As discussed in my previous blog, its been observed that starting User profile sync job is not an easy task at times. This post describes errors and the solution that I recently worked on. The issue was on a SharePoint 2010 farm which is migrated from 2007 farm.

Issue & Observations
Unable to start User Profile sync service from Central administration site ->system settings->Services on server. The service freezes at "starting" and never start. Below are the information from event viewer and verbose enabled ULS logs.

From ULS

Exception occured while connecting to WCF endpoint: Microsoft.SharePoint.SPEndpointAddressNotFoundException: There are no addresses available for this application.     at Microsoft.SharePoint.SPRoundRobinServiceLoadBalancer.BeginOperation()     at Microsoft.Office.Server.UserProfiles.MossClientBase`1.get_Channel()     at Microsoft.Office.Server.UserProfiles.MossClientBase`1.ExecuteOnChannel(String operationName, CodeBlock codeBlock)     at Microsoft.Office.Server.UserProfiles.ProfilePropertyServiceClient.ExecuteOnChannel(String operationName, CodeBlock codeBlock)

UserProfileApplicationProxy.InitializePropertyCache: Microsoft.Office.Server.UserProfiles.UserProfileException: There are no addresses available for this application. ---> Microsoft.SharePoint.SPEndpointAddressNotFoundException: There are no addresses available for this application.     at Microsoft.SharePoint.SPRoundRobinServiceLoadBalancer.BeginOperation()     at Microsoft.Office.Server.UserProfiles.MossClientBase`1.get_Channel()     at Microsoft.Office.Server.UserProfiles.MossClientBase`1.ExecuteOnChannel(String operationName, CodeBlock codeBlock)     at

Microsoft.Office.Server.UserProfiles.ProfilePropertyServiceClient.ExecuteOnChannel(String operationName, CodeBlock codeBlock)     --- End of inner exception stack trace ---     at Microsoft.Office.Server.UserProfiles.ProfilePropertyServiceClient.ExecuteOnChannel(String operationName, CodeBlock codeBlock)     at Microsoft.Office.Server.UserProfiles.ProfilePropertyServiceClient.GetProfileProperties()     at Microsoft.Office.Server.Administration.UserProfileApplicationProxy.RefreshProperties(Guid applicationID)     at Microsoft.Office.Server.Utilities.SPAsyncCache`2.GetValueNow(K key)     at Microsoft.Office.Server.Utilities.SPAsyncCache`2.GetValue(K key, Boolean asynchronous)     at Microsoft.Office.Server.Administration.UserProfileApplicationProxy.InitializePropertyCache()

From Event viewer

Log Name:      Application

Source:        Microsoft-SharePoint Products-SharePoint Foundation

Date:          3/4/2011 12:30:23 PM

Event ID:      8077

Task Category: Topology

Level:         Error

Keywords:     

User:          Domain\sp_farm

Computer:      Computer FQDN

Description:

"There are no instances of the User Profile Service started on any server in this farm. Ensure that at least one instance is started on an application server in the farm using the Services on Server page in Central Administration."

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />

    <EventID>8077</EventID>

    <Version>14</Version>

    <Level>2</Level>

    <Task>13</Task>

    <Opcode>0</Opcode>

    <Keywords>0x4000000000000000</Keywords>

    <TimeCreated SystemTime="2011-03-04T18:30:23.718750000Z" />

    <EventRecordID>18688</EventRecordID>

    <Correlation />

    <Execution ProcessID="3356" ThreadID="5948" />

    <Channel>Application</Channel>

    <Computer>Computer name</Computer>

    <Security UserID="S-1-5-21-1834648779-3785927647-1620804944-5169" />

  </System>

  <EventData>

    <Data Name="string0">User Profile Service</Data>

  </EventData>

</Event>

-----------------------------------------------------------------------------------------------------------------------------------

Log Name:      Application

Source:        Microsoft Resource Management Service

Date:          3/4/2011 1:00:07 PM

Event ID:      0

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Computer name

Description:

Service cannot be started. System.Data.SqlClient.SqlException: Cannot open database "Sync DB" requested by the login. The login failed.

Login failed for user domain\sp_farm'.

   at Microsoft.ResourceManagement.WindowsHostService.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft Resource Management Service" />

    <EventID Qualifiers="0">0</EventID>

    <Level>2</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2011-03-04T19:00:07.000000000Z" />

    <EventRecordID>18718</EventRecordID>

    <Channel>Application</Channel>

    <Computer>sharepoint</Computer>

    <Security />

  </System>

  <EventData>

    <Data>Service cannot be started. System.Data.SqlClient.SqlException: Cannot open database "Sync DB" requested by the login. The login failed.

Login failed for user 'Domain\sp_farm'.

   at Microsoft.ResourceManagement.WindowsHostService.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)</Data>

  </EventData>

</Event>

-----------------------------------------------------------------------------------------------------------------------------------

Log Name:      Application

Source:        Forefront Identity Manager

Date:          3/4/2011 1:00:07 PM

Event ID:      3

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      sharepoint

Description:

.Net SqlClient Data Provider: System.Data.SqlClient.SqlException: Cannot open database "Sync DB" requested by the login. The login failed.

Login failed for user 'domain\sp_farm'.

   at Microsoft.ResourceManagement.Data.Exception.DataAccessExceptionManager.ThrowException(SqlException innerException)

   at Microsoft.ResourceManagement.Data.DatabaseConnection.Open(SqlConnection connection)

   at Microsoft.ResourceManagement.Data.DatabaseConnection.Open(DataStore store)

   at Microsoft.ResourceManagement.Data.TransactionAndConnectionScope..ctor(Boolean createTransaction, IsolationLevel isolationLevel, DataStore dataStore)

   at Microsoft.ResourceManagement.Data.TransactionAndConnectionScope..ctor(Boolean createTransaction)

   at Microsoft.ResourceManagement.Data.DataAccess.RegisterService(String hostName)

   at Microsoft.ResourceManagement.Workflow.Hosting.HostActivator.RegisterService(String hostName)

   at Microsoft.ResourceManagement.Workflow.Hosting.HostActivator.Initialize()

   at Microsoft.ResourceManagement.WebServices.ResourceManagementServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses)

   at Microsoft.ResourceManagement.WindowsHostService.OnStart(String[] args)

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Forefront Identity Manager" />

    <EventID Qualifiers="0">3</EventID>

    <Level>2</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2011-03-04T19:00:07.000000000Z" />

    <EventRecordID>18717</EventRecordID>

    <Channel>Application</Channel>

    <Computer>sharepoint</Computer>

    <Security />

  </System>

  <EventData>

    <Data>.Net SqlClient Data Provider: Sys

-----------------------------------------------------------------------------------------------------------------------------------

Log Name:      Application

Source:        Microsoft.ResourceManagement.ServiceHealthSource

Date:          3/4/2011 1:00:07 PM

Event ID:      2

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      sharepoint

Description:

The Forefront Identity Manager Service could not bind to its endpoints.  This failure prevents clients from communicating with the Web services.

A most likely cause for the failure is another service, possibly another instance of Forefront Identity Manager Service, has already bound to the endpoint.  Another, less likely cause, is that the account under which the service runs does not have permission to bind to endpoints.

Ensure that no other processes have bound to that endpoint and that the service account has permission to bind endpoints.  Further, check the application configuration file to ensure the Forefront Identity Manager Service is binding to the correct endpoints.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft.ResourceManagement.ServiceHealthSource" />

    <EventID Qualifiers="0">2</EventID>

    <Level>2</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2011-03-04T19:00:07.000000000Z" />

    <EventRecordID>18716</EventRecordID>

    <Channel>Application</Channel>

    <Computer>sharepoint</Computer>

    <Security />

  </System>

  <EventData>

    <Data>The Forefront Identity Manager Service could not bind to its endpoints.  This failure prevents clients from communicating with the Web services.

A most likely cause for the failure is another service, possibly another instance of Forefront Identity Manager Service, has already bound to the endpoint.  Another, less likely cause, is that the account under which the service runs does not have permission to bind to endpoints.

Ensure that no other processes have bound to that endpoint and that the service account has pe

-----------------------------------------------------------------------------------------------------------------------------------

Log Name:      Application

Source:        Microsoft.ResourceManagement.ServiceHealthSource

Date:          3/4/2011 1:00:07 PM

Event ID:      26

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      sharepoint

Description:

The Forefront Identity Manager Service was not able to initialize a timer necessary for supporting the execution of workflows.

Upon startup, the Forefront Identity Manager Service must initialize and set a timer to support workflow execution.  If this timer fails to get created, workflows will not run successfully and there is no recovery other than to stop and start the Forefront Identity Manager Service.

Restart the Forefront Identity Manager Service.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft.ResourceManagement.ServiceHealthSource" />

    <EventID Qualifiers="0">26</EventID>

    <Level>2</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2011-03-04T19:00:07.000000000Z" />

    <EventRecordID>18715</EventRecordID>

    <Channel>Application</Channel>

    <Computer>sharepoint</Computer>

    <Security />

  </System>

  <EventData>

    <Data>The Forefront Identity Manager Service was not able to initialize a timer necessary for supporting the execution of workflows.

Upon startup, the Forefront Identity Manager Service must initialize and set a timer to support workflow execution.  If this timer fails to get created, workflows will not run successfully and there is no recovery other than to stop and start the Forefront Identity Manager Service.

Restart the Forefront Identity Manager Service.</Data>

  </EventData>

</Event>

-----------------------------------------------------------------------------------------------------------------------------------

Log Name:      Application

Source:        Microsoft.ResourceManagement.ServiceHealthSource

Date:          3/4/2011 1:00:06 PM

Event ID:      22

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      sharepoint

Description:

The Forefront Identity Manager Service cannot connect to the SQL Database Server.

The SQL Server could not be contacted. The connection failure may be due to a network failure, firewall configuration error, or other connection issue. Additionally, the SQL Server connection information could be configured incorrectly.

Verify that the SQL Server is reachable from the Forefront Identity Manager Service computer. Ensure that SQL Server is running, that the network connection is active, and that the firewall is configured properly. Last, verify the connection information has been configured properly. This configuration is stored in the Windows Registry.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft.ResourceManagement.ServiceHealthSource" />

    <EventID Qualifiers="0">22</EventID>

    <Level>2</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2011-03-04T19:00:06.000000000Z" />

    <EventRecordID>18712</EventRecordID>

    <Channel>Application</Channel>

    <Computer>sharepoint</Computer>

    <Security />

  </System>

  <EventData>

    <Data>The Forefront Identity Manager Service cannot connect to the SQL Database Server.

The SQL Server could not be contacted. The connection failure may be due to a network failure, firewall configuration error, or other connection issue. Additionally, the SQL Server connection information could be configured incorrectly.

Verify that the SQL Server is reachable from the Forefront Identity Manager Service computer. Ensure that SQL Server is running, that the network connection is active, and that the firewall is configured properly. Last, ver

Cause

In this case, the SSP was not migrated properly. Some of the database information was not properly registered in the SharePoint server registry.

Resolution

- Stop User profile service and User profile sync service on ALL SharePoint servers in the farm

- Clear timer config cache by following the "resolution" documented at https://support.microsoft.com/kb/939308

- Deleted the Pending timer job related to the UPA sync service provisioning using Central administration->Monitoring->check job status

- Confirmed that the security token service has only windows and anonymous enabled ( from IIS manager->SharePoint web services->Security token service->Authentication (under IIS))

- On the SharePoint server access the registry editor and confirm that the information related to FIM ( database servername , sync DB name etc ) are properly populated, if found wrong , back  up the registry key and edit the values to reflect the right information.

HKLM\system\currentcontrolset001\services\FIMservice

HKLM\system\currentcontrolset002\services\FIMservice

HKLM\system\currentcontrolset\services\FIMservice

- Delete all FIM related certificates from certificate store ( for account and system) . Make sure that no FIM related certificate is listed in any folders when looked at certificate manager.

- From Central administration->Application management->Manage service application, Make sure the User profile service application and its proxy are started, If found stopped, its always recommended to recreate them taking necessary backups (mysites)

- Start User profile service on the machine where you would like to start the User profile sync service (use central administration console)

- Once the service is started, try starting the User profile sync service from the central administration site

Its  been commonly observed that working with User profile service application is one of the pain areas of SharePoint 2010. Most of the time, it fails with starting the User profile synchronization service from Central administration site. I was recently working with an issue where the user profile synch service fails to start and it gives the very common error message in the SharePoint ULS logs (as below)

User Profile Application Proxy failed to retrieve partitions from User Profile Application: Microsoft.Office.Server.UserProfiles.UserProfileApplicationNotAvailableException: No User Profile Application available to service the request. Contact your farm administrator.    
at Microsoft.Office.Server.Administration.UserProfileApplicationProxy.get_ApplicationProperties()   
at Microsoft.Office.Server.Administration.UserProfileApplicationProxy.get_PartitionIDs()    
at Microsoft.Office.Server.Administration.UserProfileApplicationProxy.IsAvailable(SPServiceContext serviceContext

By raising the logging level to verbose, we could observe the following error as well.

Exception occured while connecting to WCF endpoint: System.ServiceModel.CommunicationException: The server did not provide a meaningful reply; this might be caused by a contract mismatch, a premature session shutdown or an internal server error.    Server stack trace:     
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)    
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)    
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)    Exception rethrown
at [0]:     
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)    
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)    
at Microsoft.IdentityModel.Protocols.WSTrust.IWSTrustContract.Issue(Message message)    
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)    
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)    
at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo)    
at Microsoft.SharePoint.SPSecurityContext.<>c__DisplayClass7.<GetProcessSecurityTokenForServiceContext>b__6()    
at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)    
at Microsoft.SharePoint.SPSecurityContext.GetProcessSecurityTokenForServiceContext()    
at Microsoft.SharePoint.SPChannelFactoryOperations.CreateChannelAsProcess[TChannel](ChannelFactory`1 factory, EndpointAddress address, Uri via)    
at Microsoft.SharePoint.SPChannelFactoryOperations.CreateChannelAsProcess[TChannel](ChannelFactory`1 factory, EndpointAddress address)    
at Microsoft.Office.Server.UserProfiles.MossClie

Cause

The authentication for security token service in IIS had "Forms" and "ASP.NET impersonation" enabled. This was preventing the user’s identity to be passed to the security token service and the token service was unable to generate tokens properly.

Resolution

Open up the  IIS Manager on the SharePoint server

• Expand “Sites”
• Expand “SharePoint Web Services” and select “SecurityTokenServiceApplication”
• Double click on “Authentication”(under IIS)
• Disable “Forms Authentication” and ASP.NET impersonation 
• Confirm that only Windows and Anonymous Authentication are enabled
• IISRESET 

During the course of troubleshooting we initially suspected the database corruption may be an issue . Verified the DB permissions and created anew configuration DB . That did not resolve the issue . Later we found that even though we can create other service application s(like mms and search service application) , we are unable to access them . Most of them were related to security and that made us suspect "security token service application"

To clarify the above , we tested the security token service application by running the rule

Central administration site -> Monitoring ->review rule definitions ->"The security token service is not available" (under availability)

This shows the below errors in in the system event viewer :

Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Event ID:      8306
Task Category: Claims Authentication
Level:         Error
Description:
An exception occurred when trying to issue security token: The server did not provide a meaningful reply; this might be caused by a contract mismatch, a premature session shutdown or an internal server error..
Event Xml:
<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
    <EventID>8306</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>47</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2011-02-01T20:08:31.889137200Z" />
    <EventRecordID>178223</EventRecordID>
    <Correlation ActivityID="{E47AD4F2-E51A-49A2-BAB2-E22243297CEC}" />
    <Execution ProcessID="1072" ThreadID="5060" />
    <Channel>Application</Channel>
    <Computer>FQDN of computer</Computer>
    <Security UserID="S-1-5-21-1037773150-1901201615-623648099-663347" />
  </System>
  <EventData>
    <Data Name="string0">The server did not provide a meaningful reply; this might be caused by a contract mismatch, a premature session shutdown or an internal server error.</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Event ID:      2138
Task Category: Health
Level:         Warning
Description:
The SharePoint Health Analyzer detected a condition requiring your attention.  The Security Token Service is not available.
The Security Token Service is not issuing tokens. The service could be malfunctioning or in a bad state.
Administrator should try to restart the Security Token Service on the boxes where it is not issuing tokens. If problem persists, further troubleshooting may be available in the KB article. For more information about this rule, see "https://go.microsoft.com/fwlink/?LinkID=160531".
Event Xml:
<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
    <EventID>2138</EventID>
    <Version>14</Version>
   <Level>3</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2011-02-01T20:51:16.683910600Z" />
    <EventRecordID>180549</EventRecordID>
    <Correlation ActivityID="{6212567F-596F-42CD-BEDC-2F77864FA2D9}" />
    <Execution ProcessID="1832" ThreadID="4180" />
    <Channel>Application</Channel>
    <Computer>FQDN of computer</Computer>
    <Security UserID="S-1-5-21-1037773150-1901201615-623648099-663347" />
  </System>
  <EventData>
    <Data Name="string0">The Security Token Service is not available.
The Security Token Service is not issuing tokens. The service could be malfunctioning or in a bad state.
Administrator should try to restart the Security Token Service on the boxes where it is not issuing tokens.

OR

“An error occurred while receiving the HTTP response to https://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc. This could be due to the service endpoint binding not using the HTTP protocol. This could also be due to an HTTP request context being aborted by the server (possibly due to the service shutting down). See server logs for more details.”

Before we begin this topic, please visit this blog post to understand the concept of RMS and IRM which will help you to configure RMS with MOSS better

Here are the major steps that we are going to perform. Its highly recommended that you perform these steps on a test environment.

1. Prepare the infrastructure for Active Directory directory services, RMS, and Office SharePoint Server 2007.
2. Install and configure RMS on the RMS server
3. Install and configure Office SharePoint Server 2007 with RMS environment.
4. Verify RMS and Office SharePoint Server 2007 integration.

Lets start..!

To demonstrate how RMS can be integrated with MOSS, we will consider 4 servers with names and roles on them as shown below.

AD

- Microsoft Windows Server 2003 with SP2

- Active Directory Services and DNS (DNS is necessary if your test environment is running on a separate network)

MOSS-SERVER

- Office SharePoint Server 2007 with SP2 and latest Cumulative updates

RMS-SERVER

- Microsoft Windows Server 2003 with SP2

- RMS Server

- Internet Information Services (IIS) 6.0

- Message Queuing (MSMQ)

- Microsoft SQL Server™ 2005 Standard Edition (This can be on a different machine as well)

RMS-CLIENT

- Microsoft Windows XP SP2

- Microsoft Office Enterprise 2007

Lets look at one server by one now:-

Configure the server “AD”:-

1. Login to Windows server 2003 machine and run dcpromo from start->run (domain name eg: rmstest.local)

2. Raise the Forest functional level and domain functional level to Windows server 2003

3. Create the following user accounts in Active Directory RMSSRV,RMSADM,User1 and User2 with respective email addresses (add the email address in the email column when viewing the properties of a user, no mailbox configuration required)

Configure the server “MOSS-SERVER”:-

1. Login to MOSS-SERVER using rmstest\administrator credentials and join the server to the domain

2. Download and install the RMS client from https://go.microsoft.com/fwlink/?LinkId=67736. If you are using a 64-bit version of Windows XP Professional or Windows Server 2003, download the 64-bit version of the RMS client from https://go.microsoft.com/fwlink/?LinkId=67935

3. Install .Net Framework , IIS and MOSS , complete the configuration wizard

4. Create a web application on port 80 and create a new site collection with collaboration template (https://moss-server)

Configure the server “RMS-SERVER”:-

1. Login to RMS-SERVER using rmstest\administrator credentials and join the server to the domain

2. Add the RMSADM user to the local administrators group in RMS-SERVER

3. Add Application server Role to this server (From add./remove programs –>add/remove windows components , application server->IIS and ASP.NET )

4. Add Message Queuing on this server ( From add/remove programs->add/remove windows components, Application server –>Message Queuing)

5. Install Microsoft SQL Server 2005 Standard edition and make sure you can log in to Management console successfully

6. We have now completed the installation of prerequisites, Lets download and install RMS server from https://go.microsoft.com/fwlink/?LinkId=73722

Configure the server “RMS-CLIENT”:-

1. Login to RMS-CLIENT using rmstest\administrator credentials and join the system to the domain

2. Download and install the RMS client from https://go.microsoft.com/fwlink/?LinkId=67736. If you are using a 64-bit version of Windows XP Professional or Windows Server 2003, download the 64-bit version of the RMS client from https://go.microsoft.com/fwlink/?LinkId=67935

3. Install Microsoft Office Enterprise 2007

Now lets configure RMS settings

RMS is provisioned and administered by using a local Web site automatically created during the RMS installation. (sample screenshots below, the values entered might be not relevant)

1. Provision RMS using Global Administration Web site

• Click Start, point to All Programs, point to Windows RMS, and then click Windows RMS Administration.
• You can see that Default web site is already present Click Provision RMS on this Web site.
• In the User name box under RMS Service Account, type RMSTEST\RMSSRV, and then type the respective password.
• In the RMS private key password box under Private key protection and enrollment, enter a strong password, and then confirm it
• Type rmsadm@rmstest.local in the Administrative contact box.
• Under RMS Proxy Settings, clear the This computer uses a proxy server to connect to the Internet check box.
• Keep the default values for everything else on this page, and then click Submit. This might take a few minutes to complete.

2. Register RMS SCP in Active Directory

• Log on to RMS-SERVER as RMSTEST\ADMINISTRATOR or another Active Directory user account who is a member of the Enterprise Admins group in the RMSTEST Active Directory domain.
• Click Start, point to All Programs, point to Windows RMS, and then click Windows RMS Administration.
• Click Administer RMS on this Web site.-> Administer RMS on this Web site
• Scroll to the bottom of the page and click RMS service connection Point.
• Click Register URL.

3. Login to Active directory and confirm the below

• Login to AD with RMSTEST\Administrator account and Click on start->administrative tools->active directory sites and services and now expand the service and make sure you have “RightsManagementServices” listed.  ( You may have to click on View->Show Services Nodes on the mmc in order to see this)

Now lets configure MOSS for RMS

1. Adding to Trusted zones

• Log in to MOSS-SERVER as RMSTEST\ADMINISTRATOR.
• Click Start, point to Control Panel, and then click Internet Options.
• Click the Security tab, click Local Intranet, and then click the Sites button.
• Type https://MOSS-SERVER and then click Add.
• Click Close, and then click OK.

2. RMS certification pipeline

• Log on to RMS-SERVER as RMSTEST\RMSADMIN.
• Click Start, and then click My Computer.
• Navigate to C:\Inetpub\wwwroot\_wmcs\Certification.
• Right-click ServerCertification.asmx, click Properties, and then click the Security tab.
• Click Add.
• Click Object Types, select the Computers check box, and then click OK.
• Type MOSS-SERVER,  click OK.
• Click Add.
• Click Object Types, select the Groups check box, and then click OK.
• Type RMS-SERVER\RMS Service Group, and then click OK.
• Click OK to close the ServerCertification.asmx Properties dialog box.

3. Enable Information Rights Management in Office SharePoint Server 2007

• Log on to MOSS-SERVER as RMSTEST\ADMINISTRATOR.
• Click Start, point to Administrative Tools, and then click SharePoint Central Administration.
• Click Operations, and then click Information Rights Management.
• Click “Use the default RMS server specified in Active Directory”
• Click OK.

4. Add USER1 and USER2 to the SharePoint site

• Access the site https://moss-server with rmstest\administrator
• Click Site Actions, point to Site Settings, and then click People and Groups.
• Click New, and then click Add Users.
• Type User1@rmstest.local;User2@rmstest.local in the Users/Groups box, and then click OK.
• Make sure User1 and User2 can access the site

5. Restrict permissions using RMS

• In the same Office SharePoint Server 2007 site, click Home.
• Click Document Center, click Documents, click Settings, and then click Document Library Settings.
• Under the Permissions and Management , click Information Rights Management.
• Select the Restrict permission to documents in this library on download check box.
• Type appropriate policy title in the box provided.
• Type appropriate description
• Click OK.

Now lets look at RMS-CLIENT

1. Create and upload a Microsoft Word document for testing

• Log on to RMS-CLIENT as USER1.
• Using Word create a test document and write any content to it.
• Access the URL https://moss-server and upload the file to the same document library that was configured for RMS
• You may have to check in to complete the upload
• By uploading the document into this library, the document receives the restrictions set on the library.
• Log off as USER1.

2. Open a protected document

• Now Log in to RMS-CLIENT as USER2.
• Login the site https://moss-server and it automatically recognizes as user2
• Navigate to the document library and try to download the file
• The following message will appear: "Permission to this document is currently restricted. Microsoft Office must connect to https://rms-server/_wmcs/licensing to verify your credentials and download your permission."

• Click OK.
• Now the following message will appear: "Verifying your credentials for opening content with restricted permissions".

• Once the file is  opened, you can see that he print button is disabled.
• Now , try to download the file to your local machine and move to any other machine and try to open with any other username other than User1 (user 1 is the author and no RMS permission set will be effective)
• Even when you download and move the copy of the file to another server / you cannot print the document.

But , when you need a document to be prevented from Editing or saving you can to set the policy from the file itself

From RMS-CLIENT

1. Create a new document

• Login to the RMS-CLIENT system as USER1
• Open up the Word and create a sample document and save the file on the desktop
• Click on the Office Ribbon –>Prepare –>”restrict Permission->Restricted access

• Enable “Restrict permission to this document” and Click on “More options”
• Click on Add and provide the email ID of the user2 (user2@rmstest.local) and click on OK
• You can see that the user2 is added in the list with permission level “Read”

  

• Access the site https://moss-server and upload the document to the site
• Log off from RMS-Client and login as User2 and access the site https://moss-server ; download the file just uploaded by user1
• Open the file and click on “View permission”

Note: - Integrating Office SharePoint Server 2007 with RMS does not protect the documents while they are on the server. When a document is uploaded to an Office SharePoint Server 2007 site, the server will remove all protection until a download request is received by the Office SharePoint Server 2007 server. At this time, the Office SharePoint Server 2007 server will apply the appropriate restrictions to the document before it is downloaded to the client computer

Rights Management Services

RMS stands for “Rights Management Services” and as the name indicates it is a Microsoft Windows information protection technology that uses encryption and a form of selective functionality denial from limiting access to documents such as corporate emails, office documents etc. RMS technology works with RMS client enabled application in order to safe guard digital information from unauthorized use.

Companies can use this technology to encrypt information stored in such document formats, and restrict unauthorized users from accessing them or modifying them. It is also possible to set the restrictions for a period of time. Specific operations like printing, copying, editing, forwarding, and deleting can be allowed or disallowed by content authors.

You might think that normal NTFS permission along with password protection techniques that’s used in office documents can achieve this task. Yes, we can achieve this goal, but from an organization point of view, using RMS we have more control for administrating the rights for users on the documents.

Major Components of the rights management environment

We have already discussed that RMS is a client-server technology model. So we get introduced to a few of the common components that are involved in Right Management environment.

This includes the RMS servers, RMS client computers and RMS-enabled applications. These components also rely on a SQL database and the Active Directory services to make the rights management process work. Together, these components enable users to create, publish, distribute and consume IRM-protected content.

1. RMS servers

RMS servers must run Windows Server 2003 (any editions except web edition) or above with Internet Information Services (IIS), Message Queuing, and ASP.NET enabled. A minimum of 512 MB RAM is recommended with 40 GB of hard disk space. RMS server can work with single Network adaptor. As far as the Fie system, Microsoft recommends NTFS.RMS must be installed in an Active Directory domain with domain controllers running Windows 2000 server SP3 or above.

You can download the RMS from the following Link: https://go.microsoft.com/fwlink/?LinkId=73722

2. RMS client software

The RMS client software is built into the Windows Vista based operating system. It’s available for a free download for any other previous operating system including Windows 2000, Windows XP and Windows Server 2003.

Download the RMS client from https://go.microsoft.com/fwlink/?LinkId=67736.

If you are using a 64-bit version of Windows XP Professional or Windows Server 2003, download the 64-bit version of the RMS client https://go.microsoft.com/fwlink/?LinkId=67935.

3. RMS-enabled applications

IRM-protected content can only be created and viewed with RMS-enabled applications. RMS-enabled applications work with the RMS client software. Some RMS-enabled applications include:

1. Microsoft Office 2003 and 2007

2. Microsoft Internet Explorer (version 5.01, 5.5 and 6.0) with the rights management add-on

3. Internet Explorer 7 XPS Viewer

4. Mobile Office applications in Windows Mobile 6

5. Applications created or extended using the Microsoft Windows Rights Management Services Software Developer’s Kit (SDK)

4. SQL server

RMS requires a database running on Microsoft SQL Server 2000 with SP3a or above, or the Microsoft SQL Desktop Engine (MSDE). MSDE should be used only for testing, as you are unable to view logging information or change the data in the configuration database under the MSDE licensing terms. If you use MSDE, you have to install it on the RMS server itself.

The SQL server contains the following databases:

1. RMS configuration database
2. Logging database
3. Directory services database

The databases can be run on the same or separate SQL servers. The RMS account certificates that identify users as trusted entities are stored in the configuration database on the RMS root server or cluster.

5. Active Directory

The RMS server uses the Microsoft Active Directory services to authenticate the identities of RMS/IRM users and resolve group memberships when the publishing license grants rights to a group. When a user sends a request for a publishing or use license, the request starts with a query to Active Directory for the URL of the server Web service. This service then provides the URL for the license request itself.

Information Rights Management

Information Rights Management (IRM) is an information protection technology built into Microsoft® Office 2007 that works with Rights Management Services (RMS) in Microsoft Windows Server 2003.

IRM helps organizations and its users to control how the information can be used. With the help of IRM, the creator or sender of a document or a message have complete control to specify who can open/edit/ print, forward or copy it or perform any other actions with the information it contains.

An RMS server running Microsoft Windows Server 2003 serves as a central repository for information used to identify what rights have been granted to particular users and to verify the credentials of those users. Information Rights Management is the component in the RMS-enabled application that enforces those rights; IRM is to RMS what Microsoft Office Outlook is to Exchange.

Actions that can be controlled with IRM:-

When IRM is configured properly, users can assign access permissions to certain types of files created with Office 2007 applications for certain users. Here are a few actions that can be controlled using IRM

1. Editing the content

2. Forwarding a file

3. Copy/cut/paste the content as text

4. Printing the file

5. Faxing

6. Using the default Print Screen (PRT SC) key to capture the image of the content

As discussed, IRM protection can be applied to any office documents such as Word files, Excel workbooks, PowerPoint presentations and templates and InfoPath forms as well as Outlook 2007 email messages.

Limitations of IRM

Here are some of the limitations of IRM

1. Content corruption due to hardware failure or any kind of viruses

2. Taking a photograph of the content displayed on the screen

3. Manually writing down the contents

4. Using a third party screen capture utility to capture screenshot

5. Using a keystroke logger to capture the content of the document when it is being created.

IRM-protected documents and messages can be created using Office 2007 Professional Plus and Enterprise editions only and not using Office 2007 Standard edition. Standard edition can be used to open and view IRM-protected documents

Want to configure RMS with MOSS Click here

Image , we need to gradually check all the documents in the document library and delete all the documents which are more than one month old. As the documents keep coming , its very hard for an administrator to look at all the document libraries available and check for each documents created date and manually delete them if the conditions are met.

To over come this manual task, SharePoint can be configured in such a way that it can manage the documents by creating information management policy.

There are 2 steps we need to follow to configure this policy.

1. To define the policy execution time (this is a global setting)

2. To create a policy and associate with the document library (this is individual setting)

STEP 1

1. Open up the central administration site and navigate to operations->Information management policy configuration (under security configuration)

2. Click on Expiration

3. Click on “Automatically find the process expired items” and schedule it as “Daily”

If you wish to run this only on week days , select the day and the time frame to execute this job.

The option “Process expired items now” is provided for the administrator to perform the activity manually in between the specific time frame if required.

4. Click on Save and you will be redirected back to Information management policy configuration settings page again.

STEP 2

1. Open the end user site as the site collection administrator or farm administrator

2. Click on “View all site contents” and click on “Create” then select “Document library”

3. Provide the document library name and create

4. Once document library is created, Click on settings->document library settings->Information management policy settings

5. Click on “Define a policy” and click OK

6. Provide the name of the document policy , policy state and administrative description

7. Click on “Enable Expiration” under “Expiration”

8. Click on “A timer period based on the items properties”

9. Set the value as  “Created” +30+”days” (as previously discussed, its an example)

Select “Set programmatically” if you wish to set the value using coding.

10. Select the option “delete” for “Perform this action” under “When the item expires”

11. Click on Ok

You can verify that a timer job is created as “Information management policy” to run daily. If you wish to clear of the documents on the newly created document library now, rather than waiting for the job to run , once again access the central admin and then click on “process expired items now” (as per step 1 –>3) .

But this will force the policies which are set on other document libraries as well.

In the event you feel that the timer job is running and does not stop, wait for some time , this will take some time to run because it depends on the size of the site, size of number of doc libraries and documents.

By any chance , if the the timer job status shows freezed , you can go ahead and run the command stsadm –o execadmsvcjobs on the SharePoint

Being end users , everyone might feel that this is very easy to use. But there are multiple complex interactions happening with different technologies to make documents which are not present in file systems to viewable using explorer.

The main protocols that are capable of directly manipulating file data stored in SharePoint are

- WebDAV (Web Distributed Authoring and Versioning)

WebDAV is a simple extension to the HTTP protocol based on a public specification. It provides an extended vocabulary that defines how basic file functions, such as copy, move, delete, and create folder, are performed across HTTP.

- FPRPC (FrontPage Server Extensions Remote Procedure Call)

FPRPC provides WebDAV capabilities using extensions to the HTTP vocabulary, but it also has the ability to embed more complex Remote Procedure Call (RPC) communications in the data portion of the packet.

Now, lets check how a document library looks when connected with WebDAV and FPRPC

Using WebDAV:-

This is how the document library looks like when opened using WebDAV protocol and in the next picture , we can see the address as \\servername when opening the document library with windows explorer (doc library->actions->open with windows explorer)

Using FPRPC:-

This is how the document library looks like when opened using FPRPC and in the next picture , we can see the address as https://servername when opening the document library with windows explorer (doc library->actions->open with windows explorer)

To force explorer view to use WebDAV follow the below settings

1. Make sure you  have enabled and started the “web client” service on the client machine  (services.msc->web client)

2. Host sites only on port 80 ; If multiple sites need to be on port 80 , make use of host header with appropriate DNS settings

3. Host sites without SSL

To force explorer view to use FPRPC follow the any of the below settings

1. Stop and disable the “web client” service on the client machine  (services.msc->web client)

2. Host sites on any TCP port other than 80

3. Host sites with SSL

Important points to be remembered when troubleshooting explorer view issues

1. The Ports 137,138,139 and 445 should be opened between the client and the SharePoint server. We can verify it using telnet<space><the SharePoint server name/IP><space> 137 and it should connect properly. the same can be done for ports 138,139 and 445

2. If we trying to access an intranet site using FQDN, its good that we add the site to the Trusted Sites zone on client computers as a dot (.) in the URL will make IE consider that its Internet and accepts the security configuration for internet zone.

3. Follow the KB article https://support.microsoft.com/kb/888123 if the error is similar

4. Apply if this is applicable https://support.microsoft.com/kb/892211

5. If you restart the web client service on the client operating system , its always better to restart the O/S as there are some known issues reported. (operating system prior to longhorn)

6. Apply this if suitable https://support.microsoft.com/kb/841215/

7. Avoid using Basic authentication . Basic authentication will work fine with WebDAV but has reported issues with FPRPC. If used , force web browser to use WebDAV

8.The account BUILTIN\NetworkService  must have read and write access to “Temporary Internet Files folder” to successfully complete a drag-and-drop operation.

9. Proxies configured in LAN also can cause issues in getting access to the explorer view https://support.microsoft.com/kb/832161/

10. Errors with lengthy URLS , follow this https://support.microsoft.com/kb/329919/

In order to describe the steps to achieve the above task, we take the SharePoint farm as follows

Win2k3-DC :

Domain controller

Exchange server 2003

DNS server

SQL server 2005

Win2k3-MOSS :

MOSS 2007 SP2

SMTP

Step 1 

MOSS creates and uses AD contacts to configure Email enabled document libraries. So we need to first determine where in AD these contacts can be created . I prefer if these contacts can be created in a separate or dedicated OU so that the troubleshooting becomes easier. Here is an example from my test environment.

Step 2

Now, we need to configure an MX record for the MOSS server in DNS. Follow the below step

• Open DNS manager in DC (start->run and type dnsmgmgt.msc and hit enter)
• Traverse to the Domain name under “Forward lookup zone” and right click –>select “New Mail exchanger(MX)”
• Provide the host name of the MOSS server and the FQDN of the SMTP server ( in our case MOSS server itself)

This will look like:-

Step 3

Install and configure SMTP service

• Login to MOSS server and click on start –>run then type appwiz.cpl
• Click on Add/Remove windows components –>application server->details->IIS->details-> enable SMTP service and click OK
• Provide Windows installation CD to copy the necessary files
• Once the installation completes , Start, Administrative Tools, Internet Information Services
• Right click on Properties of Default SMTP Virtual Server
• Click the Access Tab, Relay. Add the IP address of the servers that can relay through this server. In my case this was the Exchange server in my domain
• Click Ok, Ok, and Apply

Step 4 

• Open MOSS2007 Central Administration and click on the Operations Tab

• Click Yes to enable incoming mail and the settings mode on Automatic

• Under the Directory Management Servicesection select Yes
• In the Active Directory Field type the name of your Organizational unit that we created earlier. example: OU=Sharepointcontacts,dc=spsdomain,dc=local.
• In the SMTP mail server field type the name of your moss server tat has the SMTP server installed. Example win2k3-moss.SPSDomain.local
• Leave the value to default for all other columns Directory management section on this page

Step 5

Now, we will create a new document library on a existing site , to do that

• Open the site with administrator privilege
• Click on “View all site content”
• Click on create and then document library
• Enter the name of the document library (example :- email_doc)
• Click on Yes for “Allow this document library to receive email”
• Provide the email id for the document library ( its always good to keep the similar name as the library name)
• Click ok Create

Step 6

• Open the document library we have just created
• Click Settings – document library settings
• Under Communication Settings click E-Mail Settings
• In the E-Mail Message Section Select Yes for save original e-mail
• In the E-Mail Security section Select Yes to Accept e-mail messages from any sender (optional)
• Click OK

Step 7

• Login back to DC and open dsa.msc
• Navigate to the OU “Sharepointcontacts” and make sure we have new contact in the name “email_doc” present there
• You can open the contact and verify the email id
• Make sure the username with which the Windows SharePoint services timer service is configured has proper permission on the drop folder located at “c:\inetpub\mailroot\drop”

Now, open up your outlook and start sending emails to email_doc@win2k3-moss.spsdomain.local with or without attachments. Wait for the timer service to run and the mails with / without attachments will appear in the document library list

Issue:- When trying to bring an additional Active Directory field into SharePoint using the /ssp/admin/_layouts/EditProperty.aspx page under the "Property Import Mapping", "Data source field to map" and "Enter field to map" drop downs are missing as shown above

Solution:-

1. Login to Central administration site

2. Click on SSP and Click on “User profile and properties”

3. Click on “view import connections”

4. Click on the connection name and edit the Connection the one we need to change

5. Click on “Specify a domain controller” under “connection settings”

6. The list of domain controllers will appear now, Drop down to see the Domain controllers available in the domain and can be reachable by SharePoint.

7. Select a Domain controller which is Global Catalog

8. Make sure from the SharePoint server , you can telnet to this Domain controller selected, using the TCP port 389

9.Click on OK and check the edit property page to see if "Data source field to map" and "Enter field to map" drop downs are displayed

Reason:-

When the option “Auto discover domain controller option is selected under “Connection settings”, the SharePoint server will try to reach any of the domain controllers available in the domain randomly . this will actually connects with different domain controller at times. In most of the cases, domain controllers will be located in different geographical location and the traffic will be controlled using firewall or similar options. So , when the SharePoint tries to reach the domain control , at times it may fail to reach due to the network issues/restrictions. Using the above options, we manually point the SharePoint server to a specific Domain controller where the SharePoint can reach the DC.

As we need to create a new Config DB , we have tried detaching the server from farm. It was giving this error message

The reason behind this was the timer job was in stuck state and unable to progress that in intern made any changes to config DB not successful.

The steps that can be taken forward to correct the issue is :-

1. Stop the Windows SharePoint Services Timer service.
2. On the SharePoint Server where Central Administration Site is hosted browse to C:\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config\<guid>
3. Move all the xml files to another location.
4. Also backup the cache.ini file. Then Edit the cache.ini and replace the current value with "1".
5. Restart the Windows SharePoint Services Timer service. New xml files will start appearing in the guid folder.
6. Verify the cache.ini now contains its previous value (or verify that the value is no longer "1"; any non-1 value is fine).
7. Run the command from the sharepoint server "stsadm -o setproperty -pn command-line-upgrade-running -pv no" (without quotes)
8. Run the command from the sharepoint server "stsadm -o execadmsvcjobs" (without quotes)
9. Run the command from the sharepoint server "psconfig -cmd upgrade -inplace b2b -wait -force" (without Quotes)
10.Run configuration wizard and disjoin from farm

“Stsadm –o backup –directory \\path –backupmethod full” command produces the same error when selecting full farm

Looking at the backup.log file the error showed something like this

WebException: The remote server returned an error: (503) Server Unavailable.

Debug: at Microsoft.Office.Server.Search.Administration.SearchApi.RunOnServer[T](CodeToRun`1 remoteCode, CodeToRun`1 localCode, Boolean useCurrentSecurityContext, Int32 versionIn)at Microsoft.Office.Server.Search.Administration.SearchApi..ctor(WellKnownSearchCatalogs catalog, SearchSharedApplication application) at Microsoft.Office.Server.Search.Administration.SearchSharedApplication.get_SearchApi()at Microsoft.Office.Server.Search.Administration.SearchSharedApplication.Microsoft.SharePoint.Administration.Backup.IBackupRestore.OnPrepareBackup(Object sender, SPBackupInformation args)at Microsoft.SharePoint.Administration.Backup.SPBackup.RunPrepareBackup(SPBackupRestoreObject node)

Finally I ended up in collecting the Network  Monitor trace on the server when performing the back up using stsadm command

From Netmon trace we could see that the server hosting central administration site checks for proxy before performing any HTTP activity . More over we could see that the user agent is not IE but System.Net.AutoWebProxyScriptEngine/2.0.50727.832

This points to use of either OWStimer or stsadm command. It was clear from the Network monitor trace that server needs access to Office Server web services in order to complete the backup . So the error 503 server unavailable was from the proxy server

Resolution:-

1. Login to the server where the central administration site is hosted with the account with which Central administration site’s application pool is running.

2. Remove the proxy settings from the IE session for the user. Log in to the server with all administration users and make sure for all the users the proxy is not configured

3. Modify the central administration’s web.config file to set “proxy autodetect” to “false” ( do this on all servers if you have multiple serves in farm)

<system.net>

    <defaultProxy>

      <proxy autoDetect="false" />

    </defaultProxy>

  </system.net>

4. Reset IIS on SharePoint servers