Sharepoint webpages slow to load (SPCertificateValidator.Validate) long execution time

Has been a week of make, break, fix and make it faster.
Performance issues with SharePoint can be caused by many issues. This is one small avoidable issue that can help improve the page load speeds.

As a general rule the first thing to start with when troubleshooting performance issues with web page loads times, is to enable the developer dashboard. This will give you a break down of the components the page loads and the associated load times.
To enable the Dev Dash : http://workingsharepoint.blogspot.co.uk/2012/03/developer-dashboard.html

One item we found consistently coming up with a long load time (20s) during testing was the following. (SPCertificateValidator.Validate). Execution Time=20034.2566316328

A quick explanation of this is that a component on the page is trying to check the validity (CRL check) of the "SharePoint Root authority" certificate. As it cant find it in the Trusted root certificates, Windows tries to retrieve the CRL from the net and causes the delay.
See the MS article for a full explanation.



Solutions to this are to do one, or both if a test environment, on your WFE servers.
This comes straight from the MS article which is referenced below.

A> Install the SharePoint Root Authority certificate in the Trusted Root Certification store.

1. Obtain the “SharePoint Root Authority” certificate as a physical (.cer) file
   a. Launch the SharePoint 2010 PowerShell window as Administrator
   b. $rootCert = (Get-SPCertificateAuthority).RootCertificate
   c. $rootCert.Export("Cert") | Set-Content C:\SharePointRootAuthority.cer -Encoding byte

2. Import the “SharePoint Root Authority” certificate to the Trusted Root Certification store
   a. Start | Run | MMC | Enter
   b. File | Add/Remove Snap-in
   c. Certificates | Add | Computer account | Next | Local computer | Finish | OK
   d. Expand Certificates (Local Computer), expand Trusted Root Certification Authorities
   e. Right-click Certificates > All tasks > Import
   f. Next | Browse | navigate to and select C:\SharePointRootAuthority.cer | Open | Next | Next | Finish | OK



B> Disable the automatic update of root certificates on the SharePoint Servers.

1. Launch gpedit.msc as a local administrator.
2. Go to Computer Configuration | Windows | Security settings | Public Key Policies | Certificate Path validation settings.
3. On the Network Retrieval tab, define the policy and uncheck “Automatically update certificates in the Microsoft Root Certificate Program”
4. Run gpupdate /force for the policy to take effect immediately.


In our development environment we enabled both as there is a minimal risk but is not reccomended for any public facing Production Environment.
The article was for a search page but in our case was happening on the Home page of our site so this helped increase the page loads time by around 20 seconds.


MS Article : Search results are returned much slower intermittently
http://support.microsoft.com/kb/2639348

Extract all your Sharepoint Solutions to disk

A neat "how to" with a good explanation to extract all solutions from your SharePoint Farm.

Care of Shane Young :
https://msmvps.com/blogs/shane/archive/2011/05/05/using-powershell-to-export-all-solutions-from-your-sharepoint-2010-farm-and-other-fun.aspx

Thanks for clawing back hours from SharePoint and Dev hell

SharePoint Upgrade Failures

Recently I noticed that some servers in a Farm were listed as requiring an upgrade.
This process was used to resolve.
Don't forget to backup your Farm before trying anything.


Central Admin > Manage Servers in this Farm
Under status, two Servers were listed as "Upgrade required"

Reviewing the DB's showed that content DB's required an upgrade.
Central Admin > Upgrade and Migration > review DB status


To check further, from the hive folder run an upgrade check and pipe it to a file for review
stsadm -o localupgradestatus > c:\folder\upgradecheck.txt
Review the log file and find the section that Needs Upgrade
<status>Needs Upgrade</status>
This should list which components have an issue.


To resume a failed upgrade run the following, depending on your situation, on each server with the problem

psconfig.exe -cmd upgrade -inplace v2v -passphrase <insert-passphrase-here> -force
psconfig.exe -cmd upgrade -inplace b2b -passphrase <insert-passphrase-here> -force

v2v would be used for SharePoint 2007 databases placed in a SharePoint 2010 environment. 
For SharePoint 2010 databases in a newer patch level on a SharePoint 2010 environment you should use b2b
Check MS link below for psconfig ref on when to use -force option.



This still would not work and the error below occurred.

On step 3 I was getting the error "failed to create sharepoint timer service job to upgrade sharepoint products"
Logged in as the Setup account and re-ran the psconfig to resume the upgrade.
This time the following error occured.

####
An exception of type Microsoft.SharePoint.Administration.SPUpdatedConcurrencyException was thrown. Additional exception information: An update conflict has occurred, and you must re-try this action. The object SPUpgradeSession Name=Upgrade -20120320-184525-16 was updated by DOMAIN\ACCOUNT, in the PSCONFIG (7240) process, on machine SERVER. View the tracing log for more information about the conflict.

Total number of configuration settings run: 3

Total number of successful configuration settings: 2

Total number of unsuccessful configuration settings: 1

Successfully stopped the configuration of SharePoint Products.

Configuration of SharePoint Products failed. Configuration must be performed before you use SharePoint Products. For further details, see the diagnostic log located at [LOCATION OF LOG] and the application event log.
####

Sharepointgeoff advises to Resolve:

1. stsadm -o setproperty -pn command-line-upgrade-running -pv No
2. IISReset
3. Restart the Windows SharePoint Timer (cmd window : net stop sptimerv4, then net start sptimerv4)
4. psconfig –cmd upgrade –inplace b2b –wait –force (or v2v, whatever was run above)


Then ran the SP wizard on the servers in question and voila, happy SP servers.




Psconfig command-line reference (SharePoint Server 2010)
http://technet.microsoft.com/en-us/library/cc263093.aspx

Resume upgrade (SharePoint Server 2010)
http://technet.microsoft.com/en-us/library/ff382638.aspx

Relevant info ::
In some cases, you might have to restart upgrade to finish upgrading your sites from Microsoft Office SharePoint Server 2007 to Microsoft SharePoint Server 2010. For example:

During an in-place upgrade, if the server restarts or the upgrade fails, you must restart the upgrade process by using Psconfig.exe to upgrade the remaining sites.


During a database attach upgrade, any sites that cannot be upgraded will be skipped. After you have corrected any issues in the sites (such as a missing template or language pack, or the site being set to read-only or having exceeded its quota), you can restart upgrade by using a Windows PowerShell command to upgrade just the skipped sites.

SharepointGeoff : SPUpdatedConcurrencyException Fix when trying to install June 2011 CU for SharePoint Server
http://www.sharepointgeoff.com/spupdatedconcurrencyexception-fix-when-trying-to-install-june-2011-cu-for-sharepoint-server/

Setting ADFS Token Expiration times.

The SAML token lifetime is set by the token issuer (resource ADFS Server). You may find that this is too short and want to extend it.

Note that the valid session time is set by the ADFS SAML TokenLifeTime and the LogonTokenCacheExpirationWindow in SharePoint.
The SAML TokenLifeTime always needs to be greater than the LogonTokenCacheExpirationWindow in SharePoint.

The formula to apply here is as follows.
Valid Session time = TokenLifeTime - LogonTokenCacheExpirationWindow




To change the session times


On the resource ADFS server
The following script example shows you how to change the lifetime of the SAML token issued by the "SharePoint Adatum Portal" relying party in ADFS to 480 minutes.

Add-PSSnapin Microsoft.ADFS.PowerShell
Set-AdfsRelyingPartyTrust –TargetName "SharePoint Adatum Portal" –TokenLifeTime 480

On the Resource SharePoint Farm
The following script example shows you how to change the LogonTokenCacheExpirationWindow in SharePoint to two minutes.

$ap = Get-SPSecurityTokenServiceConfig
$ap.LogonTokenCacheExpirationWindow = (New-TimeSpan -minutes 2)
$ap.Update();
IIsreset


SAML Token Expiration in SharePoint on this page is worth a read to understand the principles
http://msdn.microsoft.com/en-us/library/hh446526.aspx


To display the current ADFS relying party trust settings
Set-AdfsRelyingPartyTrust

To display the SharePoint Security Token Service Config

Get-SPSecurityTokenServiceConfig

Developer Dashboard

The Developer Dashboard helps diagnose issues with custom code, load times and heaps more.


There are a few ways to enable/disable/ondemand it.
Note : you may need an IIS reset to see the developer dash appear / disappear


1. Powershell 

PS commands in blue

onDemand Mode (makes the icon available to expand the info window on each relevant page)
$service = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$addsetting =$service.DeveloperDashboardSettings
$addsetting.DisplayLevel = [Microsoft.SharePoint.Administration.SPDeveloperDashboardLevel]::OnDemand
$addsetting.Update()

Enable for all
$service = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$addsetting =$service.DeveloperDashboardSettings
$addsetting.DisplayLevel = [Microsoft.SharePoint.Administration.SPDeveloperDashboardLevel]::On
$addsetting.Update()

Remember to Turn Off
$service = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$addsetting =$service.DeveloperDashboardSettings
$addsetting.DisplayLevel = [Microsoft.SharePoint.Administration.SPDeveloperDashboardLevel]::Off
$addsetting.Update()



2. STSADM

Run stsadm from command prompt in the hive\bin dir unless you have it as a path in windows.
hive = C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\

onDemand Mode
stsadm –o setproperty –pn developer-dashboard –pv “OnDemand”

Enable for all
stsadm –o setproperty –pn developer-dashboard –pv “On”


Remember to Turn Off
stsadm –o setproperty –pn developer-dashboard –pv “Off”

PowerShell remoting

PowerShell remoting gives you the ability to run powershell scripts remotely on another machine.
Pretty cool if you have to run recurring scripts on multiple machines from your own PC.



On your target server ::
Open a powershell window as admin and run the following commands in blue

Enable-PSRemoting
Accept all prompts

Set-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 1000
Accept all prompts

Enable-WSManCredSSP –Role Server
Accept all prompts



If your account running the script needs ShellAdmin permissions to run the script, check if the account is shell admin with the following on your target server. This was only relevant to what I was doing in SharePoint, ignore if not applicable.
get-spshelladmin

If its not listed, add the account to shell admin on the target server.
add-spshelladmin accountname


Add the account (or SP account in my case) used to run code to the server local admin group.
In case of a multi-server farm, add on all servers. This again may not be relevant in your case.



On your Client Server :: (where you want to run your script)
Open a powershell window as admin and run the following commands in blue
 
Enable-WSManCredSSP -Role client -DelegateComputer *


Test access from the client server to the target server by entering the following PS command in a PS window
Enter-PSSession -ComputerName servername -Authentication CredSSP -Credential domain\accountname




All thanks to Abid the code Yoda and this URL :
http://blogs.msdn.com/b/opal/archive/2010/03/07/sharepoint-2010-with-windows-powershell-remoting-step-by-step.aspx

PowerShell cheat sheet

Random basic commands I keep forgetting, this list will surely keep growing


Add the SharePoint snap in :

Add-PSSnapIn Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

Set a path :

Set-location "path"

Output the PS command in a formatted table

"randomPS-command" | Format-Table –AutoSize

Check DB status for upgrade status

Get-SPDatabase | ?{$_.NeedsUpgrade –eq $true} | Select Name

Install SP Solution to all web applications  

Add-SPSolution -LiteralPath "c:\source\CodeMonkeySolution.wsp"

Install SP Solution to all web applications, to the GAC and force it in

Install-SPSolution -Identity CodeMonkeySolution.wsp -allwebapplications -GACDeployment -force

Adding and Removing dll's from the GAC using Powershell

To add a .dll to the GAC

Run the SharePoint PowerShell console as Administrator

type : Set-location <path to dll's here>

[System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")

$publish = New-Object System.EnterpriseServices.Internal.Publish

$publish.GacInstall( <path>\RandomcodemonkeyDLL.dll)

 
To remove a .dll from the GAC

$publish.GacRemove( <path>\RandomcodemonkeyDLL.dll)

A good way of getting the names of you assemblies from  :
 Simplest way to get the strong name of an assembly
http://nileshmandekar.blogspot.co.uk/2012/03/simplest-way-to-get-strong-name-of.html


A very elegant way of getting the dll's in and out via script is like this from Fred :
http://fredericloud.com/2011/01/08/no-gacutil-no-problem/