Sharing the experience

layouts/inplview.js? access is denied

2012-02-10T10:34:00.000-08:00

[Question]:
layouts/inplview.js? access is denied

In SharePoint 2010 when I am trying to get a item menu by right clicking on the item I am having a javascript error:
layouts/inplview.js? access is denied
How can I fix it?

[Answer]:

I have resolved this error by correcting AAM (Alternate Access Mapping) records.

My issue was that I have configured HTTPS between user and ISA, but set HTTP between ISA and the SharePoint server. ISA: How to redirect HTTP to HTTPS, How to set SSL Certificate

Such configuration is called "off-box SSL termination." But, I have setup AAM in incorrect way.

The correct AAM for "off-box SSL termination" is to use HTTP and HTTPS urls as Internal URLS for one default HTTPS Public URL(in case public and internal hostname are equal in ISA):

P.S. In case you haven't setup SSL certificate on the web server and you want to request site locally avoiding trip to ISA, add to local host file as an example perimiter.portal2010.local with IP of the server; and then add AAM for this hostname. It will do the trick.

ISA: How to redirect HTTP to HTTPS, How to set SSL Certificate

2012-02-08T07:22:00.000-08:00

One of the task while building SharePoint farm ( in my case 2010) is to set Load Balancing. The common approach for this is to make use of ISA.

My prod SharePoint portal needs to use SSL connection. Plus, I love simplicity. So, I have decided to use ISA
to set SSL connection for users.

Traffic between users and ISA are HTTPS, but traffic between ISA and SharePoint portal is HTTP.
The beautiful name for such connection is off-box SSL termination.

To implement it, we need to have:
1. SSL certificate issued for the portal host name;
2. ISA

That's it)

How to do it:

1. Setup a SSL certificate that been issued for your portal host name on ISA
Simple concept: How to add SSL certificate

2. Create a Server Farm object in ISA , create Firewall Policy with this object.

Set Internal site name that been send to WFE, In the farm object add WFE server IPs

Server Farm is TO where the requested will be redirected

3.Create a Listener
Listener is FROM where the requested will be redirected

The specified IPs are IPs of ISA that been used specifically for redirection users. DNS server administrator should create a DNS entry with public DNS host (ex. portal2010.local) that is been pointed to the IP on ISA.

In the connection tab check HTTP and HTTPS. This way you allow a user to type HTTP, but eventually his request will be converted into HTTPS (that is achieved through other option which will be shown in a few sec)

4. Add certificate to the listener
Simple concept: How to add SSL certificate

5. Add to the rule on the tab "Public name" , the public name of the portal

6. And this is the crucial, juicy and last step.
Bridging - How the request will be redirected

Notice that "Redirect" goes to HTTP, not to SSL.
This way you don't have to install SSL certificate on WFE itself, just on ISA. But the user still get HTTPS connection between him and ISA.

P.S.
Test Rule shows you HTTP connection, because it shows the communication between ISA and WFE.
The user will see a different picture. he will see HTTPS since he's been served by ISA.

P.S.S.
Remember to configure AAM appropriatelly. Also, my advice is to configure WFE the way you can test the sites without load- balancing on the box itself:

SharePoint Load balancing:local settings for a web server

Networking: essential commands

2012-02-07T08:46:00.000-08:00

I am getting deeper in networking while building topology for SharePoint 2010.
Here is a quick reminder for everyone who is not a network savy but has to survive.

The following list of the network commands will help to understand where you machine is and how it's routed.
So, run MS-Dos window and enjoy:

1. notorious - ping - sends out a packet to a designated internet host or network computer and measures its response time. The target computer will return (hopefully) a signal.

2. ipconfig (add /all to get a full picture) - It is used to display the TCP/IP network configuration values (assigned IP, gateway and DNS server)

3. tracert - The actual path between two computers on the Internet is not a straight line but consists of numerous segments or "hops" from one intermediate computer to another. Tracert shows each step of the path taken.

4. pathping - this command combines functions of Ping and Tracert. Pathping will first list the number of hops required to reach the address you are testing and then send multiple pings to each router between you and the destination.

5. netstat - displays the active TCP connections and ports on which the computer is listening, Ethernet statistics, the IP routing table, statistics for the IP, ICMP, TCP, and UDP protocols.

The command "netstat -a" will display all your connections. The command "netstat -b" will show the executable files involved in creating a connection. A figure showing all the switches and syntax is given below

5. nslookup - This command helps diagnose the Domain Name System (DNS) infrastructure.

For more detailed info, TCP/IP and Networking Tools

Simple Concept: Central Administration Url: Where it stores and how to change

2012-01-31T14:17:00.000-08:00

[Question]:

On SharePoint server when I click on "Central Administration" it goes nowhere...

How do I change the Url for 'Central Administration" shortcut?

[Answer]:

When "central administration" goes nowhere, first check if shortcut goes to the right url.

Url for this shortcut is kept in registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\WSS\CentralAdministrationURL

Please backup the key first, and then safely set you desired url for CA.

It actually changes automatically when you setup default public url in Alternate Access Mapping.

P.S. For some reason a new url won't work locally on the server?
Please read about some tweaks that you wan't to do on the web server:
Disable the loopback or specify HostName

BDCM: How to import through PowerShell

2012-01-30T12:30:00.000-08:00

[What you have]:
You have a bunch of BDCM files.

[What you want]:

You want to import BDCM files via PowerShell Script.

[What you want to know]:

Simple concept: How to use SharePoint cmdlets in PowerShell ISE

[What you want to do]:

Run following in your PowerShell window:

sl {your path to BDCM files}

$MetadataStore = Get-SPBusinessDataCatalogMetadataObject -BdcObjectType "Catalog" -ServiceContext {your url to CA}

$bdcmFiles = @(Get-ChildItem);
foreach ($bdcmFile in $bdcmFiles)
{

Import-SPBusinessDataCatalogModel -Path $bdcmFile.Name -Identity $MetadataStore -Force

}

[What you want to consider]:

BDCM: How to set permissions through the code?

Simple Concept: _layouts/userdisp.aspx shows 404 not found

2012-01-25T11:44:00.000-08:00

[Question]:

How to fix 404 not found on SharePoint 2007 browsing User Profile page _layouts/userdisp.aspx ?

[Answer]:

The userdisp.aspx page code needs to be changed on any servers providing web application services for the site (the web front ends, for example). On the servers, navigate to C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\LAYOUTS. Make a copy of the userdisp.aspx file – just in case, so you'll have something to revert back to! Open the original using Notepad. Look for Scope="Farm" and change Farm to Web so that it reads Scope="Web". Save and close. Repeat on all web servers

P.S. More details from SharePoint User Information Userdisp.aspx Error by Melonie Poole

Application Server Administration job failed for service instance:Access to the path 'C:\Windows\system32\drivers\etc\HOSTS' is denied.

2012-01-25T10:10:00.000-08:00

Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (db7e7060-eba7-4b6c-b09e-242978fa6e97).
Reason: Access to the path 'C:\Windows\system32\drivers\etc\HOSTS' is denied.

Having this error?

Read on and you will know why Search writes in the host file and how to give access to the host file.

First of all, Search service writes in the host file when you use a dedicated server for crawling
For more details - sharepoint 2007 search writes wrong IP in host file

Wondering if you need to use a dedicated server? Read this simple and useful article - Configure a dedicated front-end Web server for crawling (Office SharePoint Server 2007)

In case you need to keep a dedicated server for crawling, to fix the issue with access to host file, do following:
Set permissions for group WSS_Admin_WPG on host file
Make sure that you Set "Modify" BUT NOT "Full control" (otherwise Search deletes HOST file)

sharepoint 2007 search writes wrong IP in host file

2012-01-25T09:32:00.000-08:00

Wondering why host file has wrong IPs for SSP or your portal?
And you can clearly see that these records made by Search service.
#Added by Office SharePoint Server Search

I found a wonderful post about it : Configure a dedicated front-end Web server for crawling (Office SharePoint Server 2007)

"When you use the Configure Office SharePoint Server Search Service Settings page in Central Administration to select a dedicated front-end Web server for crawling the SharePoint timer service writes the entries to the Hosts file"

The host file may have wrong IPs written by search service in the following cases:

The server that you specified as your dedicated front-end Web server for crawling has multiple IP addresses assigned to one or more network cards.
Your server farm is using network load balancing.

To quickly fix it:
1. Go to Central Administration /_admin/Server.aspx, click on "Office SharePoint Server Search".
Select "Use all web fronts end computers for crawling"
2. Change IPs in the host file.

After this fix, search service will not overwrite host file.

Simple Concept : visionapp Remote Desktop 2011: how to restore configuration file?

2012-01-09T12:24:00.000-08:00

[Question]: I want to use my configuration for visionapp Remote Desktop 2011 under a different account logged into machine. I don't have .vre (export) or .vrb (backup) file with my configuration.How can I transfer my connection configuration?

[Answer]:
Run visionapp, add file

Browse and find you original settings.xml file with connections and credentials under C:\Documents and Settings\{User}\Application Data\visionapp\vRd2010\settings.xml

Select the file, finish the process.

Note: stored credentials in setting.xml won't be decrypted, so you need to retype password for them.

Simple Concept: PowerShell: The local farm is not accessible.

2011-12-09T09:28:00.001-08:00

[Question]: What permissions should I have to run PowerShell against SharePoint 2010?
How can I fix following issues:
- The local farm is not accessible. Cmdlets with FeatureDepedencyId are not registered
- Cannot access the local farm
- Object reference not set to an instance of an object?

[Answer]:
Remember, when using the SharePoint 2010 Management Shell and its Windows PowerShell cmdlets, you need both:

the rights granted via the Add-SPShellAdmin cmdlet and

local administrator rights on the server on which you’re running the management shell

(From Hey, Scripting Guy! Tell Me About Permissions and Using Windows PowerShell 2.0 Cmdlets with SharePoint 2010)

P.S. Do you need a fast tour on PowerShell And SharePoint 2010?

PowerShell and SharePoint: What, Why and How - gives you an overview what's PowerShell and how to use it for SharePoint 2010

SharePoint 2010: PowerShell and Stsadm - explains why you want to use PowerShell instead of stsadm in SharePoint 2010

Simple concept: How to use SharePoint cmdlets in PowerShell ISE - shows you how to user PowerShell in SharePoint 2010

PowerShell: Add-SPSolution -force when wsp is already deployed - a PowerShell replacement for stsadm -o addsolution and deploysolution

The 2010 SharePoint databases, purposes and mirroring supportability

2011-12-09T06:41:00.001-08:00

I have scrutinized the article Database types and descriptions (SharePoint Server 2010) and here is the result - a table which gives an overall understanding what datatables SharePoint 2010 uses and what for, plus their ability to be mirrored.
* Url to set Failover field sometimes is missing since I haven't tested by myself
*** "No??" Indicates the msdn documentation gives "No", but in CA UI I see an option to set Failover
***The easy way to set failover:
1. Make sure that you have configured a mirror
2. Run the script
2.1. suitable in case that all your mirrors on the one box:

Param([string]$FailoverInstance = $(Read-Host "Enter the Mirror (Partner) SQL Instance(like server\instance)")) 
get-spserviceinstance -all | foreach-object { 
    if ($_.typeName -eq "Microsoft SharePoint Foundation Database") { 
        foreach ($Database in $_.Databases){ 
             
            write-host "Updating FailoverPartner on" $Database.Name "to" $FailoverInstance 
            $Database.AddFailoverServiceInstance($FailoverInstance) 
            $Database.Update() 
            write-host "Successfully Updated Failover Partner on" $Database.Name "to" $FailoverInstance 
        } 
         
    } 
}

2.2.
For individual database, run this simple script.
$db = get-spdatabase | where {$_.Name -eq "db_name"}
$db.AddFailoverServiceInstance("db02");
$db.Update()
****In case of the issue with Failover, try to find an answer from SharePoint 2010 Failover doesn't work

	Default Database name	Purpose	Mirror supportability	Default recovery mode	Url to set Failover
1	SharePoint_Config	contains data about SharePoint databases, Internet Information Services (IIS) Web sites, Web applications, trusted solutions, Web Part packages, site templates, and Web application and farm settings specific to SharePoint 2010 Products, such as default quota settings and blocked file types.	Yes	Full	PowerShell
2	SharePoint_AdminContent	It stores all site content, including site documents or files in document libraries, list data, and Web Part properties, in addition to user names and rights for the Central Administration site collection	Yes	Full	PowerShell
3	WSS_Content	Content databases store all content for a site collection, including site documents or files in document libraries, list data, Web Part properties, audit logs, and sandboxed solutions, in addition to user names and rights.	Yes	Full	_admin/CNTDBADM.aspx
4	WSS_UsageApplication	It stores health monitoring and usage data temporarily, and can be used for reporting and diagnostics.	Yes, but not recommended. Can be easily recreated in the case of failure	Simple	PowerShell
5	Bdc_Service_DB_	stores external content types and related objects	Yes	Full	_admin/ServiceApplications.aspx
6	Application_Registry_server_DB_	stores backward-compatible information that is used to connect to information that is used by the Microsoft Office SharePoint Server 2007 Business Data Catalog API.	Yes	Full	PowerShell
7	SubscriptionSettings_	stores features and settings for hosted customers	Yes	Full
8	Secure_Store_Service_DB_	stores and maps credentials, such as account names and passwords	Yes	Full	_admin/ServiceApplications.aspx
9	StateService	stores temporary state information for InfoPath Forms Services, the chart Web Part, and Visio Services.	Yes	Full	PowerShell
10	WebAnalyticsServiceApplication_StagingDB_	temporarily stores un-aggregated fact data, asset metadata, and queued batch data for the Web Analytics service application.	No	Full
11	WebAnalyticsServiceApplication_ReportingDB_	stores aggregated standard report tables, fact data aggregated by groups of sites, date and asset metadata, and diagnostics information for the Web Analytics service application.	Yes	Full	PowerShell
12	Search_Service_Application_DB_	hosts the Search service application configuration and access control list (ACL), and best bets for the crawl component. This database is accessed for every user and administrative action	Yes	Simple	searchfarmdashboard.aspx
13	Search_Service_Application_CrawlStoreDB_	stores the state of the crawled data and the crawl history	Yes	Simple	searchfarmdashboard.aspx
14	Search_Service_Application_PropertyStoreDB_	stores information that is associated with the crawled data, including properties, history, and crawl queues	Yes	Simple	searchfarmdashboard.aspx
15	User Profile Service Application_ProfileDB_	stores and manages users and associated information. It also stores information about a user's social network in addition to memberships in distribution lists and sites.	Yes	Simple	_admin/ServiceApplications.aspx
16	User Profile Service Application_SyncDB_	stores configuration and staging data for use when profile data is being synchronized with directory services such as Active Directory	No??	Simple	_admin/ServiceApplications.aspx
17	User Profile Service Application_SocialDB_	stores social tags and notes created by users, along with their respective URLs	Yes	Simple	_admin/ServiceApplications.aspx
18	Managed Metadata Service_	stores managed metadata and syndicated content types	Yes	Full	_admin/ServiceApplications.aspx
19	WordAutomationServices_	stores information about pending and completed document conversions	Yes	Full
20	PerformancePoint Service Application_	stores temporary objects, persisted filter values, and user comments	Yes	Full	_admin/ServiceApplications.aspx
21	ProjectServer_Draft	contains data for editing projects. This database also hosts the tables used by the Project Queue. Data in the Draft database is not directly accessible by end users.	Yes, but you must follow additional steps.	Full
22	ProjectServer_Published	contains a copy of all of the projects that have been published. The Published database also contains tables that are specific to Project Server (timesheets, resources, custom fields, security definitions, and other metadata). This database also hosts the tables used by the Timesheet Queue. Data in the Published database is not directly accessible by end user	Yes, but you must follow additional steps.	Full
23	ProjectServer_Archive_	stores the backup data of projects, resources, calendars, enterprise custom fields, the enterprise global Project Web Access view definitions, Project Web Access system settings, and category and group security settings as set up by the Project Web Access administrator. Data in the Archive database is not directly accessible by end users.	Yes, but you must follow additional steps.	Full
24	ProjectServer_Reporting	is the repository for the entire portfolio of projects in Project Server. These tables present stable snapshots of each project plan based on the last time a project was published to Project Server and include de-normalized time phased data, allowing for advanced reporting capabilities outside of the Project client. Data in the Reporting database is accessible by end users.	Yes, but you must follow additional steps.	Full
25	FASTSearchAdminDatabase	stores and manages data related to administration of FAST Search Server 2010 for SharePoint. This includes search setting groups, keywords, synonyms, document and site promotions and demotions, term entity extractor inclusions and exclusions, spell check exclusions, best bets, visual best bets, and search schema metadata.	No	Full
26	DefaultPowerPivotServiceApplicationDB	stores the location of cached or loaded PowerPivot data files, data refresh schedules, and PowerPivot usage data that is copied from the central usage data collection database.	Yes, but mirroring is managed solely through SQL Server: SharePoint Server 2010 is not aware of the PowerPivot database.	Full
27	RSDB	stores all report metadata including report definitions, report history and snapshots, and scheduling information.	No	Full
28	RSTempDB	stores all the temporary snapshots while reports are running.	No	Full

Simple Concept: How to change database SQL server name in SharePoint

2011-12-07T10:20:00.001-08:00

[Question]:

How do I change the SQL Server name in SharePoint 2010\2007?

[Answer]:

Golden rule: "User SQL Alias instead of the SQL server name"

In any case, whether you need replace the SQL instance name or SQL alias, you can do it:

For 2007: Make use of the stsadm command: stsadm -o renameserver

For 2010: Make use of the PowerShell command: Rename-SPServer
You want to run the command on every server in the farm.

Real example:

I had the SQL alias soa-db01-prod, which it is not what I want now.
I want to replace SQL alias to soa-db05-prod.

Steps to successful SQL server name renaming on ever server that is included in the Farm (except SQL servers):
1. Add a new SQL alias "soa-db05-prod"
2. Run the command
Rename-SPServer –Identity "soa-db01-prod" –Name "soa-db05-prod"
3. Delete alias "soa-db01-prod"
4. iisreset

ATTENTION: I have discovered that after running Rename-SPServer 2 services still were referencing to the old SQL name:

1. User Profile Service Synchronization.
To fix it - I have restarted the User Profile Synchronization Service
( to know more about How to deal with User Profile Service - How to start User Profile Synchronization service)

2. Web Analytics Service Application
To fix it - I have stopped the services Web Analytics Data Processing Service,Web Analytics Web Service and re-created the service.

an unhandled exception systemsecurity.cryptography.cryptographicexception occurred in OWSTIMER.exe

2011-12-02T07:51:00.001-08:00

Having this one every day on your local box where SharePoint 2010 installed?

This is a known issue that gives you no harm: OWSTimer unhandled exception popup – System.Security.Cryptographic.CryptographicException

Don't worry about your Prod SharePoint 2010 box. The window will not popup in the case you don't have Visual Studio installed there.

Chrome: An additional plug-in is required to display some element.

2011-12-01T13:58:00.001-08:00

What plug-in should I install? How can I look at the installed plug-ins?

You can look at the installed plug-ins by typing in the Chrome browser:
about:plugins or chrome://plugins/

When I click on "Install plug-in" nothing happens.

In this case, there is chance that you are suffering from Skype plug-in:

Refer to:Chrome–An additional plug-in is required to display some elements on this page–Solved

I fixed my Chrome by removing Skype extension.

Simple concept: How restore a SharePoint 2010 content database on the different farm

2011-12-01T08:02:00.001-08:00

[Question]:
How restore a SharePoint 2010 content database on the different farm?

[Answer]:
The concept is pretty much the same as for 2007. You can refer to post How to restore a sharepoint web app from a SQL backup

But, let me highlight 2 aspects:

1. This is 2010 specific.
You have 2 options how you add your content database ( Add a content database (SharePoint Server 2010)
- you add a content database through CA
- or you can execute PowerShell command Mount-SPContentDatabase

2. Dealing with errors after adding the content database

If after adding the content database, you are experiencing the following issues with that database:

ISSUE:

- In the log file you see such error when you try enable or disable features (or other scenarios that I have ran):

Unknown SQL Exception 201 occurred. Additional error information from SQL Server is included below. Procedure or function 'proc_SecGetIndividualUrlSecurityCheckEventReceivers' expects parameter '@MinLevel', which was not supplied.

-or

Database '{content_database_name}' on SQL Server instance '{SQL_Instance_name}' is not empty and does not match current database schema.

TO FIX:

Compare the SQL Server instance versions from where the content database got shipped to the new farm.

Simple concept: How to find SQL Server version ?

Here is an example from my life:

The new farm uses the SQL Server instance version:

10.50.1600.1 (RTM)

The database are copied from SQL Server instance version (Prod):

10.50.2500.0 (RTM SP1)

If SQL versions are not the same, you have to make them equal. You are lucky, if your new farm SQL instance has lower version so you can upgrade it.

ISSUE:

The page on CA /_admin/DatabaseStatus.aspx shows the status for a content database"

Database is too new and is not supported

TO FIX:

Check the farm version:
_admin/FarmServers.aspx

Here is an example from my life:

The new farm:
Configuration database version: 14.0.4762.1000

Prod:
Configuration database version: 14.0.6106.5002

If the farm versions are different, make them equal.

P.S.
In the case you need to install June 2011 Fix, after installation you may experience the following error:

"Cannot connect to the configuration database."

TO FIX:
Run SharePoint Product configuration wizard

SharePoint 2010 Failover doesn't work: Login failed at System.Data.SqlClient.SqlInternalConnectionTds.LoginWithFailover

2011-11-30T13:10:00.001-08:00

We did the SQL mirroring for a content database.Then I went on /_admin/CNTDBADM.aspx select the content database and set the failover server for it.

We have 2 servers. Initially, db01 - is a principal, db02- failover.

The connection strings looks like this one:Data Source=db01;Failover Partner=db02;Initial Catalog={Content_db_name};Integrated Security=True;Enlist=False;Asynchronous Processing=False;Connect Timeout=15'

Then for test purposes we switch the principal to the previous failover server(db02). db01 became a mirror.

SharePoint worked great first couple hours.

But then when we sunset db01, the SharePoint collapsed with error that he can't connect to db01:

SqlError: 'Login failed for user '{failover instance service account}.' Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: '{db01 server netbios name}'

SQL database login for '{Content_db_name}' on instance 'db01' failed. Additional error information from SQL Server is included below. Login failed for user '{failover instance service account}

ConnectionString: 'Data Source=db01;Failover Partner=db02;Initial Catalog={Content_db_name};Integrated Security=True;Enlist=False;Asynchronous Processing=False;Connect Timeout=15' ConnectionState: Closed ConnectionTimeout: 15

An error occured while attempting to verify that the database is read only for database {Content_db_name}. The error contained the following message: Login failed for user {failover instance service account}

System.Data.SqlClient.SqlException: Login failed for user '{failover instance service account}'.
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)
at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject)
at System.Data.SqlClient.SqlInternalConnectionTds.LoginWithFailover(B

Even though I can see the connection string with Failover Partner value in the log, it hasn't been recognized by SharePoint.

This strange fix worked for me:

I re-applied the failover setting on the content database through PowerShell:

***Note you must be logged into PS as the Farm Account to set the failovers, a farm admin does not have sufficient rights to do this.***
(Setting Failover Partners for Sharepoint 2010)

$db = get-spdatabase | where {$_.Name -eq "Content_db_name"}
$db.AddFailoverServiceInstance("db02");
$db.Update()

How do you know if SharePoint uses the failover succesfully? Here is an indicator in the log file:

SQL Server failover connection detected. SQL Server db01 failing over to SQL server db02

P.S. The failover server should have a partner on SQL side. My DBA set the content db without mirroring on db02 . That immediately brought the error on SharePoint side. Somehow it checks that the failover server contains the content database that should be mirrored.

System.InvalidOperationException: Server db02, database {Content_db_name} is not configured for database mirroring

P.S.S.
There is an excellent article that covers all SharePoint 2010 databases and their failover ability.

Simple concept: How to use SharePoint cmdlets in PowerShell ISE

2011-11-29T14:17:00.001-08:00

[Question]:
I heard that I can manage everything in SharePoint 2010 with PowerShell. But when I run Windows PowerShell ISE , it doesn't recognize SharePoint PowerShell commands (ex: Get-SPContentDatabase)

How can I use PowerShell ISE for SharePoint 2010?

[Answer]:
SharePoint 2010 Management Shell is a just a PowerShell instance that loads sharepoint.ps1 script. So, you are free to use your own favorite IDE to build scripts, just load sharepoint.ps1 (SharePoint 2010: PowerShell and Stsadm)

To get sharepoint.ps1 loaded in PowerShell ISE:

1. Start PowerShell ISE

2. (in case you haven't created a profile yet)
run the following command to create a profile which loads every time you start PowerShell ISE
new-item -path $profile -itemtype file -force

3. (in case your profile is empty)
the following command writes to profile "." source loading of SharePoint.ps1"

sc $profile “.'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\CONFIG\POWERSHELL\Registration\SharePoint.ps1'”

4. Restart PowerShell ISE

Simple concept: Database is up to date, but some sites are not completely upgraded.

2011-11-29T11:48:00.001-08:00

[Question]:
After Mount-SpcontentDatabase, I m having Database is up to date, but some sites are not completely upgraded. on /_admin/DatabaseStatus.aspx. When I click on the /_admin/UpgradeStatus.aspx it shows me the status - Succeeded

How can I know what site collection is not upgraded and how can I upgrade it?

[Answer]:
First of all, to identify what site collection doesn't got upgraded, run:

stsadm.exe -o localupgradestatus > upgradestatus.txt

Open upgradestatus.txt and scroll down to the end of the file, you will see similar section:

In this picture as you see, there no site collection that need upgrade.
If you have any, you can identify them by searching by word "Needs upgrade" in this file.

Secondly, run the command in the PowerShell:

$id=(Get-SPContentDatabase -Identity "{Your content db name}").Id
Upgrade-SPContentDatabase -id $id

Finally, check the upgrade status by running stsadm again:
stsadm.exe -o localupgradestatus > upgradestatus.txt

In my case, it helped me get rid of the site collection "Needs update" warning in the report generated by stsadm.exe -o localupgradestatus

P.S. But still, I am having Status "Database is up to date, but some sites are not completely upgraded." which doesn't bother me since localupgradestatus shows me "0" objects need upgrade.

Simple concept: How to add SSL certificate

2011-11-22T12:34:00.001-08:00

[Question]:
How to add ssl certifate to machine? And how to use it?

[Answer]:
1.

2.Add\Remove Snap-in

Add ->“Certificates”->Computer account->Local computer

4. Select you SSL certificate and import it.

How to use it:

1. in IIS, you configure https, the imported certificate will appear in the SSL certificate drop box:

Note: SSL certificate is valid for specific host name.

2. in ISA, you can configure to fetch https request even though the balanced web fronts are not configured for https:

SharePoint Load balancing:local settings for a web server

2011-11-22T12:28:00.001-08:00

I have configured load balancing for SharePoint through ISA.

My second thought was "How can I check what's wrong with specific SharePoint IIS site if I can't trace where I have been redirect?"

Solution is to set the specific setting on the web server box itself.

Every time you log into a web server and navigate to central administration or web application using the same url as all users do, you will be redirected to specific local IIS site.

In order to achieve:

1. Change the host file:

C:\Windows\System32\drivers\etc\host
Add the following:
{ip the web server} {host name for CA}
{ip (second) for the web server } {host name for a web app}

2. Required if you setup https with certificates on ISA and want to set HTTPS between ISA and WFE
(Refer to the post Simple concept: How to add SSL certificate)
In case AAM has public url as https, you need to implement https on the local IIS (since you local request will not reach ISA with SSL certificates installed there),
Put the address that you have specified in the host file on the previous step, select the corresponding SSL certificate (the host name for web app should be exact the same as it is in SSL certificate)
ATTENTION: You can skip this step if you configure ISA HTTPS between a user and ISA and HTTP between ISA and WFE (ISA: How to redirect HTTP to HTTPS, How to set SSL Certificate)

3. The last but not least.
When you try to navigate using the hostname that you put in host file you likely to get the error:401 (Logon Failure: Reason: An error occurred during logon)
To overcome this issue:
You need to register your host names for local IIS Site (BackConnectionHostNames):

KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

Restart the IISAdmin service

Integrated Windows authentication: NTLM or Kerberos?

2011-11-22T12:18:00.001-08:00

Recently, I have been studied the topic "Kerberos: Why do I need it?"

Here is a quick explanation (from Configuring Kerberos Authentication for Microsoft SharePoint 2010 Products)what is Integrated Windows Authentication and relation to NTLM and Kerberos:

Integrated Windows authentication enables Windows clients to seamlessly authenticate with SharePoint Server without having to manually provide credentials (user name/password). Users accessing SharePoint Server from Internet Explorer will authenticate by using the credentials that the Internet Explorer process is running under — by default the credentials that the user used to log on to the desktop. Services or applications that access SharePoint Server in Windows integrated mode attempt to authenticate by using the credentials of the running thread, which, by default, is the identity of the process.

NTLM

NT LAN Manager (NTLM) is the default protocol type when Integrated Windows authentication is selected. This protocol takes advantage of a three-part challenge-response sequence to authenticate clients. For more information about NTLM, see Microsoft NTLM (http://go.microsoft.com/fwlink/?LinkId=196643).

Pros:

· It is easy to configure and typically requires no additional infrastructure/environment configuration to function

· It works when the client is not part of the domain, or is not in a domain trusted by the domain that SharePoint Server resides in

Cons:

· It requires SharePoint Server to contact the domain controller every time that a client authentication response needs validation, increasing traffic to the domain controllers.

· It does not allow delegation of client credentials to back-end systems, otherwise known as the double-hop rule. It is a proprietary protocol.

· It is a proprietary protocol.

· It does not support server authentication.

· It is considered less secure than Kerberos authentication

Kerberos protocol

The Kerberos protocol is a more secure protocol that supports ticketing authentication. A Kerberos authentication server grants a ticket in response to a client computer authentication request, if the request contains valid user credentials and a valid Service Principal Name (SPN). The client computer then uses the ticket to access network resources. To enable Kerberos authentication, the client and server computers must have a trusted connection to the domain Key Distribution Center (KDC). The KDC distributes shared secret keys to enable encryption. The client and server computers must also be able to access Active Directory directory services. For Active Directory, the forest root domain is the center of Kerberos authentication referrals. For more information about the Kerberos protocol, see How the Kerberos Version 5 Authentication Protocol Works (http://go.microsoft.com/fwlink/?LinkId=196644) and Microsoft Kerberos. (http://go.microsoft.com/fwlink/?LinkId=196645)

Pros:

· Most secure Integrated Windows authentication protocol

· Allows delegation of client credentials

· Supports mutual authentication of clients and servers

· Produces less traffic to domain controllers

· Open protocol supported by many platforms and vendors

Cons:

· Requires additional configuration of infrastructure and environment to function correctly

· Requires clients have connectivity to the KDC (Active Directory domain controller in Windows environments) over TCP/UDP port 88 (Kerberos), and TCP/UDP port 464 (Kerberos Change Password – Windows)

Long story short, I have decided that I am willing to spare time and configure Kerberos if I see the farm desperately needs following:

1. Boost performance

2. SSRS reports needs to pass a user credentials to external source like this one:

3. BDC uses Web services that needs to pass a user token to the external source

4. Any other type delegation (which is not present in my specific scenario but it might be in your case)

Logon Failure: Reason: An error occurred during logon

2011-11-22T12:07:00.001-08:00

This issue occurs if you install Microsoft Windows XP Service Pack 2 (SP2) or Microsoft

Windows Server 2003 Service Pack 1 (SP1). Windows XP SP2 and Windows Server 2003 SP1

include a loopback check security feature that is designed to help prevent reflection attacks

on your computer.

Therefore, authentication fails if the FQDN or the custom host header that you use does not
match the local computer name.

Method 1: Specify host names (Preferred method if NTLM authentication is desired)

To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

Set the
DisableStrictNameChecking
registry entry to 1. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
281308 Connecting to SMB share on a Windows 2000-based computer or a Windows Server 2003-based computer may not work with an alias name
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Right-click MSV1_0, point to New, and then click Multi-String Value.
Type BackConnectionHostNames, and then press ENTER.
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
Quit Registry Editor, and then restart the IISAdmin service.

Back to the top

Method 2: Disable the loopback check (less-recommended method)

The second method is to disable the loopback check by setting the DisableLoopbackCheck registry key.

To set the DisableLoopbackCheck registry key, follow these steps:

Set the
DisableStrictNameChecking
registry entry to 1. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
281308 Connecting to SMB share on a Windows 2000-based computer or a Windows Server 2003-based computer may not work with an alias name
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Right-click Lsa, point to New, and then click DWORD Value.
Type DisableLoopbackCheck, and then press ENTER.
Right-click DisableLoopbackCheck, and then click Modify.
In the Value data box, type 1, and then click OK.
Quit Registry Editor, and then restart your computer.

(http://support.microsoft.com/kb/896861)

Simple concept: SSRS authentication

2011-11-22T08:39:00.001-08:00

[Question]: How to figure out what authentication does SSRS use? Is Kerberos enabled ?

[Answer]:

Go to the box where SSRS service is running;
"{System drive}:\Program Files\Microsoft SQL Server\MSRS{some numbers}.MSSQLSERVER\Reporting Services\ReportServer\rsreportserver.config"

Check the section: "Authentication"

For example, the value for SSRS authentication without Kerberos which SSRS service runs under not NetworkService or LocalSystem account:

<Authentication>
<AuthenticationTypes>
<RSWindowsNTLM/>
</AuthenticationTypes>
<RSWindowsExtendedProtectionLevel>Off</RSWindowsExtendedProtectionLevel>
<RSWindowsExtendedProtectionScenario>Proxy</RSWindowsExtendedProtectionScenario>
<EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>

The explanation of the value is here - How to: Configure Windows Authentication in Reporting Services

More on that: Authentication Types in Reporting Services

SharePoint 2010 gentelman's tool set (freeware)

2011-11-15T07:19:00.001-08:00

I have compiled a tool set for SharePoint 2007 a time go which can help developers to handle SharePoint 2007 issues easily. All mentioned tools are freeware.

I am starting compiling tools for SharePoint 2010:

SharePoint Feature Administration and Clean Up Tool - http://featureadmin.codeplex.com/ - helps to investigate missing features and remove them. The most common task after database attach upgrade is to get rid of 367b94a9-4a15-42ba-b4a2-32420363e018 ReportServer SharePoint 2007 feature. Feature Admin Tool v2.2. makes is fast and easy!

As before, a tremendous help with reading SharePoint logs -ULS Viewer - http://code.msdn.microsoft.com/ULSViewer - ULSViewer allows users to open a ULS log file and display its contents in a user friendly format.

A descendant of The SharePoint Manager 2007 - http://spm.codeplex.com/ SharePoint manager 2010- still powerful and "must have" for everybody who touches the SharePoint from administrative side.

Simple concept:SharePoint document is locked for editing by "another user"

2011-11-15T07:02:00.001-08:00

[Question]:
I am trying to edit the document from SharePoint library , getting an error:
The document is locked for editing by "another user".
How I can resolve this issue?

[Answer]:
Annoying...
Need some knowledge on that - The document is locked for editing by another user" error message when you try to open a document in Word
Need an immediate help? -
1. Kill the process WINDWORD.exe
2. Check out the file to the draft folder from SharePoint library

Edit the document and safe it with checking in.
Next time you will not have problem with editing the document