http://blogs.technet.com/b/sykhad-msft/archive/2013/04/20/sharepoint-2010-user-profile-synchronization-service-decoded-part-1.aspx

Contd...

Contents of Part-2: 

• Sync DB reset and when does it help? 
• Enabling NetBios name on UPA and under what scenarios?
• What happens during Profile Synchronization?
• When to make use of User Profile Replication Engine (UPRE)
• Should I restart UPSS every time I apply cumulative updates/Service Packs for SharePoint Server 2010?

1. Sync DB reset and when does it help? 

What does Sync DB reset do? It will flush the Sync DB completely and clear all the contents in it.

• Resetting Sync DB should be done as a last resort, consider resetting the Sync DB when:

a. Sync information being inconsistent, something like Profile Picture which is coming from AD disappears or reverts to old image

b. Few Properties which are Imported from AD into SharePoint show up for a few Users, but not for everyone. The same can be true for Export as well

c. When you have modified things manually on the FIM Client

d. When information comes into Sync DB but not the Profile DB

• Things to be reconfigured after a reset of Sync DB, what will be lost & what will remain intact?

a. All sync information will be lost

b. The AD Sync Connection will be deleted

c. After the reset of Sync DB, Restart UPSS, re-create AD Sync connection, Map all the User Properties (both Out of the Box and Custom) & perform Full Profile Import

d. All the User related information like Profile Pictures, About Me, Social Tagging data, etc. the data which resides in Profile DB and the Social DB, these information will be intact even after we perform a reset of Sync DB

• Most important, Disable the MySite Cleanup Job before the reset the Sync DB, once reset is done perform two Full Profile Imports + one Incremental Profile Import
• How to Reset the Sync DB:

  http://technet.microsoft.com/en-us/library/ff681014.aspx#resetSync 

2. Enabling NetBios name on UPA and under what scenarios?

• How to determine if there is a need to enable the NetBios name on the UPA?

• Go to the SharePoint Server, right on 'My Computer' & click on Properties, look for the domain name, for example, the name is sykhad2 as shown below:

• Now on the same SharePoint Server, open command prompt and run the command "whoami" without the double quotes, for example in my case I get the output as: "sykhad20\administrator" as seen below:

• Ideally even here it should come up as "sykhad2\administrator" since DC NetBios name is different than the Domain Name we see this difference.

  Here is another picture to show the same

   

• What happens if we do not enable the NetBios name on the UPA?

• How to enable the NetBios name?

On the SharePoint PowerShell run the following commands:

Get-SPServiceApplication

$upa = Get-SPServiceApplication –Identity "UPA GUID"

$upa.NetBiosDomainNamesEnabled

(Note: if the Netbios name is enabled, the Output will be TRUE for the above command, FALSE if not enabled)

Setting it to True:

$var.NetBiosDomainNamesEnabled = 1

$upa.update()

Setting it to False:

$var.NetBiosDomainNamesEnabled = 0

$upa.update()

You can also refer: http://technet.microsoft.com/en-us/library/ee721049.aspx#NetBIOSProc

The output will be shown as seen below:

• Few more takeaways on NetBios names:

1. Say you realized that your SharePoint farm needs a NetBios name to be enabled, all this while it was not enabled and we have been performing profile imports multiple times. Just enabling the NetBios name using the above commands alone is not good enough. We will have to delete the old AD Sync connection first, then enable NetBios name, restart UPSS and create a new AD Sync connection
2. For some reason if you are unable to delete the existing sync connection before enabling NetBios name, I would prefer to do a Reset of Sync DB which will clear the connection, and you can then enable NetBios name on the UPA
3.  Unable to perform profile import, When we check on the MIIS Client we get error: Replication access was denied, error code:8453, even after we have 'Replication Change Directory Permissions' on AD
4. When NetBios name and FQDN name are different,  we have to also give replication directory change permissions even on the Domain Configuration partition.
1. Refer- http://blogs.technet.com/b/steve_chen/archive/2010/09/20/user-profile-sync-sharepoint-2010.aspx

3. Troubleshooting issues after the UPSS has started successfully

• Errors while creating AD sync connection:

I have a separate blog which covers this section, refer:

http://blogs.technet.com/b/sykhad-msft/archive/2012/03/15/sharepoint-2010-errors-while-creating-ad-sync-connection-on-user-profile-service-application.aspx

 4. What happens during Profile Synchronization?? 

When we get into the MIIS Client, we see various stages being shown when we run Profile Imports, let's see what it actually means:

1. FullImport: From AD into FIM Sync DB

2. FullSync: Sync all the objects

3. DeltaImport: Only Imports the changes since the last FullImport/DeltaImport
4. DeltaSync: Sync all the objects

5. Export: Export all changes objects into Connection DB and then to associated Data Source

In simple English, when we perform a Profile Import from AD into SharePoint:

The information flows from AD into the Sync DB (which is our FIM DB) and from Sync DB to the à Profile DB

And when there is an Export from SharePoint to AD, say you are trying to export Profile Pictures from SharePoint into AD, the then process would be reversed:

The information flows from SharePoint à into the Sync DB (which is our FIM DB) and from Sync DB to the à Active Directory 

5. When to make use of User Profile Replication Engine (UPRE)

UPRE comes into picture when you want to copy over the contents from one UPA to another. Consider a scenario where you have a lot of custom properties created on the UPA, Users have updated a lot of information manually into the Profile DB like, About Me, Skill Sets, Telephone Number, Profile Picture, and the UPA also has a lot of Tagging data which resides in the Social DB, and this UPA goes corrupt for some reason and you realize the only way to get things working is by creating a new UPA.

However you don’t want to lose any data from the Profile & Social DBs.

In such cases, we have this PowerShell utility called UPRE, which is designed to copy over all the contents from one UPA to another. I personally did not have much luck using this tool, however if the data is crucial you may want to give a shot using this tool

Please refer - http://technet.microsoft.com/en-us/library/cc663011.aspx

6. Should I restart UPSS every time I apply cumulative updates/Service Packs for SharePoint Server 2010?

The answer is Yes!

• We now know that, the  schema population & table creation on the Sync DB happens only during starting the UPSS, and this DB is governed fully by the FIM Client and not by SharePoint

• So when we patch the SharePoint Servers, we run the SharePoint Configuration Wizard to complete the process of upgrade, and during the SharePoint DBs will get upgraded
• To check the version of the SharePoint DBs, we run the command:

select * from versions

• We can run this query on all the SharePoint DBs including Profile & Social DBs, but not against the Sync DB, as there is no table called "versions" in the Sync DB
• For example: I ran this command on the Profile DB and I see the version information as seen below:

• However if I want to check the same version information for Sync DB I should run the query:

select * from versioninfo

• If you open the MIIS Client, and click on Help à About, you will see the same version as seen above:

• The Bottom line is, the SharePoint Configuration Wizard does not touch the Sync DB, only when we restart the UPSS after applying updates the Sync DB gets updated

Hope you enjoyed reading this!

Please feel free to comment, ask questions & let me know if there is anything else which you want me to include as a part of this blog!

Enjoy SharePointing!!!

SharePoint 2010: User Profile Synchronization Service decoded:

This blog series will be divided in two Parts which in which we are going to discuss a few basic facts about User Profile Service Application/User Profile Synchronization Service, troubleshooting techniques, different scenarios etc. the blog covers the following:

Contents of Part-1: 

• Quick overview on User Profile Service Application (UPA)
• Scenarios where User Profile Synchronization Service (UPSS) is not designed to work
• Do's and Don'ts while working on UPSS
• Starting with troubleshooting UPSS
• Troubleshooting issues after the UPSS has started successfully

 1. Quick overview on User Profile Service Application (UPA)

The above image has been taken from www.harbar.net

For a detailed Overview on how the User Profile Service Application you can refer the following links:

http://technet.microsoft.com/en-us/library/ee721049.aspx

http://www.harbar.net/articles/sp2010ups2.aspx

2. Scenarios where User Profile Synchronization Service (UPSS) is not designed to work:

 a. Single Server Farm

UPSS is not designed to start/work on a Single Server Farm. How to check this? Check the 'ServerRole'  by going to:  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\WSS"  If the 'ServerRole' says: 'SINGLESERVER' this confirms it is a Single Server Farm

Refer:http://support.microsoft.com/kb/983061

b. SharePoint farm built using SQL Authentication***  

You can check on the below registry which is the 'dsn' key, this 'dsn' key will only be created when SharePoint server is connected to a farm Got to the SharePoint Server 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web
Server Extensions\14.0\Secure\configdb' And look for the 'dsn' key

If the 'Integrated Security' says 'False' it means it is a SQL Authentication, for Windows Authentication the 'Integrated Security' will be 'True'

SQL Authentication:

Windows Authentication:

Refer: http://blogs.technet.com/b/sykhad-msft/archive/2011/07/29/building-sharepoint-2010-farm-using-sql-authentication-amp-its-limitations.aspx

***Installing Oct-CU-2012 for SharePoint Server 2010 helps to start User Profile Sync Service even on SharePoint 2010 Farms built using SQL Authentication. The fix was included for this issue was included in Oct-CU-2012 and above Cumulative Updates for
SharePoint Server 2010

Refer- http://support.microsoft.com/kb/2687557/en-us

“Assume that you create a new User Profile Service Application (UPA), and you configure the synchronous database to use SQL authentication by setting up a SharePoint farm as an administrator. In this situation, the UPA creation is successful, but the UPA synchronization service cannot start”

c. When you have Full Fledged Forefront Identity Manager (FIM) installed on the SharePoint 2010 Server:

When you have Full Fledged Forefront Identity Manager (FIM) installed on the same SharePoint Server, where you are trying to start UPSS, ideally Full Fledged FIM should not be installed on any of the SharePoint 2010 Server as this becomes an unsupported scenario.

How to check if this is installed?

• Go to Control Panel on the SharePoint 2010 and check if that’s installed

• Get into Services console, right click on "Forefront Identity Manager Sync Service", check the Path to executable which should ideally be:

           "C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\Bin\miiserver.exe" however in cases where FIM Client has been installed, the executable path will be shown as:

           "C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\Bin\miiserver.exe"

• Also checked into the below registry:

          "HKLM\system\currentcontrolset\services\FIMSynchronizationService", even here the ImagePath will show an incorrect path which is: "C:\Program Files\Microsoft Forefront Identity Manager\2010\Synchronization Service\Bin\miiserver.exe"
           instead of: "C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\Bin\miiserver.exe"

What next? How to fix this?

• Uninstall Full Fledged FIM Client from Control Panel

• You could try the following: correct the ImagePath of the following registry

                                "HKLM\system\currentcontrolset\services\FIMSynchronizationService" from "C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\Bin\miiserver.exe"

                                 to: "C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\Bin\miiserver.exe"

• This should correct the Path to executable under the Services Console for the "Forefront Identity Manager Sync Service"

• Hopefully this should resolve, however I have seen cases where even after uninstalling FIM Client & modifying the above registry alone is sometimes not sufficient to start back the UPSS, that's because there are a lot of registry key entries which does not get removed when we uninstall FIM, in such cases an extensive cleanup of manual cleanup of registries is required, I would highly recommend to open up a Support Incident with Microsoft to get this fixed

3. Do's and Don'ts while working on UPSS

     a. Don’t-

• Do not delete the old User Profile Service Application (UPA) until and unless you are very sure about it

• Do not modify anything on the MIIS client directly, please refer: http://support.microsoft.com/kb/2517937 to see what is a supported modification and what is not

• Do not start any of the FIM services on Services Console manually

     b. Do's-
    

• Disable MySite Cleanup job 

• Take good backup of all the 3-DBs (Profile, Social and Sync DBs)

4. Starting with troubleshooting UPSS:

• Are we logging in with Farm Admin Account? Is this account also a local administrator?
• The SharePoint Timer Service Account, Account running the SharePoint Central Admin Pool, & the account seen when we click start on UPSS should be one and the same, if it is not, then please run the following command to fix this:

• Check if we can browse to STS and the successful page should return the below message:

I have a written a detailed blog on this, please go to the below link and get your STS fixed

http://blogs.technet.com/b/sykhad-msft/archive/2012/02/25/sharepoint-2010-nailing-the-error-quot-the-security-token-service-is-unavailable-quot.aspx

Until & unless we are able to browse to STS page successfully, there is no point in moving ahead with any other kind of troubleshooting on UPSS

• Restart the UPSS, monitor the progress on ULS viewer by filtering the category as "User Profiles"

A good trace will show the below progress:

• Depending on where the UPSS is failing, looking at the above image, we should carry out the next phase of troubleshooting-

Say for example: if it is failing to create ILM certificates, delete all the Forefront Identity Certificates and re-try Refer: http://support.microsoft.com/kb/2498715

• When there is no progress for User Profile category is seen on the SharePoint ULS logs:

  There is definitely a Failed One-Time timer job which is causing this, delete this 'One-Time' timer job by going to Central Admin à Monitoring àReview Job Definitions and look for 'One-Time' within column 'Schedule Type'

   

Part-2 will cover the following:

• Sync DB reset and when does it help?
• Enabling NetBios name on UPA and under what scenarios?
• What happens during Profile Synchronization?
• When to make use of User Profile Replication Engine (UPRE)
• Should I restart UPSS every time I apply cumulative updates/Service Packs for SharePoint Server 2010

 Link for Part-2:

http://blogs.technet.com/b/sykhad-msft/archive/2013/04/30/sharepoint-2010-user-profile-synchronization-service-decoded-part-2.aspx

Errors:"Unable to process create message" and "Unable to process put message"

Possible Fix:

Note: This blog has been moved to:

http://thesharegear.com/2017/08/30/errorsyncconnection/

Kindly visit the above link for a possible fix

• An STS is a specialized Web service that is designed to respond to requests for security tokens and provide identity management. The core functionality of every STS is the same, but the nature of the tasks that each STS performs depends on the role the STS plays in relation to the other STS Web services in your design. (refer- http://technet.microsoft.com/en-us/library/ee806864.aspx)

• STS is neither a SharePoint service, nor a window service, but actually a WCF web service

• Many SharePoint Services like User Profile Sync Service, SharePoint Search Service are Claims aware and such SharePoint Services will need STS to be up and running in a stable condition

• Let's take Search as an example: Let's take a case where Query Component is hosted on the App Server and a User hits the WFE and performs a Search. In this case the WFE will communicate with the Query Component on the App Server by making use of its STS to get the Claim, and the same is sent to the App Server. Without STS working, this communication will not be possible.

• Also User Profile Synchronization Service (UPSS) cannot start if the STS is not in a healthy condition

• Not only SharePoint Services, even Web Applications will require STS to be working for the Intra/Inter Farm Authentication.

• The below figure shows that within a SharePoint Farm the Intra/Inter Farm Authentication happens using Claims Authentication, and since it uses Claims Authentication, it is more than required for the STS to be working

I have seen numerous cases where the UPSS fails to start because of the unavailability of the STS. In such cases you can also see following errors logged:

In SharePoint Health Analyzer: "The Security Token Service is unavailable"

In SharePoint ULS logs while starting UPSS, errors like:

• An exception occurred when trying to issue security token: The server did not provide a meaningful reply; this might be caused by a contract mismatch, a premature session shutdown or an internal server error (OR)

• Request for security token failed with exception: System.ServiceModel.ServiceActivationException: The requested service, 'http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc/actas' could not be activated (OR)

• An exception occurred when trying to issue security token: The requested service, 'http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc/actas' could not be activated

You may not see all the errors as shown above, I'm just trying to collate the common errors seen while starting UPSS when STS is broken.

To troubleshoot such issues, it will be good to check if we can browse to the STS Web Service page.

To browse you have to go to IIS Manager --> Sites --> SharePoint WebServices --> SecurityTokenServiceApplication, click on 'Content View' down at the bottom, right click on Securitytoken.svc and click Browse (as shown below)

The expected page to see if STS is working will be as shown below:

As long as you get the above message while browsing, be sure that the STS is working just fine. In cases where STS is broken, you will not be able to browse to the above web service. You will get errors like Server Error in '\' Application, or Internet Explorer cannot display the web page etc.

How to fix STS?

Step One:

Right click on the SecurityTokenServiceApplication and click Explore, copy the web.config and compare the file with the file attached, which is completely out of the box with no modifications. If you find a lot of changes in the web.config file on your Farm with that of mine, replace the file on SecurityTokenServiceApplication(please also have the copy of the original web.config), perform an IIS reset and check if the STS page comes as expected

Step Two:

A BIG Thank You! To Abhishek Saigal (one of the finest resource in SharePoint Admin world) who came up with this fix, which has a success rate of 99.99%

I have tried this fix on numerous User Profile cases where UPSS could never start due to broken STS, and after STS was fixed UPSS started like a charm!

The below PowerShell commands re-provisions all the SharePoint Web Services, and this is one of the safest way to get the STS working.

There is no need to be afraid of losing any data/applications on SharePoint while/after running the below commands

Run the following commands one by one on SharePoint PowerShell:

Note: This blog has been moved to:

http://thesharegear.com/sts/

Kindly visit the above link for the possible fix.. Thank you

About SQL Authentication:

Basically there are 2-ways to connect to the SQL Server Management Studio, one using Windows & the other using SQL Authentication. For Windows obviously you need to have a domain Username & password and the same needs to be added under 'Security' --> Logins on the SQL Server Management Studio 

 To create a SQL login account on the SQL Server, login to the SQL Server Management Studio --> Security --> Logins, right click on 'Logins' and click 'New Login'

Now enter the Username of your choice and choose the radio button for 'SQL Server Authentication'

After the account has been created successfully, you can see the same account under Security --> Logins

To confirm if the account has been appropriate permissions, login to the SQL Server Management Studio using SQL Authentication & confirm your access.

Using SQL Authentication on SharePoint 2010:

Usually Organizations prefer to build SharePoint Farms using SQL Authentication when they have SQL & SharePoint Servers in two different domains and these domains usually do not  trust between them, in such cases SharePoint Servers are most likely in DMZ Zone.

Let's first see how to start building a SharePoint Farm from the scratch using SQL Auth.

In this example we have 2-Domains: DOM233960A & DOM233960B which belong to SQL & SharePoint respectively. We do not have any kind of trust between these 2-domains.

Both the servers are on Win-2008 R2 SP1, I'm making use of SQL 2008 R2.

To begin with we need to setup a SQL Account on the SQL Server which has at least DBCreator & Security Admin role assigned.

In this example I have created an account by name 'sql' on the SQL Server  as shown above (this account is on the SQL Server and absolutely not required to be created on the Windows Server itself)

Check Point:

Once the account is setup, login to the SQL Server Management Studio with the newly created account and confirm the login.

This being done, let's now to go the SharePoint Server.

Remember since we are building SharePoint Farm using SQL Auth, we do not have an option to run the SharePoint Configuration Wizard to setup the farm, we should be doing this via the command prompt.

Before we move on create a config DB, let's check the connectivity from SharePoint to SQL.

Check Point:

Create an UDL connection on the SharePoint Server - create a text document on the desktop of the SharePoint Server by name 'test.udl'

 Double click on 'test.udl', enter the SQL Server name, SQL Account username & password created on the SQL Server, click on the drop down on step-3 which says 'Select the database on the server' as shown below as we should be able to see the DBs present on the SQL Server.

and when we hit 'Test Connection', we should get a response as ' Test connection succeeded'

Do not move forward if the UDL Test fails, Check the below points if the UDL Connection does not succeed.

Try to Telnet to the SQL Server from SharePoint, install Telnet Client (if not installed) from the Features menu.

Type the following command on the command prompt: telnet "name of the SQL Server" "port number"

In my case command looks like this: telnet   sykh23396018 1433

If Telnet is successful, you will get the output as blank as shown below:

 The port number 1433 is the default port which is used by SQL Server for remote connections to the database. If you are using any other port but 1433 make sure you have the 'SQL Server Browser' service running on the SQL Server so that you can telnet from the SharePoint server using the non-default port.

 If Telnet fails, there are high chances it is blocked by the Firewall, if you are using Windows Firewall, either Disable the firewall or Add an Inbound Rule for the port 1433

 Try the Telnet again, if successful, try the UDL. Once the UDL Test is passed be sure enough we have required communication setup between SQL & SharePoint.

It's time now for us to get to the Magical PSConfig Command which will create a new SharePoint Config DB & Admin Content DB, as usual we have to run this under the 14 hive folder on the SharePoint Server.

Please check TechNet article for detailed list of commands- http://technet.microsoft.com/en-us/library/cc263093.aspx

The required command is:

 psconfig.exe -cmd configdb -create -server <Server_name> -database <Database_name>  -dbuser <username> -dbpassword <password>  -user <DOMAIN\username> -password <password>  -admincontentdatabase <Database_name>

 Note: '-user' will be the username which we become the Farm Admin after we run the above command.

 '-dbuser' will be the 'sql' account which we initially created on the SQL Server.

Once the above command has been run successfully, it implies we have connected the SharePoint to the SQL Server using the SQL Authentication.

You can double check on the below registry which is the 'dsn' key, this 'dsn' key will only be created when SharePoint server is connected to a farm

Got to the SharePoint Server " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\Secure\configdb"

And look for the 'dsn' key

In the above key if you notice, the 'Integrated Security=False' which confirms the SharePoint Server is connected to SQL using SQL Auth, & also the password is seen in clear text.

When you build a SharePoint Farm using Windows Auth, the same 'dsn' key will be seen as below:

Here if you see, the 'Integrated Security=True' which means this one is Windows Auth.

Now you can run the SharePoint Configuration Wizard via the UI and provision Central Admin and complete the wizard successfully.

(We can also provision Central Admin and run the wizard using command line)

This completes building of SharePoint 2010 farm using SQL Authentication.

Coming to the limitations of using SQL Authentication compared to Windows:

1. Changing SQL Account Password:

At any given point in time if you are in a need to changing the SQL Account password, please bare in mind this is no joke.

There is no easy way to change the SQL Account password known to mankind as of now. If you happen to change the password accidentally on SQL Server for the SQL Account which was used to build the SharePoint Farm, as soon as the password is changed all the SharePoint sites will go down. You have to either go back and change the password again to the old one or build a new Config DB and associate all the Content DBs which is as good as rebuilding the complete SharePoint Farm.

Then how do I change the password?

• There is an option of Changing the password via the Object Model, however the success rate is minimal.
• There could be a hotfix rolled out in the near future, even otherwise changing SQL Account password is not recommended unless you are ready to re-build the farm.

2. Do all functionalities of SharePoint work on a farm build using SQL Authentication?

Microsoft is trying their best to make work all the functionalities of SharePoint 2010 work as compared to Windows, however there are few things you must know. I ran the Farm Configuration Wizard after I built the SharePoint 2010 farm using SQL Authentication and found the following Services not to be working, below is the screenshot.

When I ran the Farm Configuration Wizard I was on RTM build which is 14.0.4762 

1. After I applied SP1 for SharePoint 2010, I again ran the Farm Configuration Wizard to provision the above 3-Service Applications, & I was able to provision "Search Service Application" & "Managed Metadata Service" however not the “Secure Store Service”
2. I then had to install http://support.microsoft.com/default.aspx?scid=kb;EN-US;2536599  to get the "Secure Store Service" working

 (Note: I have seen Secure Store Service working after installing June-CU-11 for SharePoint 2010 without having to install the above KB, if you want to stick only with SP1 then KB-2536599 is mandatory for "Secure Store Service") 

3. User Profile Synchronization Services DOES NOT work with SQL Authentication. You will be able to provision User Profile Service Application, however when you try to start the User Profile Sync Service, you will not be able to start, it will hang on starting & finally die. On the event viewer you will witness an error something like shown below: 

                 Log Name:      Application 

Source:        ILM Web Service Configuration

Date:          7/19/2011 9:02:28 PM

Event ID:      234

Task Category: None

Level:         Warning

Keywords:      Classic

User:          N/A

Computer:      SYKH23396020.DOMB.local

Description:

 ILM Database could not be created: Error sent to Windows Event Log running : EXEC sp_grantlogin N'DOMB\Administrator';DECLARE @existingUser nvarchar(128); IF EXISTS( SELECT name from sys.sysusers where sid=0x01050000000000051500000049B2CE8F62788E2A6A2DC5D4F4010000 )BEGIN SELECT @existingUser=name from sys.sysusers where sid=0x01050000000000051500000049B2CE8F62788E2A6A2DC5D4F4010000;IF( @existingUser <> N'dbo' )

    EXEC sp_addrolemember N'db_owner', @existingUser; 

    END 

    ELSE

    BEGIN 

    EXEC sp_grantdbaccess N'DOMB\Administrator';  EXEC sp_addrolemember N'db_owner',N'DOMB\Administrator';END: Windows NT user or group 'DOMB\Administrator' not found. Check the name again. 

Windows NT user or group 'DOMB\Administrator' not found. Check the name again. 

User or role 'DOMB\Administrator' does not exist in this database.

User Profile Sync Service may work with SQL Authentication in future, as of now even on latest builds it does not. 

There could be more limitations on building SharePoint 2010 farm using SQL Auth other than mentioned above and that's the very reason why Microsoft prefers & recommends Windows Authentication over to SQL when building SharePoint farms.

*******Updated on 22-Mar-2013*******

*Installing Oct-CU-2012 for SharePoint Server 2010 helps to start User Profile Sync Service even on SharePoint 2010 Farms built using SQL Authentication. The fix was included for this issue was included in Oct-CU-2012 and above Cumulative Updates for SharePoint Server 2010

This update also allows us to change the SQL Account Password

Refer- http://support.microsoft.com/kb/2687557/en-us

“Assume that you create a new User Profile Service Application (UPA), and you configure the synchronous database to use SQL authentication by setting up a SharePoint farm as an administrator. In this situation, the UPA creation is successful, but the UPA synchronization service cannot start”