We can delegate user’s credential whose account reside in
user domain to sharepoint application and back-end data source which reside in
the other domain within a single forest. The important fact on this is the

For step-by-step instructions on how to do this, there is a
Microsoft technet documentation which explains this in a very detail instructions,
you can find the document in the following link

I’ve got user in nortwind domain who accessed the sharepoint
and external data in contoso domain using excel service application.

Here’s basically the excel service application which opened
and rendered data successfully. You have to do
data refresh to prove that kerberos delegation is working for you

I could see the user’s credential being delegated to
back-end data source.

The following screen is the error that you might get when you
try to do data refresh and Kerberos constrained delegation has not been setup
properly.

SharePoint Kerberos Constrained Delegation across domains in a Single Forest.docx

Database HA DR Review.png

https://www.windowsphone.com/en-US/apps/9ce93e51-5b35-e011-854c-00237de2db9e

the following references help us to prepare the required infrastructure to support this

You can refer to my previous article on how to set failover instance on sharepoint database or refer to the following article Plan for availability (SharePoint Server 2010)

But, what about the sql server mirroring side once the failover happen? will it be able to re-syncronize back or do we need to setup the mirroring from the scratch once the failover happened ?

In high availability mirroring (mirroring with witness server), when failover happened because the principle server is down,the witness server and mirror server will form a quorum to set the mirror server to be the new principle server and the mirror state will be in disconnected state, and even after long times/sometimes, when the old principal come back online, it will check with its mirroring partner/new principal about the mirroring state thru mirroring LSN (Log Sequence Number) and will try to get the mirroring state to be in synchronized state by redo-ing the transaction logs thru mirroring LSN. Though the database role (principle/mirror) won’t change automatically.

You can get more details information on how SQL Server mirroring and failover work in the following article : Database Mirroring in SQL Server 2005

The following features won’t be available

• Conferencing  (IM, Video and Web)
• Presence & DND based routing
• Modify Presence or Change Call Forwarding Settings
• Contact List
• Response Group and Call Park

The following features will still be available due to modular REGISTRAR component built in the FE/SBA server

• PSTN Inbound and Outbound calls
• Intra-Site calls
• Inter site calls (PSTN Rerouting)
• Hold, Retrieve, Transfer
• Authentication, Authorization
• Voicemail Deposit (Redirect to Exchange UM in Data Center)
• Voicemail Retrieve (through PSTN)
• Call Forwarding, SimulRing
• Boss-Admin, Team-call
• Call Detail Records (CDR)
• All 2 Party Intra Site communications
• Audio Conferencing through PSTN
• Contact Search

This is because of the Registrar component on the FE server which resides on the Front-End Server

And the local copy of the SQL Server database RTCLOCAL on each FE/SBA

On the SIP log, lync server saying that it lost connection to backend database server

09/28/2011|13:48:54.266 280:3C4 INFO  :: Data Received - 172.31.10.31:5061 (To Local Address: 172.31.10.211:58647) 710 bytes:

09/28/2011|13:48:54.266 280:3C4 INFO  :: SIP/2.0 503 Service unavailable

Authentication-Info: TLS-DSK qop="auth", opaque="F947CF13", srand="F77F22BC", snum="3", rspauth="d6ac9feba989ad7ce618372ad1e5fb3eb2563acc", targetname="NTLyncEE01.nwtraders.com", realm="SIP Communications Service", version=4

From: "Robert Lea"<sip:robert@nwtraders.co.nz>;tag=e3fbc1f23a;epid=ccd46068cb

To: <sip:robert@nwtraders.co.nz>;tag=F9E68E7E2D7C2F5F42D91E1AD7F8DC12

Call-ID: dfe9ff99be614b5bb612e533dbaa4af5

CSeq: 1 SUBSCRIBE

Via: SIP/2.0/TLS 172.31.10.211:58647;ms-received-port=58647;ms-received-cid=F0B00

ms-diagnostics: 4144;reason="Database communication link is down";source="NTLyncEE01.nwtraders.com"

Retry-After: 54

Server: RTC/4.0

Content-Length: 0

09/28/2011|13:48:54.266 280:3C4 INFO  :: End of Data Received - 172.31.10.31:5061 (To Local Address: 172.31.10.211:58647) 710 bytes

You might have custom site definition in sharepoint 2007, and you’d like to do some actions/transformation upon upgrading sharepoint 2007 to sharepoint 2010 such as changing file mapping, activating new site/web features, etc. this is where UDF file comes in handy to help us how we’d like to upgrade sharepoint 2007 site.

You can get more reference on UDF based on the following article:

https://www.sharepointjoel.com/Lists/Posts/Post.aspx?List=0cd1a63d%2D183c%2D4fc2%2D8320%2Dba5369008acb&ID=309

What’s a good sample UDF? You can find from the existing SharePoint 2010 UDF file in C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\CONFIG\UPGRADE\ folder. You’ll be able to see a lot UDF file samples.

Some of the explanation on the above definition

File : Describes the relationship between an existing provisioned file to its equivalent file for upgrading to Microsoft SharePoint Foundation 2010, specifying how setup paths of files in the previous version map (relate) to setup paths in the new version relative to their %ProgramFiles%\Common Files\Microsoft Shared\web server extensions\14\TEMPLATE directories.

AppliedWebFeatures Element: Supplies a list of Web site Features to be marked as "provisioned" for Web sites created in Microsoft SharePoint Foundation 2010. For example, an announcements list template of the previous version must be mapped (related) to its equivalent announcements Feature in the new version.

You can find more details on this upgrade definition file schema on the following reference

Upgrade Definition Schema

https://msdn.microsoft.com/en-us/library/ms412955.aspx

a sample Upgrade log taken from C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS will look something like this

[powershell] [SPXmlConfiguration] [DEBUG] [9/29/2011 7:38:06 AM]: Template upgrade:     ContentDB version of LITWARE.Sample.Products#0: 3.0.0.3

[powershell] [SPXmlConfiguration] [DEBUG] [9/29/2011 7:38:06 AM]: Template upgrade:      onet.xml version of LITWARE.Sample.Products#0: 4.0.0.3

[powershell] [SPXmlConfiguration] [DEBUG] [9/29/2011 7:38:06 AM]: Template upgrade: <WebTemplate> for LITWARE.Sample.Products#0 supports the range of versions from 3.0.0.1 to 3.0.0.3.

[powershell] [SPXmlConfiguration] [DEBUG] [9/29/2011 7:38:06 AM]: Template upgrade:   Upgrade XML: <WebTemplate ID="10001" LocaleId="*" FromProductVersion="3" BeginFromSchemaVersion="1" EndFromSchemaVersion="3" ToSchemaVersion="3" />

[powershell] [SPUpgradeSession] [DEBUG] [9/29/2011 7:38:06 AM]: NeedsUpgrade [Products - %LCID%1033 - %GTID%_GLOBAL_#10001 - %TMPLID%LITWARE.S...] returned: True.

[powershell] [SPUpgradeSession] [DEBUG] [9/29/2011 7:38:06 AM]: Upgrading [Products - %LCID%1033 - %GTID%_GLOBAL_#10001 - %TMPLID%LITWARE.S...].

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Saving lock and quota...

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: 0 sites properties saved.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Turning off lock and quota...

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Determining the set of root webs/site collections to upgrade.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Upgrading the root webs/site collections for 'LITWARE.Sample.Products#0' template: WebTemplateVersion=3.0.0.3, TargetWebTemplateVersion=4.0.0.3, Language=1033.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: No RemoveSiteExternalSecurityProvider flag specified.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template Upgrade: Creating the @UpgradeSetupPathMapper table.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template Upgrade: Creating the @UpgradeListMapper table.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Determining the set of webs to upgrade.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Applying the global template to all webs that require it.

 [powershell] [SPContentDatabaseSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Calling get SchemaVersion on Database spoint2010_litware5l, Status = Upgrading.

[powershell] [SPContentDatabaseSequence2] [DEBUG] [9/29/2011 7:38:06 AM]: Calling get SchemaVersion on Database spoint2010_litware5l, Status = Upgrading.

[powershell] [SPUpgradeSession] [DEBUG] [9/29/2011 7:38:06 AM]: IsBackwardsCompatible [SPContentDatabase Name=spoint2010_litware5l] returned: True.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Applying the global template to the web with URL "https://intranet.contoso.com/sites/Litware5".

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Ensure Global Template: Skipping global template application for site with URL "https://intranet.contoso.com/sites/Litware5". A master page gallery already exists at "/sites/Litware5/_catalogs/masterpage" and the UserInfo list already exists.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Generating the file upgrade query.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Generating the list upgrade query.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Begin running the template upgrade query.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: End running the template upgrade query.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Activating site-collection-scoped features...

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:06 AM]: Template LITWARE.Sample.Products#0: Activating feature b50e3104-6812-424f-a011-cc90e6327318 in site collection with URL "https://intranet.contoso.com/sites/Litware5", force=False.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:08 AM]: Template LITWARE.Sample.Products#0: Activating feature 3bae86a2-776d-499d-9db8-fa4cdc7884f8 in site collection with URL "https://intranet.contoso.com/sites/Litware5", force=False.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:13 AM]: Template LITWARE.Sample.Products#0: Activating feature 0af5989a-3aea-4519-8ab0-85d91abe39ff in site collection with URL "https://intranet.contoso.com/sites/Litware5", force=False.

[powershell] [SPWebTemplateSequence] [DEBUG] [9/29/2011 7:38:15 AM]: Template LITWARE.Sample.Products#0: Empty <WebFeatures> section in upgrade template, skipping SPWeb scoped feature activation.

That’s a log from sample UDF file that I made for my custom site definition. In this sample, I’d like to activate some new features when I upgrade my sharepoint 2007 site which is based on my custom site definition. Some of the new features that I’d like to activate when I upgrade to sharepoint 2010 will be like preparing new master page so that it’s ready when I’m planning to switch to V4 UI version, etc.

This UDF file can be made to match our new site definition in SharePoint 2010.

If you have enabled auditing on the site collection that you'd like to move to the new content database, mergecontentdbs does move the auditdata table if your SharePoint V3 farm is at least on December 2010 Cumulative Update (12.0.6550.5002).  If your farm is not at December 2010 CU yet, your auditdata table won't be carried over to the new content database when you perform mergecontentdbs.

Here's the excerpt related to this issue from the list of Issues that this hotfix (December 2010 CU package) fixes ,

For more detail:

Description of the Windows SharePoint Services 3.0 hotfix package (Sts-x-none.msp): December 30, 2010
https://support.microsoft.com/kb/2458600 

SharePoint 2010 does move auditdata to the new content database when you perform mergecontentdbs/move-spsite.

When I captured the SIP log from the edge server, I saw the following error message from edge server saying that the Outbound TLS negotiation failed. It means that even on doing SSL handshake/established was already failed.

TL_ERROR(TF_CONNECTION) [0]07B4.0814::04/08/2011-21:50:58.091.00000852 (SIPStack,SIPAdminLog::TraceConnectionRecord:SIPAdminLog.cpp(157))$$begin_record

LogType: connection

Severity: error

Text: Outbound TLS negotiation failed

Local-IP: 10.1.2.10:49181

Peer-IP: 10.1.2.1:5061

Peer-FQDN: ctdcexc.contoso.local

Connection-ID: 0x1801

Transport: TLS

Result-Code: 0x80004005 E_FAIL

$$end_record

I found the KB 982021 which describes the supportability of running OCS 2007 R2 on windows Server 208 R2.

Supportability is available for Office Communications Server 2007 R2 member server role on a Windows Server 2008 R2 operating system

https://support.microsoft.com/kb/982021/en-us

I went through the document and found there's one patch that I missed to install on my server which relates to TLS/SSL negotiation failure on Windows Server 2008 R2/Windows 7 OS, described as follow:

975858  (https://support.microsoft.com/kb/975858/ ) An application or service that calls the InitializeSecurityContext function together with the ISC_REQ_EXTENDED_ERROR flag may encounter a TLS/SSL negotiation failure on a computer that is running Windows Server 2008 R2 or Windows 7 operating system

I Downloaded the patch, installed, and rebooted the server, after that the remote user access worked well :)

In this scenario, you can provide fault tolerance by following the standard guidance for making databases and service applications redundant.

The following post guides you on how to setup stretched farm. I will post additional topics related to stretch farm such as search failover.

The following post is based on the following configuration:

• Web Applications that we currently have

• In order to have stretched farm, the databases need to be mirrored. So, we're going to setup synchronous mirroring. In order to setup stretched farm, we need to get the list of databases used by SharePoint 2010 Get-SPDatabase cmdlet from SharePoint Powershell

Get-SPDatabase | select Name |Format-List > C:\Script\dblist.txt

Here's the result

Name : UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0

Name : SharePoint_Config_2010

Name : Search_Service_Application_SharePointServer_CrawlStoreDB_8e9425630542404

       cb93dd470bdb85d82

Name : Search_Service_Application_SharePointServer_PropertyStoreDB_c12560cf7322

       4e3bb563e3424ce51bce

Name : SharePoint_Admin_Content_2010

Name : WSS_Content_2010

Name : WSS_Content_My_2010

Name : WSS_Content_mysites_2010

Name : WSS_Content_sp2010

Name : WSS_Content_STPLab2010

Name : WSS_Content_Temp

Name : Search_Service_Application_SharePointServer_DB_b4c715175e0c4827b7b324c02afd7f96

Name : UM_MMS

Name : SharedServices_2010

Name : WSS_UsageApplication

Name : UserProfileUM_SyncDB_a5502148-ca0a-4dbc-acfe-8d1f1717c843

• Set-up the databases to full-recovery mode for those databases except the logging database/WSS_UsageApplication

USE [master]

GO

ALTER DATABASE [UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0] SET RECOVERY FULL WITH NO_WAIT

GO

ALTER DATABASE [SharePoint_Config_2010] SET RECOVERY FULL WITH NO_WAIT

GO

ALTER DATABASE [Search_Service_Application_SharePointServer_CrawlStoreDB_8e9425630542404cb93dd470bdb85d82] SET RECOVERY FULL WITH NO_WAIT

GO

....

• Back-up the database and the transaction log

USE [master]

GO

BACKUP DATABASE [UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0]

    TO DISK = 'C:\DBBackup\UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0.bak'

GO

BACKUP LOG [UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0]

    TO DISK = 'C:\DBBackup\UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0.trn'

GO

BACKUP DATABASE [SharePoint_Config_2010]

    TO DISK = 'C:\DBBackup\SharePoint_Config_2010.bak'

GO

BACKUP LOG [SharePoint_Config_2010]

    TO DISK = 'C:\DBBackup\SharePoint_Config_2010.trn'

GO

.......

• Copying the backup files to the mirror SQL Server location
• Restore the database and the transaction log on the secondary site/stretched site SQL Server

USE [master]

GO

RESTORE DATABASE [UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0]

    FROM DISK = 'C:\DBBackup\UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0.bak'

        WITH FILE=1, NORECOVERY

GO

RESTORE LOG [UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0]

    FROM DISK = 'C:\DBBackup\UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0.trn'

        WITH FILE=1, NORECOVERY

GO

.......

• Setup SQL Server mirroring with the mirrored partner

Follow the instructions provided on the following link:

How to: Configure a Database Mirroring Session (SQL Server Management Studio)

https://msdn.microsoft.com/en-us/library/ms188712.aspx

Manually setup the SQL Mirroring  

• We need to add failoverserviceinstace for each sharepoint database involved within the stretched farm. We can do the setting from PowerShell to add the drsqlsp2010.contoso.com into the failoverserver property. By running the following script:

$db = get-spdatabase | where {$_.Name -eq "UserProfileUM_SocialDB_f189d285c9554848a72f73ca9c8e9dc0"}

$db.AddFailoverServiceInstance("DRSQLSP2010")

$db.Update()

$db = get-spdatabase | where {$_.Name -eq "SharePoint_Config_2010"}

$db.AddFailoverServiceInstance("DRSQLSP2010")

$db.Update()

......

Verify the result.

PS C:\> Get-SPDatabase |select Name,failoverserver

Name                                    FailoverServer

----                                    --------------

UserProfileUM_SocialDB_f189d285c9554... SPServer Name=DRSQLSP2010

SharePoint_Config_2010                  SPServer Name=DRSQLSP2010

Search_Service_Application_SharePoin... SPServer Name=DRSQLSP2010

Search_Service_Application_SharePoin... SPServer Name=DRSQLSP2010

SharePoint_Admin_Content_2010           SPServer Name=DRSQLSP2010

WSS_Content_2010                        SPServer Name=DRSQLSP2010

WSS_Content_My_2010                     SPServer Name=DRSQLSP2010

WSS_Content_mysites_2010                SPServer Name=DRSQLSP2010

WSS_Content_sp2010                      SPServer Name=DRSQLSP2010

WSS_Content_STPLab2010                  SPServer Name=DRSQLSP2010

WSS_Content_Temp                        SPServer Name=DRSQLSP2010

Search_Service_Application_SharePoin... SPServer Name=DRSQLSP2010

UM_MMS                                  SPServer Name=DRSQLSP2010

SharedServices_2010                     SPServer Name=DRSQLSP2010

WSS_UsageApplication                    SPServer Name=DRSQLSP2010

UserProfileUM_SyncDB_a5502148-ca0a-4... SPServer Name=DRSQLSP2010

The command above added the failover partner to the connection string used by sharepoint. So, in case the server DCSQL failed, the server will try to connect to DRSQLSP2010. We can see from the information put in the registry on each of the sharepoint server.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\Secure\ConfigDB]

"dsn"="Data Source=dcsql;Failover Partner=DRSQLSP2010;Initial Catalog=SharePoint_Config_2010;Integrated Security=True;Enlist=False;Connect Timeout=15"

• We simulated to change the principal to DRSQLSP2010 to see whether SharePoint can automatically failover to the specified server or not. In the real environment, you'll need to make sure that you can get the SQL server on the stretched site to be able to recover from broken SQL mirroring as well as be able to get database get-up and running normally.

And we've got the mirrored server as the principal now

• Once we did the failover to the mirror, we can see the following entries on the ULS log, saying that the SQL Server failover connection detected.

w3wp.exe (0x0FCC)                       0x01C0  SharePoint Server                            Database                            tzkm      Medium               SQL Server failover connection detected. SQL Server dcsql failing over to SQL server DRSQLSP2010.    

• Verifying the feature do work after failover such as Search, MMS, user profile, and other services as necessary

That's the setup that we need to go through to setup stretched farm. In the next post, I'll explore in more detail related to SharePoint components failover in disaster recovery condition.

We'll need to give the user the following rights on the sharepoint & SQL server:

• SharePoint Farm Administrators Group Account
• Member of local administrators group on each Sharepoint WFEs
• Member of db_owner on the SharePoint Central Admin web application content database
• Give the user full permission to the web application thru Web Application Policy.

Please be aware that doing all of these steps will give full access to the user to the farm configuration, web applications, as well as the Sharepoint servers.

In this example, we've solutionuser2 that needs to have the rights to deploy solution to Sharepoint 2007 farm:

• Giving the user permission to be member of farm administrators

• Setting him as member of local administrators group,
• Member of the db_owner of the sharepoint central admin web application content database thru SQL Server management studio. In this example, the content database name is SharePoint_Admin_Content_2007

• Give the user full permission to the web application thru Web Application Policy.

And now the user can add solution to the solution store as well as deploying the solution package to the farm.