SharePoint From Scratch

A Teamsite "Get it Right" Primer

SPRobot — Tue, 02 Jun 2009 12:53:00 GMT

If you've been given designer access to a team site and want to begin to use it to support your team's collaboration efforts, ask yourself these questions:

What are my team's inputs? Identify them as content types and define their ownership and lifecycle.

What does my team do with those inputs? Pay particular attention to the need to interact, "hand-off" or track.

What are my team's outputs? Define their ownership and lifecycle from creation to archive.

Before you answer these questions with great specificity, remember the objectives are to:

Make it clear where stuff belongs and what team members are supposed to do. Use landing pages with links and filtered views to instruct and direct users to the content they need.

Make content easy to find. Point to filtered and sorted views from landing pages with navigational aids. Use web part pages to hold filtered views and support parent\child item relationships.

Eliminate duplication of content - Create the necessary metadata to support your filters and workflows without requiring copying or moving content.

Make aggregate views of status easy to access - Add priority and status columns that allow team leaders to address and dispense with escalated items and guage status ata glance.

If you'll take the answers to the set of questions and build your teamsite to meet that set of objectives, you'll find that your team will move into and continue to use your site and gain SharePoints collaboration advantages.

hth

-robot

WSS on Server 2008

SPRobot — Tue, 24 Mar 2009 16:34:00 GMT

We have some unique challenges installing WSS on Server 2008.

First of all there's some chatter about WSS being offered as a Server 2008 Role. The assertion being that you can just go into Server Manager and run the Add Roles wizard to select the WSS role and then the configuration is straightforward. Then there's some dissenting voices that suggest it may be more complicated than that.

Second, there's also a number of issue that arise from the User Access Control (UAC) issues. This technology is covered in detail on TechNet here.

The Microsoft Instructions are here where we get this:

... if you installed the 64-bit version of Windows Server 2008 and then modified the Enable32bitAppOnWin64 registry key so that Internet Information Server (IIS) is running in 32-bit emulation mode, you cannot install Windows SharePoint Services 3.0. To install either 32-bit or 64-bit Windows SharePoint Services 3.0 you must run IIS in 64-bit mode.

Remember in SQL Server 2005, you had trouble with remote connections that had to be addressed in the Surface Area Configurator which no longer exists in SQL Server 2008. Now you just need to look at the server instance properties and make sure " allow remote connections is ticked. Then in the Configuration Manager, enable the protocols you need. Also, we need the SQL server browser serivce to be running.

Also, here we see that when SQL Server 2008 is running using a domain account it must be configured to support Kerberos authentication. Now, nobody knows more about Kerberos authentication than we do so maybe this is as easy as running SetSPN to establish an SPN for the domain user. We get some help here explaining how to configure our service account to use Kerberos.

This may take a while...

More to come...

-robot

The Uninstall

SPRobot — Tue, 24 Mar 2009 14:35:00 GMT

Okay, I've stepped into it.

I started a post yesterday about how to back out of an install when you've got it wrong. What I did was select Kerberos Authentication for the Central Adminstration website and once the Configuration Wizard completed, I couldn't open CA and I didn't want to take the time to configure the SPNs for my service accounts just now so I wanted to do a "post-config" uninstall.

So I just deleted the databases, the web site and the app pool and thought I'd just run the wizard again.

Not such a great idea.

The wizard remembered the old farm, but, without the configuration database available, it couldn't "unprovision" it. The WSS entry in Programs and Features wouldn't uninsall either; It offerred a Remove or a Repair option but neither would run to comletion; they would both start and then just quit and go away.

Eventually, I ran Setup.exe again and it offered a Repair option. Once it finished, I ran the wizard again and it gave me a dialog box that said "Error connecting to existing configuraiton database" and I said "really?" My only option was to cancel and when I did, I was able to run it a second time and it was happy to allow me to create a new farm.

So, what we've learned is the Proper "Post-Config" Uninstall Procedure.

Run the Configuration Wizard and, on the second page, select Disconnect from this server farm and click Yes on the warning dialog. This will delete the IIS web site and the application pool.
Then, run the uninstall from the Control Panel's Features and Programs application and click Yes on the warning dialog. This will take a reboot.
Then, if you really want to get rid of it all, go to the database server and delete the Config and Admin Content databases.

hth
-robot

PSConfig.exe v. The Configuration Wizard

SPRobot — Mon, 23 Mar 2009 15:06:00 GMT

In certain circles, you'll hear them say "There's no option to running the Configuration Wizard after you install the SharePoint Binaries.

In another, in particular, the blog of our new friend, Alpesh, you'll hear that PSConfig.exe can replace the Configuration Wizard.

So I've installed WSS and I have two new menu options under Administrative Tool, SharePoint Central Adminsitration and the SharePoint Configuration Wizard. When I try the Central Adminstration link, I'm told I need to run the wizard. So our question is, can we replace the configuration wizard with a suitable set of PSConfig.exe commands.

First, Let's take a look at what the wizard does.

It warns you that we'll be restarting some services including IIS.
Select between an existing farm or a new farm. Let's presume at this point that we'll be creating a new farm. If we need to work an install script for additional server, we'll look at it after.
Configuration DB Settings - You add the server name, database name, username and password. This is your "DBAccess Acount" and will be the App Pool identity for the Central Administration web site.
Central Admin Configuration - This step inludes your opportunity to select a port number for your CA web site (I always select 63999) and your selection of NTLM or Kerberos.

That's if the the Configuration Wizard until you click Advanced Settings. Here you'll get to select Active Directory Account Configuration mode where you can specify the domain and organizational unit where the new users will get created. Let's call this a complication we can look at later.

So that's it.

Now if you look at the PSConfig.exe reference on TechNet you'll see we can get all this into it's commands but first, let's agree on some sample values for the required inputs.

Our domain is called OurDomain.
Our DB server is called OurDBServer.
Our Configuration DB name will be SharePoint_Config, the Wizard's default.
Our DB Access account is called OurDomain\SPDBAccess and its password is SPDBAPassword.
Our farm administrator account is called OurDomain\SPFarmAdmin and his password is SPFAPassword.
Our CA port number is going to be 63999 and we'll use Kerberos authentication.

And let's review the PCConfig.exe syntax: PSCongig.exe -cmd <command> [<parameters>]

Now, I'm not trying to rewrite the reference but let's see if we can get our farm built.

Our first venture into PSConfig activity will be to use the ConfigDB command to create the configuration database. Let's try:

PSConfig.exe -cmd configdb -create -server OurDBServer -database SharePoint_Config -dbuser OurDomain\SPDBAccess -dbpassword SPDBAPassword -user SPFarmAdmin -password SPFAPassword -admincontentdatabase SPAdminContent

So, I try this and I get this error:

You do not have the appropriate permissions to use the SharePoint Products and Technologies Configuration Wizard. This application requires Administrator privileges.

I'm logged in to the server as SPFarmAdmin and, sure enough, I'm already a local bax admin. The problem seems to be Windows 2008 and its stinginess with permissions. When you start a command prompt in Server 2008, it does not automatically provide that session with administrator privileges; to run the configdb command, you have to right-click on the command prompt menu option and select Run as Administrator.

Also you may run into another problem burried in your database server. The SQL Server Browser service must be running if your not running a single, default database instance on your server.

Yet, still, I am not able to run the configdb command. The PSConfig.exe program creates a log called PSCDiagnostics_xxx everytime you run it and puts it in the \12\Logs folder. Here, when I start to get errors, it tells me that the login for my dbuser fails:

So for right now, the Configuration Wizard seems to be a requirement.

-robot

Kerberos: Threats and Countermeasures

SPRobot — Mon, 16 Mar 2009 14:32:00 GMT

Now the assignment is to brief our security group on the impact of our Kerberos configuration might have "downstream" specificially relating to "threats and countermeasures."

I guess the theory is that by trusting accounts and servers for delegation, security holes may arise in unexpected ways. Also, the specific configurtations may impact non-SharePoint web applications that are hosted on servers alongside SharePoint web applications.

Also, when we last looked at Kerberos, we were operating in our spiff new Server 2003 domains and, this being 2009, those domains look considerably less spiffy. So, to maintain sufficient spiffiness, we'll be working in our spiffy new Server 2008 domains.

We have the TechNet content re: Server 2008 here: http://technet.microsoft.com/en-us/library/dd349791.aspx

Here we find a link to download a document titled: Threats and Countermeasures: Security Settings in Windows Server 2008 and Windows Vista

The only relevant content here relates to providing permission to set the "Trusted for Delegation" property for user and computers in the Active Directory domain.

The main point of this content is that if you provide this permission to a user then you have the possibility that user can be hacked and some nefarious agent can then set the permissions, and establish authentication that will be trusted by the coputers that use this permission.

One excellent point it make is "Delegation of authentication is a capability that multitiered client and server applications use. It allows a public-facing service to use client credentials to authenticate to an application or database service. For this configuration to be possible, both client and server must run under accounts that are trusted for delegation.

The impact here is that user account that get hacked can create a problem that would extend to data sources that trust the account even if that datasource itself is not hacked. The countermeasure is to use "constrained delegation" to llimit the access of trusted delegates.

As I see it, this means I log into Windows and I'm me. I visit my team site and SharePoint interacts with the content database using its service account and renders my selected page. On my page, there's a web part that queries an extenal datasource; since the service account is trusted for delegation and the web server is trusted for delegation, the service account and the web server are able to carry my ID to the external datasource and, essentially, log me it. As a result, the query result will be security trimmed for me. Obviously, if I can establish users and computers that are trusted for delegation, I can make the service account and the web server carry my credentials to an external datasource and gather the answer to a query that the service account itself may not have permission to see.

Second, elsewhere on TechNet (http://technet.microsoft.com/en-us/library/cc782684.aspx) tells us: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.

Third, Kerberos Authentication uses Active Directory and our new best friend, Tim, has two great posts on the way Kerberos works in AD here:

http://blogs.technet.com/ad/archive/2007/12/17/t2a4d-concidentally-what-i-would-name-a-droid-if-i-had-one.aspx
and
http://blogs.technet.com/ad/archive/2008/05/09/trusted-for-delegation-in-services-for-user-s4u.aspx

Tim gives us this clever tidbit:

The T2A4D setting has no actual check box or radio button which is intuitively titled “Click Here for Trust To Authenticate for Delegation”. Instead the setting is integrated with the constrained delegation settings interface on a computer account.

So, if we want to boost our credibility with the security team, we might suggest that we are, in fact, addressing the constrained delegation countermeasure we mentioned above.

-robot

.swf Files Won't Play in IE7

SPRobot — Tue, 20 Jan 2009 23:25:00 GMT

I love putting other people's shockwave pages in page viewer web parts. I've sorted and filtered them to have a pretty handy reference of .swf solutions.

The problem is in IE7; the .swf thingey just won't play. Try it in Firefox, no problem, in IE7, no dice.

I understand this arises from a security "feature" in IE7 that blocks "Cross-Domain" shockwave objects. Of course, this is exactly what I want to do because I don't have much Shockwave skill and I'd just like to drop it on my SharePoint page and be finished with it. The page is in my domain and the .swf file is in somebody else's.

I found there's a registry hack that disables this "feature." Create a key named HKLM\Software\Microsoft\Internet Explorer\Main\Feature Control\FEATURE_BLOCK_LMZ_SCRIPT and add a REG_DWORD value to the key of 0 which should show up as 0x000000 (0)

Now my page views with .swfs in them work just fine.

Now I know squat about the registry but I understand you can really mess things up rooting around in there. And I have zero concern about security because our security Nazi's are on steroids and if anything gets hacked, it's on them. So if you're concerned about system stability or security, you're welcome to continue to look around for another fix. If you find one, please share it with us.

hth
-robot

The New Book

SPRobot — Tue, 02 Dec 2008 16:16:00 GMT

If you'll pardon the blatant commercialization, I'd like to let you know that my latest publishing effort is now available on Amazon.com. I'm credited as contributing editor and worked with Dr. Bradford for several months to publish Modern ERP: Select, Implement and Use Today's Advanced Business Systems.

You can get a good look at our publicity description here: http://www.ModernERP.com (A Godaddy site)

If you buy it, please let me know what you think.

-robot

Help with Search from a SharePointBlogs.com blogger

SPRobot — Mon, 17 Nov 2008 15:24:00 GMT

Here's some great info on MOSS Search:

http://www.sharepointblogs.com/jennyeverett/archive/2008/01/24/more-on-configuring-search.aspx

Nice work Jenn!

-robot

Ofiice Server Search Error 6482 - Application Server Administration job failed...

SPRobot — Sun, 16 Nov 2008 04:07:00 GMT

I went to TechNet forums with this error:

http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/cde1b74c-f19d-4b06-9754-d64f20858bfa

Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (ea1f2cb4-6fe0-4838-92d7-1e1a908808fd).

Reason: Object 196c41c4-d474-42a2-8bac-f5239cefff2c not found.

It an application error that pops up every minute.

I can't find the object in the registry which might be why it can't be found by the applicaiton.

So I went to Services on Server. I clicked on the Office Server Search Service.

I entered the password of the service account that the service uses and clicked OK.

When I did, I got a entry in the Application Log that said a new application had been found identifying the same GUID as the one not found above.

Then it also appeared in the registry under HKLM..Office Server Search\Applications.

I reset IIS and now search is working and the error has quit... for now.

What I don't know is what triggered it in the first place. Search had been working and then it quit and that's when the errors started.

-robot

MOSS Events in SCOM 2007

SPRobot — Thu, 04 Sep 2008 15:14:00 GMT

Earlier, we installed the WSS and MOSS management pack in our SCOM server.

Now, when we explore the Authoring tree, under Management Pack Objects node, we get a Rules node. Here we get all the rules that the server can attempt to enforce. At the top of the Rules window, on the right, there's a Change Scope link that pulls up a dialog box exposing all the potential targets that are associate with the server's management packs.

If we uncheck them all, we can select only:

Microsoft Office SharePoint Server 2007 MOSS Server
Microsoft Office SharePoint Server Application Installation
Microsoft Windows SharePoint Services 3.0 WSS Server
Microsoft Windows SharePoint Services Application Installation

When we click OK, the Rules window resets to a grid with our four Type headings. When those headings are expanded, they reveal a number of rules SCOM will attempt to enforce on our MOSS Server.

The server nodes contain rules that include a rule name that is probably unique to SCOM. But the properties of each rule includes a configuration tab that associates the rule with:

An Object
A Counter
An Instance

These values map back to the counters in the Windows Performance application found under Administrative Tools.

The applicaiton nodes include a rule name and properties that map our to items in the application and system logs that you find in your computer management mmc.

You can override these rules or add your others.

hth

-robot

Kerberos SPN Command Calculator

SPRobot — Fri, 29 Aug 2008 19:01:00 GMT

I know you guys are tired of hearing me go on and on about Kerberos but I think you'll like this.

Don't forget to set SPNs for your each of your hosts and for each of the various host headers used in your alternative access mappings. This means if you set an SPN for http://portal, you'll also need one for http://portal.MyFirm for your intranet host and you'll need http://portal.MyFirm.Com for internet.
Since all those SetSPN.exe commands are so complicated, I built the SPN Command Calculator, an excel spreadsheet where you enter your host names and your service accounts and it calculates the command strings you need to set the SPNs. You can thank the guys at SharePoint blogs for hosting it and letting you download it.

Let me know what you think.

-robot

MOSS and SCOM 2007

SPRobot — Fri, 29 Aug 2008 15:17:00 GMT

We built our server farm and we have this other computer that runs SCOM 2007. The challenge is to get one to work with the other.

I found the SharePoint Monitoring Toolkit here.

This page has four download buttons:

MOSS Management Pack installer (.msi)
A zip file with "Guides" (.zip)
A Readme (.rtf)
WSS Management Pack installer (.msi)

The Readme is three pages and has some good inrfo on files locations and known issues. These all have work-arounds and do not seem to be gate issues.

The "Guides" zip file includes .doc and .docx versions of the MOSS and the WSS management packs. The MOSS doc is 101 pages.

The guide opens with perfunctory boilerplate and then begins with a Getting Started section. These instruct you to import the .mp file into your SCOM console. This is a problem because we don't get a .mp file, we get a .msi and while some of you may know how to reconcile this distinction but I can only guess that I run the .msi and I get the .mp.

Sure enough, I run both .msi files and I end up with a C:\Program Files\System Center Management Packs folder and it's got a MOSS and a WSS folder, each with a Management Pack folder with my .mp files inside.

The guide continues to instruct us to open the Operations Console and import the .mp files. As far as I can be sure, this is my first venture into SCOM and it's Ops Console. It looks alot like SQLServer 2005. You find the Administration tree and right-click on management packs and select Import where you can navigate out to the .mps and import them.

That should give us a set of default monoitoring activities these can be modified and other can be created.

Next, we have to add the managment agent and we're pointed to http://technet.microsoft.com/en-us/library/bb309622.aspx. Here we see we have a number of options:

Deploy the agent from the SCOM console.
Deploy the agent directly on the target compuer (a "manual agent install")
Deploy the agent from a command line.
Deploy the agent by including the target in a group.
Deploy the agent to a member of Multiple Management Groups (called "multihoming".)

Selecting the first option, takes me to the instructions on TechNet that introduces me to the Discovery Wizard that describes a three step process: Discover, Select, Configure.

Of course, my lab guys have this in one domain and I need to monitor a server in another. I try a number of computer name options and user options ending up at the IP address and the local administrator account but, alas, the Wizard cannot discover the server.

-robot

The Standard View of your list is being displayed because your site configuration does not support the Datasheet.

SPRobot — Thu, 28 Aug 2008 17:49:00 GMT

I have a site where anonymous access is allowed and, if I haven't logged in, when I browse to a datasheet view, I get a standard view with this note at the bottom:

The Standard View of your list is being displayed because your site configuration does not support the Datasheet.

Which is fine, I guess, except for two things.

First, I don't believe a configuration option is available for a view that will make it appear as a datasheet for anonymous users.

Second, if your default view is a datasheet and it's available anonymously, Google will crawl the page and index the error message as part of the page content. Consequently, if you do a search for the error text, you find eight bazillion pages that allow anonymous access to views that use the datasheet as the default view.

And that's okay too, except it makes looking for a possible configuration option that doesn't exist alot more difficult.

On the good side, you can get an idea of what people are doing with their SharePoint lists like the guys at idvsoutions, here.

-robot

IE Crashes When Opening Library Documents

SPRobot — Tue, 26 Aug 2008 12:31:00 GMT

MS IE has encountered an error and needs to close

Everytime you try to open a document in a document library.

Apparently this arises when you have a mismatch in Office program versions such as SharePoint Designer, which is Office 12, and Excel 2003.

Our new pal, Brian, who writes a blog here, tells us MS has a hotfix here.

HTH

-robot

Kerberos (Again)

SPRobot — Fri, 22 Aug 2008 14:54:00 GMT

This is obviously one of the trickiest tools in the MOSS box.

Previously, I referenced this industry standard post from Martin Kearn.

And now we have this from TechNet.

And this from TechNet Blogs.

Installing it is one thing; proving that it's working is another. For example, what happens when it doesn't work?

So we've got this Kerbtray.exe tool from the Win2K Resource Kit.

When you install it, it doesn't make a menu item to open it so you have to go to your C:\Program Files\Resource Kit folder to run it from the .exe.

When you run it, you get a system tray icon and when you click on the icon, you get a cool little windows app that shows you:

Client Principal - This looks like me because it says Robot@MyFirm.MyDomain.Net
A tree of what looks like IDs spilling out of MyFirm.MyDomain.Net - these are kind of cryptic; one is cifs/SomeComputer.MyFirm.MyDomain.Net. Another is host/MyComputerName.MyFirm.MyDomain.Net. There's others including this one that kind of makes sense: LDAP/SomComputer.MyFirm.MyDomain.Net. I think the "SomeComputer" is actually our local domain controller. Some of the others are duplicates.
A box headed Service Principal (spelled -P-A-L meaning "lead person", not "idea.")
A tabbed table with heading for Names, Times, Flags, Encryptions Types.

The Names tab includes three fields, Client Name, Service Name, and Target Name. When I select a different node in the tree, the lead value in the Service Principal box changes to match and the names then change accordingly.

I'm going to log out, reboot, log in with a local account and then see what it says.

Much as I suspected, when you log in locally, the little application is blank and it says No Network Authentication. I tried logging into my SharePoint site that is supposed to be running Kerberos and still nothing. I also tried executing a RunAs command and using my network ID and still, nothing.

So, apparently, they've updated our MOSS "Infrastructure" and you have to have this update: Description of the Microsoft Office Servers Infrastructure Update: July 15, 2008 This update says to update be sure to run the WSS Infrastructure Update first. This upate lives here: Description of the Infrastructure Update for Windows SharePoint Services 3.0: July 15, 2008

So the question arises, have these already been installed using the automated update programs? No sweat, it says it will tell you how to tell if these updates have already been installed. To do this, it gives you a set of files names with size and date info and I guess you're supposed to see if those files are already on your server. My problem is that it doesn't tell me where to look for them.

Anonymous Access to Document Libraries

SPRobot — Wed, 06 Aug 2008 20:55:00 GMT

This one is pretty peculiar.

If you allow anonymous access in IIS and you allow anonymous access in your web app's authentication provider (in CA Application Managment) you can set Anonymous Access on the site's Advanced Permissions page by selecting Anonymous Access from the settings menu.

If you select Nothing, when you select the Anonymous Access option from your doc library permissions' Settings menu, the Change Anonymous Access Settings page displays but all the options are greyed out.

So, let's say you go to your site's Advanced Permissions and select Anonymous Access from the Settings menu and select Entire Web Site.

Now, when you look at the permissions for a list you can select Anonymouse Access from the Settings menu and you'll get a Change Anonymous Access Settings page with four options: Add, Edit, Delete, and\or View.

But if you look at the permissions for a document library, when you select Anonymouse Access from the Settings menu, you'll get a Change Anonymous Access Settings page with four options: Add, Edit, Delete, and\or View but the first three are greyed out.

Does this mean that anonymous contributions to document libraries are not possible with WSS?

I guess it does. If you look here: http://office.microsoft.com/en-us/sharepointtechnology/HA101130181033.aspx?pid=CH100649861033

You notice the Note at the bottom: Note Only the View Item permission is available for libraries. This is to help protect your site from potential script injection attacks.

Great, another elegant solution squashed by overbearing security.

-robot

WSS Alert Failures

SPRobot — Tue, 22 Jul 2008 16:10:00 GMT

Maybe some of you brainiacs know why, but yesterday, I turned on the Remote Procedure Locator Service on my Server 2003 and restarted the timer service and, now, all of a sudden, my alerts have started working.

In the past, the "You have created an alert" message would go out but the alerts would not.

I think I have both immediate and scheduled alerts working for the first time.

-robot

Incoming eMail Settings

SPRobot — Wed, 14 May 2008 14:25:00 GMT

Sure, we'd like to have inbound eMail working because it can do alot for corporate communications. Our friend, Joel, has a great outline of these capabilities here.

When I try to enable inbound eMail for a document library, I click on the link on the list settings.

You can set the inbound mail to sort into folders depending on subject or sender and you can tell it to overwrite files. I presume, if the library is set for versioning, overwrites will create a new version.

I can't tell because, when I click OK on the Inbound Email Settings page, I get one of those ugly SharePoint errors that says:

The request failed with HTTP status 401: Unauthorized.

Troubleshoot issues with Windows SharePoint Services.

I always wonder if we'll ever see those people again that click on that bottom link because, once you do, you are in Hell.

So, digging around, we find this. Seems to be perfectly on point. It says:

To enable or configure incoming e-mail support for a list or library, you must have the Manage Lists permission on the list or library. The Manage Lists permission is granted by default to the Site name owners SharePoint group.

I don't see a Manage Lists permission on the doc library. All I see is Full Control. And, otherwise this page doesn't help. Even though I have the "full control" permission, I get the unauthorized error.

At this point, I tried a new blank team site and created an discussion board. During the creation process, I checked the Enable email option and gave it an email address. When I clicked OK, I get an Operation Completed page that says:

The list was created successfully, but could not be assigned an e-mail alias because of the following error: The request failed with HTTP status 401: Unauthorized.

So I check the Windows Event Logs and I see I have some number of these:

The Execute method of job definition Microsoft.SharePoint.Administration.SPIncomingEmailJobDefinition (ID f940c454-b2f0-4bb0-bdec-fa034f5e6ee7) threw an exception. More information is included below.

Value cannot be null.
Parameter name: path

On MSDN, I see that someone else has the exact same problem.

I've seen several references to this from our new best friend Steve in the UK.

-robot

Local Access to Central Admin

SPRobot — Wed, 23 Apr 2008 16:06:00 GMT

This is peculiar:

When I'm looking at my server's console and I try Start | Programs | Microsoft Office Server | SharePoint 3.0 Central Administration a browser opens pointed to http://MyServer:12345. I get a log in prompt that says: Log in to MyServer.MyDomain.Local.

No matter what I enter, I am not getting logged in. I try my setup account which is a domain admin. I try other domain admins. I try my DB Access account and all my service account. After three tries, I end up with "You are not authorized to view this page."

I try reworking the URL to http://MyServer.MyDomain.Local:12345 and I try http://LocalHost:12345 and neither works.

The only thing that works is the IP address with the port number.

When I try the Central Admin site from my desktop, I get the Central Admin site, no sweat.

This seems suboptimal.

-robot

Importing a Spreadsheet

SPRobot — Tue, 15 Apr 2008 15:25:00 GMT

We like to think that the transition from list to spreadsheet is almost seamless. And I've delivered some great solutions that allow users to manipulate spreadsheets on their local hard-drive and then upload the data to a suitable list on the portal.

However, this time, I'm trying to get the spreadsheet import to work.

So I have this spreadsheet with field validation, hidden columns and conditional formatting and I try to point my import browse button to it and I get an error box that says:

Import to Windows SharePoint Services list
Object doesn't support this property or method

When I click OK, I get the spreadsheet and the Import to Windows SharePoint Services list dialog box where I can select a Range of Cells, a Table Range, or a Named Range.

When I select a range of cells, drag my mouse across the desired cells and click Import, after I get prompted for a login, I get this error:

Import to Windows SharePoint Services list
Method 'Post' of object 'IOWSPostData' failed

Turns out this was all my fault because I've installed the SharePoint Designer which is an Office 12 product.

This action created an Office12 Folder under C:\program files\microsoft office\.

The problem is the EXPTOOWS.XLA file and it's accompanying EXPTOOWS.DLL file that live in the \Office 12\1033 folder. So I renamed these two files by adding a .12 extension to them and I copied the same files out of my

C:\program files\microsoft office\Office 11\1033 folder

and pasted them into my \Office 12\1033 folder

No more problem importing spreadsheets.

hth

-robot

Executables in the 12 Hive

SPRobot — Tue, 11 Mar 2008 21:26:00 GMT

When I run a search on *.exe in the \12 folder, I get:

HCINSTAL.exe - This appears to be the executable that will install the Help Collection. It is sometimes an issue when language packs are installed as noted here.
MSSDMN.exe - This is a process related to populating full text indexes as noted here.
MSSEARCH.exe - Also related to indexing on SQL Server but can also be used for Exchange.
OWSTIMER.exe - This is the program that tracks SharePoint's "to do" list. It is critical for alerts and use logs. There's a pretty good description here.
PRESCAN.exe - This is a program that analyzes your site to identify issues before you upgrade a site. Technet has a good description here.
PSCONFIGUI.exe - The only references to this executable I found are in hotfix description on Microsoft.com. I think it's the configuration wizard.
SPWRITER.exe - This is the volume shadow copy service (VSS) reference writer and most of the references we find are discussion about hotfixes from Microsoft.
STSADM.exe - This is the admin command line console.
WSSADMIN.exe - This is the service that runs the various administrative functions.
WSSTRACING.exe - Not sure what this one does. Jose says it logs records out to the diagnostic log file.

Jose's post is actually a very good description of baseline MOSS performance indicators. If you've got better links or explanations, I'd love for you to share them.

-robot

Error on User Profiles and Properties Page and Event ID: 7888

SPRobot — Fri, 07 Mar 2008 21:36:00 GMT

In a brand new three server farm, I'm opening up the User Profiles and Properties page from the SSP Admin site.

I get the red "X" with this error:

An error has occurred while accessing the SQL Server database or the Office SharePoint Server Search service. If this is the first time you have seen this message, try again later. If this problem persists, contact your administrator.

The only log entry I can attribute to this action is in the WFE's Application log and I've copied the error below.

Source: Office SharePoint Server
Category: Office Server General
Event ID: 7888
Description:
A runtime exception was detected. Details follow.
Message: The request failed with HTTP status 503: Service Unavailable.

Techinal Details:
System.Net.WebException: The request failed with HTTP status 503: Service Unavailable.
   at Microsoft.Office.Server.Search.Administration.SearchApi.RunOnServer[T](CodeToRun`1 remoteCode, CodeToRun`1 localCode, Boolean useCurrentSecurityContext, Int32 versionIn)
   at Microsoft.Office.Server.Search.Administration.SearchApi..ctor(WellKnownSearchCatalogs catalog, SearchSharedApplication application)
   at Microsoft.Office.Server.Search.Administration.SearchSharedApplication.get_SearchApi()
   at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.<>c__DisplayClass3.<GetImportStatus>b__0()
   at Microsoft.Office.Server.Diagnostics.FirstChanceHandler.ExceptionFilter(Boolean fRethrowException, TryBlock tryBlock, FilterBlock filter, CatchBlock catchBlock, FinallyBlock finallyBlock)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

So, in digging around, I got this one hint from an acquaintance at MindSharp.com:

IIRC, this is a permissions error in that the particular SharePoint Server 2007 service cannot access the SQL database.

Which leads me to the following questions:

What's IIRC
Which MOSS 2007 service would we be talking about, the SSP Admin service?
Which SQL Database?

So to work past all of these questions, I added every service account to a group on the SQL Server and then created a SQL Server Login for that group with the sysadmin server role and made it dbowner of every database.

Alas, to no avail. Apparently, there's something between the server that's running the SSP Admin service and the SQL Server that acting gnarly.

I'll fix it. It'll rue the day...

More 10016 Errors

SPRobot — Wed, 05 Mar 2008 22:01:00 GMT

So the system log fills up whenever I try to look at the user user profiles. The system log error is this:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{3D42CCB1-4665-4620-92A3-478F47389230}

to the user MyDomain\mosssspsvc SID (S-1-5-21-1875211509-1510927935-777304043-47821). This security permission can be modified using the Component Services administrative tool.

The User Profile page says this:

An error has occurred while accessing the SQL Server database or the Office SharePoint Server Search service. If this is the first time you have seen this message, try again later. If this problem persists, contact your administrator.

I found a couple of reports like this one that say to search for the CLSID in the registry and then get the associated App ID and look for the App ID in Component Services under the DOM Config heading where you have to convert the view to a list view to see the App IDs.

When I do that, I get the OSearch Application and I set the Local Activiation permissions so allow Local Activate for my MossSSPSvc user but the errors wouldn't quit untill I rebooted the machine. Apparently, something in that process got everything reset except the User Profiles and Properties page issues.

I'll ge to it next.

-robot

MOSS, Kerberos and the Security Log

SPRobot — Wed, 05 Mar 2008 14:59:00 GMT

You may recall we discussed Kerberos authentication here.

And we linkd to two great posts, one, here, from Martin.

And as we worked through the process, it started to make some sense. We quit when we got to configuring component services, I guess out of sheer laziness.

Well, now, I'm digging through the Windows Security log and I'm seeing these 10016 errors that say:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{61738644-F196-11D0-9953-12345ABCDEC1}

to the user MyDomain\mossapppool_01 SID (S-1-5-21-1234567899-1510927935-777304043-47828). This security permission can be modified using the Component Services administrative tool.

To me, this is obviously a "two-hop" issue. So I go back and look at the component issues from Martin's post.

Now, this is the first time I've ventured into Component Services which is a Server 2003 Administrative Tool mmc. Martin says to drill into the properties of My Computer and change the Default Impersonation Level on the Default Properties tab to Impersonate. This makes sense if I'm telling My Computer to assume that it's impersonating someone else when it runs a component that needs to "Hop" to connect to another computer.

The the only other issue is in the DCOM Config folder under My Computer where we have to look at the IIS WAMREG admin Service. Here we select the Security tab and edit the Launch and Activation Permissions adding our app pool identities and giving them Local Activation permissions. Then, I presume I'll need to do the same to my SSP server that's also a WFE server.

And the hope is that this will eliminate the 10016 Errors from the security log. We'll see.

-robot

MOSS 2007 SP1 Install

SPRobot — Mon, 03 Mar 2008 20:37:00 GMT

So, now that I have the farm operational, they want SP1 installed.

The first thing I found was this:

Planning and Deploying Service Pack 1 for Microsoft Office SharePoint Server 2007 in a Multi-server Environment

And then, I downloaded the WSS SP1 language pack install instead of the WSS SP1 install so be sure the WSS file you're using is:

wssv3sp1-kb936988-x64-fullfile-en-us.exe

I guess you might have the x86 version or non-us-english versions as well but, the important point would be that is does not have an "lp" in the name.

Then, our new friend, Shane, covers it pretty good here.

I can add that, on the multi-farm install, I had trouble when I tried to run the Configuration Wizard on both WFE servers at once. It seemed to like running one and then the other better.

-robot