Tag: SharePoint 2010

Now powered by SharePoint Foundation 2010

Since my world is already mostly SharePoint 2010, I figured it was time to move my blog from Blogger, which has been a great starter experience, to something I am more familiar with, SharePoint Foundation 2010. I am blessed with many friends who had offered me space on their servers rather than needing to stand up another on at my house to worry about, and I finally took one of them up on the offer.

In the coming days you can expect some new content, but for tonight I am just excited to put the finishing touches on my conversion from Blogger to SharePoint.

March 12, 2011
SharePoint 2010 & Site Directory revisited: bug fix request rejected by Microsoft

We received the official, and well thought out, answer back from Microsoft regarding the Site Directory bug that I reported on with my post “SharePoint 2010 and the Site Directory” back in December 2010.

Here is the official answer from Microsoft:

Issue Summary
Site collection creation fails with access denied error when the master site directory site collection is located on a web application which is using the new claims aware authentication method.

Cause for Rejection and Technical Explanation
The Microsoft Office team has reevaluated this bug and unfortunately our initial decision still holds. We realize that this causes a lot of inconvenience but the code change required is extremely large and introducing a change can leave behind a huge and unexpected bug trail.

The site directory feature has been deprecated in SharePoint 2010.

Site Directory provided site collection admins a central location where they can pin bunch of URLs with categories. Users could then browse through categories, view and access all URLs/sites associated with the site collection. In SharePoint 2010, social tagging provided a much richer way to categorize URLs, and we provided tag cloud web part for navigation. To avoid having two similar solutions, site directory was deprecated.

Please know we carefully review all Hotfix request because each code change that we implement must maintain or improve the quality and stability of the product. We strive for this to ensure the continuing integrity of the code base and to maintain a supportable product. While we recognize the impact that this issue is having on you, we cannot compromise the stability of the product’s code base using the Hotfix process.

Alternative solution

1. Ensure that the master site directory site collection is located on a web application which is using classic windows authentication.

2. Disable master site directory setting and explore the capabilities of the new social tagging feature to categorize sites. Learn more about this new feature at ”Social tagging overview (SharePoint Server 2010)” http://technet.microsoft.com/en-us/library/ff608137.aspx

March 2, 2011
Set-SPManagedAccount syntax for password resets

Working with the PowerShell command for Set-SPManagedAccount this morning I found that the TechNet bulletin for this command has an inaccuracy with regard to password changes.

When trying to reset a password from PowerShell I followed the syntax and used:

Set-SPManagedAccount –Identity domainaccount –AutoGeneratePassword true

I got the following error:

Set-SPManagedAccount : A positional parameter cannot be found that accepts argument ‘true’.
At line:1 char:21
+ Set-SPManagedAccount <<<< -Identity domainaccount -AutoGeneratePassword true
+ CategoryInfo : InvalidArgument: (:) [Set-SPManagedAccount], ParameterBindingException
+ FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.SharePoint.PowerShell.SPCmdletSetManagedAccount

Turns out that the command has been changed and there is now no need for the “true” flag as the default is now “true” but you get the opportunity to choose (unless you pass the -confirm:$false flag)

The result of passing the command without the “true” looks like this:

Confirm
Are you sure you want to perform this action?
Performing operation “Set-SPManagedAccount” on Target “USsvc-ssaspfarm”.
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help
(default is “Y”):

If you select “Y” the system will change the password for you with an automatically generated password. If you want to validate the change an easy way to do it is to follow my previous blog post, https://bifocal.llc/how-to-get-your-managed-account-passwords-when-they-are-changed-automatically-by-sharepoint-2010/, to view the passwords before and after you run the command.

February 23, 2011
SharePoint 2010’s Visio Graphics Services: EventIDs 8061 & 8046 unmasked
Getting EventIDs 8061 & 8046 in your ULS Logs and Event Logs on your application server? Having trouble figuring out exactly what they are trying to tell you? Finding inconsistent results between site collections? Let’s dive in…

Here are the offending errors:

TechNet tells us: quoting directly from the article linked here

Symptoms: One or more of the following symptoms might appear:
- A file or files might not load.
- This event appears in the event log: Event ID: 8061 Description: File not found at this location: <file location>.
- This event appears in the event log: Event ID: 8051 Description: Unable to parse file at location: <file location>.
Cause: One or more of the following might be the cause:
- A user might try to load a page that contains a Web Part that references a file that no longer exists or is invalid.
- A user might try to view a Visio diagram that is corrupted.
- A user might try to view an invalid Visio diagram.
Unfortunately this really doesn’t help you identify what the problem is or how to resolve it.

Here is what I discovered:

The common thread is the app pool. Validate that the app pool that is being reported in the error is the same app pool that is hosting the Visio Graphics Services service.

Next using the visit using the PowerShell script provided in my previous blog article, How to: Get your Managed Account passwords when they are changed automatically by SharePoint 2010, get the password for the account running your Visio Graphic Services and head over to your Manage Service Applications and manage the Secure Store Service. Find your Visio SSS entry and reset the credentials.

Once you have set the credentials you need to recycle the Application Pool on the application server. In a standard OOB install look in SharePoint Web Services for the site that contains VisioGraphicsService.svc and view the basic settings to determine which app pool is being used by the site and recycle it.

After this is complete you should see all of your Visio Graphics Services rendering correctly.

Why the inconsistent behavior mentioned at the beginning of this article? If you create a site after the SSS credential is invalid and you have a site that is still holding a valid SSS token then you will see one site (the new) be broken and one site (the old) working perfectly. Just one of the fun anomalies we get to experience in the field.

Once again, another issue finds it’s root cause in credentials management. While SharePoint 2010 has brought us leaps and bounds further than any product previously released, we still must remain vigilant in our credentials management as Admins and Architects. IMHO, Planning for proper credentials management is almost as critical as DR planning, and often time more far more complex.
February 21, 2011
The definitive BCS in SharePoint 2010 book now available

My friend and colleague Scot Hillier has just published his new book with his co-author, Brad Stevenson, called “Professional Business Connectivity Services in SharePoint 2010”.

Scot brought me a copy today and from the brief bits that I have had an opportunity to read so far (plus what I was privilege to review prior to the printing), it far exceeds the expectations one might have for simply being THE BOOK (yes I know there is only one out there) on BCS. Scot targets the book to C# developers, but even a simple admin/architect type like me is able to understand and follow Scot’s easy to read style of writing and grasp the concepts.

As the “stereotypical SharePoint admin” model punching bag for Scot’s presentations I may be a bit biased as I get to work with this talented guy on a regular basis, but I highly recommend you invest in this book, available in paperback or e-book, and give it a thorough read. Chapter 8 on “Working with BCS Security” and the details he gives around Secure Store and Claims Authentication make it worth the investment alone for us admin types.

Shameless Plug (as though this whole post wasn’t already!)
Buy Scot’s book from the publisher or from Amazon.com and support his good work.

January 31, 2011
How to: Fix the "Unable to access SharePoint sites from the localhost" problem

Ever try to access a page on your SharePoint site from your web front end only to get prompted for a login that never lets you through?

The issue happens when dealing with sites that Integrated Authentication and have names that are mapped to the loopback address. Translation: if you are using Windows with Claims or Classic Mode web applications and you are trying to connect from the server, this is you.

The LoopbackCheck security feature is enabled by default on Windows Server since 2003 SP1 and since most SharePoint Farms are going to have an FQDN AAM or two, this is going to be something that many admins are going to run into.

There are two options, and as in most scenarios one is easy and the other is the right way.

Option 1. – create a Multi-String Value that has all of your AAMs for the server and restart the IISADMIN service.

Option 2. – disable the LoopbackCheck on the server

The Microsoft recommended option is #1 (I happen to agree), however you have to do this on every server (however if you have access to create and modify GPOs, this should be something that you can just have centrally managed for all SharePoint WFEs) and you need to have the list of all of your AAMs handy with which to do it. Not a ton of work, so bite the bullet and update the registry entry.

Serious caveat: Option 2 is great if you are working on a developer vm or something to play with for a short burst, but if you are going to put something in production, please protect yourself and allow Microsoft to do the same. This is one of those security scenarios where they are putting a validation check in place to protect you from malicious attacks.

For the more detailed steps on making the changes visit the KB article and get it from the horse’s mouth.

January 25, 2011
Update: PowerPivot in Windows with Claims Authentication on SharePoint 2010 case

We had a second great discussion with Lee Graber and Venky Veeraraghavan and our MS Account Team today. They are actively working on getting a solution to allow PowerPivot to work with Windows Claims Authentication in SharePoint 2010, as I talked about in my previous post. They are expecting to down select an approach, from 4 down to 1, by the end of the week and give us an update on what the timeline will look like.This has been a great experience working with the two product teams, SharePoint and PowerPivot. Everyone at Microsoft is very dedicated to getting a solution that will not only work for this one customer (us), but for the general population as well.I will update again once I have more to report!

January 18, 2011

SharePoint 2010 & SQL 2008 R2 build numbers and helpful patching links

In an effort to make life simpler I have compiled a short list of useful link to build numbers and patching sites for SharePoint 2010 and SQL 2008 R2.

The Microsoft SharePoint Updates PagesSharePoint 2010 – http://technet.microsoft.com/en-us/sharepoint/ff800847.aspx
SharePoint 2007- http://technet.microsoft.com/en-us/office/sharepointserver/bb735839.aspx
This is your official sites for downloading the SharePoint updates from Microsoft. Highly useful rather than waiting on the blogger community to send you a link, or get the TechNet bulletin, your carrier pigeon to arrive, or any of the other 120+ ways to get your SharePoint update information!

Cornelius J. van Dyk’s Blog on Versions for SharePoint
http://www.cjvandyk.com/blog/Lists/Versions/
Highly useful link if you find yourself a CU or two behind and you want to know what version of the CU is currently applied to your farm. Simply visit your Central Admin Manage Patch Status page http://localhost:####/_admin/PatchStatus.aspx to check what version number your farm is on.

SQL 2008 R2 build numbers
http://support.microsoft.com/kb/981356/This has proven to be the most reliable site I have found for listing the latest build numbers for SQL Server since 2008 R2 dropped. To find out what what build you are running do the following:

Open SQL Management Studio
New Query
type and then execute the following command
```
select @@version 
```
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode, .externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode pre
{font-size:small;color:black;font-family:consolas, “courier new”, courier, monospace;background-color:#ffffff;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode pre
{margin:0em;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .rem
{color:#008000;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .kwrd
{color:#0000ff;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .str
{color:#006080;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .op
{color:#0000c0;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .preproc
{color:#cc6633;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .asp
{background-color:#ffff00;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .html
{color:#800000;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .attr
{color:#ff0000;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .alt
{background-color:#f4f4f4;width:100%;margin:0em;}
.externalclassaf644619e5194a77b8e785ba7f262756 .csharpcode .lnum
{color:#606060;}

We are working on getting a SQL Server version’s page up on CvD’s blog as well, but for now I here is a table with the info:

April 2010 RTM	10.50.1600.1
May 2010 CU1	10.50.1702.0
June 2010 CU2	10.50.1720.0
August 2010 CU3	10.50.1734.0
October 2010 CU4	10.50.1746.0
December 2010 CU5	10.50.1753.0

January 17, 2011

All PowerPivot Features supported only in Classic Mode Authentication

Surprised? I was this week as well. I have had a case open with Microsoft since October that we have been playing with back and forth trying to figure out why automated refreshing of a PowerPivot workbook wasn’t working.We let the case go off and on for a quite a while because in the opening days we found that if we ran the PowerPivot Service Application Pool in the context of the farm admin account, that manually refreshing the data would work. Having a work around in hand threw this issue to the back of the queue for a while.

After much diagnosis, discussion, and many weeks of thinking that the Secure Store Service wasn’t working properly, along came a very simple explanation: PowerPivot requires Classic Mode Authentication. FBA and Claims are not supported for doing data refresh or usage data collection scenarios.

The answer to our question came via 3 references:

PowerPivot Data Refresh – Everything you always wanted to know – Page 14 is a good place to start. Section called “Anatomy of PowerPivot Data Refresh” – written by Mariano Teixeira Neto

Plan PowerPivot Authentication and Authorization – “To support data refresh and usage data collection scenarios, PowerPivot for SharePoint requires Classic mode authentication. PowerPivot requires a Windows domain user to be the identity behind the SharePoint security token, which it will use to create a history of user activity and document ownership, and to connect to external data sources during data refresh.” – quoted from Technet

Why PowerPivot requires ‘classic-mode’ web applications – “The second one (i.e. ‘b’ above) is a bit trickier and it is the core issue for this blog entry. In PowerPivot, when connecting through our front-end web services (aka, the PowerPivot Web Service, or PWS in our architectural design) the underlying protocol is the same as the one that earlier versions of Analysis Services used for the ‘data pump’ feature (http://technet.microsoft.com/en-us/library/cc917711.aspx). That protocol does not know about claims – it relies on getting a Windows identity.” – quoted from Dave Wickert, aka PowerPivotGeek

One of the answers that we got regarding this is that PowerPivot is a part of SQL Server 2008 R2 and not a part of SharePoint 2010, so it wasn’t really a SharePoint authentication problem. ((Does that sound right?))

We have gone back to Microsoft and are looking to see if this is something they are going to be able to fix so that Claims Based Authentication can truly be the end-all-be-all solution that we are all hoping that it can be, or if this is just one of many things that we are going to run into that aren’t yet supported in CBA mode. For those keeping count we are now up to 2 major issues that have come back to CBA as the root cause, the other being the Site Directory issue (which we are still waiting to hear if they are going to accept our hotfix request or not… last update from the engineer was yesterday).

I have to give a ton of thanks to the MS TAM (Mike Mitchell) that I work with, the engineer (Jason Haak) who worked on this case with us, and the 2 guys who seem to be the experts in the world on PowerPivot, Dave Wickert and Lee Graber. We spent so much time focused on the technology of the platform and how cool PowerPivot was to work with, that we forgot rule #1 (which they kindly reminded us of)… RTFM.

January 12, 2011
How to: Configure Microsoft Nework Load Balancing (NLB) in a Virtualized Environment for Windows 2008 R2 on a Cisco Switched Network

Firstly, can I make this blog post’s title any longer? Yes, I didn’t include that I am doing this for SharePoint 2010, so thanks for the smart-alecked thoughts subconscious!

Scenario:

Using VMware vSphere 4.0 server to host Windows 2008 R2 64bit Servers which host SharePoint 2010 Server and looking to use Microsoft’s NLB.

Set up NLB in mulitcast mode as recommended by everyone in the blogosphere and some different Microsoft articles and viola! It works… until 5 minutes after implementation and then anyone who sits outside of the site where the servers reside can no longer get to the pages. Users at the site where the servers are can consistently resolve pages without fail. Anyone offsite gets an error.

How do you get NLB to work every time for all users regardless of location?

Resolution:

All trouble shooting pointed back to networking. After a bit of digging and working with the site networking team, I found that we had Cisco 4506 switches that we were going through and while they support multicast, the switch needs a static MAC address entered in it’s ARP table or it will not allow anyone coming to the switch from outside to connect because it doesn’t know who to route the packets to. The users on the same switch are able to see the advertisement of the MAC through broadcast.

Setting the static MAC entry in the ARP table worked for some users for a little while, but not for everyone. It wasn’t until we came across an article from VMware that we discovered that the switch supported IGMP Multicast and not standard multicast.

Things started working for a while and then we hit the wall again. I started a clean NLB Cluster installation and found that switching from standard Multicast to IGMP Multicast changed the MAC address of the virtual NIC! We were using the standard Multicast MAC for the ARP table entry instead of the IGMP Multicast MAC address.

Once we made the change to the ARP table with the correct static MAC address, we were off to the races for all users.

Helpful Links:

Here are a few helpful links to read when you are considering setting up NLB:

Implementing Microsoft NLB in a Virtualized Environment
http://www.vmware.com/files/pdf/implmenting_ms_network_load_balancing.pdf

Configure Network Load Balancing Cluster Operation Mode
http://technet.microsoft.com/en-us/library/cc731616.aspx

Internet Group Management Protocol
http://technet.microsoft.com/en-us/library/dd458978(WS.10).aspx

Verifying the NLB Cluster and Enabling Client Access
http://technet.microsoft.com/en-us/library/cc731050(WS.10).aspx

Install and configure NLB on each cluster host in the new cluster
http://technet.microsoft.com/en-us/library/cc772392(WS.10).aspx

December 28, 2010

Tag: SharePoint 2010

Scenario:

Resolution:

Helpful Links: