Getting Access Denied, even when you are a Site Collection Administrator

Here’s a solution I found to a weird issue I recently encountered. It was for a SharePoint 2007 site that had been upgraded to 2010 while also moved to a new domain. For some reason, a few of the user accounts were not getting authenticated properly. They would get the “Access Denied” page. This happened even if the person was set up as a Site Collection Administrator.

I found that this problem disappeared if I ran the following command:

stsadm –o migrateuser olddomain\username newdomain\username –ignoresidhistory

This command would return an error “Value cannot be null. Parameter Name: UserProfileApplicationProxy”. Regardless, the account could then log into the site.

Why? Don’t know.

How to make 100 friends in SharePoint

Do you have SharePoint installed on a development or test environment somewhere? Does it have it’s own Active Directory installation? So, how do you explore all the wonderful features of the SharePoint User Profile service? You know, like the Silverlight organisation chart, or Audiences, or Colleagues, or…

Well, not to fear, after much procrastination, I’m finally able to provide a solution to your problem. I’ve made up names, job titles and managers for 100 people. Any similarity to real people is purely coincidental. Not only that, but I’ve created a PowerShell script to create these accounts in Active Directory.

This means your User Profiles in your virtual environment can go from a bland handful of test accounts, to a dazzling collection of fictitious employees in different departments, physical offices and job titles. Just imagine the Audiences you can create!

Feel free to edit the CSV file (using Excel) to modify personal details and add more people. You can even add additional user properties, but you will also need to make some changes to the PowerShell script to get these into Active Directory, not hard if you are familiar with PowerShell.

I’ve tested the PowerShell script on a Windows 2008 R2 domain, however I executed it from a Windows 7 desktop. The script does not require Microsoft Exchange or third party script add-ons. I execute the script using the domain admin account. You may run into issues if you try using accounts with less privileges.

The script contains a path to an Active Directory Organisation Unit (OU) where all the accounts will be created (OU=Staff,DC=lab,DC=laptop,DC=iw). You will want to change this before running it in your environment. This OU needs to exist before you run the script.

I have configured the script to create the accounts but not to enable them. This is for security purposes. However, if you want to enable them, you just need to uncomment two lines and seek legal advice.

You can download the zip file containing the people details and PowerShell script from here. Any feedback greatly appreciated.

Getting help with Kerberos and SharePoint

Ever tried configuring a SharePoint environment to use Kerberos authentication? It is never a lot of fun. There aren’t that many people that know Kerberos to any great depth – I know I don’t. So any kind of help you can get with setting this up should be taken advantage of.

So pop over to SharePointSecurity.com and read about your new best friend – SharePoint Kerberos Buddy. I don’t think its an over-exaggeration to say that Adam Buenz is a genius in this area. Now he has released a FREE tool to help you get your Kerberos configuration right. Check it out.

Configuring BackConnectionHostNames for the Loopback Check

Its not always easy doing the right thing. At this stage, we all probably know about the issue with trying to access a site with a host name on Windows Servers (http://support.microsoft.com/kb/896861).

You probably know that there are two ways of dealing with this issue - disabling the check or providing a safe list of sites.

The easiest thing to do is disable the check. But that doesn't make it right. The check is there to protect your system against nasties that want to do bad things to your server.

So that leaves us with the option of defining a safe list of addresses that the server can access locally. Sounds easy, but I've had problems every now and again with getting this to work and the temptation is to just revert to disabling the check. So I thought I'd share some rules that I follow when setting the BackConnectionHostNames entry:

1. Don't include the protocol - e.g. "mywebsite" rather than "http://mywebsite"
2. Put each entry on it's own line
3. Use lowercase - e.g. "mywebsite" rather than "MyWebSite"
4. If it is an internal site, include the short name as well as the fully qualified domain name (e.g. "mywebsite" and "mywebsite.domain.somewhere.local")
5. Reboot after you have created the BackConnectionHostNames registry entry. I believe that you don't need to reboot for subsequent changes to this key, but I probably would - call me superstitious.

Australian SharePoint Conference – only days away

The Australian SharePoint Conference is back in Sydney on March 8th and 9th. This is a great event to learn more about the SharePoint products and see how other companies in Australia are using it. There are four tracks, so there should be something for everyone:

• Business
• Voice of the Customer
• IT Professional
• Developer

Also check out the half-day workshops held on the 7th and 10th. For full details and to purchase tickets, visit www.sharepointconference.com.au

Sydney SharePoint User Group tonight (18 Jan 2011)

The Sydney SharePoint User Group is kicking off the year with a session on InfoPath 2010 on SharePoint 2010. The meeting is tonight – Tuesday 18 Jan, in the city – 280 Pitt Street.

For more details, check out http://www.sharepointusers.org.au/sydney

Geeks without Borders

Check out http://www.qlditrelief.org/ – see how you can provide assistance to the people affected by flooding in Queensland

Solved: Cannot upload a file to SharePoint 2010

A client was having a problem uploading documents to a SharePoint 2010 library last week. After filling out the Upload Document pop-up dialog box they got a basic browser “An error has occurred” message.

On closer inspection we saw a JavaScript error message in the lower left corner of the browser window. The details were:

Message: Unexpected call to method or property access.
Line: 264
Char: 5
Code: 0
URI: res://ieframe.dll/httpErrorPagesScripts.js

I found a KB article (979887) that mentions this error message and indicates that the problem is fixed in the latest security updates for Internet Explorer 8 (MS10-018 at the time of writing).

The client used the Microsoft Windows Update site (http://www.update.microsoft.com) to apply the updates and the problem vanished.

Not taking action is not always the best strategy

As part of my work, I often review how clients are managing their SharePoint farm. I've started to recognize a trend that I find a little disconcerting. It relates to applying operating system updates to Windows Servers. I find that the majority of my clients do not apply these automatically. The reason is that they feel that these updates may cause issues on the server. Let's be honest, there are plenty of examples of this happening, so this is not a unfounded concern.

But what is the downside of this approach? It means that their server is exposed to the issues that these patches apply to. To me, this is a significantly greater risk than a system becoming unavailable. Users may be unhappy if a server is offline, but what are the consequences of a hacker gaining access to your network?

I think there are two basic approaches you can take - turn on automatic updates or review and test each update that is released. These are the two extreme cases, but I know which end of the spectrum I would much rather be on. The number of companies with the skills and time to evaluate each update is small. Enabling monitoring of servers and services is relatively cost effective and has benefits above and beyond patch management.

Keeping the window of opportunity as small as possible for hackers is something every administrator should be trying to do. Hackers aren't after your servers specifically, they are just after the softest targets. Try not to be at the back of the herd when they attack.

Using the System.Diagnostics EventLog.WriteEntry

Disclaimer – I’m a part-time developer. Do not assume that any coding advice that you read here is “best practice”.

I’ve been working on a SharePoint timer job in SharePoint 2007. To make it easier to find out what is going on within the job, I want to write to a log. From my perspective, the best log to use is the Windows Application log. This is a location that server administrators are familiar with accessing and there are many monitoring products out there that can keep an eye on it for you.

The Microsoft Dot Net Framework includes a System.Diagnostics namespace to help you interact with the Windows Logs. Initially I thought it would be a straightforward job to just call the Eventlog.WriteEntry() method. That’s when I disappeared down the rabbit hole of MSDN articles and blog posts.

Here’s what I’ve discovered in my journey:

When writing to the event log you need to specify a Source. This identifies the process that generated the error. This column is shown in the Windows Application Log and it can be used for filtering. It may be possible to use pre-existing ones, but I wanted to use my own.

When you use the EventLog.WriteEntry() method with a Source that doesn’t already exist, Windows will try to create the source for you. Behind the scenes, that involves updating the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application (assuming you are writing to the Application log). The problem is that your code may not have permissions to update that location, which causes your code to throw an exception. Trust me, it can take a while to realise that your error handling code is the component that is causing the problems.

You’ll find a number of blog posts and forum responses out there about granting ASPNet accounts permissions to registry keys. I really don’t like including steps like that as part of a deployment, so I continued to look for another approach. As an aside, since my code is a timer job, it will be running under the credentials of the account configured for the OWSTimer service. Even when I granted this account permissions to the Application and Security registry keys AND ran the code using the SPSecurity.RunWithElevatedPrivileges, I still couldn’t get it to create the Event Log source for me.

If your read this KB article you might decide to create the source manually by adding a registry key under the KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application key and giving it the same name as the Source parameter in your call to eventLog.WriteEntry(). This will stop your call to EventLog.WriteEntry() crashing, however – you’ll probably start seeing longwinded error messages in your eventlogs such as:

The description for Event ID 0 from source YourSourceName cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

The actual text from you event will be appended. Not ideal, is it?

It turns out that event log messages are usually generated by passing an ID along with some parameters. This gets cross-referenced with a “message log file” and translated into the text seen in the event log. This makes translating errors into multiple languages easy. So what Windows is trying to tell us in the previous message is that it cannot find this message log file, which isn’t surprising, because I didn’t create one.

Now if I were a real developer, I’d probably go off and create a message log file, bundle it up and register it using all the proper ways and means. But I’m not. I just want to write a message to the Windows Event Logs.

So here’s the approach I worked out. I created a simple Dot Net console app. I included a reference to the System.Diagnostics namespace, and I added one line of code to the main() method -

EventLog.CreateEventSource("MySourceName", "Application");

I then run this application directly on the server (Windows 2008 Standard in this case) while I’m logged on as a local administrator. I checked the registry and confirmed that a new key had been added to the KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application location. This key includes a value that references EventLogMessages.dll

This is a reference to one of those message log files I mentioned earlier. It basically contains a simple mapping rule that outputs whatever text you pass EventLog.WriteEntry(). I rebooted the server at this stage. This may not be necessary, perhaps I could have just restarted the timer job service. I’ll leave that as an exercise for the reader.

Once the machine came back online, my timer job started writing to the event log without all the extra “the description of the event not found”. Now if I’m working on a multi-server SharePoint farm, I’d run my little console app on each of the servers to ensure that they all get the registry settings. I could even get trickier and make the console app use a command line parameter for my Source name, but I don’t want to stretch my luck.

One of Microsoft’s support articles mentions using an EventLogInstaller class to register the source. That worked too, but I found the console app easier to create and easier to implement in a production environment. I’m not sure what the advantages are with the EventLogInstallter, perhaps it makes sense if you are creating more complicated setup applications.

Here’s a link to an MSDN magazine article that explained a lot of the process to me:

http://msdn.microsoft.com/en-us/magazine/cc163446.aspx#S3

Sydney SharePoint User Group - The Reluctant Database Administrator

Don’t forget that the October SharePoint User Group in Sydney is tomorrow, Tuesday 19th. Victor Isakov will be discussing what a SharePoint Administrator should know if they become responsible for the SQL Server. More details available at http://www.sharepointusers.org.au/sydney. If you do want to come along, just e-mail sydney@sharepointusers.org.au so that we know you are coming.

SharePoint 2010 and the iPad

I have always loved gadgets. If it were true that these gadgets are productivity enhancing devices then I should be one of the most productive people alive. Sadly, this is not the case. It just seems that I can be unproductive in a lot more places than before.

Recently I caved in to temptation and got myself an iPad. Many people have sneered at this device, but I have always considered it a brave move by Apple. It is an untested format in the marketplace. I think that only time will tell whether they carve out a place in peoples work and personal life or whether it goes the way of the Internet connected fridge. I also hope that other vendors innovate around this format, more choice is always better.

The main reason I gave myself for getting an iPad is so that I can become familiar with how it integrates with SharePoint. I know deep down that I really got one coz they are shiny and new, but the lie is easier to live with. In truth though, many of the clients that I work with have expressed interest in using iPads or have actually started to trial them. So I thought I might share some of my experiences here on the blog.

Firstly, I have come across two iPad applications in the App Store - SharePlus and Filamente. Both of these allow you to access a Sharepoint site, lists libraries and sub sites. Both provide the ability to sync content so that you can access it offline, and both have their own little quirks. These are version 1 products, hopefully reliability will get better as they mature. Neither of these applications gives the user the same experience as if they were using a web browser, they focus on letting you see content in your SharePoint lists and libraries.

Another option is to use the iPad Safari browser. This proves to be a nice option for online access. If I am in my office I can access the site by entering a fully qualified domain name (e.g. http://somewhere.officenetwork.local). Even though the site is also available on a shorter name of http://somewhere, the iPad doesn't seem to be able to use that. Of course you will need to ensure that your Alternate Access Mapping and IIS host headers are correctly set up for this to work.

Outside my office I have been able to connect to my intranet through the iPads VPN functionality. We also publish our intranet externally using Microsoft Threat Management Gateway over SSL, the iPad browser has no issue with this either, however the two iPad apps didn't accept this method of connecting.

Not everything works perfectly through the safari browser when accessing a SharePoint 2010 site. Vertical and horizontal scrolling can be troublesome, rotating the display between portrait and landscape seems to fix this some times, two-finger scrolling is another trick that has mixed results. Pinching to zoom in and out of the page has rarely worked for me. I've also noticed that the people picker field only lets you search for a name, not type one in directly. You can create, edit and delete list items but don't expect to use any of the more advanced rich text editing functionality.

One area that I think holds a lot of promise on the iPad is the Office Web Applications and InfoPath Forms Services. I haven't had a chance to check these out myself yet (see earlier comments on productivity) but Dux Raymond Sy has an interesting video that shows some of these in action.

So I shall continue to explore the capabilities of the device and share what I learn here. Stay tuned.

Don’t Do What Johnny Don’t Does

You know that sense of relief that you get when you stop banging your head against a brick wall? Well, I experienced that this week and I thought I’d share, just in case there are others out there that are going through the same.

I was setting up a SharePoint 2010 environment and configuring it to index PDF documents. This is still a manual task in SharePoint 2010 as the components are not built in to the platform. However, it’s not that hard. If you go about it the right way that is.

You should already know that SharePoint 2010 will only run on a 64-bit operating system. Therefore you are going to need a 64-bit PDF iFilter to allow SharePoint to index the PDF content. There are a few on the market, some free, some you pay for. In this case the client decided to use the free Adobe PDF iFilter. Not a problem. I installed Adobe Acrobat Reader 9 (which has an iFilter built in) on the SharePoint server, I made a bunch of changes to the registry, I updated Central Admin, I rebooted a half dozen times, I lit incense sticks, performed full indexes another half dozen times yet could still not get PDFs indexed.

Blog post comments indicated that others were experiencing similar issues. The blog article would explain how easy it all was, then a few of the commenters would say that they just could not get it working.

The moment of enlightenment came when I realized that there is a difference between the iFilter built in to the Adobe Reader 9 application and the separate download that Adobe have for the 64-bit PDF iFilter. THAT is what I needed. I was wondering why the installation directory for the Reader was pointing to c:\program files (x86). Sure, this would all work fine on a 32-bit platform, but when you are on 64-bit, then the Reader app won’t cut it no more.

So I uninstalled the Reader app, installed Adobe’s 64-bit iFilter, and Microsoft Bob became my uncle. There is one registry setting that I needed to make (only one)

1. Launch RegEdit on the SharePoint index server
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0\Search\Setup\ContentIndexCommon\Filters\Extension
3. Create a new key called “pdf”
4. Set the (Default) value for the key to {E8978DA6-047F-4E3D-9C78-CDBE46041603}

If you look at the other registry keys in this section, the (Default) value type should be REG_MULTI_SZ. However, I couldn’t figure out how to change the type for the (Default) value in my new “pdf” key. I got round this by exporting one of the other keys, editing it in Notepad and then importing it. I’m tricky.

Don’t forget that you also need to add the PDF extension to the list of File Types that SharePoint should index. You’ll find this under the management page of the Search Service Application.

I may have restarted the SharePoint Server Search Service (net stop osearch14, net start osearch14), I can’t recall.

After that, just run a full index of your SharePoint 2010 content and you should be good to go. As a side note, I’ve heard that you can’t configure PDF indexing on SharePoint Foundation Server (what you might call WSS 4.0). I haven’t tried, so can’t confirm or deny that.

What Content Types are published from the Content Type Hub?

In SharePoint 2010 there is this great new functionality to define a Site Collection as a Content Type Hub. Once you do this, SharePoint will copy any Content Types you declare in this Site Collection out to any other Site Collections that subscribe to the same Managed Metadata Service as the Content Type Hub.

Today a client asked if they can define Content Types at sub-site levels in the Content Type Hub site collection and have them published out. Interesting idea, and there was nothing that confirmed or denied it in the TechNet documentation. So after some testing I can now confirm…that you can’t. Only Content Types defined at the root of the Content Type Hub Site Collection are published out.

Interactive Pivot of Australia Tech-Ed 2010 Sessions

Going to Tech-Ed in Australia next week? Check out this Microsoft Pivot of the session data, created by MVP Rob Farley:

http://pivot.lobsterpot.com.au/TechEdAU2010/

I’ve been able to quickly filter down to the SharePoint sessions and see who is presenting on what day (fyi – there are 20 Office/SharePoint breakout sessions).

It would be nice if it was easier to get something like the session names for the set of data you are looking at, rather than having to click on each item individually. Still – it’s a nice fast way of browsing a large amount of data.

Right Click on a SharePoint 2010 list item

One thing I liked in SharePoint 2007 was the ability to click anywhere along an item’s drop-down field to get at the menu. I was disappointed to see this removed in SharePoint 2010 – now you have to click on the dropdown list’s down arrow to see the menu.

Sure, it makes sense from a user interface perspective – consistency with standard UI controls and all that. However it was a pain to have to move my mouse those extra few pixels to the right, particularly if the dropdown field is very wide.

Well, I just discovered that you can now right-click anywhere on a list item’s drop down field (except on the text) and you’ll get the drop down menu for the item. This is going to save me so much time!

Opening a Word document from SharePoint hangs the browser

Here’s an issue that I ran into on a recent project – when I tried to open a document (for editing) from the SharePoint web site, the browser would hang, Word wouldn’t launch and I would have to end up killing the Word and Internet Explorer processes using the Task Manager.

To keep a long, tedious story short, I eventually discovered that the document’s metadata in SharePoint had trailing spaces. Once I removed these, the document opened up just fine. One or two trailing spaces seemed to be fine, but if there was a lot of them, then it caused issues when trying to open the document in Word.

It’s not particularly easy to get trailing spaces into a document’s metadata. If you try to insert them via the browser user interface, SharePoint automatically removes them for you. However, in this project, I was populating the metadata using code. So now I know to use a Trim statement in my code to remove any trailing spaces when updating a SharePoint document’s metadata.

Shared Service Provider – Access Denied message

Interesting issue I just had with a Shared Service Provider setup that I thought I’d share. After creating the Shared Service Provider, I tried accessing it, but I got the SharePoint “Access Denied” message. I made sure that the account that I was using was a Site Collection Administrator. I also tried giving the account full control via a Web Application Policy. Setting up another account as a site collection admin didn’t work either. No errors or warnings in the Windows Event Logs.

When I created the Web Application for the SSP, I provided an AD account to use for the Application Pool. When I set up the SSP, I specified a different account for the Shared Services Timer Jobs. This is a “best practice” – having different accounts for different jobs.

Looking at IIS, I noticed that the App Pool for my SSP web app was using the SSP Timer Service account. Odd.

I went back and modified the SSP configuration (Central Admin – Application Management – Manage this farm’s Shared Services – Edit Properties) and changed the SSP Service Credentials to the account that I originally specified for the SSP App Pool. I flicked back over to the IIS Management screen to confirm that the Application Pool was now using the account I expected.

I was then able to browse to the SSP admin site. I can’t say I understand why this issue has occurred, but there you have it. I did see a comment about not using the same name for the App Pool and the SSP name which might be the reason for my problem. I’m too lazy to retest right now.

Other related info – my environment is running on Windows 2008 SP2 x64, MOSS 2007 Enterprise with SP 2, using separate servers for AD, SQL and MOSS.

Photos from the Sydney SharePoint User Group Launch

Here are some photos that we took during the Sydney SharePoint User Group 2010 Launch event. We had a packed room, great speakers and cool prizes to give away. Thanks again to Microsoft for letting us use their venue and to AvePoint for the prizes and catering.

Got your tickets to Australia’s largest SharePoint Conference?

Only a few weeks to go before the SharePoint Conference kicks off in Sydney. The two day event is on June 16th and 17th at the Hilton Hotel in the city. There are three separate tracks, depending on your interest – Business, Technical and Case Studies.

The Keynote speaker for the event is Arpan Shah, the Director of the SharePoint Technical Product Management team at Microsoft HQ in Redmond. With the recent release of SharePoint 2010, this conference is an ideal place to get up to speed on the new platform and hear real-world stories from companies that use SharePoint on a day-to-day basis

For more details and to register for tickets go to http://www.sharepointconference.com.au/