Showing posts with label SharePoint. Show all posts
Showing posts with label SharePoint. Show all posts

Monday, 2 July 2012

Uninstalling SharePoint Diagnostic Studio 2010

How to uninstall SharePoint Diagnostic Studio 2010

SharePoint Diagnostic Studio 2010 is actually part of the SharePoint 2010 Admin Tookit.


To uninstall a specific tool from the SharePoint 2010 Administration Toolkit
1.  From Programs and Features, select the Microsoft SharePoint 2010 Administration Toolkit and click Change.
The same dialog box is displayed if you run the SharePoint2010AdministrationToolkit.exe file instead of using Programs and Features.
2. Select the tool you want to remove.
3. Click Next, and then click Finish.

Detailed here : http://technet.microsoft.com/en-us/library/cc508848


Note : installing the tool provisions a solution globally "extendeddiagnosticproviders.wsp", this is not removed when you un-install the tool.



Also note, SharePoint Diagnostic Studio (SPDiag) 2010 can place significant load on SharePoint servers
http://support.microsoft.com/kb/2655725

MS say :
Using the SharePoint Diagnostic Studio (SPDiag) 2010 can consume significant network bandwidth and other resources on the server being monitored as well as on the database server used to host the project database.
Evaluate the need to have the toolkit installed.
Uninstall the SharePoint Diagnostic Studio 2010 if it is not required.


It's nice to have clean working performing environments.

Monday, 18 June 2012

Essential tools

Some great everyday tools to work with. These are mostly based around work with SharePoint.


SharePoint related

ULS viewer - http://ulsviewer.codeplex.com/ or http://archive.msdn.microsoft.com/ULSViewer/
don't leave home without it. ULSViewer allows users to open a ULS log file and display its contents in a user friendly format. Users can then perform advanced functions such as filtering, sorting, highlighting, loading logs, appending logs, etc in order to single out the data that is important to the user. This information can be used to diagnose problems with machines running ULS services, or to monitor machines and the events they create in realtime.


Notepad++ - http://notepad-plus-plus.org/
fantastic tool for html, xml, config file editing

XML Notepad -  http://xmlnotepad.codeplex.com/
XML Notepad provides a simple intuitive User Interface for browsing and editing XML documents

WinMerge - http://winmerge.org/
compares files, go compare

Power GUI - http://powergui.org
GUI for script editor for Microsoft Windows PowerShell, more features and can be more stable in some cases than PS console

Fiddler - http://fiddler2.com/fiddler2/
Browser Web Debugging Proxy, logs traffic between PC and browser.

WireShark - http://www.wireshark.org/
 go deep, network protocol analyzer for Unix and Windows




Useful Firefox\IE add-ins

Firebug - http://getfirebug.com/
Tools for web development. Allows inspect, edit and monitor CSS, HTML, JavaScript and Net requests in any web page

Yslow - http://yslow.org

Grade your web pages
Page performance, page components, stats, tools for performance

HttpWatch - http://www.httpwatch.com/
HttpWatch is an integrated HTTP sniffer for IE and Firefox that provides new insights into how your website loads and performs



Day to day tools

Vision app remote desktop - http://www.visionapp.com
excellent tool to manage remote access to multiple systems all at once, set your creds and login with one click. copy and paste between systems.


TreeSize pro - http://www.jam-software.com/treesize/
GUI for local and remote hard disk manager

KeePass - http://keepass.info/
Local client password manager

VMWare Workstation
VMWare machines at will


Process Explorer - http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Process Explorer shows you information about which handles and DLLs processes have opened or loaded.

Monday, 23 April 2012

Multiple login prompts with Load balanced Web Front Ends using ADFS Authentication

Problem :
Users were getting multiple authentication prompts when attempting to access a SharePoint website using ADFS authentication.



Possible other issues :

You may randomly be redirected back to a login page.
You may end up in an authentication loop that causes ADFS to halt the request because of a perceived denial of service (DOS) attack, as the note states.
If you look at a trace of the activity, you may see SharePoint setting your fedauth cookie to an expired value, then start making the requests again to ADFS, which then, either won’t issue you a non-expired cookie, or SharePoint looks at and transforms it to an expired cookie.



A quick Google, came up with the site below. (Cheers Steve)

As the our new Network Load Balancer (NLB) was not managed by us, they had not setup cookie based persistence. Or “Affinity” as described in the article below.

This was enabled and the problem went away.

It happens as the traffic from your browser may hit one WFE, and then another. A token is issued for each session so in this case setting cookie based persistence resolves the issue.



Resolution :
Enable the cookie based persistence on the NLB





Steve Peschka
Make Sure You Know This About SharePoint 2010 Claims Authentication - Sticky Sessions Are REQUIRED
http://blogs.technet.com/b/speschka/archive/2011/10/28/make-sure-you-know-this-about-sharepoint-2010-claims-authentication-sticky-sessions-are-required.aspx

Monday, 16 April 2012

Setting SQL Server Alias Names in SharePoint 2010

Setting up a SQL Alias name is useful if you have multiple farms in virtual environments. It helps as you always reference the same SQL alias and when you are moving DB's between different SQL Servers.

Ideally this needs to be done on all WFE & App servers, before installing SP and setting up your Farms.
Not required on your SQL server though.

1. Start “C:\windows\system32\cliconfg.exe”
Select the tab “Alias” and click the button “Add”.
Select “TCP/IP” and define the name of the alias "SPSQLSrv". The fill in the hostname of your database server and select the “Dynamically determine port”-checkbox. After that click “OK”.

If you running 64 bit, Start “C:\windows\syswow64\cliconfg.exe”
personally even though running 64 bit, i have had it working just using the 32bit version. never hurts to be thorough though.

2. Now on each SharePoint Server, create your new farm using the Sharepoint Products Configuration Wizard. Use the defined sql alias name as your database server. "SPSQLSrv"

Friday, 23 March 2012

Converting Self-Signed Certificates into certificates with a Private Key that IIS can use


Enabling SSL on SharePoint test sites will display the standard IE or Firefox certificate error.
To avoid this and provide a smooth experience for test users you can generate a Self-Signed certificate and  convert this to a .pfx file that can be imported into IIS.

When generating self-signed certificates for test systems this method will allow you to get a self-signed certificate with Private Key

Generate a self-signed  cert and Private Key

Copy the Certificate and Private key to their own respective text file and save with relevant names.
Change the extension of the certificate to a .pem or .crt file


Convert to usable self-signed certificate including private key (Convert PEM To PKCS12 (PFX) Format)

Paste in the Private Key and self-signed certificate, create a password.
Download the .zip file containing the .pfx certificate with Private Key
This .pfx file can now be imported into IIS.

You will still need to import the .pem/.crt self-signed certificate into your own PC “Trusted Root Certification  Authorities > Certificates” certificate store.
This can be done manually or via Group Policy if required for a large environment.
This will prevent the certificate errors when accessing a SSL enabled SharePoint site in your test environments.


Wikipedia has more information on the file extensions used for SSL certificates here :
http://en.wikipedia.org/wiki/X.509

Thursday, 22 March 2012

Setting ADFS Token Expiration times.

The SAML token lifetime is set by the token issuer (resource ADFS Server). You may find that this is too short and want to extend it.

Note that the valid session time is set by the ADFS SAML TokenLifeTime and the LogonTokenCacheExpirationWindow in SharePoint.
The SAML TokenLifeTime always needs to be greater than the LogonTokenCacheExpirationWindow in SharePoint.

The formula to apply here is as follows.
Valid Session time = TokenLifeTime - LogonTokenCacheExpirationWindow




To change the session times


On the resource ADFS server
The following script example shows you how to change the lifetime of the SAML token issued by the "SharePoint Adatum Portal" relying party in ADFS to 480 minutes.

Add-PSSnapin Microsoft.ADFS.PowerShell
Set-AdfsRelyingPartyTrust –TargetName "SharePoint Adatum Portal" –TokenLifeTime 480

On the Resource SharePoint Farm
The following script example shows you how to change the LogonTokenCacheExpirationWindow in SharePoint to two minutes.

$ap = Get-SPSecurityTokenServiceConfig
$ap.LogonTokenCacheExpirationWindow = (New-TimeSpan -minutes 2)
$ap.Update();
IIsreset


SAML Token Expiration in SharePoint on this page is worth a read to understand the principles
http://msdn.microsoft.com/en-us/library/hh446526.aspx


To display the current ADFS relying party trust settings
Set-AdfsRelyingPartyTrust

To display the SharePoint Security Token Service Config
Get-SPSecurityTokenServiceConfig

Monday, 19 March 2012

SharePoint Website Warm up options

There are many warm up scripts and exe's that can run against your SharePoint environments to speed up the first time access to any site. These options have worked the best for our infrastructure. personally the first works well and has useful options.

Setup a scheduled windows task which launches your selection, running under an account that has relevant access, every morning before start of business. The web application is hit and every page iterated in the site.




SPWakeup : http://spwakeup.codeplex.com/
A simple application that touches each site and site collection on a Sharepoint or WSS server to rebuild the IIS cache.
This is compatible with Win 2008 R2 and SharePoint 2010, nice touch is the email letting you know it's been run.

Powershell Script : http://www.jonthenerd.com/2011/04/19/easy-sharepoint-2010-warmup-script-using-powershell/
The script loads the SharePoint plugin, enumerates the zones, and sends a request to each one.


MS Application Warm-up : http://forums.iis.net/t/1176740.aspx
The MS IIS team had a nice warm up optiont that i've used before, but this has been removed at present (19/03/2012)
Keep an eye on any new developments as it was a good option.
SP George had a good how to : http://sharepointgeorge.com/2010/warm-sharepoint-web-applications-windows-2008-r2-iis-75-application-warmup-module/



For reasons on why we get IIS resets and reasons to use Warm up scripts check out this link : http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/8547eaed-5420-4cca-af29-206d71898322/

Thursday, 15 March 2012

Setting up Kerberos Authentication for Sharepoint



To understand the basics, read the articles at the end of this how to. In short you permit your web service account to connect from a specified URL, to a specific Server with a specific SQL account.



For the SQL Service account

A : Manual Process For SQL
Open a cmd prompt with Run as (run as the domain admin account) or add the following with ADSI Edit.
Enter the following in the cmd prompt
setspn -A MSSQLSvc/servername.mydomain.tld:1443 mydomain\SQLserviceaccount
press enter

if successful enter the following
setspn -A MSSQLSvc/servername:1443 mydomain\SQLserviceaccount
press enter


B : Else, open ADSI edit
Browse to the SQL Server Service account used (mydomain\SQLserviceaccount)
right click > properties.
In the Attribute section, select ServicePrincipleName > click Edit
Add the following :
MSSQLSvc/servername:1443
MSSQLSvc/servername
MSSQLSvc/servername.mydomain.tld:1443
MSSQLSvc/servername.mydomain.tld


For the Web application Account

A : Manual Process
Open a cmd prompt with Run as (run as the domain admin account) or add the following with ADSI Edit.
Enter the following in the cmd prompt
Setspn -A HTTP/myURL.mydomain.tld mydomain\webappserviceaccount


B : Else, open ADSI edit
Browse to the Web Application Service account used (mydomain\webappserviceaccount)
right click > properties.
In the Attribute section, select ServicePrincipleName > click Edit
Add the following :
HTTP/myURL
HTTP/myURL.mydomain.tld

Note : it's always HTTP even if you site is HTTPS





Enable Constrained Delegation for the Web Application account

Browse to the web application Active Directory service account (mydomain\webappserviceaccount)
Edit the Object > Select the Delegation Tab > Trust this user for Delegation to any service (Kerberos only)
Click Ok



Test the Kerberos Setup

1. Setup a new site in Central Admin
Central Admin > Manage Web Applications > New
Select Claims Based Auth
Create a new IIS Site
Port : 80
HostHeader : enter name of site users will browse to
Edit Path to D:\etc...
Allow Anonymous : Yes
Enable Windows Auth : checked
Intergrated Windows Auth : checked and Negotiate (Kerberos) set
Create new Applicaiton pool : enter pool name or leave as default.
Select the Web application Service account : (mydomain\webappserviceaccount)
Amend you DB name if required.
Select OK to create the new web application

2. Create a site collection
Any site will do, use the same name as the host header and enter a site collection admin.
Click ok

3. Open DNS Manager > Create an A record for the Site name pointing to the IP i.e. MyURL
FQDN should be myURL.mydomain.tld

4. Open the Servers' Event Viewer > Select the Security logs > Filter the log to event ID 4624


5. Access the site from your PC browser : http://myURL
Check the Servers' Event Viewer for 4624 events, Logon Process and Authentication package should read : Kerberos


This is a really good site for further info : http://technet.microsoft.com/en-us/magazine/ee914605.aspx

These websites contain good explanations
http://www.thesharepointblog.net/Lists/Posts/Post.aspx?List=815f255a%2Dd0ef%2D4258%2Dbe2a%2D28487dc9975c&ID=43
http://blogs.msdn.com/b/russmax/archive/2009/10/20/configuring-kerberos-authentication-in-sharepoint-2010-part-1.aspx

The first was pretty clear to me and was used to create this page.

Wednesday, 14 March 2012

Developer Dashboard

The Developer Dashboard helps diagnose issues with custom code, load times and heaps more.


There are a few ways to enable/disable/ondemand it.
Note : you may need an IIS reset to see the developer dash appear / disappear


1. Powershell 

PS commands in blue

onDemand Mode (makes the icon available to expand the info window on each relevant page)
$service = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$addsetting =$service.DeveloperDashboardSettings
$addsetting.DisplayLevel = [Microsoft.SharePoint.Administration.SPDeveloperDashboardLevel]::OnDemand
$addsetting.Update()

Enable for all
$service = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$addsetting =$service.DeveloperDashboardSettings
$addsetting.DisplayLevel = [Microsoft.SharePoint.Administration.SPDeveloperDashboardLevel]::On
$addsetting.Update()

Remember to Turn Off
$service = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$addsetting =$service.DeveloperDashboardSettings
$addsetting.DisplayLevel = [Microsoft.SharePoint.Administration.SPDeveloperDashboardLevel]::Off
$addsetting.Update()



2. STSADM

Run stsadm from command prompt in the hive\bin dir unless you have it as a path in windows.
hive = C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\

onDemand Mode
stsadm –o setproperty –pn developer-dashboard –pv “OnDemand”

Enable for all
stsadm –o setproperty –pn developer-dashboard –pv “On”


Remember to Turn Off
stsadm –o setproperty –pn developer-dashboard –pv “Off”


Sunday, 11 March 2012

AD Permissions on SharePoint Administrative accounts.

A common mistake that produces the various errors below on install or when adding service accounts to SharePoint.

Solution :
"Authenticated Users" should have "read" permissions on all Service accounts you add to SharePoint.
From the AD consol > edit the AD service account object > Security tab > Select "Authenticated Users" > ensure "Read" permissions are enabled.

Error on SP installation : 
Failed to create the configuration database.
An exception of type System.Collections.Generic.KeyNotFoundException was thrown.  Additional exception information: The given key was not present in the dictionary.
System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary.
at System.ThrowHelper.ThrowKeyNotFoundException()
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)

Error on adding AD account as managed SharePoint account : 
The given key was not present in the dictionary.

Windows TIFF iFilter

Built-in Windows TIFF iFilter, simple to install and comes with Windows Server 2008 R2. 
permits you to index Tiff Files in SharePoint 2010

Install instructions :
Open Server manager > Features > Add Features > Windows TIFF iFilter > Next > Install.

Next,  check the Group policy to ensure OCR filter is enabled.
Open mmc > add group policy object snapin > Local computer policy > administrative templates > OCR > Force TIFF iFilter to perform OCR for every page in a document > edit > Enable.

Install on your SharePoint Servers doing the indexing the Farm.
In the case of a multi tier farm, if you have no compatibility concerns or security issues, install on all servers in the Farm in case you move the indexing role around.


Lastly, upload a .TIFF with some text, run an indexing job and check the search results.


Thanks to Mr Liu : http://johnliu.net/blog/2010/8/13/sharepoint-enable-ifilter-for-tiff-ocr.html

Monday, 5 March 2012

SharePoint 2010 Farm Backups via PowerShell

There are a few ways to do this but this method gave good results.

Overview :
Setup a share on a Server you will use to store the farm backups. This can be any one of your SP servers in the Farm. We normally backup to a share on the SQL box.
Setup scheduled tasks to trigger a batch file which runs the PS scripts to backup the farm, or cleanup the backups. This seems like an extra step but worked for me on Win 2008 R2 where nothing else would after a long day.
A good place to run this task would be an application server that most folk don't have access to as i set the script execution policy to unrestricted.



Pre-reqs :

Script execution status :
Check the server that you will be running the PS scripts on.
Ensure the execution policy for PS scripts are set to unrestricted.
(run PS as admin) PS commands in blue
To check : Get-ExecutionPolicy
To Set : Set-ExecutionPolicy Unrestricted


Setup your File share to store you backups :
Share the folder with the following settings
Everyone full access
NTFS permissions : SQL account & SP Admin account full access. (you need both accounts listed here)
Share name : \\Servername\FarmBackups



PS Scripts setup : 

Place you backup scripts in a relevant folder
\\Servername\FarmBackups\backupscripts


1. Setup a .bat file to be triggered by the scheduled task
File name : 1schedfarmbakup.bat
Insert the following line in the file and save. Batch file command in red
powershell -command "&{D:\FarmBackups\backupscripts\2backupSPfarm.ps1}"




2. Setup the powershell script file to backup the Farm.
File name : 2backupSPfarm.ps1
Insert the following lines and save
Add-PsSnapin Microsoft.SharePoint.Powershell
Backup-SPFarm -Directory \\Servername\FarmBackups -BackupMethod full -BackupThreads 10 -percentage 10 -verbose –force

Note : backup farm to specified directory using full backup with 10 threads, display the results every 10 percent verbosely and force the script to run even if there is not enough space on the drive. so make sure you have monitoring on you drive space!


3. Setup the bat file to clean out old Farm backups from the server.
File name : 3clean.bat
Insert line below and save
powershell -command "&{D:\FarmBackups\backupscripts\4cleanbackups.ps1 }"


4. Setup the powershell cleanup script

Filename  : 4cleanbackups.ps1
Insert the following, with correct path, in italic below, and your required number of backups and save

#///Start of ps script
# Location of spbrtoc.xml
$spbrtoc = "\\servername\FarmBackups\spbrtoc.xml"

# Days of backup that will be remaining after backup cleanup.
$days = 2

# Import the Sharepoint backup report xml file
[xml]$sp = gc $spbrtoc

# Find the old backups in spbrtoc.xml
$old = $sp.SPBackupRestoreHistory.SPHistoryObject |
? { $_.SPStartTime -lt ((get-date).adddays(-$days)) }
if ($old -eq $Null) { write-host "No reports of backups older than $days days found in spbrtoc.xml.`nspbrtoc.xml isn't changed and no files are removed.`n" ; break}

# Delete the old backups from the Sharepoint backup report xml file
$old | % { $sp.SPBackupRestoreHistory.RemoveChild($_) }

# Delete the physical folders in which the old backups were located
$old | % { Remove-Item $_.SPBackupDirectory -Recurse }

# Save the new Sharepoint backup report xml file
$sp.Save($spbrtoc)
Write-host "Backup(s) entries older than $days days are removed from spbrtoc.xml and harddisc."

#///end of ps script



Setup Scheduled tasks.

Login to the Server running the backups as SP setup account


Setup new task (Backup the farm)

General:
Name - Backup SharePoint Farm
Run whether user is logged in or not
Run  with highest privileges
Configure for : windows 2008 R2

Trigger :
Schedule
Daily at 18:00
Stop if runs longer than 5 hours (enter appropriate time)
Enabled

Actions :
start a program
Browse to the 1schefarmbackup.bat
Fill in appropriate start in dir

Conditions :
Start task only if computer is on AC

Settings :
Allow run on demand
Stop if runs longer than 3 days
If task does not end, force to stop.

Click OK to create task and enter PWD for SP Setup account.



Setup new task  (cleanup old backups)

General:
Name – Cleanup SP Farm Backups
Run whether user is logged in or not
Run  with highest privileges
Configure for : windows 2008 R2

Trigger :
Schedule
Daily at 04:00
Stop if runs longer than 2 hours (enter appropriate time)
Enabled

Actions :
start a program
Browse to the 3clean.bat
Fill in appropriate start in dir

Conditions :
Start task only if computer is on AC

Settings :
Allow run on demand
Stop if runs longer than 4 hours
If task does not end, force to stop.

Click OK to create task and enter PWD for SP Admin account.



Lastly, test your scheduled tasks and ensure the backup folders and .xml files are created on your share. Then check your cleanup scripts run successfully and cleanup the relevant folders a day or two later.



This came from somewhere but never kept the reference, apologies if came from you.

PowerShell script not running as Scheduled Task Server 2008
http://social.technet.microsoft.com/Forums/en-US/ITCG/thread/0ea10ab8-8dd3-4c4c-977c-bbfd0bb17a1d/

PowerShell cheat sheet

Random basic commands I keep forgetting, this list will surely keep growing


Add the SharePoint snap in :

Add-PSSnapIn Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue


Set a path :

Set-location "path"

Output the PS command in a formatted table

"randomPS-command" | Format-Table –AutoSize

Check DB status for upgrade status

Get-SPDatabase | ?{$_.NeedsUpgrade –eq $true} | Select Name

Install SP Solution to all web applications  
Add-SPSolution -LiteralPath "c:\source\CodeMonkeySolution.wsp"

Install SP Solution to all web applications, to the GAC and force it in
Install-SPSolution -Identity CodeMonkeySolution.wsp -allwebapplications -GACDeployment -force

Adding and Removing dll's from the GAC using Powershell

To add a .dll to the GAC

Run the SharePoint PowerShell console as Administrator

type : Set-location <path to dll's here>

[System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")

$publish = New-Object System.EnterpriseServices.Internal.Publish

$publish.GacInstall( <path>\RandomcodemonkeyDLL.dll)


 
To remove a .dll from the GAC

$publish.GacRemove( <path>\RandomcodemonkeyDLL.dll)





A good way of getting the names of you assemblies from  :
 Simplest way to get the strong name of an assembly
http://nileshmandekar.blogspot.co.uk/2012/03/simplest-way-to-get-strong-name-of.html


A very elegant way of getting the dll's in and out via script is like this from Fred :
http://fredericloud.com/2011/01/08/no-gacutil-no-problem/