When you try to configure SSO in MOSS, it may fail with an error like this one:

 If you check ULS log, you may find these entries about the issue:

 In the application Event Log on the SharePoint Web Server, you may find this log entry:

 Event Type: Error

Event Source: Office SharePoint Server

Event Category: SSO

Event ID: 6517

Date: 2/21/2008

Time: 9:55:12 AM

User: N/A

Computer: MOSSBOX

Description:

User CONTOSO\SSO failed to configure the single sign-on server. The error returned was 0x80070995. Verify this account has sufficient permissions and try again.

It sounds like the SSO service account contoso\SSO seems to have permissions, huh? Here are the troubleshooting tips for the issue:

Variables: 

Let us consider the following details (variables :) ) for this issue scenario:

Farm service account: contoso\SPSVC

SSO administrator account: contoso\SSO

FQDN name of the SharePoint server: MOSSBOX.contoso.com

Step 1: Confirm SSO accounts are set with correct permissions

As mentioned in Plan for single sign-on (http://technet.microsoft.com/en-us/library/cc262305(office.12).aspx#section4) , make sure the SSO accounts are set with correct permissions / privileges. It is one of the important steps for the troubleshooting of the issue.

Step 2: Confirm whether the name resolution works correctly

Let us find out the current logged on Domain information using the command: Set U

From command line, type: set u

The result may be something like this:

USERDNSDOMAIN=CONTOSO.COM
USERDOMAIN=CONTOSO
USERNAME=SPSVC
USERPROFILE=C:\Documents and Settings\SPSVC

Now let us find the logged on domain controller information using the command: Set L

From command line, type: set l

The result may be something like this:

LOGONSERVER=\\DC1

At this stage, let us find out the PDC emulator role holder in the domain using the command: netdom

From command line, type: netdom query fsmo

The result may be something like this:

Schema owner                Box1.CONTOSO.com
Domain role owner           Box1.CONTOSO.com
PDC role                    DC1.CONTOSO.com
RID pool manager            Box3.CONTOSO.com
Infrastructure owner        Box3.CONTOSO.com
The command completed successfully.

According to the above command line, the PDC emulator role is set with DC1.CONTOSO.com

That said, let us use the command nltest which uses DNS queries to resolve the PDC emulator in the same way that  any application would resolve.

From command line, type: nltest /dcname:contoso

You may get a result something like this:

NetGetDCName failed: Status = 2453 0x995 NERR_DCNotFound

Don't you think this is the same error message we see in the ULS log? Yes, that's correct.  If so, what is the expected result for the above command ?  It should be something like this:

PDC for Domain svc is \\DC1
The command completed successfully

Q: What does the above error mean? 

A: The nltest reslt indicates that DNS queries to find/resolve the  PDC emulator failed - which is a DNS name resolution issue AND not an issue related to user permissions!

That said, let us verify whether this is really a DNS name resolution issue using nslookup command:

From command line, type: nslookup

The result may be something like this:

Default Server:  DC1.contoso.com
Address:  10.0.0.10

Now let us change the context to Service Location record - type this command in nslookup

> set type=srv

The above line won't produce any result and it would return the > prompt

Now let us find the SRV record for the PDC emulator by typing _ldap._tcp.pdc._msdcs.CONTOSO.com

> _ldap._tcp.pdc._msdcs.CONTOSO.com

You may get a result like this:

Server: DC1.contoso.com
Address:  10.0.0.10

_ldap._tcp.pdc._msdcs.CONTOSO.com SRV service location:
priority = 0
weight = 100
port = 389
svr hostname = DC1.CONTOSO.com
DC1.CONTOSO.com internet address = 10.0.0.10

Q: What does the above result mean?

A:

• DC1.CONTOSO.COM is the PDC emulator as well as the DNS server for the domain.
• Also we get same results for "SET L" + Netdom + nslookup which confirms that the issue is NOT about the DNS name resolution EVEN THOUGH we get error for NLTEST command.
• If the above result does not result correct PDC name, then there are certainly issues at DNS side

As we confirmed the working of name resolution here, we need to proceed with the checking of firewall ports (necessary for SSO) that are opened  [Step 3 covers the relevant details]

Are there multiple DNS servers in your environment?

There are possibilities that there may be one or more forest level DNS servers available in addition to the domain level DNS in the environment - here is a sample output on that aspect:

when we execute _ldap._tcp.pdc._msdcs.CONTOSO.com:

Server:  ForestDNS1.CONTOSOFOREST.com
Address:  10.0.0.20

_ldap._tcp.pdc._msdcs.CONTOSO.com SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = DC2.contoso.com
DC2.contoso.com   internet address = 10.0.0.21

According to the above o/p, the PDC emulator is  DC2.contosoforest.com which is different from the output for "netdom query fsmo" command! This kind of situation may occur if CONTOSOFOREST.com is a forest where contoso.com is one of the domain trees.

That said, let us query the domain's own DNS server using NSLOOKUP:

Enter this command in NSLOOKUP:

> server DC1.contoso.com

This changed the DNS  context and the result may be something like this one:

Default Server:  DC1.contoso.com
Address:  10.0.0.10

Now set the context to Service Location record
> set type=srv

To find the SRV record for the PDC emulator, let us type _ldap._tcp.pdc._msdcs.contoso.com

> _ldap._tcp.pdc._msdcs.contoso.com

Server:  DC1.contoso.com
Address:  10.0.0.10
_ldap._tcp.pdc._msdcs.contoso.com SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = DC1.contoso.com

DC1.contoso.com   internet address = 10.0.0.10

With the above output, it is clear that:

• DC1.contoso.com is the correct PDC emulator for the domain
• In order to get the correct PDC emulator name, the correct DNS server for the domain (in this case, the same box DC1) should be set for the IP configuration of the SharePoint box.

A member server of the domain should always point to it's own domain's domain controller for DNS & the Domain's Domain Controller should have forwarders to query the rest of the forest.

That said, let us verify the results for the command ipconfig:

From command line, type: ipconfig /all

You may get an o/p like this:

Windows IP Configuration
   Host Name . . . . . . . . . . . . : MOSSBOX
   Primary Dns Suffix  . . . . . . . : contoso.com
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : contoso.com
Ethernet adapter Local Area Connection:
   Connection-specific DNS Suffix  . : contosoforest.com
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection #3
   Physical Address. . . . . . . . . : 00-10-56-84-32-40
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 10.0.0.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.0.254
   DNS Servers . . . . . . . . . . . : 10.0.0.21

With the about o/p, it is quite clear that 10.0.0.21 is NOT the correct DNS server for the box (which resolves to the Forest level DNS rather than the domain level DNS)

That said, we need to modify the IP settings for the adaptor to reflect 10.0.0.10 as the primary DNS server - with that if you execute nslookup, then you would be able to get the correct PDC name.

Step 3: Enable necessary Ports 

The next part of the troubleshooting of the issue involves the checking of ports in the PDC. For that we can use TELNET from our MOSS box [we need to enable TELNET feature if you are using MOSS with Windows 2008]

• According to Plan security hardening for server roles within a server farm (Office SharePoint Server) ( http://technet.microsoft.com/en-us/library/cc262849(office.12).aspx#section5 ), confirm whether we have necessary ports opened in the domain controller as well as in the SharePoint boxes.
• Make sure the OS specific firewall ports are correctly configured
• Also make sure your IPSec rules (if implemented) and firewall ports are correctly configured.

For example, if you do not get connected to port 135 by using TELNET DC1 135, then you are expected to get only the error "NetGetDCName failed: Status = 2453 0x995 NERR_DCNotFound" for nlstat command as well as SSO configuration cannot complete.

You can use PortQueryUI (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8355e537-1ea6-4569-aabb-f248f4bd91d0&displaylang=en) in addition with PortQuery (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=89811747-C74B-4638-A2D5-AC828BDC6983) to check the ports opened in the servers.

Step 4: Further troubleshooting

If the issue still persists, gather simultaneous network traces from both the SharePoint box (The first server computer on which the Single Sign-On service is enabled) and the domain controller that is resulted as part of running set l command.

Check the associated traffic to identify the possibilities for the issue.  In case if you require further assistance in troubleshooting, kindly create a support case with Microsoft Support.

Hope this post would be helpful!

Webcast 1:

Date: 9/14/10

Time: 1 pm PST

Title: Search Your Way to Success:  Leveraging SharePoint's Search Capabilities in Public Web Sites

Partner: Ironworks Consulting

Abstract:

Learning Objectives & Key Takeaways:

Objective 1: Understand the key principles of enterprise search.

Objective 2: Understand the evolution of search within SharePoint (2007 to 2010).

Objective 3: Learn how to optimize search for SharePoint sites.

Summary: The enterprise search capabilities built in to SharePoint provide an easy win for organizations seeking to achieve a quick return on their SharePoint investment. This technical deep dive will include a discussion of search configuration best practices, strategies for maximizing SharePoint’s capabilities, and simple customizations that can take your search experience to the next level.

Registration:   https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032458983&Culture=en-US

Webcast 2:

Date: 9/21/10

Time: 1 pm PST

Title: Engaging Users with Content-Driven Web Sites Powered by SharePoint and FAST

Partner:  PointBridge

Abstract:

Content: it’s what attracts visitors to your web site and, more importantly, it’s what keeps them coming back. In this webinar, we’ll see how technologies from Microsoft enable an organization to easily publish information to the web and then allow visitors to interact with the content on their sites.

Specifically, the webcast will cover:

(1) Content management and publishing processes

(2) More than just pages: rich content in SharePoint

(3) Creating search experiences that users love

(4) Pushing content to users dynamically: using search in new way.

This webinar will showcase the new capabilities of SharePoint 2010 and FAST Search for SharePoint to act as powerful engines for powering Internet growth.

Registration:  https://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032459051&EventCategory=4&culture=en-US&CountryCode=US

https://channel9.msdn.com/shows/ARCast.TV/ARCastTV-Building-an-Integrated-Office-Solution-Using-Word-OpenXML-and-SharePoint-2010/

With this interview you will find out:

- Why Office Word can be choosen as the frontend user interface and SharePoint 2010 for the backend;
- How to enable users to get data from multiple data sources using familiar user interface in Word;
- How to manage security and user permissions with information stored in an external database and ERP system;and
- What search functions can be provided using metadata and built-in search capabilities.

Microsoft SharePoint Server 2010 Technical Library in Compiled Help format 

Microsoft SharePoint Foundation 2010 Technical Library in Compiled Help format

Microsoft FAST Search Server 2010 Technical Library in Compiled Help format

Windows PowerShell compiled Help for SharePoint Server 2010

Windows PowerShell compiled Help for SharePoint Foundation 2010 

Happy Computing!

Enterprise Architect Marc Dencker explains what Microsoft Business Productivity Online Suite (BPOS) is, and what financial and operational benefits it offers to customers in addition to several important issues related to SharePoint deployment to BPOS cloud such as:

• Custom code and third-party application consideration and integration
• Testing, deployment, revision and rollback,
• SharePoint service management and user authentication.

Check this link for details: https://channel9.msdn.com/shows/ARCast.TV/ARCastTV-SharePoint-Deployment-to-Microsoft-BPOS-Cloud/

Twitter friendly version:  Learn SharePoint 2010 Best Practices Videos, labs and code available on testing, deployment and security available on Channel 9.

Application Compatibility for Office 2010: Analyze your environment for installed add-ins and identify potential migration issues as you migrate earlier versions of Office to Office 2010. Learn how the Compatibility Inspector tools can perform an analysis of the code and suggest potential issues with this video on Channel 9. Additional videos and a lab are also available.

Twitter friendly version: Planning for Office 2010 Migration? Watch this Channel 9 video for tools to help identify potential migration issues.

Happy Learning!

You re-install or upgrade Vista / Windows 2008 / Windows 7 in a system. That may result the creation of "Windows.old" folder. You may try to delete that folder and its contents ; that may not work as expected - you may get multiple access denials and the folder "Windows.old" cannot be removed. This issue may be seen even if you have administrator privileges to the box.

For such a scenario, you may create a batch file based on the code below and run that batch file to delete the "Windows.old" folder:

REM JK-Windows.Old Deleter Version 1.0.181109 by jkadeesh

@echo off

setlocal

Title Windows.Old Deleter

set BAT_HOME=%~dp0
set BAT_NAME=%~s0
set BATFILE=%~nx0
set DRVLET=%~d0

if "%1"=="" goto interactive

REM Flash related lines are meant for deleting Flash specific .OCX files which cannot be easily deleted

if exist %1\Windows\System32\Macromed\Flash CD /D %1\Windows\System32\Macromed\Flash && cacls *.* /P Everyone:F

cd /d %DRVLET%

takeown /f %1 /R /d y
icacls %1 /grant administrators:F /t
rd /s /q %1

goto end

:interactive

cls

cd /d %DRVLET%\

IF EXIST %DRVLET%\Windows.old ECHO. && ECHO Found %DRVLET%\Windows.old && GOTO Auto

IF NOT EXIST %DRVLET%\Windows.old ECHO. && ECHO NOT FOUND %DRVLET%\Windows.old && ECHO.

echo Enter folder name [with complete path] which needs to be deleted:
echo.
echo To exit type "x" and press Enter key

echo.
echo.

set /p user=Folder Name[with path]:

if "%user%"=="x" goto end

if exist %user%\Windows\System32\Macromed\Flash CD /D %user%\Windows\System32\Macromed\Flash && cacls *.* /P Everyone:F

cd /d %DRVLET%\

takeown /f %user% /R /d y
icacls %user% /grant administrators:F /t
rd /s /q %user%

if not "%user%"=="x" goto interactive

goto end

:Auto
cls
ECHO.

cd /d %DRVLET%\

set user=Windows.old

if exist %DRVLET%\%user%\Windows\System32\Macromed\Flash CD /D %DRVLET%\%user%\Windows\System32\Macromed\Flash && cacls *.* /P Everyone:F

cd /d %DRVLET%\

takeown /f %user% /R /d y
icacls %user% /grant administrators:F /t
rd /s /q %user%

goto end

:end
ECHO.
ECHO Exiting...
ECHO.
pause

How to use the above code?

0. Disable User Access control [temporarily] - Once this task of deleting files / folders is completed, you may want to re-enable User Access Control. To disable UAC, go to Control Panel > User Accounts > Turn User Account Control on or off ; then uncheck the option "Use User Account Control (UAC) to help protect your computer" and click OK. Then restart the computer.

1. Copy/paste the code to Notepad

2. Save the file with the file name as: DeleteFiles.bat to C:\ drive [any location is ok - you need to go to the relevant location using the command line in step: 4]

Note that the 'Save as type' should be selected as "All Files (*.*)" before you click the Save button.

3. Go to Command prompt

4. Type CD \  to go to C:\

5. Type DeleteFiles foldername and then press Enter key

By default, the folder name is C:\Windows.old.

If the Windows.old folder resides in D:\ [or a different drive], then enter the drive letter accordingly along with the folder name.

6. Then you will notice a lot of operation in the command window and the script will end with "Exiting..." . Press any key to exit the script.

Then you will find Windows.old folder is completely removed - Note that with this method the contents of Windows.old folder will not won't be sent to the Recycle bin.

DeleteFiles.bat can be run without supplying the folder name also - in that scenario, it will consider Windows.old folder present in the current drive from which you run the batch file.

This posting is provided "AS IS" with no warranties. Use of included tools and reports are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

- People who haven't yet had a chance to use SPSReport to gather SharePoint speicific information

- People who wanted to know some details about SPSReport before running it in their environment

What is SPSReport?

• It is a Microsoft Public License (Ms-PL) based utility available @ http://spsreport.codeplex.com/ to gather detailed information about SharePoint configuration in a system. You can further share that information to a Microsoft Support Professional for your SharePoint related support case(s).

SPSReport can be used to gather data for SharePoint Support Cases that involve the following SharePoint environments:

• Windows SharePoint Services 2.0 / SharePoint Portal Server 2003
• Windows SharePoint Services 3.0 & Office SharePoint Server 2007 [MOSS 2007]

 Here are some points for you about SPSReport:

1. By default, the tool is installed to this folder: %Systemroot%\SPSReports\Portal\

2. This is the default directory structure for SPSReport: %SystemRoot%\SPSReports\Portal >  Bin > Rpt > Cab  

3. SPSReports\Portal\bin\Readme.txt contains details about the tool - After extracting the data by running SPSReport.exe, this file can be accessed without running the tool further.

4. The tool does not make any changes to registry / operating system / SharePoint

5. Login to the machine with the user account that have Administrative rights to run this tool

6. Since the tool will take some time [5 to 15 minutes] to gather data, run the tool during off-peak hours if the machine is busy.

7. IIS logs are not collected by the tool and they need to be manually collected, if needed.

8. The tool cannot gather ULS logs if the trace log file location is customized - For example, if Trace Log location is set to D:\WSS-logs, SPSReport cannot gather the logs from that custom location.

9. In that case, gather the ULS logs manually if they are asked by the Microsoft Support Professional.

10. This tool gathers only three recent ULS log files at the time of running it.

11. Based on WMI settings of the machine, the tool may not collect reports based on WMI.

12. This tool may result some errors while running on Windows 2008 OS, but most of the times it can collect the required data - it normally works well with Windows 2000 or Windows 2003.

After prompting for the mode of operation, the gathering of data may fail sometimes.  In that case:

1. Make sure you login with administrative privileges to collect the data

2. Try to re-run SPSReport.exe.  Even if it fails again:

• Collect COMPUTERNAME_PROGRESS.TXT from SPSReports\Portal\rpt folder

[For example: if your machine name is MyPC, you can find a file named MyPC_PROGRESS.TXT in SPSReports\Portal\rpt folder]

• Send it to the Microsoft Support Professional of your support case.

Sometimes after completing the gathering of data, the final .CAB file may not be generated

• In that case, zip all the files in SPSReports\Portal\rpt folder
• Share the .zip file with the Microsoft Support Professional

I attached a .PDF file with screen shots of SPSReport to this post. SPSReport v3.0.0.8 which is the latest version at the time of posting this blog.

SPSReport-Screenshots.pdf

Updated version of Technical Libraries for Microsoft Search Server 2008, MOSS 2007 and WSS 3.0 are available - These libraries include TechNet content for MSS 2008/ MOSS 2007 / WSS 3.0 as of June 12, 2009:

Microsoft Search Server 2008 Technical Library in Compiled Help format:
http://www.microsoft.com/downloads/details.aspx?familyid=6CF0F7B6-C0A7-48F8-977E-9BC76B97FF98&displaylang=en

Office SharePoint Server 2007 Technical Library in Compiled help format:
http://go.microsoft.com/fwlink/?LinkID=124606

Windows SharePoint Services 3.0 Technical Library in Compiled Help format:
http://www.microsoft.com/downloads/details.aspx?familyid=C9D6C8C5-8A62-4961-8C1B-DF08B667B1C4&displaylang=en

Even though these libraries include a lot of links for online resources, the offline data inside these libraries are quite worth for a SharePoint Administrator.

Do you want to get updates about SharePoint Server 2007 Newly Published Content using RSS? Then subscribe to this RSS feed: http://services.social.microsoft.com/feeds/feed/SharePointServerNewContent 

Happy SharePointing!

Consider this scenario:  You try to install a cumulative update [CU] for SharePoint 2007 or WSS 3.0.  During the beginning of the installation of the update, you may get this error:

"The expected version of the product was not found on the system" 

For example:

You installed MOSS 2007 SP1 with Italian Language Pack with Language Pack SP1.  You install SP2 for MOSS; but you forget to install the SP2 for the Italian Language Pack.  Then if you try to install April 2009 CU, then you will get the above given error message.

What is the cause?

This issue normally occurs:

- if you have language pack(s) installed for WSS / MOSS AND
- The language pack(s) do not have correct Service pack applied to them

How to resolve this error?

Option 1: Install the correct Service Pack for the language pack; then install the CU.

Option 2: Install the CU; then install the Service Pack for WSS/MOSS; after that install Service Pack for the Language Pack.

For example:

In the case of April 2009 CU, install the CU to the farm  [Assumption here is the SharePoint farm is already installed with SP1+Language Pack SP1+some cumulative updates] first.

Then install Service Pack 2 for WSS/MOSS; after that install Service Pack 2 for the Language Pack(s).

References

Here are the links to download the language pack [Note: You should select the correct language and then click "Change" button in the relevant Download pages of the Language Packs Service Packs to get the preferred Language Pack]:

WSS 3.0 Language Pack SP1 - x32

http://www.microsoft.com/downloads/details.aspx?FamilyId=05046B1D-DD7B-456A-8838-8D978C5F3579&displaylang=en

WSS 3.0 Language Pack SP1 - x64

http://www.microsoft.com/downloads/details.aspx?FamilyId=C7CF102B-5DD8-4D86-BE5A-D56F63EF37A4&displaylang=en

WSS 3.0 Language Pack SP2 - x32

http://www.microsoft.com/downloads/details.aspx?FamilyId=085E5AC8-58F6-4CF9-8012-33B95EE36C0F&displaylang=en

WSS 3.0 Language Pack SP2 - x64

http://www.microsoft.com/downloads/details.aspx?FamilyId=2C2B6CAF-B46D-45EB-AC4D-DEAAA48C3A2C&displaylang=en

The 2007 Microsoft Office Servers Language Pack SP1 - x32

http://www.microsoft.com/downloads/info.aspx?na=47&p=4&SrcDisplayLang=en&SrcCategoryId=&SrcFamilyId=c7cf102b-5dd8-4d86-be5a-d56f63ef37a4&u=details.aspx%3ffamilyid%3d3A6C26FD-0BEB-40D5-8CBA-15164FAAB150%26displaylang%3den

The 2007 Microsoft Office Servers Language Pack SP1 - x64

http://www.microsoft.com/downloads/info.aspx?na=47&p=1&SrcDisplayLang=en&SrcCategoryId=&SrcFamilyId=c7cf102b-5dd8-4d86-be5a-d56f63ef37a4&u=details.aspx%3ffamilyid%3d56681742-7D2C-4A6F-9178-DACD32AADC6C%26displaylang%3den

The 2007 Microsoft Office Servers Language Pack SP1 - x32

http://www.microsoft.com/downloads/details.aspx?FamilyId=01C6A3E8-E110-4956-903A-AD16284BF223&displaylang=en

The 2007 Microsoft Office Servers Language Pack SP1 - x64

http://www.microsoft.com/downloads/details.aspx?FamilyId=66C5026F-9F47-4642-8378-2526918009FA&displaylang=en 

http://blogs.msdn.com/sharepoint/archive/2008/07/15/announcing-availability-of-infrastructure-updates.aspx 

Happy Patching, Folks :)