After started the User Profile Synchronization Service, when you try to manage the User Profile Service, you encounter an error, and the following error is logged in the SharePoint Unified Logging Service (ULS).

Error Message 

<date time>       w3wp.exe (0x1F88)                       0x1AA4 SharePoint Portal Server              User Profiles             
     et8j        High                    UserProfileServiceUserStatisticsWebPart:LoadControl failed, Exception: System.IO.FileLoadException: The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT:0x80131040)    
at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.InitializeIlmClient(String ILMMachineName, Int32 FIMWebClientTimeOut)    
at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager..ctor(UserProfileApplicationProxyuserProfileApplicationProxy, Guid partitionID)    
at Microsoft.SharePoint.Portal.WebControls.UserProfileServiceStatisticsWebPartBase.LoadControl(Object sender, EventArgs e)

Causes 

The issue is caused by that, the UserProfileConfigManager adds a reference to Microsoft.ResourceManagement, but the located Microsoft.ResourceManagement assembly's manifest definition does not match the assembly reference.

Solutions

To fix the issue, please restart the Internet Information Server(IIS) by running command iisreset.

Symptoms

When you try to start the User Profile Synchronization Service from Central Administration, the User Profile Synchronization Service is Starting, and then Stop after 5 to 10 minutes. Meanwhile, the following error message is logged in the SharePoint Unified Logging Service (ULS) log.

Error Message 

<date time>       OWSTIMER.EXE (0x1E38)                              0x0F80  SharePoint Portal Server              User Profiles                      g145                Unexpected       Maximum number of retries done for starting FIM SpService. Please look at ULS logs and event viewer to look for the root cause of the failure.

<date time>       OWSTIMER.EXE (0x1E38)                              0x1ADC                SharePoint Portal Server              User Profiles                                 9q18      High  
UserProfileApplication.SynchronizeMIIS: Failed to configure MOSS initial MAs, will attempt during next rerun.
Exception: System.Management.ManagementException: Generic failure     
at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatuserrorCode)    
at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()    
at Microsoft.Office.Server.UserProfiles.Synchronization.ManagementAgent.ManagementAgentCollection.ManagementAgentEnumerator.MoveNext()    
at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.IsMossMaConfigured(UserProfileApplication
application)    
at Microsoft.Office.Server.Administration.UserProfileApplication.SetupSynchronizationService(ProfileSynchronizationServiceInstance
profileSyncInstance).

Causes 

The issue is caused by insufficient privilege to get Management Agents from WMI.

SharePoint tries to list the Management Agents that were created in the MIIS server. It uses WMI, and query class MIIS_ManagementAgent from namespace root\MicrosoftIdentityIntegrationServer to get the management agents. Without sufficient privilege to query the class, there will have a 0x80041001 Generic failure be from WMI:

1. Click Start > Run
2. Type wbemtest
3. Click Connect , and then type root\MicrosoftIdentityIntegrationServer and follow by clicking Connect
4. Click Query
5. Type the WQL: SELECT * FROM MIIS_ManagementAgent
6. Click Apply to execute the query

If you use Process Monitor to monitor process “wmiprvse” at the same time, you will see lots of “Access Denied” on C:\Program Files\Microsoft Office Servers\14.0. The processing account is Network Service

Solutions 

1. On the SharePoint server(s), open “Local Users and Groups”
2. Select Groups
3. Double-click “WSS_WPG” group
4. Add the Network Service account to this group

<date time>  w3wp.exe (0x2EF0)                        0x4084 SharePoint Foundation          Runtime                        tkau Unexpected Microsoft.SharePoint.SPException: Group cannot be found.    at Microsoft.SharePoint.ApplicationPages.PeoplePage.get_CurrentGroup()     at Microsoft.SharePoint.ApplicationPages.PeoplePage.OnLoad(EventArgs e)     at System.Web.UI.Control.LoadRecursive()     at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 2a23135d-6a07-4230-b2bf-d3a03f0acafc
<date time>  w3wp.exe (0x2EF0)                        0x4084 SharePoint Foundation          Monitoring                     b4ly Medium   Leaving Monitored Scope (Request (GET:https://<site>:80/_layouts/people.aspx?MembershipGroupId=<group id>)). Execution Time=37.5787984227046 2a23135d-6a07-4230-b2bf-d3a03f0acafc
 

Causes 

The issue happens when the current group(MembershipGroupId from query string) is not in the web associated groups. SharePoint uses the following way to check if a group is existing in the web associated groups.

1. Get a dictionary named “ReferencedGroups”
1. Get a semicolon spited string(strAssociatedGroups) that indicate the groups that are associated with current web:
       string strAssociatedGroups = Web.AllProperties[“vti_associategroups”] as string
2. Get all unique Ids(groupIds) from the AssociatedGroupsString, and store them in a collection.
3. Get the associated groups based on the collection we got from step 2:
       Web.SiteGroups.GetCollection(groupIds.ToArray())
4. Use a Dictionary to store the groups with groupId(SPGroup.Id) as key and group(SPGroup) as value.
2. Check if the current group is existing in the ReferencedGroups dictionary.
   1. ReferencedGroups.TryGetValue(GroupId, out m_currentGroup). The parameter GroupId is got from the query string “MembershipGroupId”.
   2. If m_currentGroup is null, the “Group cannot be found” will be shown

 Solutions 

Add the group to associated groups using the following code:

SPSite site = new SPSite("site’s URL");
 SPWeb web = site.OpenWeb();
 SPUser user = web.CurrentUser;
 web.SiteGroups.Add("group name", user, user, "description");
 SPGroup g = web.SiteGroups["group name"];
 web.AssociatedGroups.Add(g);
 web.Update();

Or, add the group’s id to the associategroups property directly using PowerShell:

$site = Get-SPSite <site’s URL>
 $web = $site.OpenWeb()
 $associategroups = $web.Properties["vti_associategroups"]
 $web.Properties["vti_associategroups"] = $associategroups + “;” + <the group’s id>
 $web.Properties.Update()

The timer job completed, but failed on one or more machines in the farm

SharePoint ULS:
<date time> OWSTIMER.EXE (0x06C0) 0x07E4 SharePoint Foundation Timer 6398 Critical The Execute method of job definition Microsoft.SharePoint.Administration.SPServiceApplicationInstanceProvisioningJobDefinition (ID 94bba7da-a1d1-4416-8b29-90097d834a3b) threw an exception. More information is included below.  Requested registry access is not allowed. d76d33cf-1737-48b9-b880-6d4561081fa2

Exception stack trace:  
 at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)   
 at Microsoft.Office.Server.Utilities.SetupUtility.get_InstallLocation()   
 at Microsoft.Office.Server.Administration.UserProfileApplication.get_InstallPath()   
 at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.ProvisionApplicationInstance()   
 at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.ProvisionLocal(SPServiceInstance serviceInstance) 

System Log:
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          <date time>
Event ID:      6398
Task Category: Timer
Level:         Critical
Keywords:     
User:          <user alias>
Computer:      <computer name>
Description:
The Execute method of job definition Microsoft.SharePoint.Administration.SPServiceApplicationInstanceProvisioningJobDefinition (ID 94bba7da-a1d1-4416-8b29-90097d834a3b) threw an exception. More information is included below.

Requested registry access is not allowed.
Event Xml:
<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
    <EventID>6398</EventID>
    <Version>14</Version>
    <Level>1</Level>
    <Task>12</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2011-03-08T03:16:46.198079000Z" />
    <EventRecordID>26617</EventRecordID>
    <Correlation ActivityID="{D76D33CF-1737-48B9-B880-6D4561081FA2}" />
    <Execution ProcessID="1728" ThreadID="2020" />
    <Channel>Application</Channel>
    <Computer>SPS2010-01.contoso.com</Computer>
    <Security UserID="S-1-5-21-3468372412-3115835394-1960983456-1105" />
  </System>
  <EventData>
    <Data Name="string0">Microsoft.SharePoint.Administration.SPServiceApplicationInstanceProvisioningJobDefinition</Data>
    <Data Name="string1">94bba7da-a1d1-4416-8b29-90097d834a3b</Data>
    <Data Name="string2">Requested registry access is not allowed.</Data>
  </EventData>
</Event>

Causes

The issue is caused by the insufficient permission on registry key: 

at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)   

Solutions 

To solve the issue, please follow these steps:

1. Use the Process Monitor to monitor the registry, once you get the following ACCESS DENIED message(You can filter the result with “Result contains Access Denied”):  
   
   

   Date & Time:      <date time>

   Event Class:        Registry

   Operation: RegOpenKey

   Result:  ACCESS DENIED

   Path:     HKLM\SOFTWARE\Microsoft\Office Server\14.0

   TID:        2020

   Duration:             0.0000297

   Desired Access:                Read

2. Open Registry Editor (Start > Run, type regedit)
3. Open key: HKLM\SOFTWARE\Microsoft\Office Server\14.0(got from Process Monitor from step 1)
4. Assign the SharePoint Timer Service account the Read permission to this key

 File Not Found. at Microsoft.SharePoint.Library.SPRequestInternalClass.CreateListFromFormPost(String bstrUrl, String& pbstrGuid, String& pbstrNextUrl)
 
 at Microsoft.SharePoint.Library.SPRequest.CreateListFromFormPost(String bstrUrl, String& pbstrGuid, String& pbstrNextUrl)
 
 at Microsoft.SharePoint.SPListCollection.CreateListFromRpc(NameValueCollection queryString, Uri& nextUrl)
 
 at Microsoft.SharePoint.ApplicationPages.NewListPage.BtnOk_Click(Object sender, EventArgs args)
 
 at System.Web.UI.WebControls.Button.OnClick(EventArgs e)
 
 at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
 
 at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)
 
 at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
 
 <date time> w3wp.exe (0x06EC) 0x0D6C Windows SharePoint Services General 72lu High Cannot find doc <document>? 
 <date time> w3wp.exe (0x06EC) 0x0D6C Windows SharePoint Services General 8z1w High Failed to upload document library template type "101" for list "<listName>" in web "https://server". 
 <date time> w3wp.exe (0x06EC) 0x0D6C Windows SharePoint Services Fields 88yg High Failed to instantiate list 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Template\Features\DocumentLibrary\doclib' 
 
  

Causes

The issue happens while trying to upload a ghosted document template file to the being created list/document library.

When create a list/library, SharePoint need to:

1. Instantitate the list in store
2. Upload the ghosted document template file to the list/document library 

When upload the file, the SharePoint need to check if the ghosted DocumentTemplateFile is a validate file. If it is not a validate file, the following error will be thrown:

     72lu   High        Cannot find doc <documentName> 

The DocumentTemplateFile is defined in the site definition in onet.xml file.

Solutions 

You can follow these steps to solve the issue:

1. Connect to SQL Server database that is stored the SharePoint content databases using SQL Server Management Studio(SSMS)
2. Query the table "dbo.Webs" from the current content database (the database for the site collection)
3. Check the WebTemplate id from the result
4. Find the associated site template with the id follow this article: https://praveenbattula.blogspot.com/2010/08/know-site-template-used-for-sharepoint.html
5. Go to C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\SiteTemplates\<the templatename got from the previous step>\XML
6. Open the Onet.xml
7. Get the DocumentTemplateFile element that has Type=<Id of the type of the list/document library that is mentioned in the error log>"
   Failed to upload document library template type "<Id of the type of the list/document library>" for list "<listName>" in web https://server
8. Ensure its “Name” attribute points to a validate file (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\1033\STS\<the value for Name here>)

 Log Name: System 
 Source: Microsoft-Windows-DistributedCOM 
 Date: 4/8/2011 10:49:29 AM 
 Event ID: 10016 
 Task Category: None 
 Level: Error 
 Keywords: Classic 
 User: NETWORK SERVICE 
 Computer: <server name> 
 Description: 
 The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {000C101C-0000-0000-C000-000000000046} and APPID {000C101C-0000-0000-C000-000000000046} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Or

 Log Name: System 
 Source: Microsoft-Windows-DistributedCOM 
 Date: 4/8/2011 10:49:29 AM 
 Event ID: 10016 
 Task Category: None 
 Level: Error 
 Keywords: Classic 
 User: NETWORK SERVICE 
 Computer: <server name> 
 Description: 
 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {A0A8C0AC-FC70-4EE2-93A8-4A2257AE8619} and APPID {38AFE312-B8E5-4354-A11F-9224307B28AC} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 

Causes

The issue is caused by the user NT AUTHORITY\NETWORK SERVICE SID does not have permissions to activate the DistributedCOM locally.

Solutions

In order to solve the issue, please grant Local Activation permission for the COM Server applications to the user NT AUTHORITY\NETWORK SERVICE. By default, the group Distributed COM Users has the permissions. So, please add NT AUTHORITY\NETWORK SERVICE to Distributed COM Users directly to fix the issue:

1. Open Computer Management(Administrative Tools > Computer Management)
2. Double-click Local Users and Groups
3. Click Groups
4. Double-click Distributed COM Users
5. Click Add
6. Set the location to be local machine by clicking Locations
7. Type Network Service in the Enter the object name to select textbox
8. Click OK to apply

[OWSTIMER][ProfileDatabaseSequence] [ERROR] [4/5/2011 10:45:25 AM]: Action 14.0.17.0 of Microsoft.Office.Server.Upgrade.ProfileDatabaseSequence failed.
[OWSTIMER] [ProfileDatabaseSequence] [ERROR] [4/5/2011 10:45:25 AM]: Exception:The trust relationship between the primary domain and the trusted domain failed.
[OWSTIMER] [ProfileDatabaseSequence] [ERROR] [4/5/2011 10:45:25 AM]: at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids, Boolean& someFailed)
at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)
at System.Security.Principal.SecurityIdentifier.Translate(Type targetType)
at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()
at Microsoft.Office.Server.Upgrade.UserProfileAclUpgrader.DoUpgrade()
at Microsoft.Office.Server.Upgrade.ProfileDatabaseAction.Upgrade()
at Microsoft.SharePoint.Upgrade.SPActionSequence.Upgrade()
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:Begin Rollback()
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:End Rollback()
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:Begin Dispose()
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:End Dispose()
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:SQL Query Count=8
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:SPRequest Objects=4
[OWSTIMER] [UserProfileAclUpgrader (14.0.17.0)] [DEBUG] [4/5/2011 10:45:25 AM]:Execution Time=598.815491913078
[OWSTIMER] [SPUpgradeSession] [ERROR] [4/5/2011 10:45:25 AM]: Upgrade [ProfileDatabase Name=SharedService00_UserProfile_43a8a0e5322149d...] failed.
[OWSTIMER] [SPUpgradeSession] [ERROR] [4/5/2011 10:45:25 AM]: Inner Exception:The trust relationship between the primary domain and the trusted domain failed.

Causes 

While upgrading from SharePoint Server 2007 to SharePoint Server 2010, the upgrade process will check the user permissions for personalization. In the verification, the upgrade process gets each account’s SID from the database, and then tries to translate it to NTAccount.

The general steps are:

1. The upgrade process get all Shared Service Provide(SSP) user permissions' settings for personalization from the SSP database using stored procedure dbo.proc_MIP_GetObject(You could use parameter 1F4CF7D3-51DC-49CB-8A5B-E05C5EAF318A to execute the stored procedure)
   

   The returned ACEs should be like: 
 
< ?xml version="1.0" encoding="utf-16"?>
< Acl>
< Ace IdentityName="NIHAO\administrator" DisplayName="NIHAO\administrator" SID="AQUAAAAAAAUVAAAAPrara24ehw3RvYe99AEAAA==" Rights="63" />
< Ace IdentityName="NT AUTHORITY\Authenticated Users" DisplayName="NTAUTHORITY\Authenticated Users" SID="AQEAAAAAAAULAAAA" Rights="3" />
< Ace IdentityName="NTAUTHORITY\NETWORK SERVICE" DisplayName="NT AUTHORITY\NETWORK SERVICE" SID="AQEAAAAAAAUUAAAA" Rights="63" />
< /Acl>


2. The upgrade process uses the SID from the returned ACEs to translate the account to NTAccount using method TranslateToNTAccounts.

If the SID is invalid, the translation will fail, and you may encounter the error as shown in the error message. 

Solutions 

To fix the issue, please follow these steps:

1. Open the SSP
2. Click the "Personalization services permissions"
3. Remove the user or group that is invalid

In order to confirm which account caused the issue, you can use the following code:

SecurityIdentifier identity = new SecurityIdentifier(Convert.FromBase64String("<SID got from the database>"), 0);
 
 string str = ((NTAccount)identity.Translate(typeof(NTAccount))).ToString();
 

New-SPTrustedIdentityTokenIssuer: Exception of type 'System.ArgumentException' was thrown.

Parameter name: newObj

At line:1 char:33

+ New-SPTrustedIdentityTokenIssuer
<<<<  -Name "<name>"
-Description "<description>" -Realm <realm>
-ImportTrustCertificate <certificate> -ClaimsMapping <mappings>
-SignInUrl <url> -IdentifierClaim <IdentityClaim>
   
+ CategoryInfo : InvalidData: (Microsoft.Share...dentityProvider:SPCmdletNewSPIdentityProvider) [New-SPTrustedIdentityTokenIssuer],argumentException   
+ FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletNewSPIdentityProvider

Causes 

The New-SPTrustedIdentityTokenIssuer will create a SPTrustedLoginProvider named newObj.

The error can occur in the following scenarios:

• The newObj SPTrustedLoginProvider is null
• The name(parameter Name) of the SPTrustedLoginProvider has been used
• The length of the name(parameter Name) of the SPTrustedLoginProvider is larger than 50
• The certificate(parameter ImportTrustCertificate) for the SPTrustedLoginProvider has been used

Solutions

In order to fix the issue, please ensure:

1. The name of the SPTrustedLoginProvider is not been using
2. The length of the name is less than 50
3. The certificate is not been using