Microsoft has release RTM versions of some of the items above and the links have been update.

****************************************************************************************************************

If you are getting started with App or Microsoft SharePoint Server 2013 development, you will notice that there is no option in Visual Studio 2012 when you first install it.

In order to get the templates into VS, you need to install Microsoft Office Developer Tools for Visual Studio 2012 which can be found here: https://www.microsoft.com/visualstudio/eng/office-dev-tools-for-visual-studio (direct install : https://aka.ms/OfficeDevToolsForVS2012).

Unfortunately, this leverages the Microsoft Web Platform Installer which does not play well in closed environments. The Microsoft Web Platform Installer will install the following items:

Microsoft Identity Extensions

https://download.microsoft.com/download/0/1/D/01D06854-CA0C-46F1-ADBA-EBF86010DCC6/RTM/MicrosoftIdentityExtensions-64.msi

Workflow Manager Client 1.0

https://download.microsoft.com/download/D/B/D/DBD439A9-370D-40EA-B3B7-45CD935B98FB/WF/en/WorkflowManagerClient_x64.msi

Microsoft Exchange Web Services 2.0

https://download.microsoft.com/download/8/2/5/825231AC-D373-45D4-A644-7AF12340C815/EwsManagedApi32.msi

Microsoft Windows Identity Foundation SDK 4.0

https://download.microsoft.com/download/7/0/1/70118832-3749-4C75-B860-456FC0712870/WindowsIdentityFoundation-SDK-4.0.msi

Microsoft SharePoint Client Components

https://download.microsoft.com/download/E/1/9/E1987F6C-4D0A-4918-AEFE-12105B59FF6A/sharepointclientcomponents_x64.msi

Microsoft Workflow Manger Tools

https://download.microsoft.com/download/D/B/D/DBD439A9-370D-40EA-B3B7-45CD935B98FB/WFTools/en/WorkflowManagerTools_x64.msi

Cumulative Update 1.0 for Microsoft Workflow Manager Tools

https://download.microsoft.com/download/3/B/B/3BBBBE7D-5D9B-4ADD-9A53-BDDF002F4ABB/WorkflowManager-KB2799754-x64-EN.exe

Open XML SDK 2.5

https://download.microsoft.com/download/5/5/3/553C731E-9333-40FB-ADE3-E02DC9643B31/OpenXMLSDKV25.msi

Microsoft Visual Studio Tools for Office Runtime

https://download.microsoft.com/download/A/6/0/A60BE6E6-41E8-4A23-BF86-CD3CC2FE968A/ENU/vstor40_x64.exe

Microsoft LightSwitch HTML Client Preview 2 for Visual Studio 2012

https://download.microsoft.com/download/8/4/A/84A6C7F4-770F-48C2-A4E6-B3A7BAE1919F/vs_lightswitchV3.exe

Microsoft Office Developer Tools for Visual Studio 2012 - Preview 2

https://download.microsoft.com/download/A/6/0/A60BE6E6-41E8-4A23-BF86-CD3CC2FE968A/ENU/officetools_bundle.exe

Microsoft Office Developer Tools for Visual Studio 2012 - RTM

https://download.microsoft.com/download/2/F/6/2F6A4FFA-D409-40C8-AF68-F6F0CBE0A00D/ENU/officetools_bundle.exe

Once these items have been downloaded and installed on your development machine and double-click to install them, you will see that there is the option to create Apps and other items for Office and SharePoint 2013.

Unfortunately, if you try to create a project for any of these new fun items, you will get the following error:

An error occurred whilst trying to load some required components, Please ensure the following prerequisite components are installed.

Microsoft Web Developer Tools

Microsoft Exchange Web Services"

The problem is that the Microsoft Web Platform Installer adds parameters when installing the Microsoft Exchange Web Services that must be used in order to get around the error. If you have already installed the Microsoft Exchange Web Services, uninstall it from Control Panel and then open up a command prompt. Navigate to the location of EwsManagedApi32.msi. In the command prompt, run

EwsManagedApi32.msi addlocal="ExchangeWebServicesApi_Feature,ExchangeWebServicesApi_Gac"

Once that has finished installing, open up Visual Studio 2012 and enjoy creating apps for Microsoft SharePoint Server 2013.

References: https://blogs.technet.com/b/adfs/archive/2008/05/13/using-adfs-with-constrained-delegation.aspx

When using the Windows Token-Based web agents for ADFS, the server hosting SharePoint must be able to delegate a user’s account to any line of business (LOB) database when using BDC web parts.  Without using the following steps, the user will be able to authenticate to SharePoint but any BDC web parts that talk to another server will fail.  This failure can be seen in the ULS logs under the Business Data category and should indicate that the logon to the LOB system with an anonymous account.

Note:  These steps assume that SharePoint has been installed and configured.

Prerequisites

·         A SharePoint web application that is set up to use Windows Authentication and Kerberos

·         An Active Directory domain account to be used for the ADFS Web Agent Authentication Service that will be installed on the SharePoint web front end servers

·         An Active Directory domain account that is used for the Application Pool account for the SharePoint web application that is set to run Kerberos (if this is already created, ignore this )

·         Two SPNs for the Active Directory account running Microsoft SQL Server

o   MSSQLSvc/fqdn.of.sqlserver:1433

o   MSSQLSvc/shortnameofsqlserver:1433

Setup accounts needed

1.       Log onto a domain controller in the environment.

2.       If the account that is running Microsoft SQL Server already has SPNs set for MSSQLSvc, skip to step 4.

3.       Open an eleveated command prompt and type the following:

a.       Setspn -a MSSQLSvc/fqdn.of.sqlserver:1433 domain\sqlaccount

b.      Setspn -a MSSQLSvc/shortnameofsqlserver:1433 domain\sqlaccount

4.       Create an active directory domain user to run the ADFS Web Agent Authentication Service.  This account does not need to be a member of any group except Domain Users.

5.       Open an eleveated command prompt and type the following:

a.       Setspn -a HTTP/test domain\accountforadfsservice ( this is only done to see the delegation tab)

b.      Make sure that Advanced Features is checked inside Active Directory Users and Computers

c.       Right click on the ADFS Service user account and select Properties.

d.      Located and click on the Delegation tab.

e.      Click the radio button for Trust user for specified services only.

f.        Click the radio button for Use any authentication protocol.

g.       Click the Add button

h.      Click the Users or Computers

i.         Enter the account running the SQL Server service that SharePoint uses

j.        Select the MSSQLSvc/fqdn.of.sqlserver:1433

k.       Click the OK button.

l.         Click OK to close the user account properties.

6.       If the SharePoint web application is already currently configured to run Kerberos,  skip to step 9

7.       Open an eleveated command prompt and type the following:

a.       Setspn -a HTTP/<fully qualified SharePoint URL> domain\<account used for web application pool>  (i.e. setspn -a HTTP/sp.microsoft.mil ms\mossapppool)

8.       Open up Active Directory Users and Computers

a.        Make sure that Advanced Features is checked inside Active Directory Users and Computers

b.      Right click on the Application Pool account and select Properties.

c.       Located and click on the Delegation tab.

d.      Click the radio button for Trust user for specified services only.

e.      Click the radio button for Use any authentication protocol.

f.        Click the Add button

g.       Click the Users or Computers

h.      Enter the account used to run the application pool (i.e. mossapppool )

i.         Select the HTTP/<fully qualified SharePoint URL>

j.        Click the OK button.

k.       Click the Add button

l.         Click the Users or Computers

m.    Enter the account running the SQL Server service that SharePoint uses

n.      Select the MSSQLSvc/fqdn.of.sqlserver:1433

o.      Click the OK button.

p.      Click OK to close the user account properties. 

q.      Do not perform step 8.

9.       On the domain controller, open up Active Directory Users and Computers

a.       Right click on the Application Pool account and select Properties.

b.      Located and click on the Delegation tab.

c.       Click the Add button

d.      Click the Users or Computers

e.      Enter the account running the SQL Server service that SharePoint uses

f.        Select the MSSQLSvc/fqdn.of.sqlserver:1433

g.       Click the OK button.

h.      Click OK to close the user account properties.

Install and Configure AD FS Web Agents for Windows Server 2008 R2

1.       Open up Server Manager on the server that hosts SharePoint

2.       Click on Roles on the left hand side.

3.       Underneath Roles Summary, click Add Roles

4.       Click Next

5.       Select the Active Directory Federation Services checkbox.

6.       Click Next and Next again.

7.       Choose Windows Token-based Agent and select Next.

8.       Enter the FQDN of the federation server in the environment.

9.       Click Install.

10.   Once the installation has complete, open up IIS Manager.

11.   Expand Sites and locate the SharePoint web application web site.

12.   Click on this web site and double click on the Authentication icon on the right side of the screen.

13.   Right click on AD FS Windows Token-Based Agent and select Enable.

14.   Once enabled, right click on AD FS Windows Token-Based Agent and choose Edit

15.   Enter the Return Url to match the URL of the SharePoint site and leave the other settings as is.

16.   Click ok.

User right assignments on the SharePoint server

1.       Log onto the server that is running Microsoft Office SharePoint Server

2.       Go to Start | Administrative Tools | Local Security Policy

3.       Expand Local Policy

4.       Expand User Rights Assignments

5.       Add the Application Pool account to the following permissions:

a.       Logon as Service ( should be already set )

b.      Generate Security Audit Event

6.       Add the AD FS Web Agent service account to the following permissions:

a.       Act as part of the operating system

b.      Logon as Service

c.       Generate Security Audit Event

7.       Add the account created for the ADFS Web Agent Authentication Service to the local Administrators group.

8.       Add the account created for the ADFS Web Agent Authentication Service and the Application pool account to the IIS_IUSRS group.

Configuring ADFS Web Agent Authentication Service

1.       Click Start | Administrative Tools | Services

2.       Locate the ADFS Web Agent Authentication Service

3.       Right click on the service and select Properties

4.       Click the Identity tab

5.       Enter the domain\username of the account created for the ADFS Web Agent Authentication Service.

6.       Enter the password for the account and click Ok.

7.       Restart the service and open up the Event Viewer

8.       Click on the Application log and verify that there is an information level event for the ADFS Web Agent Authentication Service that states it has successfully retrieved information from the ADFS server.

Update Images Web.config file for SharePoint

1.       Log onto the server running SharePoint.

2.       Open IIS manager from Start | Run | Administrative Tools | Internet Information Services Manager.

3.       Expand Sites and expand the website for the SharePoint web application

4.       Expand the Layouts folder and click on Images

5.       Choose and double click the Authentication icon on the right.

6.        Right click on ADFS and choose Disable.

7.       Restart IIS to commit the authentication changes.

To resolve the error, we used SC.exe to modify the DACL of remoteaccess.

1. Open a command prompt ( use an elevated command prompt if running from Windows Server 2008 or 2008 R2 ).
2. Type the following and hit enter:
   1. sc.exe sdshow remoteacces
3. This will output something like the follwoing
4. 
5. Copy the output into Notepad
6. Get the SID for the Farm account.  You can either use PSGetSid or PowerShell (https://thepowershellguy.com/blogs/posh/archive/2007/01/23/powershell-converting-accountname-to-sid-and-vice-versa.aspx)
7. Once you have the SID for the Farm account, add the following right before S:( to the output you copied earlier
   1. (A;;0x4;;;SID of User account)
8. Copy the output plus the text in Step 7a and type the following:
   1. sc.exe sdset remoteaccess <output string:>
   2. Press enter
9. Verify that the DACL has been updated by running sc.exe sdshow remoteaccess.
10. If you are seeing more than remote access errors for Event ID 560, simply replace the RemoteAccess in the sc.exe commands with the object listed in the event log. 

 UPDATE:  I have been asked to explain some of my experience with the STIGs and have added that below.

When dealing with DISA STIGs, the category of the particular item is referred to often.  The highest category is Cat I, followed by Cat II and finishing at Cat III.  For the SharePoint installations that I have worked with, all Category I and most of the Category II items have been applied for both the Operating System and Internet Information Services (IIS). There are SQL Server STIGs as well but I have not seen them affect SharePoint operation.  When approaching a SharePoint installation, your life and time will be best spent installing and configuring a working SharePoint environment PRIOR to applying any STIG remediations. I have had instances where SharePoint will not even install when certain STIGs are applied.  The SharePoint Products and Technology Wizard performs some actions ( mainly permissions ) that a STIG can revert and it is easier to apply the STIG remediations and check if SharePoint still works rather than figuring out if it is a bad install or a STIG that is causing any errors.   As I go through the STIG items, I apply them one at a time and based on their recommended fix I will check the relevant SharePoint items.  The biggest thing to watch for is any file or registry permission restrictions.  Using PROCMON you can navigate through SharePoint ( mainly CA and the SSP ) and see what files and registry items it is hitting.  In almost all cases, the STIG has affected the Central Administration, SSP and the services like SPTimerV3 and Osearch rather than the actually SharePoint sites themselves.  The only issue I have seen with browsing the site has been caused when anonymous access has been turned on and the IUSR account ( which is a member of the Guest group ) does not have Logon locally permissions ( the DISA STIG has you remove the Guest group from this permission ). 

During your testing, run through all the operations that SharePoint performs with the STIGs applied.  Kick off a search crawl, run a profile import, even patch the server if you can with a SharePoint Cumulative Update.  Remember that the majority of the problems will come from the infrastructure side of the house and not users hitting the site. 

Now as with everything SharePoint it is good practice to roll changes into a SharePoint solution where possible.  This ensures that all members of the farm are updated in parellel and any changes made can be easily rolled back.  Attached to this blog is a C# project that will create a SharePoint solution to deploy the necessary assembly and web.config changes needed into your farm.  Inside the project there is a file called ADFSTimerJob.cs and a constant called MY1_FLAG.  This constant is used to identify which web.config to update on each server and can be changed to match your URL identifier.  By default it uses the IIS description that you used when creating or extending your web application. 

 A few notes about the code:

• You will need WSPBuilder to build the solution or create your own build and targets file to create the WSP.
• The code uses a custom timer job to make the changes to the web.config files directly and does not use the SPWebConfigModification class ( this is because of the ordering in which the httpmodule needs to be placed in the web config )
• The feature is web application scoped and will create the timer job ( One-time ) when the feature is activated and deactivated. 
• The code is presented as is, with no support or implied warranty.
• Feel free to ask questions against this blog post and I will try to answers as needed.
• The password for the signing cert is password

Download: ADFSModuleSharePointSolution.zip

ADFSModuleSharePointSolution.zip

Some more searching found a Codeplex project called SharePointFix.  If you look at the source code, you will see

SPDiagnosticsService diagService = SPDiagnosticsService.Local;

            try
            {
                diagService.ResetAll();
                Console.WriteLine("Sucessfully Reset");
                diagService.Delete();
                Console.WriteLine("Sucessfully Deleted");
                diagService = SPDiagnosticsService.Local;
                diagService.Update();
                Console.WriteLine("Sucessfully Updated");
                              
            }
            catch (Exception ex)
            {
                Console.WriteLine("Source: " + ex.Source);
                Console.WriteLine("Message: " + ex.Message);

            }

The key here is the Delete() method, which will clear the rows in the Objects table ( but in a supported way).  Run the code on a server with SharePoint installed and it should solve the problem. 

For those who need to run it with PowerShell:

[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint") 

[Microsoft.SharePoint.Administration.SPDiagnosticsService]::Local.ResetAll()         [Microsoft.SharePoint.Administration.SPDiagnosticsService]::Local.Delete()         [Microsoft.SharePoint.Administration.SPDiagnosticsService]::Local.Update()