By Eric Harlan
Published: August 17, 2010

SharePoint Saturday Baltimore is in full swing. Registration is open and it’s shaping up to be a great event. Do yourself a favor and make sure you’re there. You can go register now to secure your spot. Hopefully there are still spots available for you to get in. http://www.sharepointsaturday.org/baltimore

Check out the update videos as they come:

Submit Article

731 Views - View Comments (0)

Load all Snapin's to ONE PowerShell Profile

By Eric Harlan
Published: August 2, 2010
Updated: August 2, 2010

Tired of switching PowerShell windows between the main console, SharePoint and Fast? Here’s a quick way to combine all the consoles to one.

- Open the main powershell console and type “$profile” (no quotes) view the location of the profile. Chances are it will be in User\Profile\WindowsPowerShell\Microsoft.PowerShell.profile.ps1 but the following steps you will follow the location of the profile path. In my case it was the above so the steps are as follows.

(there is a powershell console for SharePoint, one for Fast and one for Windows itself)

- Go to your machine > Start > Computer > MyDocuments (documents)

- Create a new folder in this folder called “WindowsPowerShell” (no quotes)

- Add a new text file and name it “Microsoft.PowerShell.profile.ps1” (no quotes)

- Open this file (it will be blank) and add the following lines)

- “add-pssnapin “Microsoft.SharePoint.PowerShell” (no quotes)

- if you’re using fast add “add-pssnapin “Microsoft.FastSearch.PowerShell”

- Save

- Close previous PowerShell console

- Open Main “Windows” console (there is a powershell console for SharePoint, one for Fast and one for Windows itself)

- type “get-command get-sp*” (no quotes)

- Hit “enter”

You should see all the “SP” commandlets load. There ya go. Enjoy.

Ref: "RO" Fox

Submit Article

2046 Views - View Comments (0)

Why all these SharePoint service accounts?

By Eric Harlan
Published: July 15, 2010
Updated: July 15, 2010

Why all these service accounts?

I’ve started getting this question a LOT lately. I dug around for a few hours to see what I could find and I was shocked that I couldn’t find anything at all. That doesn’t mean there is nothing out there but really shocking to see that it didn’t come up in the first few pages of BING.

So the million dollar question:

Why do I need all of these SharePoint Service Accounts to run SharePoint?

I’m going to attempt to answer just that today. The short answer is you don’t need all those accounts, but you should read all of this article. The other day I was asked; how long does it take to install SharePoint? The answer I had really shocked the curious. “Well that depends really, do you want to do it the ‘Seldom right, wrong way…. The Right Wrong way, or the Right RIGHT way’”?

The fact of the matter is that there are, in my eyes 3.5 ways to install SharePoint:

1) The Seldom Right, Wrong way: (Stand Alone Server)This is usually for use in development environments. Demo boxes or SandBoxes.

a. Stand alone with a Database on the same box

2) The Right Wrong way:(Complete Farm using the Service Application Wizard) This is when you install SharePoint you build out a great farm but when you do the installation and subsequently the configuration you install all of your Service Applications (or a portion of) using the Service Application wizard.

3) The Right Right way: (Full install and create Service Applications manually) *Also Best Practice* This is where you get through the easy configuration and decline to run the Service Application wizard. You then manually create all of your Service Applications, using specific Service Accounts, Web Apps and Databases.

Woah, wait a second Eric. Are you saying the other ways are wrong? Why are they even available to the installer?

Short answer is that there are COMPLETELY VALID REASONS to do any of the previously mentioned methods of install. The fact that they can ever be considered wrong has everything to do with the plan for the instance by the enterprise.

Ok Eric, you have my attention. Why do I need to spend the time to create all of these service accounts. (and you better make it good because I know I can run SharePoint off of a single account).

Fair enough, let’s go at this in a Pro’s and Cons format. Cons first.

Cons:

Takes forever: If your company has an IT side that manages AD and the turnaround time for creating these accounts and giving them permissions takes a week. Well yeah that stinks

Management: You or said I.T. dept has to now manage these accounts. The passwords etc.

Multiple Points of FAILURE: This is one way to look at the same coin. A point we’ll make in the pro’s. But it is true to an extent. More accounts you have the more chances something goes bad with one and a service goes down.

Pros:

Separation of Data: When it comes down to the nitty gritty and there needs to be “physical” boundaries between data you’ll want to use different service accounts. Think about search content access, user profile data etc.

Custom Database Names: This is a roundabout way pro for using separate service accounts and really is a point towards not using the Service Application wizard. It goes hand in hand that by not using the wizard you can use your own service account for the application and therefore being able to name the databases that get created when configuring specific Service Applications.

Custom Web App Names: Same as above, not using the wizard and using your own service accounts lets you dictate what names most Web Apps are called as well as what services run under them.

Multiple Points of REDUNDENCY: This is that flip side of the same coin we talked about above. Just as multiple accounts could be failure points. They are also redundancy levels. Think if you had all your services running under the same service account. What if that account went bad, password expired etc. All your services go down. Now think if you had all your proper service accounts structured out maybe just search goes down but the rest of your farm and access to its features is still up.

Managed Accounts: With the new feature of managed accounts in SharePoint 2010 we can now, as the great entrepreneur Ron Popeil says: “Set it ANNNNND forget it”! We can now set SharePoint to manage the passwords of our Service Accounts (yes that can be scary) but some of that risk is taken out of needing to worry about the passwords.

Least Privileges: This basically means that you can manage and control the exact level of permissions that SharePoint can operate under. Feel free to search on “SharePoint Least Privileges” it will give you a good understanding of just how lean you can run SharePoint and still have all things work correctly.

Deep breath.

That’s really it in a nut shell. Do I think you should setup SharePoint using the recommended Service accounts? In a word, YES!

It will save you headaches, heartaches and long nights that are associated with permission based problems with SharePoint. Take the extra 2-3 hours to setup the accounts and the extra few hours (to days) setting up SharePoint the “RIGHT RIGHT” way.

So now when someone ask’s do we really need to create all these accounts for SharePoint. You’ll be able to answer them with pro’s and con’s of doing so. Many tell you the how and what for Service Accounts. Now you know the why.

Links:

Dan Holme - Least Privilege Service Accounts For SharePoint 2010

Shane Young - What Service Accounts do you need to install SharePoint 2010

Microsoft - Administrative and Service Accounts Required for initial deployment (part 1)

and part 2 (the lengthy part) located here http://technet.microsoft.com/en-us/library/cc678863.aspx

Submit Article

3301 Views - View Comments (0)

Cant change Web App pool drop down or Cant start service in Central admin

By Eric Harlan
Published: June 14, 2010

So I ran into an interesting issue today at a client site. If you ever go into Central Administration on SharePoint 2007 and realize you can’t change Web Application pool drop downs, or you can’t start a service. It’s a good bet that Internet Explorer enhanced security configuration is enabled on the browser.

You can either disable it in the browser of if it suites your needs you can disable it all together. Here’s how.

Control panel

Add remove window programs

Window components

Internet Explorer enhanced security configuration (uncheck)

Hope that helps short, sweet and to the point.

Submit Article

3518 Views - View Comments (0)

Install SharePoint 2010 and Manually Configure Service Accounts

By Eric Harlan
Published: June 5, 2010
Updated: June 5, 2010

(update)

For a non default walk through of a SharePoint installation and to really understand the nuts and bolts click here http://www.ericharlan.com/Moss_SharePoint_2007_Blog/install-sharepoint-2010-and-manually-configure-service-accounts-a179.html

I got the chance to catch up on a SharePoint 2010 install the other week. This one was different; they understood the pros and cons to segmenting out information through proper service account management, service accounts run by their own isolated identities giving a properly setup farm as a result.

There have been a lot of blog entries on installing 2010 in a single server farm, I did one early on with adoption of the 64 bit platform and filling the gap between products (How To Install SharePoint 2010 Guide) but I was surprised to find that there were few breaking ground on full blown installs. There some good ones out there that Joel Oleson highlights a few of them out there (CJG being one of them).

I wanted to bridge some of the gap and provide a visual walk through of what is going on in full install of SharePoint 2010. I won’t spend too much time on the actual installing of the bits. There are plenty out there who have covered this (do your prereq’s, create your service accounts, give permissions etc). All that stuff is REALLY REALLY important to do correctly and do it before you really dig into the nuts and bolts of a SharePoint 2010 install.

A good frame of reference is that if your install of 2010 (including components I mention above) took less than a full work day and you didn’t install it as a single server install, chances are you didn’t do something right.

The first section of this guide is what you’ve all seen; the initial installation of SharePoint so there won’t be any commentary on this section. However the real meat of the post comes when setting your Service Applications. Specifically the User Profile Service, this service along with the Search Service (possibly FAST) is in my opinion the Service Applications with the most likelihood that something won’t go right in configuration. So I am going to focus on this one with the hopes that if you can do this one, you can do any of them.

So away we go. (clicking any image will open it in a new window)

Decide to run the wizard at this step. There are a few important decisions to make before deciding.

First thing to decide, do you want to run each Service application (or any) under its own service account. For more information about SharePoint 2010 Service accounts go here http://technet.microsoft.com/en-us/library/ee662513.aspx

If you choose to run the wizard you may choose which service accounts run under any given previously setup service account. HOWEVER, if you deselect some applications (such as search) you will be able to re run the wizard to create them. The only caveat to this is that you will not be able to select an alternate service account for which to use for said Search Service Account (or any other that you wish to add after the fact). The same service account you used to create the initial Service Accounts will be selected and “grayed out” and you must use it if you run via the wizard.

The alternative is to NOT run the wizard and configure the service applications manually.

In the guide below we have run the wizard for some service applications. We then configured Excel Services and User Profile (my sites.

Best practice is typically to create all the service applications manually. Use what you need and isolate via service accounts and proper permissions.

When running the wizard you must input the Service Account you wish to use. If you are using best practices you should be logged in as the SharePointInstall service account. You’ll want to make sure you use the SharePointApp service account.

When you enter in your credentials SharePoint takes this ALREADY EXISTING AD ACCOUNT and add it to its managed accounts list.

After this step you will receive a screen that shows the service applications installed and their statuses. You will click “Finish

Next you will be presented with the screen to create your first outward facing (i.e. intra/extra/internet site). You may choose to hit skip here or you can go ahead and create your site.

Possible reason’s to skip would be you are not satisfied with the default settings that SharePoint automatically gives your default Web Application. (SharePoint – 80). If you plan to delete this web application and recreate it with specific settings, there is no reason to waste time creating a site collection at this step.

Excel Services Application

Now the next step in the process is to create the Service Applications you need for your Enterprise but did not create with the wizard earlier. Again, in our deployment we only have Excel Services and User Profile service to create manually.

Go to “Application Management” > “Manage Service Applications” > select “New” from the ribbon and choose the service you want to create, in our case the Excel Services Application

Click on “Register new managed account”

Now you will enter in the Service Account you want to use for this Service Application in our case we are using the Excel Services Account

Once you create your managed account and click “OK” you will be taken back to the previous screen to enter in your Service Application details. Here you will enter your title, Application pool name, and make sure your appropriate service account is selected.

Click “OK” to proceed

The Service account creation will process…

Then you will be taken back to your Service Application management page complete with your new Excel Services Service Application.

User Profile Service Application

The next Service Application we will address is one of (if not the) most complicated SA in the SA stack. The User Profile Service Account.

The first step is to understand what makes up the User Profile Service.

The User profile service contains features such as My Sites, Profile Database, Sync Database, Social/Tagging Database.

The real value here is to setup My Sites under its own Service Account. The isolation of having that in place will be valuable down the road and it’s an overall best practice.

However the process that is automated in the Service Application Wizard does quite a few things for this service and it’s very important to understand what it does and the steps it takes. To outline what the wizard does:

· Creates MySites Web Application

· Creates Site Collection using “My Site Host” template

· Creates Profile, Social & Sync Databases

· Connects to all the default Service Connections

· Sets Managed path /personal

It is important to proceed with the following steps in the order outlined.

Order as follows:

· Create My Site Web Application

· Create My Site Site collection via “My Site Host” template

· Create managed path for My Sites

· Create actual User Profile Service Application

· Enable User Profile and User Profile Sync Service

Step 1 is to create a new web application for your My Sites.

Go to “Application Management” > “Manage web applications” > “New” (on the ribbon)

Here you will be able to select which Service Accounts you would like your User Profile Service to have access to. Keep in mind, depending on the order in which you create your Service Applications will determine what is available in the Service Application Connections list.

Here you are specifying an application pool name and the account its running under for the My Sites web application. There is nothing special about the account and it is not linked to the User Profile Service in any way.

When ready select “Ok”.

Once you’ve created your My Site Web Application we need to create the actual site collection.

Go to “Application Management” > “Create Site Collection”

Make sure the yellow drop down box has the Web Application of the My Site you just created. Proceed to name your site collection and choose “My Site Host” under the “Enterprise tab”.

Once you create your site collection, click next to the My Sites site collection to highlight that entry in the list (this will enable using the ribbon for that site collection). Select “Managed Paths” and add the new wild card inclusion managed path of “/personal”.

Select “OK” to see your managed path added.

Now to actually create the User Profile Service Application.

Proceed to “Application Management” > “Manage Service Applications”.

Under “New” select “User Profile Service Application”.

In the first option you have the option to use an existing application pool. You also have the option to create your own. A new application pool will be represented by a web application in IIS with a GUID naming convention with the User Profile Service Application tied to the IIS web app pool application.

Here you will confirm your database server and Sync Database Name. If you require SQL authentication (not recommended) you can place that as well as the failover database server here.

NOTE: by simply placing an additional database server as a failover database does not give SharePoint an automatic fail over point. You must configure the additional server as well.

Do the same for your Social Database here.

At this stage you will designate the managed path you have allocated for your My Sites “/personal”. As well as choose the my site, site creation naming convention.

When ready select “Create”.

Success.