Environment:

Single Server farm.
SP 2010 Enterprise Edition

Issue:

1. Users were not able to connect to the performance point site using SharePoint designer, were getting the following error:

2. Couldn’t configure the unattended service account for PerformancePoint service application. Getting an error “An entry with the same key already exists”

Solution:

1. Analysed the verbose logs and found the following information:

w3wp.exe (0x31A0) 0x36E4 SharePoint Foundation Runtime tkau Unexpected System.ArgumentException: An entry with the same key already exists. at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource) at System.Collections.Generic.SortedList`2.Add(TKey key, TValue value) at Microsoft.PerformancePoint.Scorecards.AdminUI.AdminUIHelper.GetProxiesConnectedByServiceApplication(BIMonitoringServiceApplication srviceApplication) at Microsoft.PerformancePoint.Scorecards.AdminUI.CreatePpsMAServiceAppData.HasADefaultProxy(BIMonitoringServiceApplication srviceApplication) at Microsoft.PerformancePoint.Scorecards.AdminUI.CreatePpsMAServiceAppData.UpdateUIForEditingMode() at Microsoft.PerformancePoint.Scorecards.AdminUI.CreatePpsMAServiceAppData.OnLoad(EventArgs e) at System.Web.UI.Control.LoadRecursive() at System.Web.UI.Page.Pro... 7f42bbc7-e934-4e5e-9ada-38a5fc39fee5

w3wp.exe (0x31A0) 0x36E4 SharePoint Foundation Runtime tkau Unexpected ...cessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 7f42bbc7-e934-4e5e-9ada-38a5fc39fee5

2. Since its a new performance point setup decided to delete and recreate the for the performance point and Secure store SSA.

3.  Used the following STSADM command lines to stop and start the services: Performance Point service (PPS)  and Secure store services (SSS):

Stsadm -o provisionservice -action stop -servicetype "Microsoft.Office.SecureStoreService.Server.SecureStoreService, Microsoft.Office.SecureStoreService, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

stsadm -o provisionservice -action stop -servicetype "Microsoft.PerformancePoint.Scorecards.BIMonitoringService, Microsoft.PerformancePoint.Scorecards.BIMonitoringService, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

stsadm -o provisionservice -action start -servicetype "Microsoft.Office.SecureStoreService.Server.SecureStoreService, Microsoft.Office.SecureStoreService, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

stsadm -o provisionservice -action start -servicetype "Microsoft.PerformancePoint.Scorecards.BIMonitoringService, Microsoft.PerformancePoint.Scorecards.BIMonitoringService, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"

5. Created the SSSA ( Secure store service application) Application and generated the new Key with the Passphrase.

6· Created the PPS application and ran the following commands to configure the unattended service accounts “Domain\username” :

Set-SPPerformancePointSecureDataValues

Get-SPPerformancePointSecureDataValues

7. Verified that the Unattended service account got created successfully on Secure store for PPS.

8.  Ran the following commands to grant access for PPS Application pool account on content databases:

$w = Get-SPWebApplication(“https://intranet”)

$w.GrantAccessToProcessIdentity("DOMAIN\USERNAME")

$w = Get-SPWebApplication(“https://myhub”)

$w.GrantAccessToProcessIdentity("DOMAIN\USERNAME")

9. Verified the users able to connect to the BI site using the SharePoint designer!

Cheers!

Bala

Environment:

SP 2010 with Feb CU 2013

UAG 2010

TMG2010

SharePoint Web applications:

https://www.contoso.com --> (SSL) Published on UAG 2010 with windows authentication.

https://www.contoso.com --> (non-SSL) Published on TMG 2010 ( Different server) with Anonymous access.

Issue:

When we try to add a hyperlink (https://www.contoso.com/Pages/home.aspx ) on the SharePoint pages ( Using Insert hyperlink or on Content editor web part) on SSL web app (https://www.contoso.com), the URL link its getting redirected to something like this https://sslportal.contoso.com/uniquesig9c13994d80cecc9dd5e52e6f0ac391dc87c1145accac4d164eaa7f6066790e3b/uniquesig0/Pages/eBulletins/March_2013.aspx

Solution:

After analysing the trunk and UAG logs found that the issue is caused by the wrong web server address on UAG Portal Trunk for the application. Yes, we were using the FQDN address instead of the SharePoint server IP address.

We have created a new application on HTTPS trunk and confirmed this issue is not reproducible when we specify the SharePoint server IP address on the “Addresses” field. Confirmed with Microsoft partner community we should be using the SharePoint Server IP address not the FQDN.

Modified the application and updated the rule with the SharePoint IP address and everything started working as expected ( No URL redirection)

Hope that helps!

Cheers,

Bala

Environment

• SharePoint 2010 with SP2 ( 2 WFE + 1 APP)
• TMG 2010

Scenario:

1. The SharePoint site published on TMG is https://www.contoso.org.au without any authentication, its just a public facing site.

2. There is another URL for accessing the same application using the https://www.contoso.gov.au ( Extended long back). this rule is published in TMG too.

3. At the moment user can access the application using both the URLs: https://www.contoso.org.au and https://www.contoso.gov.au and all the request go via TMG to SharePoint.

4. Here is alternate access mappings for the application on SharePoint:

https://www.contoso.org.au --> Default -->https://www.contoso.org.au

https://www.contoso.gov.au --> Custom -->https://www.contoso.gov.au

Requirement:

The requirement is to change the existing setup:

1. Users Typing www.contoso.gov.au in the browser takes you to www.contoso.org.au
2. Users Typing contoso.gov.au in the browser takes you to www.contoso.org.au
3. Users Typing contoso.org.au in the browser takes you to www.contoso.org.au

Solution:

SharePoint AAM

1. Removed the https://www.contoso.gov.au from the public URL and IIS host headers on IIS for this site.

2. Added the following redirection on SharePoint AAM:

https://www.contoso.gov.au –>  Internal URL –> https://www.contoso.org.au

3. Added the following redirection on SharePoint AAM:

https://contoso.org.au –> Internal URL –> https://www.contoso.org.au

https://contoso.gov.au –> Internal URL –> https://www.contoso.org.au

IIS Server ( SharePoint)

Create a website on SharePoint server for redirection:

1. Created a simple IIS site called “Redirect – GOV.AU” on the SharePoint server

2. Added the following Bindings with the new IP address:

• www.contoso.gov.au
• contoso.gov.au
• contoso.org.au

3. Configured the HTTP redirect:

4. Modified the TMG listener to map to the new IP ( Bindings).

5. Tested and everything worked as expected!!!

Hope that helps!

Cheers,

Bala

Environment:

SharePoint 2010 with Dec CU 2012

SharePoint Domain: Contoso.com

Trusted Domain: Trusted.com

Issue:

Users from Trusted.com are not able to view the web part which they targeted to. The scenario here is we haven't used the audience group, we have directly  picked the security group  from Audience Targeting picker.

Users from Contoso.com are able to see the web part without any issues.

Troubleshooting and Fix:

1.  The ULS logs didn't help much to troubleshoot this issue and decided to verify the basics of the sync connection and UPS setup.

2. Verified the UPS and sync connection for the trusted.com and everything were normal.

3. Verified the group and made sure the group is security and global.

4.  Verified the profile import for the trusted domain and found that the users are getting imported using the Forefront identity manager.

5.  After verifying all the basics decided to check the trusted.com domain setup details.

6.  Found that the Trusted.com FQDN and NetBIOS(TRU) are different and the NetBiosDomainNamesEnabled property not been enabled on the UPS ( Bingo!).

7. Enabled the property on the UPS NetBiosDomainNamesEnabled:

$upa = Get-SPServiceApplication | where {$_.TypeName -eq "User Profile Service Application"}

$upa.NetBiosDomainNamesEnabled = $true

$upa.Update()

8. Deleted the sync connection for the Trusted.com and recreated the connection.

9. Initiated the full import and after the import the users from Trusted.com were able to see the web part!!!

Happy SharePointing

Cheers!

Bala

Today I was helping one of my customer with creating the UPS sync connection on SharePoint 2010 environment and ran into the below errors, after going through all the dramas I was able to found the cause and fix it. Thought of sharing it with all:

SharePoint Errors:

ERROR

Unable to process Create message

In the Application event log:

Source: Forefront Identity Manager

Event ID: 3

Microsoft.ResourceManagement: System.InvalidOperationException: Retrieve schema failed

at Microsoft.ResourceManagement.Utilities.ExceptionManager.ThrowException(Exception exception)

at Microsoft.ResourceManagement.ActionProcessor.SyncConfigActionProcessor.Create(String typeName, IList`1 createParameters, Guid creator, Guid cause)

at Microsoft.ResourceManagement.ActionProcessor.SyncConfigActionProcessor.ProcessInputRequest(RequestType request)

at Microsoft.ResourceManagement.ActionProcessor.ActionDispatcher.ProcessInputRequest(RequestType request)

at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction(RequestType request)

at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction[ResponseBodyType](RequestType request)

at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request, Guid requestIdentifier, Object redispatchSingleInstanceKey)

at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request)

at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Create(Message request)

Resolution:

1. Found that the domain FQDN is different than the NetBIOS name,  while creating the sync connection ( Under the Forest Name column) used the NetBIOS name of the domain instead of the FQDN.

2. Even after using the NetBIOS name we were running into the same error .  Checked the OU containers we were selecting in the sync connection and found that those containers doesn't have any users objects ( Bingo!!!).

3. Selected the OU container which has user objects and we were able to successfully create a sync connection!!!

Summary:

If you run into this issue ensure to check the following:

1. Is the domain FQDN is different than NetBIOS? If yes, use the NetBIOS name while creating the connection.

2. Verify the OU has user objects ( I am sure we wouldn't select the OU which doesn't have any users, but worth double checking it)

Component ff097580-80b1-4d0d-9e94-9cf122327c00-query-0 of search application 'Search Service App' has failed to execute transition sequence 'initialize with empty catalog' due to the following error: System.ComponentModel.Win32Exception: The Server service is not started

   at Microsoft.SharePoint.Win32.SPNetApi32.DeleteFileShare(String name)

   at Microsoft.SharePoint.Win32.SPNetApi32.CreateFileShare(String name, String description, String path)

   at Microsoft.SharePoint.Administration.SPServer.CreateFileShare(String name, String description, String path)

   at Microsoft.Office.Server.Search.Administration.QueryComponent.CreatePropagationShare(QueryComponent component)

   at Microsoft.Office.Server.Search.Administration.QueryComponent.ExecuteCurrentStage(). It is now in state Uninitialized.

Fix:

Ensure the “Server” service is started on the server. That’s the service is used for File Sharing.

Just highlight few Information from the blog:

As a result of these improvements there has been a dramatic reduction of the time required to import user information into SharePoint.  For example, inside of Microsoft on the RTM version of SharePoint Server 2010 with 100,000 users our profile import duration for full sychronization commonly required 2 weeks to complete and 2-3 days to support an incremental synchronization.  This same scenario on SharePoint Server 2010 with the December 2011 Cumulative Update has been reduced to 120-140 hours for a full synchronization and 6 hours for an incremental synchronization.

If you’re experience delays in importing users and properties or are just looking to improve the security, reliability, and performance of your SharePoint 2010 environment we recommend installing the latest Cumulative Update or Service Pack.

If anyone facing slowness with User profile import, please follow the recommendation

Cheers!

Bala

Unable to add user properties for user profile connection. Getting Unable to process Create message error in the event log and ULS logs.

Ø Error’s in the event log and ULS Logs:

OWSTIMER.EXE (0x075C)            0x0DD4 SharePoint Portal Server User Profiles      9q17     High            UserProfileApplication.SynchronizeMIIS: Failed to configure ILM MA, will attempt during next rerun. Exception: Microsoft.ResourceManagement.WebServices.Faults.ServiceFaultException: Unable to process Put message     at Microsoft.ResourceManagement.WebServices.Client.Resource.Update()     at Microsoft.ResourceManagement.WebServices.ResourceManager.UpdateResource()     at Microsoft.Office.Server.UserProfiles.Synchronization.ILMMAConfiguration.UpdateSQLConnectionInformation(String server, String databaseName, String user, String domain, SecureString password)     at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.UpdateILMMA(String databaseServerIlm, String databaseInstanceIlm, String databaseName, String domain, String userName, SecureString password)     at Microsoft.Office.Server.Administration.UserProfileApplication.SetupSynchronizationService(ProfileSynchronizationServiceInstance profileSyncInstance).       5bb66e24-5242-46d7-9b84-2bb2ff09fdbc

Event ID 3 Description: .Net SqlClient Data Provider: 266 : UpdateRequestStatusForCompletedActionWorkflows : System.Data.SqlClient.SqlException: Transaction count after EXECUTE indicates a mismatching number of BEGIN and COMMIT statements. Previous count = 0, current count = 1. Uncommittable transaction is detected at the end of the batch. The transaction is rolled back.    at Microsoft.ResourceManagement.Utilities.ExceptionManager.ThrowException(Exception exception)    at Microsoft.ResourceManagement.Data.Exception.DataAccessExceptionManager.ThrowException(SqlException innerException)    at Microsoft.ResourceManagement.Data.DataAccess.UpdateRequestStatusForCompletedActionWorkflows(Int16 maxRequestsToProcess)    at Microsoft.ResourceManagement.Workflow.PostProcessingManager.Execute()

Event ID 3 Description: System.Data.DataException: This request has an invalid target: 317C9770-288F-4E63-AD78-BE77B01C3E5D. The invalid target identifier is DE46502C-35B4-4FE7-80A9-07F3F2EA5614.

Steps taken to troubleshoot the issue:

Please note: Before following the steps please take a backup of your Profile and Sync DB.

Ø Followed the TechNet article to Reset profile synchronization’: https://technet.microsoft.com/en-us/library/ff681014.aspx

Ø Rebooted the APP sever after the reset and added the Farm account on Sync DB as dbo owner ( Per TechNet article) on SQL server.

Ø Started the profile synchronization service on APP server.

Ø Made sure the profile service started successfully without any errors.

Ø Checked the User profile application and found that the profiles connection got removed automatically (Expected behaviour after the Reset Sync Instance).

Ø Created a new profile connection successfully without any error (Unable to process Create message )

Ø After that I am able to edit/modify/update the profile connection without any error J

Additional Information:

• Rename users or change user domains
• Exclude users whose accounts have been disabled
• Remove obsolete users and groups
• Maintain profile schema changes
• Rename a profile synchronization server
• Move the User Profile Synchronization service to a new server
• Reset profile synchronization
• Restrict profile synchronization communication to a specific domain controller
• Adjust profile synchronization time-outs
• Grant Active Directory Domain Services permissions for profile synchronization (SharePoint Server 2010)

Cheers!

Bala

It’s taking more than 20 to 25 seconds to load the application on CRM outlook client.

Environment:

CRM 2011 ( Single server)

Client: Windows XP 32 bit with outlook 2010

Troubleshooting:

· It took 10 to 15 seconds to load the CRM application on outlook 2010.

· Whenever we try to open a CRM application, the virtual desktop machine CPU usage was constantly at 100% ( Outlook.exe à 50 % to 97 %).

· Provisioned a new virtual desktop with 2 CPU ( 2.86 GHz).

· Did the following optimization and confirmed that the its taking 4 to 5 seconds to load the screen. The CPU usage was normal ( 20% to 40%) :

Ø Disabled the un-wanted add-on’s on outlook.

Ø By passed the proxy for the local intranet sites.

Ø Added the site under Local Intranet on IE.

Ø Reset the client outlook plugin using the following command line:

C:\Program Files\Microsoft Dynamics CRM\Client\ConfigWizard\Microsoft.Crm.Client.Config /reset

· Tested the Latency:

Ø Client to Application server à Less than 1ms

Ø CRM Application Server to SQL server à Less than 1ms

Ø SQL server to CRM Application server à Less than 1ms

· Ensured that CPU/Memory usage is normal on SQL and CRM servers.

Additional Information & Recommendation:

· As per Microsoft recommendation “Microsoft Dynamics CRM for Outlook hardware requirements”, we need to increase the CPU on all the virtual desktops

· Bypass the Proxy Server for On-premise Deployments within a LAN using group policy.

· Add the web site under local intranet zone on IE using group policy.

· On the virtual desktop check the behaviour by disabling .Net setting called Expect100Continue feature on CRM outlook config file:

1. Navigate to “C:\Program Files (x86)\Microsoft Dynamics CRM\Client\” and open the “CrmClient{guid}.config” file in a text editor such as notepad.

2. Insert the following block of XML in the <system.Net> section of the CONFIG file. 

<settings>

     <servicePointManager expect100Continue="false" />

</settings>

3. Open Outlook and the setting will take effect immediately.

             More Information please refer CRM 2011 Outlook Client Performance Delays Caused by Expect: 100-continue Setting

· Monitor the CRM environment:

Ø Microsoft Dynamics CRM 2011 performance counters

Ø How to enable tracing in Microsoft Dynamics CRM

· Monitor the SQL Server.

Cheers!

Bala

While installing CRM 5.0, getting the following error “Error: SQLAgent service is not running on the server.”

Fix:

The CRM setup account was not part of local administrator group on SQL server and the Port number 445 was blocked in Internal Firewall.

Additional Information:

1. Minimum Permission for CRM Setup:

Minimum permissions that are required by the user account for Microsoft Dynamics CRM services and components.

Microsoft Dynamics CRM Server Setup

The user account used to run Microsoft Dynamics CRM Server Setup that includes the creation of databases requires the following minimum permissions:

•           Be a member of the Active Directory Domain Users group. By default, Active Directory Users and Computers adds new users to the Domain Users group.

•           Be a member of the Administrators group on the local computer where Setup is running.

•           Have Local Program Files folder read and write permission.

•           Be a member of the Administrators group on the local computer where the instance of SQL Server is located that will be used to store the Microsoft Dynamics CRM databases.

•           Have sysadmin membership on the instance of SQL Server that will be used to store the Microsoft Dynamics CRM databases.

•           Have organization and security group creation permission in Active Directory. Alternatively, you can use a Setup XML configuration file to install Microsoft Dynamics CRM Server 2011 when security groups have already been created. For more information, see Use the Command Prompt to Install Microsoft Dynamics CRM in the Installing Guide.

•           If Microsoft SQL Server Reporting Services is installed on a different server, you must add the Content Manager role at the root level for the installing user account. You must also add the System Administrator Role at the site-wide level for the installing user account.

2. Network Ports to be opened:

On SQL Server:

Protocol	Port	Description	Explanation
TCP	135	MSRPC	RPC endpoint resolution.
TCP	139	NETBIOS-SSN	NETBIOS session service.
TCP	445	Microsoft-DS	Active Directory service required for Active Directory access and authentication.
TCP	1433	ms-sql-s	SQL Server sockets service. This port is required for access to SQL Server.This number may be different if you have configured your default instance of SQL Server to use a different port number or you are using a named instance.
UDP	123	NTP	Network Time Protocol.
UDP	137	NETBIOS-NS	NETBIOS name service.
UDP	138	NETBIOS-dgm	NETBIOS datagram service.
UDP	445	Microsoft-DS	Active Directory service required for Active Directory access and authentication.
UDP	1025	Blackjack	DCOM, used as an RPC listener.

On CRM Server:

Protocol	Port	Description	Explanation
TCP	808	CRM server role communication	The Asynchronous Service and Web Application Server services communicate to the Sandbox Processing Service through this channel. The default port is 808, but can be changed in the Windows registry by adding the DWORD registry value TcpPort in the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM\.

Protocol	Port	Description	Explanation
TCP	80	HTTP	Default Web application port. This port may be different as it can be changed during Microsoft Dynamics CRM Server Setup. For new Web sites, the default port number is 5555.
TCP	135	MSRPC	RPC endpoint resolution.
TCP	139	NETBIOS-SSN	NETBIOS session service.
TCP	443	HTTPS	Default secure HTTP port. The port number may differ from the default port. This secure network transport must be manually configured. Although this port is not required to run Microsoft Dynamics CRM, we strongly recommend it. For information about how to configure HTTPS for Microsoft Dynamics CRM, see “Make Microsoft Dynamics CRM client-to-server network communications more secure” in Post-Installation and Configuration Guidelines in the Installing Guide.
TCP	445	Microsoft-DS	Active Directory service required for Active Directory access and authentication.
UDP	123	NTP	Network Time Protocol.
UDP	137	NETBIOS-NS	NETBIOS name service.
UDP	138	NETBIOS-dgm	NETBIOS datagram service.
UDP	445	Microsoft-DS	Active Directory service required for Active Directory access and authentication.
UDP	1025	Blackjack	DCOM, used as an RPC listener.

Cheers!

Bala