run the following command:

stsadm -o localupgradestatus

This command generates a report that contains a summary at the bottom. The part marked bold is the important part and specifies that in all databases there are 16 site collections not upgraded yet, this number should be zero.

[9] content database(s) encountered.
[0] content database(s) still need upgrade or cannot be upgraded.
[43] site collection(s) are contained in the content databases.
[16] site collection(s) still need upgrade.
[82] other objects encountered, [0] of them still need upgrade or cannot be upgraded.

If you send the output of the command to file and search for the text "Needs Upgrade", you will find the site collections that aren’t upgraded yet:

  <object>
    <name>https://www.domain.com/sites/sitecollectionname</name>
    <type>Microsoft.SharePoint.SPSite</type>
    <level>6</level>
    <status>Needs Upgrade</status>
  </object>

[SP2010] Guidance on implementation of Service Pack 1 for SP2010

2011-07-04T10:41:00.001+02:00

Check out SharePoint 2010 SP1 and the June Cumulative Update for SharePoint 2010 for guidance on implementing SP2010 Service Pack 1 and the June 2011 Cumulative Update

I use SharePoint

2011-07-04T10:38:00.001+02:00

Released last week: I Use SharePoint

A lot of information (howto's, Quick Reference Cards, etc) on how to use SharePoint!

[SP2010] Service Pack 1 released

2011-06-29T10:22:00.000+02:00

Yesterday Microsoft released Service Pack 1 for SharePoint 2010!

More info on: SharePoint Team Blog

Two very good SharePoint articles

2011-06-08T13:35:00.000+02:00

Yesterday I ran into two very good SharePoint articles, that describe an often forgotten part of a SharePoint implementation: Governance!

[SP2007/SP2010] Migrate SharePoint across domains

2011-06-07T12:54:00.001+02:00

A while ago I worked on a project where we had to migrate a customer’s SharePoint 2007 environment from another service provider to a newly created environment in our own datacenter. The challenge we had during this project was that the new environment was built from scratch, meaning that the Active Directory would be a different one than the original environment was located in. Unfortunately there were no possibilities to create a trust between the two domains.

The above would mean that since the Active Directory changed, , the domain name would change as well as all user accounts (or SIDs). This meant that all security permissions, alerts and ownerships would become unusable. These had to be migrated to the new accounts in the new AD.

For migrating users, SharePoint offers a stsadm operation called “migrateuser”. However, at the time of the project there was no operation for groups migration, so we needed a solution for that as well.

[PROJECT INFO]

The web application URL's would not change
The user account format would not change in the new Active Directory. User1 in the old AD, would be User1 in the new AD.
MIIS was used to create the users in the source environment. ILM2007 would be used in the new environment. Any custom code used in MIIS could be migrated to the ILM2007 environment, however some changes and updates would be made in the process.
The old environment was based on 32 bit SharePoint 2007 on Windows Server 2003. The new environment would be based on 64 bit SharePoint 2007 on Windows Server 2008.

[ISSUES]

The source SharePoint environment contained a SSP. Unfortunately there is no way to copy the SSP or its settings to the new environment automatically. The SSP had to be recreated manually.
The user profiles in the SSP had to be migrated as well. There was no tool available that was able to export the user profiles and import in our new environment. We had to create a tool for this. On Codeplex we found a Profile Import tool (MOSS Profile Importer), but that was unable to export the information from an existing SharePoint farm. We used this code as a starting point for our own tool.
The migrategroup command did not exist yet, fortunately only seven different AD groups were used. These needed to be migrated manually.
The stsadm operation migrateuser has to be run for each user id. A custom solution is required to generate a script for all users. Running this script consumes much time and needs to be shortened as much as possible.

[MIGRATION]
The preparation steps we took were:

Create the custom tooling require to perform the migration (profile export/import, migrateuser script)
Perform a test migration in order to validate the migration steps and target environments.

The steps we took to migrate the content were:
Environment setup

Setup the new SharePoint 2007 environment and use same patch level as the original farm
Install all custom solutions on the target environment
Create all users in the new Active Directory
Setup the SSP in the target environment and configure it according to the settings of the old environment (user profile properties, profile import, audiences, search, etc)

User profile information

Import all users from AD into the SSP
Backup all user profile information to file
The import tool is using the user id to import the data to the correct profile, so we had to replace the old domain name with the new domain name in the export file
Restore all user profile information into the new SSP

Content

Create SQL backup of the source content databases (web applications and MySites) to a USB disk
Ship the disk to the other datacenter and connect it to the server
Restore the SQL backups on the target SQL server from USB disk
Connect the content databases to the correct web applications
Test the site collections for correct operation of the databases
Run the migrateuser script generation tool. This tool created three script files, which we could run on three different servers to speed up the migration process.
Run the migration scripts
Manually change group membership for each used group (add new group, grant permissions and remove old group) in the entire site structure

Testing

Test, test, test

[POST INFO]

Since the August 2009 Cumulative Update, SharePoint 2007 stsadm includes the migrategroup operation, which is able to migrate groups the same way migrateuser does for users.

[MOSS2007/WSSv3] PowerShell Library - List where a feature is activated

2011-04-04T14:09:00.000+02:00

[DESCRIPTION]
Microsoft recommends to deactivate a feature everywhere before you remove the feature from the environment. Unfortunately there is no way of determining where the feature is activated.

To solve this issue, I have created a PowerShell script.

How to use it:

Download the PowerShell script
Open the script in Notepad and edit the <featureid> text to match the id of the feature you are interested in
Run the script
Open the output in Microsoft Excel and use "*" as separator
Based on the Scope column you can determine if the specific feature is a site or web feature

[SP2010] SharePoint Timer service crashes constantly

2011-03-31T20:15:00.000+02:00

[SYMPTOMS]
I tried to retract a solution, but the status remained "Retracting" and never changed. After some investigation I found out that the SharePoint Timer service on one of the servers crashed every couple of minutes. The event log showed the following errors:

Log Name: System
Source: Service Control Manager
Date: 3/31/2011 9:24:55 AM
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: [Server name]
Description:
The SharePoint 2010 Timer service terminated with service-specific error %%-2147467259.

and

Log Name: System
Source: Service Control Manager
Date: 3/31/2011 9:24:55 AM
Event ID: 7031
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: [Server name]
Description:
The SharePoint 2010 Timer service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

The ULS log showed the following errors:

- The timer service could not initialize its configuration, please check the configuration database. Will retry later.

- Exiting the process because the timer could not be initialized after multiple attempts.
- The timer service is stopping

[CAUSE]
After searching the Internet I found one article where someone explained that this was caused by the fact that the Configuration Cache directory (C:\ProgramData\Microsoft\SharePoint\Config) did not contain a folder with the farm GUID as the name. After checking the configuration cache folder, that folder was indeed missing.

I then remembered I had to clear the configuration cache last week because the implementation of the February 2011 Cumulative Update failed during the Configuration Wizard step. Clearing the configuration cache fixed this issue. As it turned out, I was a little too enthousiastic with deleting the folders :-)

[Resolution]

Open the Registry Editor
Browse to HKLM > SOFTWARE > Microsoft > Shared Tools > Web Server Extensions > 14.0 > Secure > ConfigDB
Copy the value in the property "Id"
Browse to folder C:\ProgramData\Microsoft\SharePoint\Config and create a folder with the name of the previously copied value
Restart the SharePoint Timer service
The folder should be populated with XML files within a minute.

The “Soft” part of SharePoint - Part 6, Challenge the Business

2011-02-25T10:11:00.001+01:00

This is a tricky one! I know the saying "the customer is always right" or "the customer is king". In IT the business is your customer, IT by itself is useless. IT is there to support the business to work as efficient as possible, but does this mean that the customer is indeed always right.......

I have seen many cases where IT puts the business before everything. They do pretty much everything to do what the business asks them to do, often without questions. Very often this resulted in projects turning into disasters:

The business asks for more that they need
They radically change their requirements when you just started the implementation

And of course, afterwards the business starts complaining that it took too long and the costs were too high.

Then what is causing these kind of issues. Two reasons behind these drama’s are:

The business doesn’t know what exactly they want.

Result 1: They ask something else every day
Result 2: They ask what they think they want

The business is asking for IT solutions instead of specifying the business need

Result: They ask for a technical solution which is not fitting their business need

That is why IT should challenge everything the business is asking for: Do they have a clear picture what they want? Do they really want what they ask? Don't they mean something else and therefore ask the wrong question? Isn’t there an easier way to meet their business need?

This is not to question everything they do, but to get to know the true question behind the question. When all requirements are clear on all ends, projects can be executed easier and cheaper.

[MOSS2007/WSSv3] PowerShell Library - Check for large lists

2011-01-28T09:45:00.001+01:00

[DESCRIPTION]
Microsoft recommends not to use lists/libraries with a huge amount of items, so called large lists. These lists can seriously impact the performance of SharePoint. Unfortunately there is no way to keep track of such large lists from an administrative side.

In order to be able to determine where large lists exist, I have created a PowerShell script.

How to use it:

Download the PowerShell script
Open it in a text editor like Notepad
Run the script
Open the output in Microsoft Excel and use "*" as separator

[MOSS2007/WSSv3] PowerShell Library - Overview Request Access Email Address

2011-01-25T11:39:00.000+01:00

When creating a site collection or sub sites, it is possible to configure an e-mail address to which SharePoint will send Access Requests mails. When a mail address of a user is configured and that user leaves or changes roles, by default there is no way of checking where that address is used.

To solve this, I have created a script that generates a report with all configured mail addresses:

How to use it:

Download the PowerShell script
Run the script
Open the output in Microsoft Excel and use "*" as separator

The “Soft” part of SharePoint - Part 5, Change Management

2011-01-24T15:34:00.000+01:00

This time something that is not really SharePoint related, but this doesn’t make it less important!

Way too many times I have seen “Administrators from the Wild West”, in other words true cowboys. Clicking links and buttons like their lives depended on it. Reading error messages is so 2010 :-)

When troubleshooting an issue, Google is my friend. However not all answers given on the Internet always work or are safe to the environment. What if something goes wrong and I bring down the environment……..in a lot of cases all hell will break loose and I have to test my running skills :-p

How to prevent this?
Every change you are about to implement to a production environment is supposed to be tested before implementation. If you are working as an administrator (server or application), I hope you are familiar with ITIL* and its procedures, especially change management. If not, see the “More info” section and read up real quick!!

In a lot of cases Change Management is seen as a pain in the butt. But when implemented correctly it can save you a lot of work or better yet save you from having to do some overtime. The goal of change management is to make you think well about the change you are going to implement and put those steps on paper:

What are you trying to fix/resolve/accomplish?
What changes are you going to make?
What are the steps to implement the change?
What are the components that are affected?
What is the impact of the change for users and administrators?
Who needs to be notified about the change?
What to do if something goes wrong?
What to document afterwards?
Etc, etc

But that is not all: Two know more than one. Change management is also about having the thought process reviewed by others. These persons can have the same type of skills, but it is also important to have it reviewed by persons with different skills. Maybe your change has impact on their area of expertise you didn’t think of.

Change Management and DTAP
In combination with a DTAP strategy, Change Management can become even more powerful. All changes are tested on the Test environment, the implementation procedure tested on the Acceptance environment, after which the change is implemented on the Production environment.

More info:
ITIL: http://en.wikipedia.org/wiki/Information_Technology_Infrastructure_Library
Change Management: http://en.wikipedia.org/wiki/Change_Management_(ITSM)

[MOSS2007/WSSv3] SharePoint 2007 Build numbers (Updated)

2011-01-18T10:35:00.004+01:00

Here a list of build numbers for SharePoint 2007. This list is updated until the December '10 Cumulative Update:

12.0.0.6550 - MOSS2007/WSSv3 December '10 Cumulative Update
12.0.0.6548 - MOSS2007/WSSv3 October '10 Cumulative Update
12.0.0.6545 - MOSS2007/WSSv3 August '10 Cumulative Update
12.0.0.6539 - MOSS2007/WSSv3 June '10 Cumulative Update
12.0.0.6535 - MOSS2007/WSSv3 April '10 Cumulative Update
12.0.0.6529 - MOSS2007/WSSv3 February '10 Cumulative Update
12.0.0.6524 - MOSS2007/WSSv3 December '09 Cumulative Update
12.0.0.6520 - MOSS2007/WSSv3 October '09 Cumulative Update
12.0.0.6514.5004 - (Corrected) MOSS2007/WSSv3 August '09 Cumulative Update
12.0.0.6514.5000 - MOSS2007/WSSv3 August '09 Cumulative Update
12.0.0.6510 - MOSS2007/WSSv3 June '09 Cumulative update
12.0.0.6504 - MOSS2007/WSSv3 April '09 Cumulative update
12.0.0.6421 - MOSS2007/WSSv3 SP2
12.0.0.6341 - MOSS2007/WSSv3 February '09 Cumulative update
12.0.0.6335 - MOSS2007/WSSv3 December '08 Cumulative update
12.0.0.6327 - MOSS2007/WSSv3 August '08 Cumulative update
12.0.0.6318 - MOSS2007/WSSv3 Infrastructure Update
12.0.0.6300 - MOSS2007/WSSv3 post-SP1 hotfix
12.0.0.6219 - MOSS2007/WSSv3 SP1
12.0.0.6039 - MOSS2007/WSSv3 October '07 public update
12.0.0.6036 - MOSS2007/WSSv3 August 24 '07 hotfix package
12.0.0.4518 - MOSS2007/WSSv3 RTM

You can find the build number of your environment via:
Central Admin > Operations > Servers in Farm

[SP2010/SPF] SharePoint 2010 Build numbers

2011-01-18T09:27:00.000+01:00

Here a list of build numbers for SharePoint 2010. Based on the build number you can determine which patchlevel your SharePoint environment is on:

14.0.5130.5002 - December 10 CU
14.0.5128.5003 - October 10 CU
14.0.5128.5000 - October 10 CU (Incorrect package)
14.0.5123.5000 - August 10 CU
14.0.5114.5003 - June 10 CU
14.0.4763.1000 - RTM

[MOSS2007] PowerShell Library - Start Incremental crawl

2011-01-17T10:49:00.001+01:00

[DESCRIPTION]
SharePoint 2007 does not support crawl schedules larger than 24 hours. So if you want to schedule a crawl to run every 36 hours, by default there is no way to do this.

At a customer we had a very large environment, which had a huge amount of changes on a daily bases. A crawl during the weekend took just a few minutes, but during the week this increased to 32 hours. Because Microsoft also recommends not to start a crawl when the previous crawl is still running (even though it cannot run two instances of the same crawl, SharePoint does something that can break the index before it detects the crawl is already running), I have created a script that does this for me.

The script checks if a crawl is running and if so quits. If a crawl is not running, it starts another incremental crawl. By scheduling this script every 15 minutes, I can make sure the crawl is never stopped for more than 15 minutes.

How to use the script:

Download the PowerShell script
(If necessary) Change the Content Source name
Run or schedule the script

[MOSS2007/WSSv3] PowerShell Library - Site definition inventory

2011-01-11T14:33:00.000+01:00

For a project we were wondering which site definitions were used in our environment. I created the following script in order to create this inventory. It loops through all web applications, site collections and sub sites and logs the use definition for each site in a log file:

How to use it:

Download the PowerShell script
Run the script
Open the output in Microsoft Excel and use "*" as separator

[MOSS2007] PowerShell Library - Delete MOSS User Profiles

2011-01-10T16:56:00.000+01:00

[Description]
At a customer we had some disabled accounts which were not imported in the profile database but did have an MOSS profile. For whatever reason SharePoint did not deleted these profiles. The customer wanted to delete these profiles without removing all profiles.

To achieve this goal, I have created a PowerShell script.
How to use it:

Download the PowerShell script
Open it in a text editor like Notepad
Change the <url> into the URL of the web application you would like to check
Run the script

[MOSS2007/WSSv3] PowerShell Library - Dump all solutions

2010-12-20T08:42:00.000+01:00

Today I am sharing a PowerShell script I have created to export all solutions that have been added to SharePoint Solution Deployment.

A while ago I visited a customer to troubleshoot an issue, however they did very little about any form of documentation. This meant that I had no way of determining exactly which version of solutions they had installed. Using this PowerShell script I was able to export all installed solutions and start testing using the actually installed solutions.

How to use the script:

Download the PowerShell script
Create a folder called "Solutions" in the same directory
Run the script
All solutions (wsp files) are downloaded to the Solutions directory

[MOSS2007/WSSv3] PowerShell Library - Check for large Nintex workflow lists

2010-12-17T12:25:00.000+01:00

Over the past months, I have been creating several PowerShell scripts in order to make my life a little easier. This week I thought, why not sharing these scripts with the world and make everybodies life a little easier :-)

Therefore here script number 1: Check for large Nintex workflow lists!

[DESCRIPTION]
When using Nintex Workflow 2007 and activating the site feature, a hidden list is created in that site called NintexWorkflowHistory. Even time a workflow starts, a Log History action is used, etc an entry is written in this log. Unfortunately this list is not cleaned automatically, potentially becoming a feared "Large List". On one occasion a user had created a workflow that added 200.000 items in just five days to that list. Because it is a hidden list, it does not appear in the GUI and you cannot easily see the size of these lists.

In order to be able to determine where large Nintex lists exist, I have created a PowerShell script.

How to use it:

Download the PowerShell script
Open it in a text editor like Notepad
Change the <url> into the URL of the web application you would like to check
Run the script
Open the output in Microsoft Excel and use "*" as separator

The script generates an output file in the following format:

http://examples.sharepoint.com/sites/NintexSite * 8927
http://examples.sharepoint.com/sites/NintexSite/SubSite * 5304
http://examples.sharepoint.com/sites/NintexSite2 * 3840
http://examples.sharepoint.com/sites/NintexSite2/SubSite * 10239

The “Soft” part of SharePoint - Part 4, DTAP

2010-12-15T09:25:00.000+01:00

What is DTAP?
DTAP is a strategy very often used in software development projects. It stands for “Development, Test, Acceptance, Production” (http://en.wikipedia.org/wiki/Development,_testing,_acceptance_and_production). Software is developed on a development environment, then technically tested on the Test environment, user acceptance tests are performed on the acceptance environment after which it is transferred to the production environment.

SharePoint is a product that can function as a platform on which companies can build custom solutions. Even though SharePoint is build on the .NET Framework, it has its own rules and boundaries. Poorly developed code can easily affect SharePoint and cause it to fail or seriously impact performance. From an administration standpoint it is very important to evaluate solutions before deploying them to the production environment (see previous article in this series). A DTAP strategy will assist you in this evaluation process.

But not only with the deployment of solutions a DTAP strategy can be useful. Also the implementation of changes or SharePoint updates/Service Packs can benefit from this strategy. They can first be tested before implementing on the production environment.

Environments: Purpose and permissions
Development
With SharePoint you can have multiple kinds of development environments. Each developer can create his own virtual local environments or you can use a centrally managed environment. Both options have their pros and cons.

Local development environment:
Purpose: Environment used for developing new SharePoint solutions. The environment is under total control of the developer.
Responsible: Developer
Server admin: Developer
Admin access: Developer
Pro : Flexible, can be used everywhere, total control over environment, developers do not impact each other
Con : Developer has to maintain environment the environment (patches, etc), host needs to have sufficient resources, environment used by one developer only

Central development environment
Purpose: Environment used for developing new SharePoint solutions. Multiple developers per environment (2 max), but they can impact each other.
Responsible: Developer
Server admin: TAM
Admin access: TAM & Developer
Pro : Centrally managed according to standards, multiple developers per environment, requires less licenses, no high end local hardware required
Con : Can only be used when connected to the network (direct or VPN), developers can impact each other

Test
Purpose: Environment used for technical testing of developed SharePoint solutions (check if conflicts are present with other solutions) and their deployment instructions. Also changes to the environment (e.g. change of settings or implementation of patch or Service Pack) can be tested on this environment.
Responsible: TAM
Server admin: TAM
Admin access: TAM
Other access: FAM and developers have admin access to SharePoint site collections and if required read access to administration pages

Acceptance
Purpose: Environment used for functional testing of developed SharePoint solutions (check if solutions complies with functional design). This environment should match your PRD as close as possible (setup and configuration wise). Just content can be out-of-date.
Responsible: FAM
Server admin: TAM
Admin access: TAM
Other access: FAM has admin access to SharePoint site collections and if required read access to administration pages

Pre-Production environment
Purpose: Environment that is a very close mirror to the production environment. Mirror on solutions, content, architecture and infrastructure. Meant for testing the implementation to a production like environment and the impact on production. Performance tests can also be done on this environment.
Responsible: TAM
Server admin: TAM
Admin access: TAM
Other access: None

Production environment
Purpose: Environment that is running the production solutions/content and is serving end-user requests.
Responsible: TAM
Server admin: TAM
Admin access: TAM
Other access: FAM has admin access to SharePoint site collections and if required read access to administration pages

Important!!
Make sure that starting with the Test environment and onwards, all environments have the same layers of the topology. The environments don’t have to be equal in number of servers, but if PRD has three layers (database, application. Web front-end), Pre-Production, Acceptation and Test should be three layers as well. Back in 2006 I learned this the hard way (http://share-point.blogspot.com/2006/02/problems-with-search-functionality.html). Our Acceptation environment consisted out of two servers and Production out of three servers……..Installation of Windows 2003 SP1 worked just fine on Acceptation, it didn’t on Production and broke search. It took me two weeks to find out the issue and another two weeks to clean up the mess I created during troubleshooting :-)

Explanation:
Purpose : Describes the purpose of the environment.
Responsible : Who is functionally responsible for the environment.
Server admin : Who is the administrating party of the environment and has to make sure that the environment is patched, secure, backed up, etc.
Admin access : Who has administrative access to the server.
Other access : Which other access is granted to which parties.
TAM : Technical Application Management
FAM : Functional Application Management

[SP2010] Site templates in SharePoint 2010

2010-12-14T15:28:00.000+01:00

In SharePoint 2007 it was possible to create a site template (stp file) of a site and use that template to create new sites. When you downloaded that stp file and added it to the global template gallery by using the stsadm command addtemplate, you were able to create new site collections based on this template.

With SharePoint 2010, this mechanism has changed a bit. Site templates are no longer stp files, but when creating a template of a site SharePoint creates a Sandboxed solution which is placed in the sandboxed solutions gallery.

A possible solution
On his site Todd Klindt explains how to use these solutions to create new site collections based on this template.

Unfortunately this method has the downside that it requires manual actions, each time you would like to use the template.

An alternative
Another solution is to add the solution to the Farm Solutions gallery. This has the advantage that you don't have to upload the solution each time. But the downside is that when adding the solution, the template does not become available in the template selection, but is added as a feature to all site collections. During site collection creation you therefore still need to activate this feature before you can use the template.

The solution
Then how to solve this issue farm wide......simply by making a small change to the solution. The template feature in the solution is scoped to a site collection by default and therefore uploads the template to the site collection template gallery. If you change the scope of the feature to Farm and then activate that Farm feature, the template is globally deployed and available for selection during site collection creation!

The “Soft” part of SharePoint - Part 3, Solution intake process

2010-11-12T20:45:00.000+01:00

Where developer should have a standard SharePoint Development process, which describes the development best practices in your environment, should every SharePoint administrator have a solution intake process.

Poorly implemented custom solutions can introduce security or performance risks, increase the cost of support, complicate deployment, and reduce productivity. Over the past years I have seen that developers do not always know how to develop good solutions for SharePoint. Even though SharePoint is build on .NET, developing for SharePoint is a totally different discipline than developing for .NET. More than often I have seen developers delivering code that was either seriously affecting the environment, not using the SharePoint deployment framework or very poorly documented.

In order to guarantee quality, it is very important to create a solution intake process. The process verifies if certain best practices have been followed and the solution is safe to deploy the environment:

Create a code acceptance checklist for the developer to fill out.

This checklist forces developer to sign off their solutions against a list of Best Practices.

Check the code using SPDisposeCheck.

This tool checks the custom code for memory leaks and proper use of disposable objects.

Check deployment documentation.

Check if the deployment documentation is correct and contains the required information.

Check solution package

Check if the solution package is created properly, using the Solution Deployment framework technologies.

If you want to have a good example of a solution intake process, Microsoft has released some documents for their SharePoint Online cloud service. Their intake process is really strict and requires the developer to design, document and test the solution before handing it over to Microsoft. They have published their process in the following documents:

More information:
Check list example: http://technet.microsoft.com/en-us/library/cc707802.aspx
SPDisposeCheck: http://code.msdn.microsoft.com/SPDisposeCheck
Using Disposable Object: http://msdn2.microsoft.com/en-us/library/aa973248.aspx

[SP2010] Issue migrate Classic to Claims authentication

2010-11-09T12:28:00.007+01:00

[SITUATION]
Currently I am working at a customer where we have to migrate SharePoint 2007 data to a new SharePoint 2010 environment. Security ACLs on the SharePoint 2007 data are registered in the old SharePoint 2007 way (called Classic in SharePoint 2010). In order to use claims these ACLs need to be converted into Claims ACLs.

[ISSUE]
On the TechNet site I discovered this article. Unfortunately when performing these steps (running a PowerShell script), it did not work. As with many issues, SharePoint doesn't give any clue what might be wrong :-(

[SOLUTION]
After some troubleshooting I remembered an issue I had back in MOSS2007. There I tried to perform an activity on a site collection, which did not work. It turned out that I did not have permissions on the site collection. To solve that, I granted myself "Full Control" permissions via the "Policy for Web Applications" page, after which the activity worked fine.

To test this theory, I tried the following steps:

Create a new web application
Create a new site collection
Add some data and set unique permissions
Grant my admin account Full Control permissions for the web application
Run the PowerShell script to migrate the web application to Claims

and see here, the script now runs just fine and migrates all Classic ACLs to Claims ACLs!!

[NOTE]
Microsoft has confirmed that there are some issues with the Classic to Claims migration. According to them, Service Pack 1 will include a tool which should be able to successfully migrate Classic to Claims. So either test your migration thoroughly or wait for SP1 (expected end Q2/beginning Q3)!!

The “Soft” part of SharePoint - Part 2, Impact of design choices

2010-10-28T07:55:00.002+02:00

During every SharePoint design phase, choices have to be made on exactly how to implement SharePoint and its components. These choice can have serious implications later on during the administration phase.

To be able to create a good design, it is imperative to have good requirements for the environment. These requirements must be gathered both at the business and at IT end, as they both have to “use” the platform in the future, although their use will be completely different.

For example:

Where the business has certain availability requirements (e.g. 99.9% 24x7), IT has the requirement that these availability requirements must be achieved using redundancy. The final design has to be an environment design with which all parties can live with.
In order to deliver a good service, IT will have to be able to test each change to the environment. In order to do this, they will require testing facilities in the form of DTAP environments. In most cases, the business will experience the DTAP strategy as annoying and time consuming.

It is very important that all choices are documented in a design document, especially when the persons performing the implementation are different than the actual administrators of the environment. The design document has to be reviewed and approved by the future administrators before implementation starts. If during implementation a deviation from the original design has to be implemented, this deviation has to be agreed between both parties.

Basically: If the implementation project messes up (for whatever reason), the future administrators will suffer the consequences!!

Very good examples of critical design choices with high impact are:

Use of a DTAP environment* - During a project, implementing a DTAP strategy requires time and money. Two things a project very often doesn’t have a lot of. Skipping the implementation of DTA environments saves time and money for the project. However this choice will seriously impact administrators in their ability to test changes before implementation (patches/service packs, new solutions or configuration changes).
Redundancy in the environment - Implementing redundancy requires extra hardware and therefore extra costs for hardware, software licenses and installation. If during implementation the requirements do not include redundancy, this will not be designed and implemented. Unfortunately, adding redundancy later will require a lot of work and has a high impact, especially for SQL Server where adding redundancy (clustering) will mean a complete reinstallation of the entire SQL environment.
Sizing - I have been part of a project where the available storage was limited. We only had a certain amount of storage available, that was it. The disk space for all servers was just enough to contain all data. Once the environment was transferred to the administrators, one of the first things they had to do was adding extra disk space and moving database across these extra disks.

The message of this story: Most items mentioned might sound obvious, but unfortunately I have seen a lot of situations where this turned out to be harder than you would think/like.

If you are part of the implementation project, make sure that you involve the future administrators as soon as possible. If you are the future administrator, make sure you get involved as soon as possible. Each design decision has to be approved by both parties! So check and communicate between both parties early and continuously.

A very good input for IT requirements are acceptation criteria. This is a list of criteria to which the project has to comply to. That way you can save yourself a huge amount of time, effort and stress! So make sure you create these!

*More on DTAP will follow in a later post

The “Soft” part of SharePoint - Part 1: Skills

2010-10-18T10:09:00.004+02:00

With products like Exchange, only IT Pros are involved, the people who are implementing or administering the environment are often the same people that are managing the Windows operating system. At least they have sufficient (infrastructure) knowledge to cover all bases.

With SharePoint, this is a whole different ball-game. As SharePoint is build on top of a lot of Microsoft infrastructure products, good infrastructure knowledge is very important (Windows, DNS, Active Directory, ISA Server/TMG, etc). Unfortunately more than often, SharePoint knowledge is very limited with people who are cracks in those technologies. SharePoint developers however have very limited infrastructure knowledge, so they have a hard time doing a very good job from a performance/security perspective. In other words implementing or managing SharePoint properly can be quite a challenge.

Then what do you need?
When you are implementing or maintaining SharePoint in a proper way, you will need various kinds of skills. Most of the times these skills are not found in one person and therefore a team needs to be created.

The required skills are:

Server - Hardware and operating system
This is the most common discipline and the knowledge that is the most commonly available. Just like with other products, basic server management is required. This includes server patching, monitoring, backup/restore, antivirus management, troubleshooting, etc.

Database - SQL server
SharePoint is build on SQL databases. Without proper administration, these databases potentially can cause issues. However SharePoint databases cannot be compared to regular SQL database. They are very sensitive on actions you can and cannot do with them. Microsoft has released guidance (whitepaper and KB articles) for database administrators on how to manage SharePoint SQL databases.

Technical SharePoint
SharePoint Technical Application Management (TAM) is implementation and management of the infrastructure side of SharePoint. The full SharePoint configuration is the responsibility of TAM, therefore they are the only ones that are allowed to change that configuration. All TAM activities are done by logging onto the server or via the Central Administration. Most common TAM activities are: Application monitoring, troubleshooting application issues, application backup/restore, deploying SharePoint solutions, configuring SharePoint, creating web applications, SharePoint antivirus, etc.

Functional SharePoint
SharePoint Functional Application Management (FAM) is implementation and management of SharePoint from an end-user perspective. Determine which functionalities the user needs, how the logical structure is going to look like and how certain SharePoint components need to be configured. Tasks of FAM would be: Assisting end-users, setting up sites, site structure, content types, determining the desired configuration of SharePoint components like search/user profiles, etc. In an ideal world do these activities not require any access to the SharePoint servers directly. Everything can be done via a web browser.

SharePoint Custom Development
SharePoint is a very extendible platform. If the default out-of-the-box functionalities are not sufficient for end-users, extra functionality can be custom developed. All customizations are build using the .NET Framework, however pure .NET developers are not automatically SharePoint developers. SharePoint has its own set of development rules and best practices. SharePoint developers use Visual Studio to develop their custom code and package that in a SharePoint solution package. This package is then delivered to TAM, who are going to deploy this to the environment.

The technical and functional application management skills can be a grey area, as they can have some overlap. An example is the creation of Managed Properties:

Specifying managed properties is done by FAM, creating and configuring the managed properties is done by TAM.
Search management is the full responsibility of FAM

Each of the above skills can be implemented as a dedicated person(s), but also a combination of an SharePoint Technical guy (Skills: TAM/FAM) and a SharePoint Developer (Skills: FAM/Development). This totally depends on your organization. In a large organization, a split might be a good option to have a clear separation of duties.

The team that implements or administers SharePoint must have at least the first four skills available. The skill “SharePoint Development” is very useful (creating visual design, creating tools, etc), but not required.

The “Soft” part of SharePoint - Introduction

2010-10-15T16:05:00.004+02:00

Over the past years I have done many SharePoint (2003 and 2007) implementations or supported with existing implementations. With each of these environments I have ran into the same types of issues. I have decided to capture all of this knowledge into some blog posts. In the next few weeks, I will post these here, starting with “Skills”. So keep posted!!

[MOSS2007/WSSv3] User profiles - Updates and deletions

2010-10-07T11:53:00.003+02:00

The how, what and why with user profiles
SharePoint is made up of two separate products, which are very tightly integrated: Windows SharePoint Services v3 (WSSv3) and Microsoft Office SharePoint Server 2007 (MOSS2007). Because WSSv3 also can be implemented by itself, Microsoft has implemented WSS user profiles in order to keep track of user information in a WSSv3 environment. Each site collection has its own User Information List with profile information for each user that has ever logged onto the site collection.

When implementing MOSS2007, extra user profile functionality is implemented on top of WSSv3, but the WSSv3 profiles still exist in the site collections. To keep all user profile information synchronized across both the MOSS profiles and the WSS profiles, Microsoft has implemented a User Profile Synchronization mechanism which synchronizes all MOSS profile information to all WSS user profiles. Because MOSS profiles can be synchronized with AD, changes in AD are synchronized to all user profiles using this mechanism.

More information on user profiles can be found here (in Dutch).

How are deletions of AD accounts handled
When a full import from AD is done and a user which has a MOSS profile is not present in the AD import, this account is marked “Missing from Import”. When the user is missing from import during three imports, SharePoint considers this account as deleted and deletes the account from the MOSS profiles. Unfortunately these deletions are NOT replicated to the WSS profiles, so the WSS profiles of those users remain in the system.

Ok, what does that mean
I found out that when you are trying to grant a user permissions somewhere in a site collection, the SharePoint People Picker both checks the User Information List and Active Directory. If a user has been deleted from AD, but still exists in the User Information List (still has a WSS profile), this user is returned in the results. This means that you can still see users that have left the company ages ago, which is very confusing for site collection administrators:

Actual real life situation:
E.g. John Doe has left the company, I can’t see him anymore in the Outlook GAL, but I can still grant him permissions in my site collection.

Crap, how do I solve this
This can be solved by cleaning your WSS profiles regularly. Unfortunately by default this is a manual process. If you only have a few site collections and a few users, this is quite easy. But if you have many site collections and many users, this is a major challenge!

In my environment we created a custom tool for this issue:

The tool checks the MOSS profiles against the WSS profiles and creates a delta file, “which WSS profiles do not have a MOSS profile”
The output we compare (automated) with AD. This because we do not import all accounts like admin accounts
The ouput is then feeded into another tool, which deletes these accounts

And are there any things I need to pay attention to
Of course! Nothing comes without a price! Because the WSS profile of users are deleted all items or documents that have been by those users become “orphaned”. SharePoint is not able to display who created or changed the item or document. So be careful!

Another issue we encountered is with search. If permissions have been granted to individual users and these users are deleted, the crawl has to change these permissions in the index file. If your index is small and have a limited amount of content, reset the index and start a new few crawl is the quickest way. In our case we ran an incremental crawl, which took three times the time a full crawl usually needs. During the crawl it looked like the crawl process was stuck. This because it was updating the index file, which just takes a very long time!

3rd edition of the Free DIWUG SharePoint magazine

2010-10-05T13:23:00.002+02:00

The Dutch Information Worker User Group has released their 3rd edition of the Free DIWUG SharePoint Magazine. More information can be found at: http://www.diwug.nl/Pages/downloads.aspx

Available for download at:
http://www.diwug.nl/Downloads/DIWUG_SharePoint_eMagazine3.pdf

[MOSS2007] Cross domain Manager property

2010-10-05T12:53:00.003+02:00

In an Active Directory, it is possible to configure a manager for a specific user. SharePoint is able to use this information and show you a hierarchy on a users MySite. Unfortunately this functionality has a limitation caused by Active Directory.

Active Directory issue
Within Active Directory It is only possible to select users (or contacts) that are in the same forest or domain as manager. So if you have (like at a customer of mine) a multi forest, multi domain environment, with Forest Trusts between all forests, you cannot select a user from domain 1 in forest 1 as the manager of a user in domain 2 in forest 2.

Customer situation
At the customer, they are using two tools to manage the data in AD:
1.) A replication engine to replicate users in one domain as a contact in the other domain. These contact are used for Exchange in that domain.
2.) A self service portal where users can configure their own data, including manager. When a user changes his/her manager, this is changed in the domain that has been marked as master domain. If the manager does not exist in that domain as a user, the contact in that domain is selected.

SharePoint behavior
This situation causes SharePoint to "generate" two different kind of hierarchy trees. One for domain1 and the other for domain2. Because contacts are not treated as users in SharePoint (as it shouldn't), when browsing through the hierarchy you never end up with the real manager account.

Then how to solve this issue
In order to work around the issue, we have modified the replication engine in such a way that the replication engine performs the following steps:

Check the manager property and retrieve the master account in the other domain
Configure the master account name in a separate AD property, which is not used
Configure SharePoint to import that AD property as the manager, with the format <domain>\<userid> (configurable in property mapping settings)

This mechanism now works like a charm: Managers are imported correctly and more important, the hierarchy tree is displayed correctly!!

[SP2010] Keep data in upgrade from RC to RTM

2010-07-08T14:04:00.004+02:00

This week I wanted to upgrade our SharePoint 2010 RC environment to the RTM version. Unfortunately I found out that an upgrade was not supported by MS. Also a database detach and reattach to an RTM installation would not work :-(

But what about our data and site structure?? It is not much, but like any other person in IT I am lazy by nature: Don't want to do anything unless it is necessary :-)

As a test I created a site collection backup using stsadm of the site collection, reinstalled our environment with the RTM version of SharePoint 2010 and performed an stsadm restore. And it worked!

So if you want to upgrade from RC to RTM, but would like to keep your data, use stsadm backup/restore!!

[MOSS/WSSv3] SharePoint 2007 build numbers (Updated until June '10 CU)

2010-07-05T10:41:00.001+02:00

Here a list of build number of SharePoint 2007, updated until the June '10 Cumulative Update. Based on the build number you can determine which patchlevel your SharePoint environment is on:

12.0.0.6539 - MOSS 2007/WSS 3.0 June '10 Cumulative update
12.0.0.6535 - MOSS 2007/WSS 3.0 April '10 Cumulative update
12.0.0.6529 - MOSS 2007/WSS 3.0 February '10 Cumulative update
12.0.0.6524 - MOSS 2007/WSS 3.0 December '09 Cumulative update
12.0.0.6520 - MOSS 2007/WSS 3.0 October '09 Cumulative update
12.0.0.6514 - MOSS 2007/WSS 3.0 August '09 Cumulative update
12.0.0.6510 - MOSS 2007/WSS 3.0 June '09 Cumulative update
12.0.0.6504 - MOSS 2007/WSS 3.0 April '09 Cumulative update
12.0.0.6421 - MOSS 2007/WSS 3.0 SP2
12.0.0.6341 - MOSS 2007/WSS 3.0 February '09 Cumulative update
12.0.0.6335 - MOSS 2007/WSS 3.0 December '08 Cumulative update
12.0.0.6327 - MOSS 2007/WSS 3.0 August '08 Cumulative update
12.0.0.6318 - MOSS 2007/WSS 3.0 Infrastructure Update
12.0.0.6300 - MOSS 2007/WSS 3.0 post-SP1 hotfix
12.0.0.6219 - MOSS 2007/WSS 3.0 SP1
12.0.0.6039 - MOSS 2007/WSS 3.0 October '07 public update
12.0.0.6036 - MOSS 2007/WSS 3.0 August 24 '07 hotfix package
12.0.0.4518 - MOSS 2007/WSS 3.0 RTM

You can find the build number of your environment via:
Central Admin > Operations > Servers in Farm

Source

SharePoint 2010 and Office 2010 officially RTM

2010-04-18T12:46:00.003+02:00

The moment has finally come: SharePoint 2010 and Office 2010 are officially Released To Manufacturing (RTM).

More info: SharePoint blog

[MOSS2007/WSSv3] SharePoint 2007 and Large Lists

2010-04-16T11:11:00.001+02:00

Over the past years a lot of information became available on SharePoint 2007 and the use of large lists. Unfortunately it still happens a lot that large lists are created by users. What impact does this have and how to limit the impact of large lists?

Microsoft recommends to limit view to a maximum of 2000 items. However this is not the only thing that can impact large list performance. When sorting is used in a view, SharePoint has to sort all of the items, before it can create the view. So even when the view only contains 2000 items, SharePoint needs to retrieve ALL items anyway.

Therefore the recommendation for large lists is not only to limit the view to 2000 items, but also prevent sorting as much as possible. Especially in the default view, which is always used when a user accesses the list.

[MOSS/WSSv3] ForeFront update issues

2010-03-22T14:35:00.003+01:00

I just installed ForeFront for SharePoint on a customer environment. Three of the engines we refusing to update their engines. A search on the Internet resulted in the following article:

ForeFront: Action required by Dec. 1, 2009: Keep protections current

[MOSS/WSSv3] Site Settings not visible, even when I am a site collection admin

2010-03-17T13:24:00.003+01:00

[ISSUE]
Last week, I had to perform some restore activities for a site collection that became corrupt. When I was done, users reported that permissions were gone. After logging on I found out that I wasn't able to open the Site Settings. The Site Actions > Site Settings menu option was gone?!?!?!?

[SOLUTION]
After some troubleshooting I found out that during earlier steps, the site collection accidentally was set to Read-Only lock. That is why I wasn't shown any admin screens. When the lock was lifted, all started working again!

[MOSS] Unknown Error when opening AreaNavigationSettings.aspx

2010-03-15T19:26:00.007+01:00

[ISSUE]
Last week one of my colleagues contacted me about an issue he encountered. When trying to open the navigation settings page (/_layouts/AreaNavigationSettings.aspx), he encountered an "Unknown Error" (don't you just love those nice and clear errors). When opening the default page, the Quick Launch navigation on that page was also displaying errors:

[TROUBLESHOOTING]
When using the CustomErrors=Off and StackTrace=True options in the web.config, we were able to retrieve a "Object reference not set to an instance of an object" message. In the ULS logs, we found the following errors:

Unable to retrieve the CachedObject that this ProxySiteMapNode references: /sites/test/sites/183/Pages/testpage.aspx
PortalSiteMapProvider was unable to fetch children for node at URL: , message: Object reference not set to an instance of an object

[SOLUTION]
The quick launch navigation was changed manually and navigation items were added. Looking a little further, I found that testpage.aspx didn't exist anymore in the Pages library. Probably a user had deleted this page, causing this issue. When I recreated the testpage.aspx, the Quick Launch navigation started working again and the Navigation Settings page didn't show the error anymore.

Launch date SharePoint 2010 known!

2010-03-08T15:44:00.002+01:00

Last Friday Microsoft announced the launch date of SharePoint 2010. On May 12th Office 2010 and SharePoint 2010 will be officialy released to the public. They will reach RTM somewhere in April.

[MOSS/WSSv3] Error while deploying a solution

2010-03-08T09:03:00.002+01:00

[ISSUE]
Last week I encountered an issue while deploying a solution. I received the following error "This operation uses the SharePoint Administration service (spadmin), which could not be contacted. If the service is stopped or disabled, start it and try the operation again."

[SITUATION]
The environment I was working on consisted out of three servers, one web front end, one application and one database server. The application server is running the Central Administration role. The above error was thrown on the web front end server.

[CAUSE]
This issue was caused by a bug in the .NET Framework v2.0. After deploying this update, the issue was solved and the deployment ran fine.

SharePoint 2010 RC installation bug

2010-03-04T12:46:00.004+01:00

The Release Candidate of SharePoint 2010 has an issue with the installation. When installing on a domain controller, you will end up with SharePoint 2010 installed in a Stand-Alone setup. This setup is using SQL Express 2008, which is not supported on a domain controller. Now I hear you say "why are you installing on a DC" and you are right, you don't want SharePoint installed on a DC.......in a production situation. In my case I am testing on a single VM, with all the roles on one server, including the DC role.

Quote MS: "In the Release Candidate build, we recommend you do not to install on a Domain Controller. While the Setup User Interface does the correct thing by suppressing the Standalone option, after the installation is done and the RC is fully installed, it is actually a Standalone install and not a farm install. Although you are not technically blocked, the install will not work since SQL Express 2008 is not supported on a Domain Controller."

Because SQL Express 2008 is not supported on a DC, if the installation detects you are installing on a DC, the selection page where you can choose between a Stand-Alone and Complete installation is removed. Unfortunately the Stand-Alone option is the default selected option, causing you to end up with a Stand-Alone installation anyways and no way to get around this via the GUI :-)

Solution:
The best way to install SharePoint 2010 RC on a domain controller is by using an scripted installation.

Extract the installation file by executing <filename> /extract:<folder name>
Open a Windows Explorer and create a file called config.xml.
Open the config.xml file and paste in the part below
Change the <PID KEY> into your own product key and the install folder
Save the file
Start a command prompt and browse to the folder
Run "setup /config config.xml"
SharePoint 2010 RC is now being installed as a Complete installation!

Have fun SharePointing!

Config.xml:

<Configuration>
<Package Id="sts">
<Setting Id="LAUNCHEDFROMSETUPSTS" Value="Yes"/>
</Package>

<Package Id="spswfe">
<Setting Id="SETUPCALLED" Value="1"/>
<Setting Id="OFFICESERVERPREMIUM" Value="1" />
</Package>

<Logging Type="verbose" Path="%temp%" Template="SharePoint Server Setup(*).log"/>
<PIDKEY Value="<PID KEY>" />
<Setting Id="SERVERROLE" Value="APPLICATION"/>
<Setting Id="USINGUIINSTALLMODE" Value="0"/>
<Setting Id="SETUP_REBOOT" Value="Never" />
<Setting Id="SETUPTYPE" Value="CLEAN_INSTALL"/>
<INSTALLLOCATION Value="D:\Program Files\Microsoft SharePoint" />
<Display Level="Basic" CompletionNotice="Yes" AcceptEULA="Yes" />
</Configuration>

My SharePoint 2010 article published in TechNet Magazine

2010-03-03T15:01:00.004+01:00

Over the past weeks I have been working on a SharePoint 2010 article, which was published in this years first edition of the Dutch TechNet Magazine. If you interested in this article, below a scanned copy of this article:

SharePoint 2010, de stap naar volwassenheid (in Dutch)

[MOSS/WSSv3] Error "The detection failed, this can be due to a corrupted installation database"

2010-02-19T12:31:00.001+01:00

[ISSUE]
When trying to install a SharePoint Cumulative Update I encountered the following error, directly after the update detection:

The detection failed, this can be due to a corrupted installation database

[CAUSE]
The installation files in the C:\Windows\Installer folder were deleted. These files are required to install updates.

[BACKGROUND]
When an application or update of an application is installed, the installation files are stored in the C:\Windows\Installer folder. When another update is installed, the updates checks the Installer folder and retrieves install information and other required components from that folder. So never delete files in the C:\Windows\Installer folder......in our case someone unfortunately did, resulting in the earlier mentioned error :-(

[SOLUTION]
On the MS Forums I found the solution for this issue. Doug Chandler has found out a way of copying the missing files from a working server to the broken server and running the Office Diagnostics tool to fix the issue. The only difference I encountered was that when I ran the Office Diagnostics tool, the tool required the installation packages of SharePoint and all of the language packs. By default it check the same folders as used during installation, so if you have these files in another directory it is going to ask you for the specific folder for all packages (148 in my case).

Useful and Free SharePoint Tools (Part 3)

2010-01-29T09:50:00.002+01:00

It has been a while since my previous "Useful and free SharePoint Tools" post. Over the past period I have ran into some more brilliant tools and didn't want to keep them from you, so here we go again! :-)

Just for reference:
Part 1: Useful and Free SharePoint Tools (Part 1)
Part 2: Useful and Free SharePoint Tools (Part 2)

SharePoint ULS Log Viewer
Do you know that feeling: You have to troubleshoot an issue and dive into the ULS log. Soon you find out how difficult it is to find what you are looking for in these logs. When using Notepad, you can try to search on time stamp or error message, but filtering is out of the question. Fortunately a guy at Microsoft created a great tool that offers searching and filtering capabilities. Just open a ULS log file and go crazy. Life suddenly becomes a lot easier :-)
Link: http://ulsviewer.codeplex.com/

Zevenseas SharePoint Search Coder
This tool is useful for developers and IT Pro's. Using this tool you can generate search queries, but also send them to SharePoint, using the object model or web services. I have used this tool often to troubleshoot some search issues I encountered. By entering the search query you can see exactly which data is returned and therefore determine if the search engine is the issue, or some code (web part for example) that processes the returned data.
Link: http://mosssearchcoder.codeplex.com/

SharePoint Feature Administration and Clean Up Tool
Ever seen the error "failed to determine definition for feature with id <GUID>" in your ULS log? This means that a feature is still registered as active somewhere in your environment, but is not installed anymore. Unfortunately there is no way using the GUI to fix this issue. The SharePoint Feature Administration and Clean Up tool has the answer for this issue. When you start this tool, it has a button "Find Faulty Feature" in the lower right part of the window. This functionality searches for feature registrations of features that do not exist anymore and if found, it can delete these references. The tool can do other stuff with features, which I didn't need to far but I thought the clean up functionality is brilliant!
Link: http://featureadmin.codeplex.com/

SPTraceView
SPTraceView is a tool that connects to the tracing service of SharePoint and shows you all logged messages in real time. You can set filtering so only certain messages are displayed. The tool has an icon in the system tray and pops up a balloon if a message comes in. By clicking the balloon, a window with all captured messages is displayed. Really useful when troubleshooting!
The tool only has one "issue": It cannot display any messages higher than configured in the SharePoint Central Admin. For example if you set messages for the General category to High, you won't see Medium or Verbose messages in SPTraceView (or the ULS log for that matter). This is inherent to the way the tracing log is built.
Link: http://sptraceview.codeplex.com/

SPSFarmReport
Ever wanted to know how your farm is configured in high level? This tool can create a very high level report of your farm configuration. I have been looking for such a tool for quite a long time now. Even though this tool creates a nice report, I would like to see a little more detail in a next version. But until then.....another useful and free tool :-)
Link: http://spsfarmreport.codeplex.com/

PowerShell
The last one of this post isn't a tool by itself, but I have to say PowerShell rules!! I am not a developer, so creating applications/webparts/etc is not for me, but which IT Pro isn't a bit lazy by nature :-) Why do something manual if you can script it? Using other scripting languages, you couldn't use .NET objects so were very limited when it comes to SharePoint. But with PowerShell you can use every .NET object you like, so also SharePoint .NET objects!! And with the addition of 650+ PowerShell commandlets in SharePoint 2010, PowerShell becomes more and more important for the IT Pro. So if you haven't done much with it yet, LEARN POWERSHELL!! You will love it and it will make your life a lot easier!
Link: http://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx

[MOSS/WSSv3] Change the application pool of a web application

2010-01-28T08:56:00.002+01:00

[ISSUE]
How should I change the application pool of a web application

[BACKGROUND]
Recently I ran into a situation where Microsoft had performed a MOSS Risk Assessment Program (MOSSRAP). One of the recommendations of Microsoft was to limit the amount of application pools used on one environment. Depending on your hardware specs, this number will be around eight. However the administrators had created about 50 web applications and configured an application pool for each one of them.

In order to adopt the Microsoft recommendation, the administrator went into IIS and changed the application pools manually. When they tried to add a new server to the farm, this triggered a reset of the configuration on all servers, basically resetting the application pools to the configuration known by SharePoint (each of the web application in its own application pool. This brought down the entire environment for several hours.

[TECHNICAL DETAILS]
During installation/configuration of SharePoint, SharePoint stores all configuration on web applications and application pools. It does that so it is able to deploy everything to a server which is joined to the farm with the correct settings. When you make manual changes to IIS, the settings in IIS do not match the configuration known to SharePoint and you might end up in deep shit.

[SOLUTION]
Unfortunately it is not possible to change the web application/application pool configuration via Central Admin. The only way is by using the SharePoint object model. On the Internet I found an article which described how you could use a PowerShell script to accomplish this configuration change:
Change application pools via PowerShell

This script did have one downside: It changed the configuration in SharePoint, however it did not change the configuration in IIS. To solve this, I found a method added to the SPWebApplication class in one of the Cumulative Updates called ProvisionGlobally. By using this method, you provision that specific web application on all servers running the web front end role. You can download the revised PowerShell script here.

After running this script the old application pools are still present in SharePoint AND IIS. In order to delete them from IIS, you need to write a script to Unprovision them. However the SPApplicationPool class does not have an UnprovisionGlobally method, so you need to run this script on each of the WFE servers.

[MOSS/WSSv3] Audit Log and MergeContentDBS

2010-01-27T09:35:00.001+01:00

[ISSUE]
Audit log not migrated when using MergeContentDBS and old entries remain in old database

[DESCRIPTION]
Recently I migrated a site collection from one database to another using the StsAdm command MergeContentDBS. After this migration I found out that audit entries, stored in the audit log table of the database, were still present in the old database. In total this was occupying about 20GB of space. In one of the previous updates of SharePoint, Microsoft introduced the stsadm command trimauditlog, but unfortunately this command cannot be used to trim entries in the old database if the site collection in not in there anymore.

[WORKAROUND]
It would be a possiblity to manually delete the entries in the audit log, however with SharePoint you will end up with an unsupported environment after manually changing databases.

The only workaround I would currently have is to move out all remaining site collections to other databases and then delete the old database.

[MOSS/WSSv3] How to determine which server is used in Load Balancing configuration

2010-01-26T14:45:00.002+01:00

[ISSUE]
When you are using multiple SharePoint Web Front End servers and load balancing (Windows NLB or otherwise), it is very hard to troubleshoot issues. Users hit one of the WFE servers and you have to figure out which one. SharePoint does not offer a quick and easy solution to do this for you.

[SOLUTION]
In order to solve this issue I have implemented a very simple, but highly effective solution. I just create an HTML file in the Layouts folder (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\LAYOUTS) called server.htm. This file looks nothing more than:

<HTML>
<HEAD>
<TITLE>---SERVER NAME--- </TITLE>
</HEAD>
<BODY bgcolor=yellow>
<H1>---SERVER NAME---</H1>
</BODY>
</HTML>

On each server I replace the text "---SERVER NAME---" with the actual server name and the bgcolor with a different color (for example "green" or "red"). If a user then experiences issues, you can just have the user add the text "/_layouts/server.htm" to the site URL to show him the server he/she is on.

Like I said, very easy and highly effective! :-)

[MOSS2007] Crawling schedule alternative

2010-01-05T09:16:00.006+01:00

[ISSUE]
On a customer environment, we were having some issues with the default search scheduler. On this environment we currently have more than 4.8 million items in the index and migrations are still happening. This means that incremental crawls run for several hours and sometimes even more than 24 hours.

By default it is only possible to schedule it once a day maximum (so not once every two days) and according to a Microsoft engineer, it is not advised to run a crawl when a previous crawl is still running. Somehow that can result in a corrupt SSP. Configuring a schedule to run each 15 minutes is therefore not an option.

[SOLUTION]
To solve this issue, I have created a PowerShell script. This script checks if a crawl is running and if not, starts a new incremental crawl. I have scheduled this script to run every 15 minutes.

[System.Reflection.Assembly]::Load("Microsoft.SharePoint, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c") | out-null
[System.Reflection.Assembly]::Load("Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c") | out-null
[System.Reflection.Assembly]::Load("Microsoft.Office.Server.Search, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c") | out-null

$serverContext = [Microsoft.Office.Server.ServerContext]::Default
$context = [Microsoft.Office.Server.Search.Administration.SearchContext]::GetContext($serverContext)

$sspcontent = new-object Microsoft.Office.Server.Search.Administration.Content($context)
$sspContentSources = $sspcontent.ContentSources

foreach ($cs in $sspContentSources)
{
  if ($cs.Name -eq "Local Office SharePoint Server sites")
  {
    Write-Host "NAME: ", $cs.Name, " - ", $cs.CrawlStatus
    if ($cs.CrawlStatus -eq [Microsoft.Office.Server.Search.Administration.CrawlStatus]::Idle)
    {
      Write-Host "Starting Incremental crawl"
      $cs.StartIncrementalCrawl();
    }
    else
    {
        Write-Host "Crawl running"
    }
  }
}

[MOSS/WSSv3] SharePoint 2007 build numbers (UPDATE)

2009-12-11T15:17:00.004+01:00

Here a list of build number of SharePoint 2007. Based on the build number you can determine which patchlevel your SharePoint environment is on:

12.0.0.6520 - MOSS 2007/WSS 3.0 October '09 Cumulative update
12.0.0.6514 - MOSS 2007/WSS 3.0 August '09 Cumulative update
12.0.0.6510 - MOSS 2007/WSS 3.0 June '09 Cumulative update
12.0.0.6504 - MOSS 2007/WSS 3.0 April '09 Cumulative update
12.0.0.6421 - MOSS 2007/WSS 3.0 SP2
12.0.0.6341 - MOSS 2007/WSS 3.0 February '09 Cumulative update
12.0.0.6335 - MOSS 2007/WSS 3.0 December '08 Cumulative update
12.0.0.6327 - MOSS 2007/WSS 3.0 August '08 Cumulative update
12.0.0.6318 - MOSS 2007/WSS 3.0 Infrastructure Update
12.0.0.6300 - MOSS 2007/WSS 3.0 post-SP1 hotfix
12.0.0.6219 - MOSS 2007/WSS 3.0 SP1
12.0.0.6039 - MOSS 2007/WSS 3.0 October '07 public update
12.0.0.6036 - MOSS 2007/WSS 3.0 August 24 '07 hotfix package
12.0.0.4518 - MOSS 2007/WSS 3.0 RTM

You can find the build number of your environment via:
Central Admin > Operations > Servers in Farm

Source

[MOSS] Event 5214 - The EXECUTE permission was denied on the object 'proc_FetchDocForUpdate'

2009-11-20T16:54:00.004+01:00

[ISSUE]
The following event was occuring on our environment quite often:

Event Type: Error
Event Source: Windows SharePoint Services 3
Event Category: Database
Event ID: 5214
Date: 11/19/2009
Time: 4:28:54 PM
User: N/A
Computer: [SERVER]
Description:
Insufficient SQL database permissions for user '[account]' in database 'SharePoint_AdminContent_3995bd54-8091-4157-b162-8aaaf7116355' on SQL Server instance '[SQL SERVER]'. Additional error information from SQL Server is included below.

The EXECUTE permission was denied on the object 'proc_FetchDocForUpdate, database 'SharePoint_AdminContent_3995bd54-8091-4157-b162-8aaaf7116355', schema 'dbo'.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[SOLUTION]
To solve this issue, perform the following steps:

Open the SQL Management Studio
Browse to the database in question, in our case "'SharePoint_AdminContent_3995bd54-8091-4157-b162-8aaaf7116355"
Open the database and then Security > Roles > Database Roles
In the right part of the window, right click the WSS_Content_Application_Pools role and click Properties
Select the menu option "Securables"
Click "Add"
Select "Specific objects" and click "OK"
Click "Object Types", select "Stored Procedures" and click "OK"
Add the following stored procedures: proc_FetchDocForUpdate, proc_GetWebMetaInfo, proc_UpdateDirtyDocument, proc_UpdateListItem
Click "OK" to add these stored procedures
Select the added stored procedures and select "Execute" in the "Grant" column.
Click "Add" once more
Select "Specific objects" and click "OK"
Click "Object Types", select "Views" and click "OK"
Add the following view: UserData
Click "OK" to add this view
Select the added view and select "Select" in the "Grant" column.
Click "OK" to complete

[MOSS/WSSv3] Post Installation automation

2009-11-04T20:31:00.003+01:00

Just ran into the following ver usefull tool on Codeplex: The Post Installation Tool or PIT. This tool automates various configuration changes after you have installed SharePoint. Via a config file you can customize some configuration tasks.

[MOSS/WSSv3] Feature cleanup

2009-10-24T15:39:00.003+02:00

Have you ever seen the following error in one of your logs:

Failed to determine definition for Feature with ID '<guid>'. Skipping this feature for element querying consideration.

This message is caused by a feature that has been removed from the environment, without being properly deactivated before removal. SharePoint still has a reference to the feature, so it tires to activate the feature. But because it doesn't exist anymore, it will skip the feature.

Last week I ran into a tool which can scan your environment for such a "faulty feature". This tool is called the "SharePoint Feature Administration and Clean Up Tool" and can be found on Codeplex.

When you have started the tool, it contains a button called "Find Faulty Feature in Farm", which starts the scan for faulty features.

Have fun with this great tool!

[MOSS/WSSv3] Content Deployment/StsAdm export/import issue

2009-10-21T08:42:00.003+02:00

[SITUATION]
At a customer the developers created a custom solution that displayed image in a picture library on a page and used the image title to overlay across the image. If the image title would be empty, the solution would use the site title. The solution worked fine on our staging environment.

We use Content Deployment to deploy the sites from the staging environment to a live environment. On the live environment, the overlayed text suddenly became the picture name instead of the picture title.

[ISSUE]
After some troubleshooting it turned out that Content Deployment deploys the site just fine from staging to live, however when an image title field is empty, Content Deployment populates this field with the image name! After performing some tests we discovered that this behavior is also occuring when:

Deploying a document with an empty title. The document name is used.
Using stsadm export/import to deploy the site instead of Content Deployment.

[CAUSE]
We raised a support call at Microsoft, but although they were able to reproduce the issue they are not going to fix this. According to "internal resources" this behavior is "by design". We could raise a design change, but that would probably be denied because other customers would deliberately use this behavior.

[SOLUTION/NEXT STEPS]
In this situation we had to modify our code to check if the title field is empty OR equal to the image name. Although this workaround works, we do not believe that this behavior is by design. When creating a "backup" using stsadm export and "restore" with stsadm import, you would expect no data to be changed in that process..........

[MOSS/WSSv3] Mergecontentdbs change

2009-10-05T21:25:00.002+02:00

I have used the STSAdm operation MergeContentDbs many times in the past. But since I heard of the bug in this operation I temporarily stopped using it.

Fortunately the bug was fixed in the April Cumulative Update. So this weekend I moved some larger site collections to their own database and then I ran into an issue I didn't experience before:

MergeContentDbs used to copy the content to the new database and remove it from the old database to free up the data. However this time the amount of free space in the database did not change! Searching the Internet revealed a change in functionality of the operation.

"If a site collection is very large, an attempt to delete the site collection from a Web application fails. This causes the stsadm -o mergecontentdbs command to fail when you try to move site collections from one content database to another. This issue is resolved by adding an optional -gradualdelete parameter to the stsadm -o deletesite command. If this parameter is present, SharePoint marks the site collection as deleted to prevent further access while a SharePoint Timer job gradually deletes the data in the site collection. After you install the hotfix package that this article describes, the stsadm -o mergecontentdbs command uses this gradual delete functionality by default."

To remove the data from the database you can do two things:

Run stsadm -o databaserepair to remove all orphans
Wait until the daily timer job "Site Collection: Delete" runs, most of the times during the night.

- mergecontentdbs gotcha
- Article updates for the April Cumulative Update

[MOSS/WSSv3] Anonymous access causes documents to appear in search and accessible for users

2009-09-23T09:42:00.005+02:00

[ISSUE]
A customer was running into a strange issue with documents that were located in a document library which had strict permissions, but the documents were returned in the search results to all users AND users were able to open them. So it looked like SharePoint didn't obey the security settings.

[SITUATION]
In the past someone played around with the anonymous access setting. Because the environment is used as an intranet this was not supposed to be configured, so we disabled anonymous access on web application level. A few weeks ago, we noticed that users were able to open sites and documents even though they did not have permissions to it.

[CAUSE]
After some investigation and checking with Microsoft it turns out that SharePoint had some left over anonymous settings. Even though anonymous access was disabled at web application level, users were still able to access the documents anonymously.

As it turns out does the disabling anonymous access on the web application level only remove the administration pages of anonymous access, it does not remove all settings that have been configured before that. To make matters worse, we even ran into an extra issue:
After we re-enabled anonymous access, configured anonymous access on site level to None instead of Entire Web Site and a full crawl ran, the documents were still returned and available for users. Some more investigation turned out that, just like permissions, the anonymous access settings were also copied when breaking inheritance. Picture the following situation:

Enable anonymous access on the web application
Configure anonymous access on a top level site to Entire Web Site
Break the permissions inheritance of a document library and change the permissions
Set anonymous access on a top level site back to None
Disable anoymous access on the web application

In this situation, because the permissions inheritance was broken when its parent has anonymous access configured, the document library also has anonymous access configured. The only way to correct this through the GUI is to enable anonymous access on the web application level AND site level, so the anonymous access administration pages are enabled again on the document library.

[BACKGROUND]
Basically what happens: If you remove anonymous access form the web application only, on the webs it remains set. In case of the document library. By default it inherits permissions form its parent. The permission inheritance most probably was broken on the doclib when anonymous access was still enabled. The permissions were copied from the parent and the anonymous access remained enabled.

[SOLUTION]
In order to fix this issue, I have written a PowerShell script which loops through the site collection, checking each web and each library or list. If it encounters a web or list that has anonymous access configured, it disables that access.

[Reflection.Assembly]::Load("Microsoft.SharePoint, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c")
$site = new-object Microsoft.SharePoint.SPSite("http://<site collection url>")

foreach ($web in $site.AllWebs) {
$web.Url
if ($web.AnonymousPermMask64.ToString() -ne "EmptyMask") {
$web.AllowAnonymousAccess
$web.AnonymousPermMask64
$web.AnonymousPermMask64 = [Microsoft.SharePoint.SPBasePermissions]::EmptyMask
$web.Update()
}

foreach ($list in $web.lists) {
if ($list.AnonymousPermMask64.ToString() -ne "EmptyMask") {
$list.DefaultViewUrl
$list.AnonymousPermMask64
$list.AnonymousPermMask64 = [Microsoft.SharePoint.SPBasePermissions]::EmptyMask
$list.Update()
}
}
$web.dispose()
}

More info

[MOSS/WSSv3] Error 1387 when removing users from Farm Administrators group

2009-09-22T12:06:00.002+02:00

[ISSUE]
Today I tried to remove the user accounts from the Farm Administrators group, that have left the company a while ago. Unfortunately I was unable to do so, SharePoint presented me with an error 1387.

[CAUSE]
Using Google I ran into the following blog post Unable to remove user from SharePoint Farm Administrators group : Error 1387. Here Tim was talking about the fact that the accounts were deleted and SharePoint was performing some kind of check.

[SOLUTION]
After temporarily recreating the accounts of the users, I was able to delete the accounts from the group successfully!

[MOSS/WSSv3] SharePoint 2007 build numbers

2009-09-08T19:29:00.006+02:00

Here a list of build number of SharePoint 2007. Based on the build number you can determine which patchlevel your SharePoint environment is on:

12.0.0.6510 - MOSS 2007/WSS 3.0 June '09 Cumulative update
12.0.0.6504 - MOSS 2007/WSS 3.0 April '09 Cumulative update
12.0.0.6421 - MOSS 2007/WSS 3.0 SP2
12.0.0.6341 - MOSS 2007/WSS 3.0 February '09 Cumulative update
12.0.0.6335 - MOSS 2007/WSS 3.0 December '08 Cumulative update
12.0.0.6327 - MOSS 2007/WSS 3.0 August '08 Cumulative update
12.0.0.6318 - MOSS 2007/WSS 3.0 Infrastructure Update
12.0.0.6300 - MOSS 2007/WSS 3.0 post-SP1 hotfix
12.0.0.6219 - MOSS 2007/WSS 3.0 SP1
12.0.0.6039 - MOSS 2007/WSS 3.0 October '07 public update
12.0.0.6036 - MOSS 2007/WSS 3.0 August 24 '07 hotfix package
12.0.0.4518 - MOSS 2007/WSS 3.0 RTM

You can find the build number of your environment via:
Central Admin > Operations > Servers in Farm

[MOSS2007/WSSv3] "The expected version of the product was not found on the system" while installing update

2009-09-08T12:27:00.002+02:00

[ISSUE]
I just tried to install the June Cumulative Update on a test environment. After the "Running detection" step, I got the following error:

"The expected version of the product was not found on the system"

[CAUSE]
Some troubleshooting revealed that we had installed SP2 for WSS and MOSS on the environment, but not for the installed language packs. After we installed SP2 for the WSS and MOSS Language Packs, the update installed just fine.

[MOSS/WSSv3] Error "Unable to get the private bytes memory limit for the W3WP process."

2009-08-17T12:48:00.003+02:00

[ISSUE]
On the environment of a customer we encountered a lot of errors in the event log, which also caused some performance issues. The message was:
"Unable to get the private bytes memory limit for the W3WP process. The ASP.NET cache will be unable to limit its memory use, which may lead to a process restart. Error 0x80070005".

[CAUSE]
The message is caused by a known issue with insufficient permissions in your IIS metabase. The metabase ACL's on the target server did not include the IIS_WPG group on the following two nodes of the metabase (IIS_WPG is in both ACL's on a clean install):
- W3SVC/AppPools
- W3SVC/Filters

[SOLUTION]
Download the MetaACL utility from KB267904. When you have downloaded and installed the program, run the vbs via the following command:

cscript metaacl.vbs IIS://Localhost/W3SVC/AppPools IIS_WPG RE

The path is case sensitive - type exactly as above; after you run this command restart the IIS services and see if this corrects the problem.

Source

[MOSS/WSSv3] Large log files with default logging options

2009-08-12T09:48:00.004+02:00

[ISSUE]
When you configured the SharePoint logging as default, it is very much possible that the logs are filled with "Preserving template record with id....." messages. You would expect these messages only to be logged when logging is set to Verbose mode.

[SOLUTION]
The question how to solve this issue has been asked a lot on the Internet, for example on the MS Forums. Unfortunately nobody had a real answer. But since a couple of months, Microsoft fixed this issue. The April Cumulative Update now contains a fix for this issue:

When you set the least critical event to report in the Event log to ERROR, and you set the least critical event to report to the trace log to MEDIUM, the following messages are logged in the Unified Logging Service (ULS) logs:
Preserving template record with size…
Deleting template record with size…
However, you only expect these ULS messages to appear if the logging level for General is set to Verbose.

Just install this update and you are good to go!!

[MOSS2007] Issues with Excel Services

2009-07-13T11:57:00.002+02:00

[ISSUE]
Over the past weeks, we have had some issue with the amount of available disk space on our C drive. In order to free up some data, I have created a script which deleted used data from the C drive. One of the items it cleaned was the C:\Windows\Temp folder. After we ran the script on our servers, Excel Services suddenly stopped functioning properly.

[CAUSE]
As it turned out, Excel Services is writing some files into the C:\Windows\Temp folder on de Excel Services servers. After running the script, these folder were deleted, messing up Excel Services.

[SOLUTION]
From within the Shared Services page (Excel Services Settings section > Edit Excel Services Settings > Workbook Cache Location), you can change the location to which Excel Services writes these temp files. When leaving empty, it will use the system Temp folder.

IMPORTANT NOTE: The application pool account needs to have write permissions to this folder. And an iisreset is required before the changed setting will be activated.

[MOSS/WSSv3] June 09 Cumulative Update released

2009-07-06T21:54:00.005+02:00

The June 09 Cumulative Update has been released. You can find more information about them on the following links:

MOSS:
972569 Global
http://support.microsoft.com/default.aspx?scid=kb;EN-US;972569

970948 Global
http://support.microsoft.com/default.aspx?scid=kb;EN-US;970948

970947 Language specific
http://support.microsoft.com/default.aspx?scid=kb;EN-US;970947

972562 Language specific
http://support.microsoft.com/default.aspx?scid=kb;EN-US;972562

WSS:
971538 uber package
http://support.microsoft.com/default.aspx?scid=kb;EN-US;971538

This update contains hotfixes after April CU and Microsoft recommends to install according to the following sequence:

Install SP2 for WSS and MOSS SP2 and Language Packs
Install the MOSS Trial hotfix http://support.microsoft.com/kb/971620/en-us
Install the uber package for WSS http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=971538&kbln=en-us
Install MOSS fixes on demand or wait for the uber package for MOSS because that is not yet available due to Microsoft Project 2007 dependencies. It is expected that the MOSS uber package also contains the trial fix.

Source: http://blogs.msdn.com/joerg_sinemus/archive/2009/07/01/moss-and-wss-june-cu.aspx

[Citrix WISP] The Web Interface for SharePoint shows "No Resources"

2009-07-03T09:22:00.002+02:00

[ISSUE]
I tried to install the Citrix Web Interface for SharePoint 2007 (WISP) on our SharePoint environment according to the installation manual supplied by Citrix.

After the installation and configuration, the WISP only showed "No Resources" instead of any applications.

[CAUSE]
According to this article is one of the features supposed to create an application in IIS in the web application where you activated that specific feature. Unfortunately it did not do that. We are using Windows 2008 and IIS7, so maybe that is the cause of this issue.

[SOLUTION]
To solve this issue, I created the application in IIS manually. Just take the following steps:

Browse to the C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\Citrix folder
There should be a folder with a GUID as its name, copy that name
Open IIS and browse to your web application
Create a new application and use the GUID as the name and the same application pool as the web application

The downside of this issue is that you need to perform this step on each of your web servers manually.

[MOSS/WSSv3] Common mistake about SharePoint recycle bin

2009-07-02T09:17:00.002+02:00

Up until recently I was under the impression (like may others with me) that the timeframe you can configure for the recycle bin in the Central Administration page was for the first stage only. When that period was expired, SharePoint would move the content to the second stage recycle bin.

Last week I have been talking with a Microsoft employee who told me something different. According to him, SharePoint deletes the items from the recycle bin after this period, both from the first AND second stage recycle bin. The only way documents get specifically moved to the second stage is when a users cleans his recycle bin.

[MOSS/WSSv3] Bug in STSADM MergeContentDBS command

2009-06-30T22:08:00.003+02:00

With Service Pack 1, Microsoft introduced the STSAdm command "Mergecontentdbs". With this command you can move site collections between databases. Unfortunately I recently ran into a bug in this command:

When your site collection contains multi valued columns, it is possible that the data in these columns will be gone after migration.

This issue is confirmed by Microsoft and according to them fixed in the April Cumulative Update. To prevent this issue from occuring, install Service Pack 2 and the April Cumulative Update on your environment.

[MOSS2007] Unexplainable errors on the server desktop

2009-06-28T10:03:00.007+02:00

[ISSUE]
A while ago we received some unexplainable errors on the servers desktop. A popup window would appear with the Title "Error" and three buttons "Abort, Retry and Ignore". That was all the info we got. When the popup was shown, IIS stopped responding all together until one of the buttons was clicked.

We had to call in the assistance of Microsoft and after numerous troubleshooting sessions we tracked down the issue to the Search component of SharePoint.

[CAUSE]
A user has uploaded a picture of himself to a picture library. He wanted to use that picture as his profile picture, so he copied the URL of the page (not of the picture) and managed to somehow paste this into the ProfilePicture URL field.

Unfortunately the picture library had spaces in the URL and when opening a picture, SharePoint always places the location where the user came from in the URL. Because the library contains spaces, were these URL double encoded:
Space: %20
Percentage sign: %25
Double encoded space: %2520

This caused the user to paste a double encoded URL into his ProfilePicture field. As it turns out, SharePoint throws an assertion error when it is requested to return this value, for example when searching for that specific person.

[RESOLUTION]
After discovering the issue, the Microsoft engineers checked internally and found out that coincidentally the issue was fixed in MOSS Service Pack 2. They redesigned the assertion handling in this service pack, fixing the issue.

Before we implemented Service Pack 2 on our environment, we changed the value is the users profile to a correct value and ran another crawl. Fortunately we never saw the issue ever again.

[WSSv3\MOSS] Shortcoming in stsadm MergeContentDbs - does not support multiple SQL instances

2009-06-28T09:55:00.005+02:00

In our environment we have multiple SQL instances that host the content databases. Just tried to copy a site collection from one content database on one SQL instance to another content database on a different SQL instance. Unfortunately I got the following message:

"The databases need to be on the same database server in order to combine them"

It looks like the command does not support multiple SQL instances, which would be a real shortcoming.

Move IIS 7 root directory to different drive in Windows 2008

2009-03-27T09:41:00.000+01:00

In IIS6, it was possible to specify the directory in which IIS should place its files during installation. In IIS7, this is not possible anymore.

To solve this issue, you can download a script which is able to do this after installation on this page:
http://blogs.iis.net/thomad/archive/2008/02/10/moving-the-iis7-inetpub-directory-to-a-different-drive.aspx

The script only contains a small bug. Solve this by:

Search and replace "f:\" by "%MOVETO%"

[MOSS2007] SharePoint removes entries from hosts file with multiple entries on one line

2009-03-26T17:02:00.003+01:00

[SITUATION]
The SharePoint environment consists of three servers, a web front end, an index/central admin and a database server. According to Microsoft Best Practices, we have activated the Web Application role on the index server as well and configured the index server to use the local server. SharePoint does this by modifying the HOSTS file.

[ISSUE]
Last week a colleague noticed that some entries in the hosts file were periodically removed. After some investigation, he found out that this only happens with entries where multiple hostnames are linked to one IP address, for example:

127.0.0.1<tab>server.domain.intra<tab>server

All entries that had only one server name in each line, remained in the hosts file.

[SOLUTION]
To get around this issue we changed the following line:

127.0.0.1<tab>server.domain.intra<tab>server

into:

127.0.0.1<tab>server.domain.intra
127.0.0.1<tab>server

After this change, SharePoint left the entries alone.

[MOSS2007] Import connections only shows a few domain controllers

2009-03-11T14:50:00.004+01:00

[ISSUE]
At my current project we experienced the the issue that only one domain controller was listed when trying to configure SharePoint to use a specific domain controller (Shared Services /ssp/admin/_layouts/EditDSServer.aspx?dn=<domain name>).

[EXTRA INFORMATION]
The specific domain has about 75+ domain controllers world wide, so the fact that SharePoint lists only one is something strange. Because the listed domain controller isn't the closed one, SharePoint will always generate WAN traffic and imports will be slower.

[CAUSE]
After a long period of troubleshooting we discovered that the Active Directory guys had deleted all _ldap and _kerberos DNS entries (except for the one domain controller) in _tcp.dc._msdcs.. They have done this to make sure that computers that log on from an unmanaged site (which IP address is not configured in the AD subnets) always use the central AD server instead of randomly choose one and generating unnecessary WAN traffic. As soon as we added some extra _ldap DNS keys, these popped up in the list.

[SOLUTION]
We added the _ldap and _kerberos DNS entries for all domain controller in our 2nd datacenter. We are now able to select the closest domain controller.

[MOSS2007] Output caching error for _layouts/images path (Event 5785)

2009-03-09T10:45:00.006+01:00

[ISSUE]
On our SharePoint environment we receive the following message very often in the Application event log:

Event Type: Error
Event Source: Office SharePoint Server
Event Category: Publishing Cache
Event ID: 5785
Date: [date]
Time: [time]
User: N/A
Computer: [server name]
Description:Unable to connect publishing custom string handler for output caching. IIS Instance Id is '[IIS web ID]', Url is 'http://[domain name]/_layouts/images/[image name].gif'.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[CAUSE]
The reason why this is logged is that SharePoint tries to cache the file mentioned. Because the _layouts/images folder is not considered a SharePoint managed path it is not able to do so.

[SOLUTION]
To fix this issue:
- Open the web config for the mentioned web application.
- Search for the <location path="''_layouts/images"> section
- Add the following text to the section (just before </system.web>)
<httpmodules>
<remove name="PublishingHttpModule">
</httpmodules>

Source: MS Forums article, last post

[MOSS2007] Error while opening Site Columns page (/_layouts/mngfields.aspx)

2008-12-01T12:55:00.004+01:00

[ISSUE]
When you open the Site Columns page (/_layouts/mngfields.aspx, Site Settings > Site Columns) SharePoint throws an "Unknown Error" at you.

When you change the CustomErrors=Off and CallStack=true values in the web config, SharePoint shows you the following error:
Object reference not set to an instance of an object.
at Microsoft.SharePoint.ApplicationPages.FieldListRenderer.Render(HtmlTextWriter output)
at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer)
at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
at System.Web.UI.Control.RenderChildren(HtmlTextWriter writer)

[CAUSE]
This issue is caused by the fact that a feature creates site columns using the incorrect casing in the url. For example:
http://<site url>/sites/Test instead of http://<site url>/sites/test
http://<site url>/Sites/test instead of http://<site url>/sites/test
source

[SOLUTION]
To determine which site columns are causing this issue:

Open a sub site and open Site Columns of that site
To the left of each column, the location where they have been created is shown
Hover over links pointing to the parent site and check URL to which the link is pointing
One or more URLs will have incorrect casing.

To solve this issue, you either have to change your feature so that it uses the internal URL which SharePoint is using. In my case, the feature that caused this issue was the "Office SharePoint Server 2007 Enterprise Site Collection Feature". In other words, some code I could not change.

I found an article on the Internet where they mentioned changing the site url in the database. I know database changes are not supported by Microsoft, but there was no other way to change this.

Open the Content Database
Open the table ContentTypes
Check the column Scopes, you will find some URLs with the correct casing and some with incorrect casing. Change the casing of the incorrect records.

[MOSS2007] Profile synchronization does not work for databases which are off-line/stopped

2008-11-26T15:17:00.004+01:00

Last week I got some complaints about user profile information not being synchronized to other sites in a SharePoint 2007 environment. After some investigation I found the following error in the ULS log:
<date> <time> OWSTIMER.EXE (0x0864) 0x08A4 SharePoint Portal Server User Profiles 8zzy Medium Aborting sweepsynch for guid instance <GUID> due to null or non-online content database

[Solution]
After configuring the database as Ready again, the profile information synchronization resumed again.

[Background information]
If you put you content database off-line, SharePoint is still able to access it but it will not create new site collections. Because were creating new site collections, which we wanted created in a specific database we put all databases (except for that specific one) on off-line. As it turned out, the downside of this is that SharePoint is unable to synchronized the user profile information to databases that are off-line.

[MOSS2007/WSSv3] Messages about missing resource files in SharePoint ULS logs

2008-11-24T11:03:00.005+01:00

[ISSUE]
The following messages appear a lot in the ULS logs of SharePoint:
11/24/2008 10:06:58.66 w3wp.exe (0x07F4) 0x1550 Windows SharePoint Services General 72kg High #20015: Cannot open "Proj.en-US.resx": no such file or folder.
11/24/2008 10:06:58.66 w3wp.exe (0x07F4) 0x1550 Windows SharePoint Services General 72kg High (#2: Cannot open "Proj.en-US.resx": no such file or folder.

[SOLUTION]
This is caused by the fact that the resource file is not present with a specific English tag in its name. To solve this issue do the following

Open the directory C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Resources
The mentioned files are not in there, but the proj.resx is
Open a command prompt and browse to the same directory
Run the following commands:
copy avm.resx avm.en-US.resx
copy compproc.resx compproc.en-US.resx
copy ep.resx ep.en-US.resx
copy er.resx er.en-US.resx
copy hlpdsk.resx hlpdsk.en-US.resx
copy itteam.resx itteam.en-US.resx
copy proj.resx proj.en-US.resx
copy pws.resx pws.en-US.resx
copy rer.resx rer.en-US.resx
copy tsa.resx tsa.en-US.resx
This will copy the default resource files to the English version resource files and the messages will disappear.

[MOSS2007/WSSv3] Kerberos, CNAMEs and SharePoint

2008-11-17T13:21:00.006+01:00

When trying to configure Kerberos on the environment, I ran into the following issue:

[ISSUE]
When opening the SharePoint site from another machine, Internet Explorer logs on with NTLM anyway. When opening the site from the server, a logon prompt appears which won't accept any credentials. After three times, an Unauthorized message is shown.

[TROUBLESHOOTING]
I had all Service Principal Names configured as described in Configure Kerberos authentication (Office SharePoint Server). To get more information I enabled Kerberos logging (How to enable Kerberos event logging), which resulted in a lot of events in the System log:

Source: Kerberos
Type: Error
Event: 3
Message: "A Kerberos Error Message was received:
on logon session <user>
Client Time:
Server Time: 12:5:19.0000 10/30/2008 Z
Error Code: 0x34 KRB_ERR_RESPONSE_TOO_BIG
Extended Error:
Client Realm:
Client Name:
Server Realm: <domain>
Server Name: krbtgt/<domain>
Target Name: krbtgt/<domain>@<domain>
Error Text:
File: e
Line: 6c0
Error Data is in record data.

[SOLUTION]
After using Network Monitor v3.2, I found that the Kerberos traffic from the server was requesting a different Service Principal Name than the url of the SharePoint site. The error which was also listed in the eventlog was returned by AD. The SPN that was send, contained the CNAME value instead of the original URL. Using Google, I found the following article:
The Problem with Kerberos Delegation (Section: "Confused Yet?")

This article states the following:

Computer running IIS: ws.identitychaos.com (WS)
Service Account hosting the Central Admin app pool: idchaos\svc.wss.farm
Host Header for Central Admin: spca.identitychaos.com
SPN's registered to idchaos\svc.wss.farm

HTTP/spca
HTTP/spca.identitychaos.com

Using a CNAME, when IE requests the SPN, spca.identitychaos.com resolves to ws.identitychaos.com (the alias resolves to the host) so IE asks AD, "tell me which account has an SPN registration of HTTP/ws.identitychaos.com" and it gets the WS computer account, not the service account. How do you fix it? You use A records instead of CNAME's.

After changing our CNAME records to A records, all Kerberos issues were resolved.

In other words:
Do not use CNAMEs when using Kerberos authentication!!!

[MOSS2007] Search issues due to corrupt SSL certificate

2008-11-12T09:15:00.004+01:00

After installing MOSS2007 which has Service Pack 1, the Infrastructure Update and the August Cumulative Update slipstreamed I ran into the following issue:

My environment consists of one Index server and two Search servers. When opening the new Search Administration page, it is supposed to list the status of all of the index and search servers. Unfortunately the Search servers were listed as Error. After doing some more investigation I found the following error appear in the application log of both search servers each minute:

Event: 6482
Type: Error
Source: Office SharePoint Server
Category:Office Server Shared Services

Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (aa8a83f6-ff42-4be3-ae6c-c1cb2205cc8f).

Reason: The underlying connection was closed: An unexpected error occurred on a send.

Techinal Support Details:
System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.ConnectStream.WriteHeaders(Boolean async)
--- End of inner exception stack trace ---
at Microsoft.Office.Server.Search.Administration.SearchApi.RunOnServer[T](CodeToRun`1 remoteCode, CodeToRun`1 localCode, Boolean useCurrentSecurityContext, Int32 versionIn)
at Microsoft.Office.Server.Search.Administration.SearchApi..ctor(WellKnownSearchCatalogs catalog, SearchSharedApplication application)
at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize()
at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

When I tried to open the SearchAdmin.asmx page (http://<index or search server name>/SearchAdmin.asmx), I get a page cannot be displayed.

This issue is caused by a corrupt SSL certificate on the "Office Web Services" web site. To solve this issue, you have to create a new certificate. You can use the SelfSSL tool, included in the IIS resource kit.

Run the following command on all search and index servers:
selfssl.exe /N:CN=<server> /K:1024 /V:9999 /S:951338967 /P:56738

[MOSS2007] Crawl issue after installation .NET Framework 3.5 SP1

2008-11-06T21:26:00.006+01:00

[ISSUE]
When the .NET Framework 3.5 SP1 has been installed, it is possible that you get some Access Denied error messages when crawling your MOSS sites. If you're indexer is set to crawl itself, via the Central Admin setting, or manual hosts modification, you might be running into this issue. You will see a combination of errors in your event logs, ULS logs and crawl logs that match the following:

Crawl Log:Event Type: Warning
Event Source: Office Server Search
Event Category: Gatherer
Event ID: 2436
Date: 10/22/2008
Time: 10:02:55 AM
User: N/A
Computer: MOSS2007
Description:The start address <http://portal/> cannot be crawled.

Context: Application 'SharedServices1', Catalog 'Portal_Content'
Details:Access is denied. Check that the Default Content Access Account has access to this content, or add a crawl rule to crawl this content. (0x80041205)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

ULS Logs: (verbose)10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common MS Search Indexing 7hoo Verbose GetVirtualServerPolicy is about to call WS for virtual server, strVirtualServerUrl http://portal/10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common PHSts 0 Monitorable ***** Couldn't retrieve server http://portal/ policy, hr = 80041205 - File:d:\office\source\search\search\gather\protocols\sts3\sts3util.cxx Line:548
10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common PHSts 0 Monitorable ****** Server portal security initialization failed, hr = 80041205 - File:d:\office\source\search\search\gather\protocols\sts3\sts3util.cxx Line:317
10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common PHSts 0 Monitorable CSTS3Accessor::InitURLType: Return error to caller, hr=80041205 - File:d:\office\source\search\search\gather\protocols\sts3\sts3acc.cxx Line:1542
10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common PHSts 0 Monitorable CSTS3Accessor::InitURLType fails, Url http://portal/, hr=80041205 - File:d:\office\source\search\search\gather\protocols\sts3\sts3acc.cxx Line:184
10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common PHSts 0 Monitorable CSTS3Accessor::Init fails, Url http://portal/, hr=80041205 - File:d:\office\source\search\search\gather\protocols\sts3\sts3handler.cxx Line:243
10/22/2008 10:59:04.23 mssdmn.exe (0x1420) 0x151C Search Server Common PHSts 0 Monitorable CSTS3Handler::CreateAccessorExB: Return error to caller, hr=80041205 - File:d:\office\source\search\search\gather\protocols\sts3\sts3handler.cxx Line:261

Security Logs:Logon Failure:
Reason: An error occurred during logon
User Name: mosscrawl
Domain: SPI
Logon Type: 3
Logon Process: Èù8
Authentication Package: NTLM
Workstation Name: MOSS2007
Status code: 0xC000006D
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: XX.XX.XX.XX
Source Port: 1417

[SOLUTION]
Perform the steps mentioned in the KB article below to fix this issue:
http://support.microsoft.com/kb/896861
Source: Ron Grzywacz's Blog

[MOSS2007/WSSv3] Login box when a normal user logs on, but not with admin

2008-11-05T13:09:00.003+01:00

[ISSUE]
A logon box constantly appears when a users is trying to log onto a SharePoint site. Whatever the user enters, he cannot get onto SharePoint.

[CAUSE]
The environment on which we experienced this behaviour was locked down according to security guidelines. One of these guidelines was to strip the "Read & Execute" permissions on the C:\Windows folder from the local users group. The .NET Framework requires Execute permissions on the C:\Windows directory to operate properly and because SharePoint relies on .NET, users were prompted for credentials.

[SOLUTION]
Add the Execute permissions for the Users group on the C:\Windows folder or restore the permissions on the C:\Windows directory to default:
- Open a command prompt.
- On a domain controller, run
secedit /configure /db c:\windows\temp\seceditsv.sdb /cfg "c:\windows\security\templates\DC security.inf" /log c:\windows\temp\seceditsv.log
- On a non-domain controller, run
secedit /configure /db c:\windows\temp\seceditsv.sdb /cfg "c:\windows\security\templates\setup security.inf" /log c:\windows\temp\seceditsv.log

[MOSS2007/WSSv3] Using a clustered SQL named instance behind a firewall in SharePoint

2008-10-31T11:46:00.006+01:00

[Issue]
For a customer I have been working on a new installation of SharePoint 2007. The environment has high availability requirements, so all components need to be redundant. The customer environment already contained a clustered SQL environment which we could use for SharePoint. We just needed to install a new SQL named instance, dedicated for the SharePoint 2007 installation.

For extra security, the SQL cluster was placed in a separate database VLAN, which was secured by a firewall. To enable communication between the SharePoint 2007 servers and the SQL named instance we opened UDP port 1434 and TCP port 4000 (port used by the instance).

After installing SharePoint 2007 on one server, I ran the SharePoint Products and Technologies Configuration Wizard to create a new farm/Configuration Database. When I used the <server>\<instance> format, SharePoint reported that it could not connect to the instance. It reported that the instance was not running, the server wasn’t a SQL server or a firewall was blocking the traffic.

[Reason]
After troubleshooting on the SharePoint and SQL servers, I turned to the firewall guys. With their troubleshooting tools we found out that:

SharePoint connected to virtual SQL cluster name (ip 10.10.10.3) using the UDP protocol over port 1434 to determine the port of the SQL instance (see “Background Information”)

The firewall allowed the traffic to the virtual SQL cluster name

The server replied on the physical node ip address (ip 10.10.10.1) back to the server

Because the server registered an outbound connection on the virtual SQL cluster name, it does not allow a reply on a different ip address and blocked the reply

Due to this behavior the SharePoint Config Wizard could not determine the port used by the instance and therefore could not connect to the instance.

After using Google we ran into the following article:
Unable to connect to a SQL Server named instance on a cluster

This issue is caused by the fact that the SQL Browser is not “cluster-aware”. It listens to all ip addresses of the server and replies always on the ip addresses of the physical node instead of on the ip address on which it received the request. The solution according to the blog post: Use SQL Server 2008 in which it is solved…….no real option at the moment.

[Solution]
To solve this issue, we created a ODBC System DSN which is configured to connect to the correct port directly and preventing the discovery process from happening:

Start > Settings > Control Panel > Administrative Tools > Data Sources (ODBC)

Tab System DSN

Click Add

Select SQL Server

Enter the name you would like the DSN to have

Enter a description

Enter the name of the server

Click Next

Click “Client Configuration”
Clear the “Dynamically determine port” checkbox and enter the port number of the SQL instance

Click Next

The connection is now checked. Click Finish to save the DSN

Now use the name of the DSN as the SQL server name.

[Background information]
When a named instance is used, in most cases that instance is running on a port which is chosen randomly at installation time (customizable afterwards). Any processes that would like to use that specific instance first connect to the SQL Browser (using UDP over port 1434), which supplies the port that the instance is running on. The process then connects to the specific port.

[MOSS2007] Error in search configuration after installing Infrastructure Update

2008-10-29T21:55:00.004+01:00

The infrastructure update introduces a Search Administration page on the Shared Services. When creating a slipstream installation, this page is automatically created when creating the Shared Services. But when you install the Infrastructure Update on an existing environment, this page is not automatically created. It does change the breadcrumb trail on the Search pages of the Shared Services site, which cause some error messages. You cannot open the “Search Administration” page (http://<ssp_url>/ssp/admin/searchadministration.aspx).

To solve this, run the following commands:
stsadm.exe -o installfeature -name S2SearchAdmin
stsadm.exe -o activatefeature -name S2SearchAdmin -url http://<ssp_url>/ssp/admin -force

Usefull and Free SharePoint Tools (Part 2)

2008-10-13T16:49:00.002+02:00

A while ago I posted a list of tools I ran into and found very usefull. Here is part 2: More usefull tools :-)

SharePoint Inspector
Using the SharePoint Inspector you can browse through the SharePoint object model, can see objects composing its structure, get their properties by reflection. This cool can be very useful when you want to check if your code does what it should do. You can use also some advanced features like activate/deactivate SharePoint features, add/remove event receivers, manage your recycle bin.

Link: SharePoint Inspector

SharePoint Manager
The SharePoint Manager 2007 is a SharePoint object model explorer. It enables you to browse every site on the local farm and view every property. It also enables you to change the properties (at your own risk). It is a very powerfull tool for developers that like to know what the SharePoint holds of secrets.

Link: SharePoint Manager

MS IT Site Delete Capture
Every had the unpleasant question of users if you could restore a site or site collection they accidentally deleted? The only way to do this by default is to perform a restore to a separate environment and use stsadm to extract the site and restore into your environment again. Even though SharePoint 2007 does have a recycle bin, this does not capture site or site collection deletions.

After you installed the Microsoft IT Site Delete Capture Feature 1.0 SharePoint administrators can intercept both site/web delete requests and archive the site/web to a resource local to the web front-end computer or UNC path before the site/web is removed from the configuration and content databases.

The Microsoft IT Site Delete Capture Feature 1.0 also exposes functionality allowing SharePoint administrators to send e-mail messages to the end-user indicating the site has been archived and deleted, any failure in the event receiver will generate an e-mail message to the end-user indicating that the site/web has not been deleted. The message format, text, and language are stored in a flexible, culture-independent extensible markup language configuration file.

Link: MS IT Site Delete Capture

SharePoint 2007 Test Data Population Tool
The SharePoint 2007 Test Data Population Tool is a capacity planning and performance testing tool that populates data for testing SharePoint deployments. The SharePoint 2007 Test Data Population Tool is available as a command-line executable program that extracts information about how to populate the server from an XML configuration file.

Use this tool to populate test data for SharePoint capacity planning. Also included are some sample test scripts that can be used for performance and load testing SharePoint and Excel Services with the test data. These tools are being provided as is and there is no ongoing support for these tools.

Link: SharePoint 2007 Test Data Population Tool

SharePoint Logging Spy
A lot of SharePoint 2007 environments consist of multiple servers. Each server is producing logs and in case of issues you always have to dig through multiple server logs. The SharePoint Logging Spy allows you real time diagnostics of multiple servers in a SharePoint farm using a single console view.

SharePoint Logging Spy is a real time diagnostic application for MOSS 2007 which allows a SharePoint administrator to view (and save to disk) the ULS Log & Event log entries from multiple machines in a SharePoint farm through a single console. NOTE - There is a known issue with Event Log Entries not being displayed from remote machines. SharePoint Logging Spy also allows the administrator to view the historic ULS logs on the farm using the same interface.
SharePoint Logging Spy also has a treeview which allows a developer or administrator to view the state of the current SharePoint enviroment. The Plug-in architechture allows for extensibility of the core application.

The application also provides drill downs for information regarding the thread or process which generated the log entries which are reported in the main screen. The thread and process information is collected on demand (when you click the menu) and is NOT historical therefore it is feasable that the process/thread may no longer exist when you ask for the information and you will get an empty result set.
To easy configuration there is a discovery wizard which will discover on-line servers in the farm and allow selective monitoring to begin.

Link: SharePoint Logging Spy

SharePoint SUSHI
SUSHI is a powerful, user-friendly SharePoint application enabling you to accomplish common SharePoint administrative and development tasks. You can think of SUSHI as a Swiss army knife for SharePoint.

SUSHI = SharePoint Utility with a Smart, Helpful Interface

SUSHI Tools
Administration
Security Reports: View all sites and lists a user has access to (VERY USEFULL!!!)
Profile Images Import: Upload Profile Images and Apply them to User Profiles.
Backup: Backup a site. Restore: Restore site from backup.
Email Test: Send a test email to make sure outbound email is set up correctly.

Lists
Copy View: Copy a view from one SharePoint list to another. Meta Data: Get detailed information about metadata in a list. Move metadata from one column to another for all items in a list. And more.
Bulk List: Creation Create a large number of subsites based on a site template.
Bulk Site Columns: Create Site Columns. Import Documents: Upload entire file structures from a file share into a document library.

Sites
Bulk Site Creation: Create a large number of subsites based on a site template.
Themes: Apply a Theme to many sites at once.

Link: SharePoint SUSHI

[MOSS2007/WSSv3] Technical Library content available as downloadable CHM file

2008-09-17T08:48:00.003+02:00

Just recently Microsoft released the entire Technical Library for Windows SharePoint Services v3 and Office SharePoint Server 2007 in Compiled Help format (CHM) to be downloaded from their site:

Available here:
- Windows SharePoint Services 3.0 Technical Library in Compiled Help format
- Office SharePoint Server 2007 Technical Library in Compiled Help format

[MOSS2007] Error during editing navigation items

2008-09-08T11:48:00.004+02:00

[ISSUE]
When trying to edit the navigation items in a site, I get the following error message:
"The page has been modified by another author on <time>"
.....even when I am 100% nobody is changing the navigation of this site.

The reason why I was editing the navigation was because some items were having some strange URL's:
/_layouts/viewlsts.aspx?BaseType=0?BaseType=0?BaseType=0?BaseType=0

[CAUSE]
After browsing on the Internet I found that this had been caused because I used the Content and Structure Manager to move a site. SharePoint has an issue, which is causing the behaviour above.

[SOLUTION]
To solve this issue, do the following:

Remove all of the Document Libraries and lists from the navigation by:

Open the list/library you want to remove from the quick launch
Click Settings > List Settings (or Library Settings)
Click on Title, description and navigation
Choose No for Display this list on the Quick Launch?

Remove all corrupted navigation items
Readd the Lists/Libraries

[MORE INFO]
Technet Forum
Windows Tech
Blog Paul Gavin

[MOSS2007/WSSv3] SharePoint 2007 and Console Applications [UPDATED]

2008-08-28T09:10:00.006+02:00

During a project, the developers created a console application which they wanted to schedule in Task Scheduler. This turned out to be a challenge because using console applications with SharePoint 2007 requires permissions on three locations. The service account will need to have the following permissions:

1.) Permissions on the SharePoint databases

Open SQL Management Studio
Go to Security > Logins
Right click Logins and select New Login
Enter account name and open User Mappings tab
Select the master database, permissions public
Select the config database (default SharePoint_Config), permissions public and WSS_Content_Application_Pools
Select the content database (default format WSS_Content_), permissions public and db_owner

2.) Permissions on the SharePoint server

Add the service account to the local administrator group (See update below)

3.) Permissions on the SharePoint site

Grant the service account the required permissions in the SharePoint site
For example: add to Site Owners group

[UPDATE] The service account doesn't need to be local admin on the server. You can use the following permissions as well:

"Logon as batch job" in Local Security Policy
Member of the local WSS_ADMIN_WPG group
Grant the local group BATCH read permissions to C:\Windows\System32\cmd.exe to make sure the scheduled task can run batch scripts.

[MOSS2007] Error "Cannot complete this action. Please try again."

2008-08-01T22:01:00.005+02:00

Over the past month I have been working on a major incident on our production SharePoint 2007 environment.

ISSUE:

When opening a sub site in a site collection by entering it url without default.aspx file, SharePoint would show an HTTP 500 error (Internal Server error). When you try to open the default.aspx file, SharePoint would display the error "Cannot complete this action. Please try again.". The symptoms were similar to:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;937038

CAUSE:
About a month ago a site administrator of a sub site noticed that the NT AUTHORITY\AUTHENTICATED USERS group was listed in the site members group. In other words, everybody who was authenticated in the domain or trusted domains had Contribute permissions. As you can imagine this was not supposed to happen, so he tried to delete the AUTHENTICATED USERS group from the members group. What the user exactly did and what happened is not really clear, but the the result was that the sub site was no longer reachable.

STEPS TAKEN:
After searching for a solution for about a day, we could not figure it out and called in the support of Microsoft. Unfortunately they also weren't very sure how to solve it, but did mentioned the possibility of installing SP1 which might solve the issue. On the other hand, the also feared that installing SP1 would fail because of the broken site. To be sure we prefered to test the installation of SP1 first. In the meantime, the users couldn't access their data and we had to fix that first.

The suggestion of Microsoft was to use stsadm -o export/import. We would restore a known good copy of the database to a restore environment, export the sub site tree, copy it to the production environment and import on top of the broken sub site. Unfortunately this did not work, we received the same error. The alternative was to restore to a new sub site. The import started fine, but after about seven hours stsadm crashed! Also a second import crashed......now what.

We had bought MetaLogix Migration Manager to migrate content from file shares, ASP/HTML websites and other SharePoint environments into our new central MOSS2007 environment. So we gave that tool a go. Fortunately that worked. After several hours, the data was available again for the users.

FIX THE PRODUCTION ENVIRONMENT:
I wanted to test the installation of SP1 on a copy of that site collection. I tried to use stsadm -o backup/restore to copy the production site collection and to a restore environment. The backup went fine, but restore failed after 8 to 10 hours :-(

I then tried to create a backup of the entire database, restore that to the restore database server and attach to an empty web application. Fortunately that worked and I had an environment to test SP1 on. The installation of SP1 completed successfully and we now know that we can install SP1 without any issues on the environment.

KEY INFO:
The entire site collection was about 48GB of size. The sub site tree was about 25GB. Moveing the data using the default stsadm tools, did not work. It looks like stsadm is having some issues with large sites.

According to Microsoft Product Support, SP1 contains stored procedures which check and fix security issues. They weren't sure if those stored procedures would fix our issue. Obviously it did :-)

[MOSS2007] Version 2.0 of my Installation Guide has just been released

2008-06-04T10:31:00.004+02:00

I finally had the time to complete a new version of my MOSS2007 Installation Guide and have just uploaded it. This new version includes installing Service Pack 1 for the .NET 2.0 and 3.0 Frameworks and MOSS2007. I also added the SQL Server 2005 SP2 Cumulative Update Pack and an IIS fix, which solves an issue which caused the error message "Attempted to read or write protected memory" in the event log.

The new version can be downloaded here: HOWTO - Install MOSS2007 v2.0

And again: if you have any comments or additions, please let me know!

Have fun!

[MOSS2007] Hotfixes to clear up 95% off the MOSS2007 event logs errors

2008-05-06T10:00:00.004+02:00

Last week a colleague of mine send me an e-mail about the patches and hotfixes that are currently available and fix about 95% of all event log error messages:

---------------------------------------------------------------------
Hi Folks,

As promised, here’s a list of Microsoft hotfixes and patches that cleared up 95% of the MOSS 2007 event log errors:-

It’s assumed that you’ve already installed WSS v3.0 Service Pack 1 and MOSS 2007 Service Pack 1

As always, read the release notes and any associated guidance before applying.

KB923028 - Attempted to read or write protected memory
http://support.microsoft.com/kb/923028
Also fixed in .NET Framework Service Pack 1: http://support.microsoft.com/kb/945757

KB933061 - WMI Hotfix
http://support.microsoft.com/kb/933061
Note: This one was geared more towards fixing issues with SQL Server Reporting Services (SSRS) 2005. Might want to install this if you’re using the SSRS 2005 SharePoint Add-In.

KB946608 - SQL Server Cumulative Update 6
http://support.microsoft.com/kb/946608
Note: Once again, geared towards the SSRS 2005 Add-In. This MUST be installed if you are using the SSRS 2005 Add-In for SharePoint

KB941274 - MOSS 2007 Post SP1 Hotfix
http://support.microsoft.com/kb/941274
Note: Several WSS v3.0/MOSS 2007 fixes included in this Hotfix package

KB946517 - IIS6 Multiple Thread Fix
http://support.microsoft.com/kb/946517

Happy Hotfixing!
---------------------------------------------------------------------

[MOSS2007] License has expired error

2008-04-03T12:34:00.002+02:00

ISSUE:
Users got the error message "Your licence for Office Server Search has expired" when performing a search or when opening a page which contained a web part that used the search.

CAUSE:
The other day I had to install some language pack on a MOSS2007 environment. After installing a language pack, you need to run the Configuration Wizard. But because people were working on the environment and the Configuration Wizard stops some services, I waited until a more suitable time to run the wizard.

While troubleshooting the issue I noticed that permissions on the registry were gone. So MOSS2007 wasn't able to read the license information and therefore reverts to expired mode, presenting the users with the error mentioned above.

Putting two and two together: Installing a language pack resets some permissions on the file system and/or registry. This is corrected when you run the Configuration Wizard.

RESOLUTION:
After running the Configuration Wizard, all problems were solved.

LESSON LEARNED:
Do not install language packs when you cannot run the Configuration Wizard immediately afterwards.

[MOSS2007] Fix for Event ID 6398 - Corrupted Memory

2008-04-02T15:22:00.003+02:00

ISSUE:
On several environments I ran into an issue which logged an event in the event log (event id 6398). The following event occures regularly:

Event Type: Error
Event Source: Windows SharePoint Services 3
Event Category: Timer
Event ID: 6398
Date: 17-9-2007
Time: 9:38:18
User: N/A
Computer: Webserver
Description:The Execute method of job definition Microsoft.Office.Server.Administration.ApplicationServerAdministrationServiceJob (ID 3dc44d7a-008a-4c71-8e96-8c19da3d2ce2) threw an exception. More information is included below.

Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

RESOLUTION:
At first I found some solutions which directed me to a .NET patch (KB923028, also included in .NET v2.0 SP1). This patch solved the issue for a short time, but after a while the messages reappeared.

Last week I found KB article 946517, which provides a fix for IIS. This patches fixes the issue mentioned above. The message never appeared again.

[MOSS2007] "Database Default Locations" ignored by SharePoint 2007

2008-03-25T12:23:00.003+01:00

PROBLEM:
While installing a new environment today, I changed the "Database Default Locations" setting in SQL Server 2005 to make sure the database files and log files were created on a certain location. Testing by creating a database manually in the SQL Management Studio worked, but when I ran the SharePoint Configuration Wizard the databases were created in the old location.

CAUSE
After some troubleshooting I found out that SharePoint somehow retrieves the old setting until SQL Server 2005 has been restarted (reboot of the server or restart of the services). Why this is I have no clue.

RESOLUTION
Just restart SQL Server 2005 and try again. The new databases are now created in the correct place.

Usefull and Free SharePoint Tools (Part 1)

2008-03-19T11:37:00.003+01:00

Over the past few months I have been working with several tools for SharePoint. Some of these tools I find very usefull:

DAVCopy
When you need to copy a lot of data to SharePoint (for example from a file share), doing this manually is:

A lot of work
Not easy to do, especially when you need to upload a directory structure. You have to use the explorer view
Not really IT like (script what you can script, better lazy than tired :-)

Browsing through the Internet I ran into a tool called DAVCopy. This tool can upload files and directories to SharePoint, with the same functionality as XCopy. For example /E for subdirectories including empty ones.

The tool has some shortcomings though:

As most of you probably already know, SharePoint doesn't accept certain characters in filenames (http://blogs.msdn.com/joelo/archive/2007/06/27/file-name-length-size-and-invalid-character-restrictions-and-recommendations.aspx). Just like copying with the Explorer view, DAVCopy just tries to upload the files without checking any illegal characters. A good thing is that DAVCopy logs the error and skips the illegal file.

To get around this issue I created my own filename checker script, which corrects all illegal characters before running DAVCopy.
The logging of the tool is very limited. It can only write logging to the console. A nice logging to a text file and especially a good summary will be a great improvement!

Link: DAVCopy

SharePoint 2007 Shared Services Provider User Profile Property Replicator
On a lot of projects we are using a development/test/acceptance/production strategy. Each environment must have its own settings. When migrating a solution to a new environment, all required settings need to be migrated as well. One of these settings are the custom User Profile Properties. A solution I recently deployed required these properties to be present before it started to work.

Creating these properties manually is not only time consuming, but also susceptable to errors. The User Profile Property Replicator tool is able to export and import these properties using XML files. I created an export of all properties in my development environment, changed the XML file to just include my custom properties and used this file to create the properties on all other environments. Quick, easy and without errors!

The only thing that can be improved is changing properties. When importing a property that already exists, the tool skips this property. I would like to see that the tool would update the property instead of skipping it. This is especially usefull when using big choice lists!

Link: MOSS Profile Replicate

Sharepoint Shared Services Search Provider Property Creation
Just like the tool above, this tool is able to export and import properties to/from XML files. Only this tool can export and import crawled properties, managed properties, content sources and search scopes.

A solution I had to deploy was relying on crawled and managed properties. To be able to map crawled properties to managed properties, the indexer first needed to discover these crawled properties in documents or content types. Using this tool I was able to export all managed and crawled properties from my development environment, change the exported XML files and import these properties into other environment. Again quick, easy and without errors!

Link: MOSS Provider Property Creation

SharePoint 2007 Shared Services Provider User Profile Importer
SharePoint is able to import settings from a external source (Active Directory, BDC source, etc) and map these values to certain profile fields. The external source is then leading for that property. But for some fields, you might not have an external source available but do want the field populated. Using the Profile Importer you can. Just create a XML input file and a XML mapping file (map the used XML tags in the input file to User Profile Property field) and off you go.

After creating my own User Profile Property, I would like to have certain values populated for certain users. Unfortunately these values were not in the Active Directory, so I could not sync them from AD. Using the Profile Importer tool I am able to populate the values I want into the fields I want for the users I want. All and all a great tool!

Link: MOSS Profile Import

SharePoint Solution Installer
As of SharePoint 2007 all custom components can be deployed using the Solution Deployment framework. Developer just have to place their solutions into a wsp package, which can then be imported into SharePoint 2007 and deployed to all servers.

Importing and removing wsp files into SharePoint 2007 must be done using the stsadm command, after which the solutions can be deployed from the Central Admin. The steps become difficult when you try to deploy a new version of a wsp file:

Retract the old version from the Central Admin
Use stsadm to remove the old version from solution deployment
Use stsadm to add the new version to solution deployment
Deploy the new version from the Central Admin

In other words switching between tools a lot. There must be an easier way!

And with the SharePoint Solution Installer there is! The tool first checks if SharePoint is installed, then if you have sufficient permissions to perform a deployment, if the Administration and Timer services are running and if the solution is already installed. If this is not the case, you can choose the web application to which the solution must be deployed. If it is installed, you can select to remove or repair (!!!!) the solution. In case of a repair, the tool automatically performs the four steps above automatically.

Installing wsp files made easy!!

Link: Sharepoint Solution Installer

SSL cannot find private key

2008-01-11T10:45:00.000+01:00

ISSUE
Last week I generated a certificate request in IIS and requested an SSL certificate. Today I tried to install the recieved certificate, but after "Processing the request" the certificate was damaged. I was able to locate it in the Certificates MMC, but while trying to export the certificate the wizard came with the message "A private key cannot be found".
When I tried to apply the certificate to a IIS web site, the web site couldn't be reached using https. No error messages were reported.

TROUBLESHOOTING STEPS
I found the Microsoft SSL Diag tool on the Microsoft site and used this tool to troubleshoot. It came back with the error ""You have a private key that corresponds to this certificate but CryptAcquireCertificatePrivateKey failed"".

CAUSE
The above issue was caused by the fact that permissions on files in the following directory were incorrect:C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeysThis directory contains files with the server's private keys. Due to the incorrect permissions, was the server unable to read the certificate private keys.

RESOLUTION
I reapplied the security settings of the directory to all files by opening the properties of the directory, select the security tab, click the Advanced button, select the "Replace permission entries on all child objects with entries show here that apply to child objects" and click OK.
The server was now able to read the private key files and therefore able to use the certificate.

[MOSS/WSSv3] MOSS and WSSv3 Service Pack 1 released!

2007-12-12T08:41:00.000+01:00

Yesterday Microsoft released Service Pack 1 for MOSS and WSSv3.

"For information on what's included in the service pack view the Announcing WSS 3.0 and MOSS SP1 article from TechNet. This information will be important from both a business and technical perspective to support installing SP1. The KB "Description of Windows SharePoint Services 3.0 Service Pack 1 and of Windows SharePoint Services Language Pack 3.0 Service Pack 1" in addition is a must read. It includes a link to a list of fixes included in WSS SP1. For Office SharePoint Server 2007 SP1 another KB has been posted with a downloadable Office Servers list of fixes."

Note: For SharePoint Server 2007 environments, WSS 3.0 SP1 should be installed before SharePoint Server 2007 SP1.

Download WSS 3.0 SP1
SP1 existing deployments:
Windows SharePoint Services 3.0 SP1, 32-bit edition and 64-bit edition
Windows SharePoint Services Language Pack 3.0 SP1, 32-bit edition, 64-bit edition

Download Office SharePoint Server 2007 SP1 (includes SP1 for Project Server, Forms Server, and Groove)
Office SharePoint Server 2007 SP1 32-bit edition and 64-bit edition
Office SharePoint Server 2007 Language Pack 3.0 SP1 32-bit edition, 64-bit edition

Download SharePoint Designer 2007 SP1
SharePoint Designer SP1
SharePoint Designer Language Pack SP1

Source: http://blogs.msdn.com/sharepoint/archive/2007/12/11/announcing-the-release-of-wss-3-0-sp1-and-office-sharepoint-server-2007-sp1.aspx

[MOSS/WSSv3] Antivirus exclusions in SharePoint 2007

2007-12-10T08:16:00.000+01:00

A few weeks ago I installed two SharePoint 2007 (MOSS) environments at a customer. Both environments were create in VMware ESX and had one database server and one SharePoint 2007 server. The ESX administrator noticed that the CPU of both SharePoint 2007 servers used a lot of performance for about 15-20 seconds each minute. Process Explorer to the rescue!!

The System process on the server was using this CPU time and using Process Explorer I was able to track the usage to the tmxpflt.sys thread. This file was part of the TrendMicro OfficeScan product, so the CPU usage was an AV issue. I searched the Internet for antivirus exclusions for SharePoint 2007, but wasn't able to find any exclusion information for SharePoint 2007. This ment I had to do the troubleshooting myself.

After some more troubleshooting I found out that:

The Windows SharePoint Services Timer service started a job every minute which caused the issue. When I stopped this service, the CPU didn't spike at all.
The Windows SharePoint Services Administration service was running the job. When I stopped this service when the CPU was high, the usage immediately dropped.
The Windows SharePoint Services Administration service was writing some logging in the file WSS_AdminService.log, which was located in the directory C:\Documents and Settings\Default User\Local Settings\Temp.
The WSS_AdminService.log file was about 65MB. TrendMicro OfficeScan scanned the file before the Administration service was able to write in it. With 65MB, this took some time and processing power.

After deleting the log file, the CPU usage didn't spike at all, so I excluded the C:\Documents and Settings\Default User\Local Settings\Temp directory which solved all issues!

So one exclusion for your Antivirus software when using SharePoint 2007: C:\Documents and Settings\Default User\Local Settings\Temp

[MOSS/WSSv3] Moving sites between content databases

2007-12-05T11:31:00.000+01:00

With the release of the Public Hotfix of October 9th (WSSv3 KB934525/MOSS2007 KB937832), StsAdm has gotten a new operation, the Mergedbs operation. A very cool operation, with which administrators are able to move sites from one content database to another!!

On his blog, Todd Klindt describes how to use the operation:
"On multiple occasions as a SharePoint administrator I have needed to move a Site Collection from one Content Database to another one. In the past this process was very painful and very manual. In this blog post I will show you how to move Site Collections between Content Databases with a single STSADM command using the "mergedbs" operation that was introduced in KB934525."