1. Open up the MIM/FIM Synchronization Service.
2. Click Management Agents
3. Highlight SPMA then click Export Management agent on far right
4. Save the XML file. Then click Import Management Agent and point to the saved XML file and click OPEN.
5. Change the Name to SPMA_QA (or whatever you feel is a better descriptor). Click Next.
6. Enter the information for the additional SharePoint CA. (Server, port, domain, User Name, Password) then click Next. You may now click next through the rest of the wizard as everything will be the defaults.
7. Open SynchronizationRulesExtensions.cs located at D:\MIM\SharePointSynchronization to edit. I used NotePad.
8. Look for ProvisionUPSA(mventry, "SPMA"); (Should be line 47) Copy this line and paste below it and change the SPMA to SPMA_QA. Close and save file.
9. Open PowerShell ISE as admin and edit SharePointSynchronization.psm1 located at D:\MIM\SharePointSynchronization.
10. Go to line 222/223 look for Start-ManagementAgent -Name SPMA –RunProfile (there should be 2 lines) Copy/Paste those two lines and change SPMA on those lines two SPMA_QA
11. Go to line 229/23 look for Start-ManagementAgent -Name SPMA –RunProfile (there should be 2 lines) Copy/Paste those two lines and change SPMA on those lines two SPMA_QA.
12. Go to line 244/246 look for Start-ManagementAgent -Name SPMA –RunProfile (there should be 3 lines) Copy/Paste those three lines and change SPMA on those lines three lines to SPMA_QA. Save script.
13. Click the Green arrow in the top ribbon to load the script module.
14. Now that the module is loaded. Run Publish-SynchronizationAssembly -Path D:\MIM\SharePointSynchronization\SynchronizationRulesExtensions.cs –Verbose this will recompile SharePointSynchronization.dll and update the directory C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\Extensions.
15. Run a full import

• Open MIISCLIENT.EXE
• Click on Tools, Management Agents (or click the Management Agents in the bar)
• Right-click on the management agent with type 'Extensible Connectivity' and select Properties
• In the Properties window, select "Configure Connection Information "The "Connect to:" beginning field should point to the new SharePoint Central Administration site. DO NOT CHANGE THE URL in MIISCLIENT.exe See https://support.microsoft.com/en-us/help/2517937/support-for-modifications-to-the-user-profile-configuration-settings-v

PowerPivot Service Application

PowerPivot gallery manual and scheduled refresh will not work. I can load and interact with the spreadsheet but if I attempt to refresh I get the error: “We were unable to refresh one or more data connections in this workbook. The following connections failed to refresh:”

The “PowerPivot Management Dashboard Processing Timer Job” is failing with the error

Troubleshooting

“The formula contains a syntax error or is not supported”.

We looked at the different columns trying to figure out which might have a calculated field, but could not find one. Finally we used PowerShell to get a list of content types and their fields. 

$web = get-spweb https://contoso.com/sites/content 
$web.ContentTypes > f:\fields.txt

After we opened up the txt document we did a search on Formula and found that there was a field called QTR that was using a formula.

The column 1Q did not exist so it was unable to calculate the value. 
We then changed the QTR content type from calculated to choice and this resolved our issue.

• Adjust memory quotas for a process
• impersonate a client after authentication
• Logon as a batch job
• logon as a service
• replace token level access
• Allow Logon through Desktop Services
• Allow Log on locally

• Administrators
• IIS_IUSRS
• Performance Log Users
• Performance Monitor Users
• Remote Desktop Users
• WSS_ADMIN_WPG
• WSS_RESTRSICTED_WPG_V4
• WSS_WPG

There are several blogs out there on this issue, however I did not see any that mentioned checking the WSSTRACESESSION14 trace session.   

First open up SharePoint PowerShell (as administrator) and run the following command: Get-SPLogLevel this will list the current logging level.  If everything is set to NONE then at some point logging was disabled. Simply go back into Central Admin --> Monitoring --> Configure diagnostic monitoring then set the appropriate logging level.  Note: This page will list the location of the folder where your logs are writing to, check to ensure you are not low on disk space,

Next let's check what account is running the windows service "SharePoint 2010 Tracing",normally this is "Local Service" and should not be changed.  The "Local Service" , WSS_ADMIN_WPG, WSS_WPG, and WSS_RESTRICED_WPG_V4 accounts should have the following permissions (WSS_ADMIN_WPG should also include delete) on the folder that contains your logs:

If you have to change permissions you will want to recycle the "SharePoint 2010 Tracing" service. Once you have verified the permissions are correct, then we will want to check the Event Trace Sessions. 

The Event Trace Sessions are located inside of Performance Monitor.

Once you open up Performance Monitor, click to expand Data Collector Sets, then click on Event Trace Sessions.  On the Right you will see WSSTRACESESSION14 (you will also see WSSUASGESESSION14 which is used for the usage logs)

Right click on WSSTRACESESESSON14 then click on Properties.

You will now see the Provider for this Event Trace Session. 

Click on Security (either the tab up top or the button to the right) and review the permissions.  WSS_ADMIN_WPG, WSS_WPG, and WSS_RESTRICED_WPG_V4  should be listed and should have TRACE_LOG_EVENT permission.

If these are missing they will need to be added.  I found that there is a trick to adding permissions. If you simply add then and click Apply and then Click OK the permissions will not stay.  So I add all the IDs that need permissions and grant them the appropriate permission, then I flip back to Performance Monitor and right click on WSSTRACESESSION14 then click stop.  I quickly toggle back to the Security setting screen and then click Apply and then click OK.  Now toggle back to Performance monitor and right click WSSTRACESESSION14 session and click start. If you now verify your permissions you should see the IDs added along with the permissions.

If you look at the blogs out on the internet you will see several that suggest adding the "Account" that is nor logging to “Performance Log Users”.  This will fix the issue but if you review the permissions for “Performance Log Users” you will see that you are granting more permissions to the "account" then if you follow the above instructions. Also for SharePoint 2013 the permissions for WSS_ADMIN_WPG will have a lot more rights then what it has in SharePoint 2010 and more than “Performance Log Users” so you may not grant all the correct permissions if you are running SharePoint 2013.

Note: There should be a registry entry at HKLM\SYTEM\CURRENTCONTROLSET\WMI\SECURITY that corresponds to the Provider number listed above, if this registry is missing then most likely you have the "default" Event Trace session permissions and so the WSS_ADMIN_WPG, WSS_WPG, and WSS_RESTRICED_WPG_V4 probably do not have permissions. 

Looking at the daily tasks a SharePoint Admin must perform I have come up with this list.  It is not meant to be all inclusive.  See this link for more detailed  information on Operations Framework and Checklists 

• Review Logs.
• • IIS Logs
  • ULS - Diagnostics logs
  • Usage logs
  • Event log
• Review Timer jobs
• Review Health Analyzer
• Review Performance Metric
  • CPU
  • Memory
  • Disk Space

• Review, Apply Hotfixes, Roll UPs, Security Updates, Service Packs
• Analyze and respond to any issues

Q: So how do we do these tasks as a non-administrator?

A; very Carefully.

Review Logs and analyze and respond to any issues

Reviewing and analyzing logs simply requires NTFS permissions on the folders where the logs are stored. This is pretty easy to configure.  Responding to issues may require the use of the SharePoint PowerShell Management Shell.  This requires that you be a member of SPShellAdmin, which depending on how tight security is you may or may not have this right.  Even if you do, you will find that some commands that write to directories or files will require you to be an admin on the box and will fail if the correct permissions are not in place.  

Review Timer jobs

Log into central admin and verify in Monitoring  --> Check Job Status that there are no "Stuck" jobs.  If you find jobs are stuck you find that you need to clear the Timer Cache.  In order to do this you must stop the SharePoint Timer service but as a non admin on the server you probably can't do that.  So you will need to Delegate the ability to manage windows services.  You also might find that you need to manage IIS or Reset Application Pools both of which typically require Admin rights. 

 Review Health Analyzer

Log into Central Admin review in Monitoring --> Review Problems and solution what issues SharePoint has identified.  Some health issues will have a Repair Automatically button that will attempt to resolve the issue. If this does not work, you may find you need to review logs, stop/start services, reset IIS , or engage an administrator on the server. 

Review Performance Metrics

In order to review performance metrics you will need to be part of the local computer group Performance Monitor Users. 

Review, Apply Hotfixes, Roll UPs, Security Updates, Service Packs

This task should be performed with the Install Account. The install account must be an administrator on the local servers.  You can disable this account when not patching to achieve the hardening of the server.

How to enable Remote PowerShell for SharePoint 2013 for Non-Administrators

My Article is primarily focused on SharePoint 2010 but I have a college that has an article for SharePoint 2013 about running PowerShell remotely as a Non-Administer.  

Conclusion

As you can see there is a lot of extra configuration that needs to be done to achieve partial ability to manage SharePoint as a non Administrator.  Deep debugging will almost always require admin access in order to dump or trace processes, so my advice is please do not attempt to run SharePoint servers as a non administrator.

Note this requires elevated rights and is typically handled by an AD group.  Based on that some of these instructions may be very light.

Open up Server Manager expand Features expand Group Policy Management expand Forest:Contoso.com expand Domains expand Contoso.com right click on Group Policy Objects click New.

You will now get a pop-up to enter a Name and comment. Enter something descriptive. Then click OK.
 

Right click on the new Group Policy Object just created then click edit.

Click to expand Policies Click to expand Windows Settings Click to expand Security Settings Click on System Services.

 
On the Right hand side you will find the services that are on the server. 
Scroll through the services until you see one you wish to delegate.
 
The first SharePoint Service I see in Claims to Windows Token Service. Double click on this service.

 
Click to check Define this policy setting.  Now select service startup mode.  (Open up services.msc to determine the current mode that this particular service is currently configured as.)

Note to save time you may want to create an excel spreadsheet with all the services and startup mode for all servers in the farm for faster reference  You will most likely find that you require multiple GPOs as not all startup modes will be the same across all servers. 

 
After selecting the startup mode. Click edit Security.
Add in the AD user/group that will require rights to manage this service.  In my case I added  contoso\app Admins (This is the same group I used for IIS delegation and Web deploy ) with Start, stop, pause. You will also need to add contoso\farm with full control (If you have followed least privilege your farm account will not be in the local administrators group, not having full control will cause issues when running PSCONFIG).

Click OK when complete.
 
Claims to Windows Token Service is now configured.

 
Repeat this for all services you wish to delegate Setting the startup mode and permissions.
Here is the list of Windows services I ended up with (If you have Project server, you will need to add those services):

• Claims to windows token service
• Document Conversion Launcher
• Document Conversion load Balancer
• Forefront Identity Manager Service
• Forefront Identity Manager Synchronization Service
• IIS Admin Service * Note this is not a SharePoint service so Farm only needs Start, stop, pause
• SharePoint 2010 Administration
• SharePoint 2010 Timer
• SharePoint 2010 Tracing
• SharePoint 2010 User Code Host
• SharePoint 2010 VSS Writer
• SharePoint Foundation Search V4
• SharePoint server Search 14
• Web Analytics Service

Close Group Policy Editor.
Create any more GPOs that you may need.
Target the GPOs to the appropriate server(s).