IIS Application Pool errors causing SharePoint 2010 to crash

We've just spent the last 7 hours troubleshooting a SharePoint 2010 issue, so I have been inspired to blog our experience in the hope we can save someone else that finds themselves in the same situation.

This problem came up on a SharePoint 2010 farm on a Windows 2008 R2 server. After applying Windows Updates, the SharePoint website stopped working. We had errors in the System and Application Windows Event logs:

• A process serving application pool 'Intranet App Pool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '10280'. The data field contains the error number.
• .NET Runtime version 2.0.50727.8669 - Fatal Execution Engine Error (000007FEF90F0D3E) (80131506)

Here is the post that led us to a solution:

https://blogs.technet.microsoft.com/momteam/2017/03/21/apm-feature-in-scom-2016-agent-may-cause-a-crash-for-the-iis-application-pool-running-under-net-2-0-runtime/

In our case, the application was called Microsoft Operations Management Agent. Once we uninstalled this, our problem disappeared. We have yet to try the work-arounds for reinstalling the agent. Right now, we are just enjoying having our website back online.

It seems like you need to have a very specific set of updates for this issue to happen. Another one of our production servers is running version 2.0.50727.5420 of the dot net framework with the same agent, but hasn't run into the same issues. 

One thing that we discovered through this process is that our test environment doesn't have the agent installed. We will probably install the agent so that we can discover these issues in our test environment instead of our production environment in future.

The irony of a health monitoring agent bringing down our production environment is not lost on me. Please leave a comment if this post helps fix your issue.

Update: a great blog post about this issue: http://kevingreeneitblog.blogspot.com.au/2017/03/scom-2016-agent-crashing-legacy-iis.html
-->

Using the Lync Online Meeting Browser Plug-in

We use Lync in our office as part of our Office 365 deployment. This makes it easy to share screens with others. Meeting attendees don't even need to have the Lync client installed to participate (or a Lync account). They will get asked to install the Lync Web App (basically a browser plug-in) when they join their first meeting.

I put together the following video to show what the user experience for the installation process looks like. This is using a Windows 7 PC and Internet Explorer 10. The experience is likely to be different depending on your operating system and browser version.

In the video, you may notice that I needed to run the installation twice. For some reason, the installation didn't complete the first time. This seems to be a common problem.

Uploading 5,000 files to Office 365 using SkyDrive Pro

I've just uploaded 5,000 files to an Office 365 environment using SkyDrive Pro. The files were small - 8 KB each, but I thought it would be interesting to look at the transfer rate. It looks like it averaged 26 files a minute over 2 hours 24 minutes. Not the fastest way to get files up, but handy if you aren't in a rush. It looks like SkyDrive Pro throttles the upload so that your machine/bandwidth/server isn't maxed out. I'm based in Sydney, Australia. More than likely, the server is based in the Singapore data centre. YMMV.

Our Office 365 Service Upgrade is coming

My company has had an Office 365 subscription for about a year now. This is based on the SharePoint 2010 functionality. Today we received a notification that we will soon be upgraded to the SharePoint 2013 platform, exciting times! We are based in Sydney, Australia, so more than likely we are being hosted out of the Singapore data centre. I'm looking forward to getting onto the latest and greatest.

Sydney SharePoint Saturday - Oct 27 2012

It only seems like a month ago since it was last in town, but SharePoint Saturday is back in Sydney on October 27th. Expect to see a lot of content on SharePoint 2013 this time, now that the beta is out. You can book your free ticket for the event here (76 left at the time of writing). I'll be there, hope to see you there too

Advanced InfoPath training in Sydney

If you work with InfoPath forms then you should check out the 3 day InfoPath Master Class being run by Qdabra in Sydney from March 27 to 29th. Qdabra are one of the top companies in InfoPath, started by former members of the Microsoft Product team and InfoPath MVPs. For more details, fill out their enquiry form.

This intermediate to advanced level class is meant to take current users of InfoPath to the next level of form design and integration. Through hands-on labs and expert-led instruction, you can learn how to create codeless forms solutions that minimize administrative costs and maximize the value of InfoPath in your organization.

Australian SharePoint Conference - three weeks to go

There is still time to pick up an early bird ticket for the Australian SharePoint Conference in Melbourne. The event is on the 20 and 21 of March and includes something for everyone - technical tracks (dev and IT Pro), business tracks, case studies, and Office productivity.

To see the full agenda and register for the event, go to http://www.sharepointconference.com.au

February 2012 SharePoint User Group - it's a Knockout!

This month's Sydney SharePoint user group is a must-see if you are interested in how you can take advantage of JavaScript to create a compelling user experience in SharePoint. My colleague John Liu will be demonstrating how to bind HTML elements to data using the Knockout JavaScript library.

For more details, check out the Sydney SharePoint User Group site

Trust me, I’m digitally signed

InfoPath has this concept of trust levels. A form template can be running in one of three levels of trust – Restricted, Domain or Full Trust. By default, InfoPath uses the Restricted trust level. This prevents you accessing any resources outside of the form template. If you add any managed code or data connections, InfoPath will raise the trust level to Domain. Sometimes your template needs to include code that requires the Full Trust level. If that’s the case, then you need to jump through extra hoops to enable this level.

There are two approaches that you can use to enable Full Trust – deploying the form to desktops using an installation package or digitally signing a form. To me, the first approach is cumbersome, as it requires you to redeploy the form any time there are changes. That’s fine if your forms are very stable, but most of the forms we work on go through multiple updates. Perhaps there are easy ways to redeploy forms using products like SCCM, but I haven’t any experience with them.

The second approach – digitally signing - allows you to deploy the form to a SharePoint forms library or network share. For me, this makes life easier if you need to update the template.

So what is involved in digitally signing an InfoPath template? In this post, I’ll walk you through my recent experiences. Digital signatures is just one of the many areas I’m no expert in, so please forgive any incorrect assumptions I have made. I was inspired to write this post due to the lack of information I found when researching this topic myself.

To state the obvious, before you can digitally sign a form template, you are going to need a digital certificate. This certificate needs to be issued by a “Certificate Authority” (commonly called a CA) that is trusted. My understanding is that our operating systems maintain a list of Trusted Root Certification Authorities. In Vista and Windows 7, this list of root certificates is updated any time your computer encounters a certificate signed by a Certificate Authority that it doesn’t already know about. You can read more about this on TechNet.

If you want to have a look at the list of Root Certificates on your computer, open Internet Explorer 9, then go to Internet Options – Content – Certificates – Trusted Root Certification Authorities. Have a look at the Untrusted Publishers while you are there. It just goes to show that you can’t trust everyone.

I believe that it is possible for an organisation to set up their own certificate server and register themselves as a Trusted Root Certification Authority on computers within their own network, but that is not something I have played with. Instead, we decided to purchase a certificate from Thawte, one of the main commercial Certificate Authorities.

My first challenge was trying to figure out exactly what I needed to buy. I couldn’t find any reference to InfoPath code signing on any of the Certificate Authority web sites. They all seem to offer a bunch of certificate types and it was unclear to me which one I needed. For example, Thawte offer a Microsoft Authenticode certificate and a Microsoft Office VBA certificate. Well, InfoPath is an Office product, but I’m not signing VBA code. I decided to go with the Authenticode option.

When I first started looking into digital signing, I wasn’t sure what exactly I needed to purchase a certificate for. Did I need a certificate for each InfoPath form template, for each computer that needed to sign forms or for each person? It turns out I was purchasing a certificate for my company. We could then sign any number of InfoPath forms with this certificate. We could deploy the code-signing certificate to as many computers as we wanted and it could be used by as many staff members as we wanted. It makes sense though to keep a tight control over who has access to the certificate, otherwise you run the risk of your certificate being used to sign code that you really don’t want to be associated with.

In my next post, I’ll walk you through the steps for purchasing a cert, installing it on a computer and then signing your InfoPath form template.

SharePoint Licensing information–where to look

Every so often I need to delve into the murky waters of SharePoint licensing. I always find this challenging. Mainly because there is a lot of contradictory information out there. I can understand why – there are many different scenarios, its complicated, people interpret the rules in lots of different ways, the rules have changed over time.

Where possible, I try to reference information directly from Microsoft, as this obviously has a lot more credibility than some blog post that you read (present blogger excepted). Imagine my surprise when I recently had to research information for a SharePoint 2007 engagement I’m working on – Microsoft seems to have removed all of the SharePoint 2007 licensing information from their site. Well, they aren’t selling it any more, so I guess that makes sense. But what if you need to answer a licensing question from an existing SharePoint 2007 client?

Of course the correct answer here is to refer your client to a mythical licensing expert, then wash your hands of the whole incident. After all, you are responsible for zeros and ones, not licensing compliance.

But what if you did actually want to understand what is allowed and even provide “evidence” to back up any readings you have taken of the licensing tea-leaves?

Here are two links that I have recently come across that I think are worth sharing. These are correct at the time of writing.

http://www.microsoftvolumelicensing.com/userights/DocumentSearch.aspx – Search for licensing documents. I’d recommend selecting PUR (Product Use Rights) in the first column and then your preferred language, region and sector. The real magic for me is the “Show Archived” checkbox. This allows you to access older documents that contain details on products that are no longer sold (e.g. SharePoint 2007). I’ve found I get more archived results if I set Region to “WW (World Wide)”. Note that the archived results are displayed in a separate box below the current results.

 

http://download.microsoft.com/download/6/8/9/68964284-864d-4a6d-aed9-f2c1f8f23e14/Assessing_SharePoint_Server_Licensing.docx – “A Guide to Assessing SharePoint Server Licensing” – December 2010. Here is the summary, straight from the document:

“This document gives Microsoft® Volume Licensing customers an overview of licensing for Microsoft SharePoint® Server 2010, SharePoint Server 2007, and SharePoint Server 2003, as well as guidance on how to assess the licenses needed. Please refer to the Product Use Rights (PUR) document for detailed guidance”

SharePoint Saturday Sydney - InfoPath Tips and Tricks

SharePoint Saturday in Sydney was held yesterday, Aug 6, 2011. It was a great event, with about 120 attendees. Kudos to Brian Farnhill and Alexandre Bacchin for organizing it.

I gave a presentation entitled "InfoPath Tricks of the Trade" which included my "Planet of the APIs" sample form. This session was showing off some ways to accomplish specific tasks with InfoPath. I focused on two tasks - getting information about the current person and creating a unique name for your form (without using a timestamp).

I certainly enjoyed delivering the session and there were interesting questions from the audience. And as soon as I retrieve my laptop's power supply that I left at the venue, I'm going to put the presentation and demo template online for people to download.

---

Update: As promised, here is the PowerPoint presentation and InfoPath template

Getting Access Denied, even when you are a Site Collection Administrator

Here’s a solution I found to a weird issue I recently encountered. It was for a SharePoint 2007 site that had been upgraded to 2010 while also moved to a new domain. For some reason, a few of the user accounts were not getting authenticated properly. They would get the “Access Denied” page. This happened even if the person was set up as a Site Collection Administrator.

I found that this problem disappeared if I ran the following command:

stsadm –o migrateuser olddomain\username newdomain\username –ignoresidhistory

This command would return an error “Value cannot be null. Parameter Name: UserProfileApplicationProxy”. Regardless, the account could then log into the site.

Why? Don’t know.

How to make 100 friends in SharePoint

Do you have SharePoint installed on a development or test environment somewhere? Does it have it’s own Active Directory installation? So, how do you explore all the wonderful features of the SharePoint User Profile service? You know, like the Silverlight organisation chart, or Audiences, or Colleagues, or…

Well, not to fear, after much procrastination, I’m finally able to provide a solution to your problem. I’ve made up names, job titles and managers for 100 people. Any similarity to real people is purely coincidental. Not only that, but I’ve created a PowerShell script to create these accounts in Active Directory.

This means your User Profiles in your virtual environment can go from a bland handful of test accounts, to a dazzling collection of fictitious employees in different departments, physical offices and job titles. Just imagine the Audiences you can create!

Feel free to edit the CSV file (using Excel) to modify personal details and add more people. You can even add additional user properties, but you will also need to make some changes to the PowerShell script to get these into Active Directory, not hard if you are familiar with PowerShell.

I’ve tested the PowerShell script on a Windows 2008 R2 domain, however I executed it from a Windows 7 desktop. The script does not require Microsoft Exchange or third party script add-ons. I execute the script using the domain admin account. You may run into issues if you try using accounts with less privileges.

The script contains a path to an Active Directory Organisation Unit (OU) where all the accounts will be created (OU=Staff,DC=lab,DC=laptop,DC=iw). You will want to change this before running it in your environment. This OU needs to exist before you run the script.

I have configured the script to create the accounts but not to enable them. This is for security purposes. However, if you want to enable them, you just need to uncomment two lines and seek legal advice.

You can download the zip file containing the people details and PowerShell script from here. Any feedback greatly appreciated.

Getting help with Kerberos and SharePoint

Ever tried configuring a SharePoint environment to use Kerberos authentication? It is never a lot of fun. There aren’t that many people that know Kerberos to any great depth – I know I don’t. So any kind of help you can get with setting this up should be taken advantage of.

So pop over to SharePointSecurity.com and read about your new best friend – SharePoint Kerberos Buddy. I don’t think its an over-exaggeration to say that Adam Buenz is a genius in this area. Now he has released a FREE tool to help you get your Kerberos configuration right. Check it out.

Configuring BackConnectionHostNames for the Loopback Check

Its not always easy doing the right thing. At this stage, we all probably know about the issue with trying to access a site with a host name on Windows Servers (http://support.microsoft.com/kb/896861).

You probably know that there are two ways of dealing with this issue - disabling the check or providing a safe list of sites.

The easiest thing to do is disable the check. But that doesn't make it right. The check is there to protect your system against nasties that want to do bad things to your server.

So that leaves us with the option of defining a safe list of addresses that the server can access locally. Sounds easy, but I've had problems every now and again with getting this to work and the temptation is to just revert to disabling the check. So I thought I'd share some rules that I follow when setting the BackConnectionHostNames entry:

1. Don't include the protocol - e.g. "mywebsite" rather than "http://mywebsite"
2. Put each entry on it's own line
3. Use lowercase - e.g. "mywebsite" rather than "MyWebSite"
4. If it is an internal site, include the short name as well as the fully qualified domain name (e.g. "mywebsite" and "mywebsite.domain.somewhere.local")
5. Reboot after you have created the BackConnectionHostNames registry entry. I believe that you don't need to reboot for subsequent changes to this key, but I probably would - call me superstitious.

Australian SharePoint Conference – only days away

The Australian SharePoint Conference is back in Sydney on March 8th and 9th. This is a great event to learn more about the SharePoint products and see how other companies in Australia are using it. There are four tracks, so there should be something for everyone:

• Business
• Voice of the Customer
• IT Professional
• Developer

Also check out the half-day workshops held on the 7th and 10th. For full details and to purchase tickets, visit www.sharepointconference.com.au

Sydney SharePoint User Group tonight (18 Jan 2011)

The Sydney SharePoint User Group is kicking off the year with a session on InfoPath 2010 on SharePoint 2010. The meeting is tonight – Tuesday 18 Jan, in the city – 280 Pitt Street.

For more details, check out http://www.sharepointusers.org.au/sydney

Geeks without Borders

Check out http://www.qlditrelief.org/ – see how you can provide assistance to the people affected by flooding in Queensland

Solved: Cannot upload a file to SharePoint 2010

A client was having a problem uploading documents to a SharePoint 2010 library last week. After filling out the Upload Document pop-up dialog box they got a basic browser “An error has occurred” message.

On closer inspection we saw a JavaScript error message in the lower left corner of the browser window. The details were:

Message: Unexpected call to method or property access.
Line: 264
Char: 5
Code: 0
URI: res://ieframe.dll/httpErrorPagesScripts.js

I found a KB article (979887) that mentions this error message and indicates that the problem is fixed in the latest security updates for Internet Explorer 8 (MS10-018 at the time of writing).

The client used the Microsoft Windows Update site (http://www.update.microsoft.com) to apply the updates and the problem vanished.

Not taking action is not always the best strategy

As part of my work, I often review how clients are managing their SharePoint farm. I've started to recognize a trend that I find a little disconcerting. It relates to applying operating system updates to Windows Servers. I find that the majority of my clients do not apply these automatically. The reason is that they feel that these updates may cause issues on the server. Let's be honest, there are plenty of examples of this happening, so this is not a unfounded concern.

But what is the downside of this approach? It means that their server is exposed to the issues that these patches apply to. To me, this is a significantly greater risk than a system becoming unavailable. Users may be unhappy if a server is offline, but what are the consequences of a hacker gaining access to your network?

I think there are two basic approaches you can take - turn on automatic updates or review and test each update that is released. These are the two extreme cases, but I know which end of the spectrum I would much rather be on. The number of companies with the skills and time to evaluate each update is small. Enabling monitoring of servers and services is relatively cost effective and has benefits above and beyond patch management.

Keeping the window of opportunity as small as possible for hackers is something every administrator should be trying to do. Hackers aren't after your servers specifically, they are just after the softest targets. Try not to be at the back of the herd when they attack.