Limiting the People Picker in SharePoint

We have multiple SharePoint environments that share the same Active Directory. However, there are cases where we need to keep the various groups of users separated. Normally the People Picker will return results from the entire Active Directory.

Doing some quick research I found that some settings available through stsadm that control how the People Picker behaves. This is described in the Microsoft TechNet article on Configure the People Picker. In particular we were interested in 2 properties

• peoplepicker-Peopleeditoronlyresolvewithinsitecollection - To force People Picker to only return users who have permissions in the site collection when the Check Names button is clicked
• peoplepicker-onlysearchwithinsitecollection - To force People Picker to only return users who have permissions in the site collection when the Select People and Groups dialog box is used

It appears that the phrase "have permissions in the site collection" did not mean what I expected. I would have expected that this would include anybody who has security permissions to the site. Instead, it means that a permission is set. That is the user is in the SPWeb.AllUsers collection (ie: has accessed the system).

Furthermore, the Check Names button has more than one function. If you enter an exact match, then Check Names verifies the name you entered. If you enter a partial match, it actually does a search which is controlled by the peoplepicker-onlysearchwithinsitecollection property.

Clear as mud? 

Amazon EC2 instance not accessible via RDP after Windows Update and reboot

For the last couple of days, I have been running into a problem where my Amazon EC2 instance is no longer accessible via remote desktop after a Windows Update and a reboot.

My process for setting up these servers is pretty straightforward: Install SQL 2008, Install SharePoint 2010 Prerequisites, Install SharePoint 2010, run Windows Update. I have done this a couple of dozen times now without any problems. Just a couple of days ago, I was finding that after the Windows Update and ensuing reboot, the server comes up, status is active, but it is not accessible via RDP or HTTP (just times out).

My first thought was that one of the more recent Windows Updates is incompatible Amazon EC2. Comparing my last successful installation with the latest Windows Update packages, I found that the following might be the culprit:

• Cumulative Security Update for Internet Explorer 8 for Windows Server 2008 x64 Edition (KB2482017)
• Platform Update Supplement for Windows Server 2008 x64 Edition (KB2117917)
• Security Update for Windows Server 2008 x64 Edition (KB2393802)
• Security Update for Windows Server 2008 x64 Edition (KB2479628)
• Security Update for Windows Server 2008 x64 Edition (KB2483185)
• Security Update for Windows Server 2008 x64 Edition (KB2485376)
• Update for Windows Server 2008 x64 Edition (KB971029)
• Windows Malicious Software Remove Tool x64 - February 2011 (KB890830)

So, I'd figure I would try again and leave out these specific updates, but upon reboot, my new instance would also be unaccessible via RDP or HTTP.

Perplexed and after a lot of searching, swearing, hair pulling, I came across this post: Avoiding RDP connectivity issues when running SharePoint 2010 on Amazon EC2. In particular, it mentions the Microsoft Article KB2379016: A computer that is running Windows Vista or Windows Server 2008 stops responding at the "Applying User Settings" stage of the logon process which describes the problem as being a deadlock in the Service Control Manager database. To break the deadlock, it is just a matter of forcing HTTP.sys depend on CryptSvc. This can be accomplished as follows:

1. Run regedit
2. Locate and the registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP
3. Create a New, Multi-string Value: DependOnService
4. Set a single value CRYPTSVC

So far so good. Maybe I'll get some sleep tonight.

 

Visual Studio 2010 setup

I had been working with Visual Studio 2003 / 2005 / 2008 and now have 2010. As usual there are some little things to do with the initial setup so that I can be functional again.

Running without a local SharePoint environment
When I try to create a new solution using any of the SharePoint templates, I got the error: A sharepoint server is not installed on this computer is not installed on this computer
It seems like in order to do SharePoint development on VS 2010 I need to have a local SharePoint environment. Unfortunately, I don't have enough horsepower to run SharePoint on my local machine so I have to go with a workaround. I know that this is not ideal, but I don't have a choice at the moment. Searching around, I came across this thread: A SharePoint server is not installed on this computer. One of the posts describes a workaround which is to essentially copy the whole registry tree of the 14 hive. So I went to my SharePoint 2010 server and exported the following [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0] and imported into my development machine. I then restarted Visual Studio and magically I am now able to create SharePoint solutions.

Adding assemblies
Another consequence of not having SharePoint on my local machine, I don't have all the assemblies in the right place. The easy workaround is as follows:

1. Copy C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\ISAPI from your SharePoint Server
2. Paste it into your local machine keeping the same folder hierarchy to be consistent
3. Run regedit
4. Add the key [HKLM]\SOFTWARE\Microsoft\.NETFramework\AssemblyFolders\SharePoint 2010 Assemblies. (Not sure if it's a Windows 7 change, but I now need to add this key instead: [HKLM]\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\AssemblyFoldersEx\SharePoint 2010 Assemblies).
5. Set the default value to C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\ISAPI

References: How to display an assembly in the "Add Reference" dialog box, How to display your assembly "Add References" dialog.

Adding Create GUID
One of the tools I find useful is a GUID generator. For some reason this is not installed by default in VS 2010. The good thing is that it is very easy to do as described in the article: How to enable "Create GUID" option in Visual Studio 2010. The steps are as follows:

1. Go to Tools->External Tools
2. Click Add
3. Enter a title (such as Create GUID)
4. In the command box, browse to C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\guidgen.exe
5. Click OK

SharePoint PrerequisiteInstaller log file location

After running the PrerequisiteInstaller you sometimes want to check the log file. At first it wasn't obvious to me where this would be stored. However, with a bit of searching I found out that it's simply stored in the %temp% directory. (duh!)

So just cd %temp% and look for the PrerequisiteInstaller.*.log files.

Moving the User Profile Service Application Synchronization Database

So, the problems with my Sync DB as I mentioned in a previous post finally caught up to me. Running low on disk space, we decided to add another block of disk space to the server and move the Sync DB over there.

Adding the volume on Amazon EC2 was very straightforward. It was just a matter creating a new volume, attaching it to the server, enabling and then formatting the drive. This is covered quite nicely in Attaching an EBS Volume to EC2.

Now with the drive ready, I needed to move the DB files over. The instructions for Moving User Databases are pretty straightforward. However, I ran into some hiccups - I had open connections to the database (from when I was troubleshooting the database size :-) ) and the command to take the database offline simply waits until those connections are closed and you're none the wiser. Also, the new files / locations need to have the right permissions otherwise you can't bring the database back online. So, here are my updated steps.

1. Close all connections to your database. You can check for open connections by executing an sp_who2
2. Take the database offline by running the following:
   ALTER DATABASE [Sync DB] SET OFFLINE
3. Move the files to the new location
4. Update the new location in the system catalog as follows (make sure you use your own location!)
   ALTER DATABASE [Sync DB] MODIFY FILE ( NAME = 'Sync DB', FILENAME = 'E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\Sync DB.mdf' );
   ALTER DATABASE [Sync DB] MODIFY FILE ( NAME = 'Sync DB_log', FILENAME = 'E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\Sync DB_log.LDF' );
5. Make sure that the database user has the correct permissions to the database files. I just copied the original settings which is giving the SQLServerMSSQLUser group full control access to the DATA folder (and the new database files). 
6. Bring the database back online by running the following:
   ALTER DATABASE [Sync DB] SET ONLINE
7. Verify the file change by running the following:
   SELECT  name, physical_name FROM sys.master_files WHERE sys.master_files.database_id = DB_ID(N'Sync DB')

I still haven't gotten to the root cause of the database file being so large. However, I just needed to buy some time for now.

PowerTab

The tab autocompletion in Powershell has, by default, the same annoying behaviour as cmd. Fortunately, Powershell has a TabExtension function. The nice folks at PowerTab have written a richer tab extension similar to the intellisense found in Visual Studio.

I just grab the latest copy of the module and put it into C:\Windows\System32\WindowsPowerShell\v1.0\Modules. This way it always loads for every user. In the first startup I just took the default settings in the configuration wizard. It took a couple of minutes to build and that was it.

User Profile Service Application Synchronization DB size

I have a SharePoint instance that is running out of disk space. Doing some poking around, I found that the User Profile Service Application Sync_DB has grown to almost 7GB. So, I ran the following SQL query to get more insight into what is going on:
exec sp_MSforeachtable @command1="EXEC sp_spaceused '?'"
Looking through the results I see that the culprits are as follows:

name	rows	reserved	data	index_size	unused
ObjectsInternal	3156618	2089728 KB	800296 KB	1288776 KB	656 KB
InstanceData	177997	4698144 KB	4697048 KB	296 KB	800 KB

I decided to take a peek inside these tables and it looks like there are thousands of objects created every day. So what are these and do they get cleared out any time?

I found a similar question asked: User Profile Service Application SyncDB Database Size. There is an response that is marked as an answer, but it merely leads us to recommended provisioning sizes of these databases to be medium to large (100GB to 1TB). There is no explanation why. This is quite bogus as I only have 75 profiles.

Argh!

I have posted a followup here: Moving the User Profile Service Application Synchronization Database