UserProfileApplication.SynchronizeMIIS: Failed to configure MIIS post database, will attempt during next rerun. Exception: System.Runtime.InteropServices.SEHException (0x80004005): External component has thrown an exception

The problem ended up being a PowerShell profile that had been created for the SharePoint Farm account. The fact that the PoweShell profile existed was fine but the customer was mapping drives within the profile. The drive mapping was the culprit. We were able to verify this by following these steps:

1. Stop the User Profile Service and delete the User Profile Service Application.
2. Verify you have a PowerShell profile. Check out the Windows PowerShell Owner's Manual on TechNet (https://technet.microsoft.com/en-us/library/ee692764.aspx) for a reference on checking for, adding, and editing a PowerShell profile. If you have a PowerShell profile then comment out everything and save the file.
3. Clear the SharePoint Configuration Cache. There's a great post written by James Waymire on this (https://blogs.msdn.com/b/jamesway/archive/2011/05/23/sharepoint-2010-clearing-the-configuration-cache.aspx). This post was written for SharePoint 2010 but it will also work for SharePoint 2013.
4. Create a new User Profile Service Application.
5. You should be able to start the User Profile Service and the User Profile Synchronization Service.

 I have seen a lot of posts on similar issues with the User Profile Synchronization Service not starting but none that resolved our problem. Hopefully this will help others having this problem.

I would like to just end my portion of this post saying that we absolutely value our Communities and Partners at Microsoft and that will not change.

General Microsoft Trademark Guidelines

https://www.microsoft.com/en-us/legal/intellectualproperty/Trademarks/Usage/General.aspx

Social Media Guidelines

The social media guidelines associated with use of Microsoft trademarks are quite similar to the app guidelines included above. Specifically, your social media account names and any and all pages or communities should not include any Microsoft trademarks. Any associated account, page, or community images should not include any Microsoft logos. The only exceptions to these requirements are if (1) you’ve secured permission from Microsoft through a license or equivalent (though such licenses are not generally available in this context); or (2) you’re using a Microsoft trademark (not including logos) to describe the purpose of your account, page, or community without suggesting affiliation with Microsoft. Finally, any social media account should not use the name or likeness of any prominent individuals within Microsoft.

For example, you cannot name your account, page, or community “Skype Forum” or “Microsoft Products.” However, it would be acceptable to name your account, page, or community “Forum for Skype Users” or “Information about Microsoft Products” as long as you do not use the Skype or Microsoft logos or otherwise suggest any affiliation with Microsoft.

Company, Product, Service, and Domain Names

Do not use or register any Microsoft trademark, including Microsoft logos, symbols, icons, or any potentially confusing variation thereof, as part of your company name, trade name, product name, service name, or domain name. Do not place your company name, trademarks, service marks, or product names next to, or combine them with, a Microsoft product name.

Update 1/4/2014

The SharePoint Team posted an update to their blog on the topic of trademark issues. Please check it out.

https://blogs.office.com/b/sharepoint/archive/2014/01/03/strategy-and-approach-to-the-sharepoint-trademark.aspx

Guidance

I've been asked for examples that can provide more guidance on this topic. If you have terms like 'Users', 'Fans', or 'User Group' in your name then that is ok. People should not be worried about imminent termination or anything like that. If Microsoft were to find an account that is problematic, we would work with the account owner to address it.

That being said, examples of acceptable use include the following:

• SharepointLover
• SharePoint Evangelist
• Info for SharePoint
• Feed for SharePoint
• SharePoint User Group
• SharePoint Interest
• Focus on SharePoint

Any name that doesn't generate confusion that an account is operated or sponsored by Sharepoint is generally acceptable. It is important to note that likelihood of confusion is heightened by use of our logos. Please visit the page linked above for the General Microsoft Trademark Guidelines as it will have the most updated information available. If there's anything not addressed on that page feel free to leave a comment here with your question and I'll get it answered. Thank you.

Create and Upload a Management Certificate

The first step in this process is to create a management certificate. You need this certificate to authenticate some of the tasks you perform with Windows Azure. One of these tasks is uploading a VHD. For the purposes of this blog post I won’t go into detail here on the steps to take to create the management certificate. Please review the Additional Resources section at the end of this blog post and you will find a link to an MSDN article on creating Certificates. Once you have created the certificate you’ll have to create an account with Windows Azure. Some MSDN subscription levels allow you to have a free Windows Azure account. Please check your MSDN subscription to see what benefits you have.

Figure 1: Windows Azure

Once your Azure account has been created login to your account and click the Portal link at the top right of your browser window. Once you are in your management portal click the New button at the bottom left to create your storage account.

Figure 2: Create storage account

Enter the URL of your storage account and the region where your storage account will be stored. The Geo-Replication checkbox is checked by default. You can leave this option on and your data will be replicated to a secondary location. In the case of a failure your data will fail over to this secondary location. If you wait until later to enable Geo-Replication there will be a data transfer charge fee.

Figure 3: Upload a management certificate

Once your storage account is created you’ll need to upload the management certificate. In the Windows Azure Management Portal click the Settings link which is the last option at the bottom of the left side menu. Once on the Settings page click the Upload menu option which is in the black bar at the bottom of the window. You will see the Upload a management certificate window as shown above. Browse to the certificate and click the check mark button to upload it to Windows Azure. Once the certificate is uploaded you’ll see it displayed under the Management Certificates section of the Settings page. I recommend you open Notepad or other utility and copy the Subscription Identifier and Thumbprint. You will need one or both of these later to create the connection to your storage account  (depending on which tool you choose to upload your VHD).

Prepare your VHD

I've been using Hyper-V on my Windows 8 laptop to run the VM locally. Hyper-V creates VMs that have a ".vhdx" file extension. These VHDX files aren't compatible with Windows Azure. You'll have to first convert the VHDX to a VHD.  

Figure 4: Locate Virtual Hard Disk

Launch the Hyper-V Manager, select the virtual machine you want to upload in Windows Azure, and select the Edit Disk action from the Actions pane. Select the Next button from the first screen and you will see the “Locate Virtual Hard Disk” window as shown above. Click the Browse button, navigate to the VHDX file in your file system and click the Open button. Once back on this screen click the Next button.

Figure 5: Choose Action

Select the Convert radio button and click the Next button.

Figure 6: Convert Virtual Hard Disk

Select the VHD radio button and click the Next button.

Figure 7: Virtual Hard Disk Type

Select the Fixed Size radio button and click the Next button.

Figure 8: Select VHD Name and Location

Click the Browse button to select the name and location of the desired VHD that will result from this operation. Click the Next button to continue.

Figure 9: Completing the Edit Virtual Hard Disk Wizard

Review the information in the description and click Finish.

Figure 10: Editing the virtual disk

The virtual hard disk conversion process is underway. Once this is complete you will have a VHD that can be uploaded to Windows Azure.

Upload the VHD

There are several tools that can be used to upload your VHD to Windows Azure. The tool you will hear the most about is the CSUpload tool. There are other GUI tools that can be used to view your Windows Azure Storage. A comprehensive list has been posted in a blog by the Windows Azure Storage Team. For this example I am using the ClumsyLeaf CloudXplorer v1. Here I’ll open up CloudXplorer and setup my Windows Azure Storage account.

Figure 11: CloudXplorer

From the CloudXplorer main window click File --> Accounts to open the Manage Accounts window.

Figure 12: Manage Accounts

By default you should see a blank window in the Manage Accounts window. In the Manage Accounts window click the New button. A menu will drop down from the new button with two options: Windows Azure Account, and Local DevStorage Account. Here we’ll choose the new Windows Azure Account option.

Figure 13: Windows Azure Account

Next you’ll have to enter your account details for your Windows Azure account. Once your information is entered correctly click the OK button. You should be taken back to the Manage Accounts window where you should see your new Windows Azure storage account added. Click the OK button to close the Manage Accounts button.

Figure 14: CloudXplorer

Once you’re back at the main CloudXplorer window, click the Upload page blob button on the toolbar as seen above.

Figure 15: Upload as Page BLOB

In the Upload as page blob window browse and select the VHD you want to upload and click the Open button.

Figure 16: Uploading

Your VHD is now uploading and will be ready to use once the upload is complete. In my next blog post I’ll cover provisioning a disk image and a virtual machine in Windows Azure.

Additional Resources

As promised here are links that can provide more information on what I covered above. Please leave a comment with any links you feel should be added to this list.

Management Certificates

• How to Create a Certificate for a Role: https://msdn.microsoft.com/en-us/library/gg432987.aspx

Preparing (converting) VHDs

• Convert VHDX to VHD: https://www.windowsitpro.com/article/virtualization2/convert-vhdx-vhd-windows-server-2012-143172

Uploading VHDs

• CSUpload command-line tool: https://msdn.microsoft.com/en-us/library/gg466228.aspx
• Windows Azure Storage Explorers: https://blogs.msdn.com/b/windowsazurestorage/archive/2010/04/17/windows-azure-storage-explorers.aspx
• ClumsyLeaf CloudXplorer v1: https://clumsyleaf.com/products/downloads

Now you will have a basic Windows Store app that's based on the Grid App template that should look like this

The tiles shown above are ok but what if you want to change the look of some tiles based on data attributes in the data source? Here we will use the SampleDataSource that is part of this app template but you can use this concept with any data source. In this example I want to change the appearance of a few of the tiles to make them look as if they are disabled and I also want to prevent the tiles from being clickable. The first thing we're going to do is modify SampleDataSource.cs to add data values that will be used to disable some of the tiles. Scroll down around line 268 where the sample data exists and change "Item Title: 1" to "Missing Item". Feel free to change any of the other Title values to "Missing Item" for the purposes of this demo. Our code will be looking for any tiles with the Title of "Missing Item" and giving each of them the appearance of being disabled. Obviously you won't have multiple Title values being the same in your real data source. This is just a basic example of showing how to look at values in your data and use that as a way to change the appearance/behavior of your tiles.

Before we jump into the code sample I will preface this section with the fact that the code is not 100% mine and it is not production ready. There are no try/catch blocks to trap for errors and the like - which we would all use when we are writing production code. This is just quick, demo code and nothing more. With that said we will add a new class to GroupedItemsPage.xaml.cs which is going to do the bulk of the lifting. Our class is going to inherit from the DataTemplateSelector class which is what we need to eventually return to our Grid control in the XAML. Use the following code to create the new class:

 public class TileTemplateSelector : DataTemplateSelector
 { 
 //These are public properties that will be used in the Resources section of the XAML.
 public DataTemplate Disabled250x250ItemTemplate { get; set; }
 public DataTemplate Standard250x250ItemTemplate { get; set; }
 
 protected override DataTemplate SelectTemplateCore(object item, DependencyObject container)
 {
 var currentFrame = Window.Current.Content as Frame;
 var currentPage = currentFrame.Content as Page;
 
 if (item != null && currentPage != null)
 {
 var data = item.ToString(); //Here we are getting the Title from the item and casting it as a string.
 
 if (!string.IsNullOrEmpty(data))
 {
 if (data.ToString() == "Missing Item") //Matching the right data value to return the DataTemplateSelector object.
 {
 var gridItem = container as GridViewItem;
 if (gridItem != null)
 {
 gridItem.IsHitTestVisible = false; //Disable the click event of the tile.
 }
 return Disabled250x250ItemTemplate; //Return the DataTemplateSelector for a disabled tile.
 }
 else
 {
 return Standard250x250ItemTemplate; //Return the DataTemplateSelector for a normal tile.
 }
 }
 else
 {
 return Standard250x250ItemTemplate; //In case of an error above return the DataTemplateSelector for a normal tile.
 }
 }
 return base.SelectTemplateCore(item, container);
 }
 }

Now open StandardStyles.xaml and scroll down around line 1645. The tiles are all using the style of "Standard250x250ItemTemplate". Copy the DataTemplate section of "Standard250x250ItemTemplate", paste the copied XAML directly below as a new DataTemplate section and rename it to "Disabled250x250ItemTemplate". For the end result you should have the following XAML pasted directly below the DataTemplate for "Standard250x250ItemTemplate". The style of the DataTemplate can be modified to fit your needs.

 <!-- Template to make the tile appear as disabled -->
 <DataTemplate x:Key="Disabled250x250ItemTemplate">
 <Grid HorizontalAlignment="Left" Width="250" Height="250" IsHitTestVisible="False" IsTapEnabled="False" Background="Black">
 <Border Background="Black">
 <Image Source="{Binding Image}" Stretch="UniformToFill" AutomationProperties.Name="{Binding Title}"/>
 </Border>
 <StackPanel VerticalAlignment="Bottom" Background="Black">
 <TextBlock Text="{Binding Title}" Foreground="Gray" Style="{StaticResource TitleTextStyle}" Height="60" Margin="15,0,15,0"/>
 <TextBlock Text="{Binding Subtitle}" Foreground="Gray" Style="{StaticResource CaptionTextStyle}" TextWrapping="NoWrap" Margin="15,0,15,10"/>
 </StackPanel>
 </Grid>
 </DataTemplate>

The next step is to modify GroupedItemsPage.xaml and wire all of this together to see the end result. Go ahead and add the following code to the <Page.Resources> section. This adds an instance of the custom DataTemplateSelector to the page:

<local:TileTemplateSelector x:Key="TileTemplateSelector" Disabled250x250ItemTemplate="{StaticResource Disabled250x250ItemTemplate}" Standard250x250ItemTemplate="{StaticResource Standard250x250ItemTemplate}" />

Finally we modify the horizontal Grid control on the page and add our DataTemplateSelector to the ItemTemplateSelector attribute. There should be an attribute named ItemTemplate already on the Grid control. You need to remove that attribute and replace it with the ItemTemplateSelector attribute as I've highlighted below. The end result should look like this (this is not the complete Grid control XAML but enough to give you an idea of what you should end up with).

<!-- Horizontal scrolling grid used in most view states -->
 <GridView
 x:Name="itemGridView"
 AutomationProperties.AutomationId="ItemGridView"
 AutomationProperties.Name="Grouped Items"
 Grid.RowSpan="2"
 Padding="116,137,40,46"
 ItemsSource="{Binding Source={StaticResource groupedItemsViewSource}}"
 ItemTemplateSelector="{StaticResource TileTemplateSelector}"
 SelectionMode="None"
 IsSwipeEnabled="false"
 IsItemClickEnabled="True"
 ItemClick="ItemView_ItemClick">

Now it's time to run the project and see the end result. You should have a screen similar to what I have in this screen shot below. I added the yellow border around the three tiles that have the new Disabled250x250ItemTemplate with MS Paint (yes this is a low budget effort) to show which tiles have picked up the new DataTemplate. The tiles have the appearance of being disabled and they aren't clickable.

• Configure outgoing e-mail (SharePoint Server 2010): https://technet.microsoft.com/en-us/library/cc263462.aspx
• Configuring DNS, MX, and SPF Records and Settings: https://technet.microsoft.com/en-us/library/ff714972.aspx
• Create an SMTP Send Connector: https://technet.microsoft.com/en-us/library/aa997285.aspx
• How to add process exclusions in Access Protection Port Blocking rules: https://kc.mcafee.com/corporate/index?page=content&id=KB56502

I sat down yesterday and read a great article titled “Managing SharePoint Security, Permissions the Hard Way” by Steven Pogrebivsky. It definitely does a great job at explaining the difficulties in managing SharePoint permissions with the out-of-the-box tools in SharePoint. I wanted to take the time to share my experience in managing SharePoint permissions the easier way.

Before I point out the easy way let’s recap the hard way. A new employee enters an organization and over time they accumulate permissions to various SharePoint sites. Over a period of months or years the permissions structure is as fractured as spaghetti code. Eventually the employee leaves the organization. Do you go back to every SharePoint site this employee had access to and remove them from every SharePoint group? Usually the answer is “No”. Why? Because the employee's permissions were never documented well enough for the site administrators to know wihch sites to remove the departing employee from.

Let’s take a step back and think about what existing processes we can leverage to ensure that SharePoint permissions are ALWAYS added and removed as employees enter and leave an organization. When a new employee enters an organization they are given an account in Active Directory (AD). The employee's account is also added to a few AD groups so they can access file shares and other resources on the network. When the employee leaves the organization their account is deleted from AD and any AD groups that they belonged to.

The easy solution: leverage AD groups and SharePoint groups together to manage access to your SharePoint sites. I highly recommend creating AD groups that mirror your SharePoint groups. That will allow you to add the AD groups to the appropriate SharePoint groups. All of the permissions management for SharePoint will be done in AD.

Let's look at this scenario again using the easier solution. A new employee enters your organization. This user is given an account in AD and his account is added to several AD groups - some of which will allow him access to a standard set of SharePoint sites. Over time this employee will gain access to new SharePoint sites by being added to new AD groups. When the employee leaves the organization their account is removed from AD and the AD groups. This employee has automatically lost access to all SharePoint sites within the organization. There is no need to search through the SharePoint sites to ensure the employee's access has been completely removed.

That is SharePoint security the easy way.