Server and AD trust relationships

Recently one of my servers started having trust issues. I would RDP to the server and it would appear to accept my domain login credentials fine, but then kick me back to the Windows server login screen with the following error:
The username or password is incorrect

I logged in as a local administrator and saw the following in the Security log
Unknown user name or bad password
... with the following status codes: 0xc000006d 0xc000006a

I tried disconnecting from the domain and reconnecting, with the required reboots, and now I get this error:
The trust relationship between this workstation and the primary domain failed

I tried to disconnect, remove the computer account, reconnect, but this resulted in this error:
The security database on the server does not have a computer account for this workstation trust relationship

This is very frustrating so finally, I did the following:
Disconnect from the domain (with a reboot)
Remove the computer account from AD
Reboot both the primary and secondary DCs
Rejoin the domain (with a reboot)

That finally worked. So, when in doubt reboot possibly everything.

Enabling Powershell Remoting

I manage a bunch of SharePoint farms and have finally gotten around to setting up Powershell Remoting to streamline some of my maintenance tasks.

Following the post Enable and Use Remote Commands in Windows PowerShell, I run the following on my remote servers:
Enable-PSRemoting -force

From my client machine, I tried the following:
$computername="MyComputerName"
$credential="MyCredential"
Enter-PSSession -Computername $computername -Credential $credential

This resulted in the following error:

Enter-PSSession : Connecting to remote server failed with the following error message : WinRM cannot process the request. The following error occured while using Kerberos authentication: The network path was not found.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information,
 see the about_Remote_Troubleshooting Help topic.

I verified that my firewall was allowing the WinRM ports.

I set my trusted hosts on my remote servers using:

winrm s winrm/config/client '@{TrustedHosts="MyComputerName"}'

I then came across this post on how to enable Remote PSSession over SSL. I have a wildcard certificate for my domain. Modifying the script ever so slightly, I ran the following to enable HTTPS and disable HTTP transport

winrm create winrm/config/listener?Address=*+Transport=HTTPS `@`{Hostname=`"MyCertificateIssuedTo`"`; CertificateThumbprint=`"MyCertificateThumbprint`"`}

netsh advfirewall firewall add rule name="Windows Remote Management (HTTPS-In)" protocol=TCP dir=in localport=5986 action=allow

winrm set winrm/config/Listener?Address=*+Transport=HTTP `@`{Enabled=`"false`"`}

netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" new enable=no

Now I get the following error:

Enter-PSSession : Connecting to remote server failed with the following error message : The server certificate on the destination computer (MyComputerName) has the following errors:
The SSL certificate contains a common name (CN) that does not match the hostname. For more information, see the about_Remote_Troubleshooting Help topic.

Aha! Progress! Now looking at the Securing WinRM thread, I try the -SkipCACheck and -SkipCNCheck Session Options as described. Now I get the following error:

Enter-PSSession : Cannot bind parameter 'SessionOption'. Cannot convert the "Microsoft.WSMan.Management.SessionOption" value of type "Microsoft.WSMan.Management.SessionOption" to type "System.Management.Automation.Remoting.PSSessionOption".

It looks like some types have changed since that thread was posted. So, I used the following instead

Enter-PSSession -ComputerName $computername -Credential $credential -UseSSL -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck)


Success!

Locating unghosted pages

I recently came across a page that was giving me this error:
The control type '...' is not allowed on this page. The type is not registered as safe.

The obvious solution is to add a <SafeControl> tag to the web.config, but checking with my developer, he said it was not necessary and he does not have that declaration on his test server.

This led me to hypothesize that a custom branding we had was causing the problem to which my developer corroborated that unghosted master pages will cause problems.

So how to locate the unghosted pages? This led me to the following post: Ghosts in the Machine? However, this is for SharePoint 2007 so taking a leap of faith, I modified the SQL script provided and came up with this:

SELECT TOP 1000 
      [DirName]
      ,[LeafName]
      ,[SetupPath]
      ,[SetupPathUser]
  FROM [WSS_Content].[dbo].[AllDocs]
  where ([AllDocs].[Type] = 0)
  AND ([AllDocs].SetupPath IS NOT NULL)
  AND ([AllDocs].DocFlags & 64 = 64) 


Checking the reference for the AllDocs Table this query seemed to make sense.

Creating Community subsites

I tried to create a community on my brand new SharePoint 2013 server.

First of all, the familiar Site Actions->New Site has been moved. You now have to open the gear menu, select View Site Content, then click new subsite. According to some blogs, there should be a Community template, but that does not appear on my list.

Recalling that a subweb can be converted to a community via activating the Community Site Feature, I just created a Blank Site and tried to activate the feature. This is when I ran into the following errors:

The Site scoped feature being activated has a dependency on hidden Site scoped feature 'FeatureDefinition/4326e7fc-f35a-4b0f-927c-36264b0a4cf0' (ID: '4326e7fc-f35a-4b0f-927c-36264b0a4cf0'). Hidden features cannot be auto-activated across scopes. There may be one or more visible Site scoped features that auto-activate the dependent hidden feature.
The Site scoped feature being activated has a dependency on hidden Site scoped feature 'FeatureDefinition/915c240e-a6cc-49b8-8b2c-0bff8b553ed3' (ID: '915c240e-a6cc-49b8-8b2c-0bff8b553ed3'). Hidden features cannot be auto-activated across scopes. There may be one or more visible Site scoped features that auto-activate the dependent hidden feature.
The Site scoped feature being activated has a dependency on hidden Site scoped feature 'FeatureDefinition/d32700c7-9ec5-45e6-9c89-ea703efca1df' (ID: 'd32700c7-9ec5-45e6-9c89-ea703efca1df'). Hidden features cannot be auto-activated across scopes. There may be one or more visible Site scoped features that auto-activate the dependent hidden feature.
The Site scoped feature being activated has a dependency on hidden Site scoped feature 'FeatureDefinition/947afd14-0ea1-46c6-be97-dea1bf6f5bae' (ID: '947afd14-0ea1-46c6-be97-dea1bf6f5bae'). Hidden features cannot be auto-activated across scopes. There may be one or more visible Site scoped features that auto-activate the dependent hidden feature.
The Site scoped feature being activated has a dependency on hidden Site scoped feature 'FeatureDefinition/c6a92dbf-6441-4b8b-882f-8d97cb12c83a' (ID: 'c6a92dbf-6441-4b8b-882f-8d97cb12c83a'). Hidden features cannot be auto-activated across scopes. There may be one or more visible Site scoped features that auto-activate the dependent hidden feature.

Curious about what these are? I ran the following Powershell

@("4326e7fc-f35a-4b0f-927c-36264b0a4cf0", "915c240e-a6cc-49b8-8b2c-0bff8b553ed3", "d32700c7-9ec5-45e6-9c89-ea703efca1df", "947afd14-0ea1-46c6-be97-dea1bf6f5bae", "c6a92dbf-6441-4b8b-882f-8d97cb12c83a") | ForEach-Object {Get-SPFeature $_}

and got the following:

DisplayName                    Id                                       CompatibilityLevel   Scope

-----------                    --                                       ------------------   -----

SocialSite                     4326e7fc-f35a-4b0f-927c-36264b0a4cf0     15                   Site

Ratings                        915c240e-a6cc-49b8-8b2c-0bff8b553ed3     15                   Site

CategoriesList                 d32700c7-9ec5-45e6-9c89-ea703efca1df     15                   Web

MembershipList                 947afd14-0ea1-46c6-be97-dea1bf6f5bae     15                   Web

AbuseReportsList               c6a92dbf-6441-4b8b-882f-8d97cb12c83a     15                   Web

Is there a feature that will activate all these as well? Searching around the internet, I did not find any so I figured why not try just activating the 2 site scoped ones using the following Powershell:

$site=Get-SPSite https://somesiteurl
$feature=Get-SPFeature "4326e7fc-f35a-4b0f-927c-36264b0a4cf0"
Enable-SPFeature -Identity $feature -Url $site.Url

$feature=Get-SPFeature " 915c240e-a6cc-49b8-8b2c-0bff8b553ed3 "

Enable-SPFeature -Identity $feature -Url $site.Url

I then went back to the Blank site and was able to activate the Community Site Feature.

I also tried new subsite and, lo and behold, the Community template is now there.

I am sure that someone will soon document how this should actually be done and that this will also be fixed in RTM, but until then, this works for me.

SharePoint Timer Service not starting up

I recently discovered that on one of my farms my SharePoint Timer Service would continuously start up and crash.
There are numerous entries like the following 2 in the System log:

The SharePoint 2010 Timer service terminated unexpectedly.  It has done this 2965 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

and

The timer service could not initialize its configuration, please check the configuration database.  Will retry later.

The following is found in ULS:

SPTimerStore.InitializeTimer: SPConfigurationDatabase.RefreshCache returned SPConstants.InvalidRowVersion

and

The timer service could not initialize its configuration, please check the configuration database.  Will retry later.

I verified that my service's user context had the correct username and password.

I also cleared the timer cache (and, yes, I emptied the GUID folder and instead of deleting it).

There were a couple of DCOM 10016 errors which seemed irrelevant to this issue, but I fixed those anyway (as per http://sajiviswam.wordpress.com/2011/04/15/the-machine-default-permission-settings-do-not-grant-local-activation-permission-for-the-com-server-application-with-clsid-000c101c-0000-0000-c000-000000000046-sharepoint-2010/)

I'm still getting the same problem.

I started looking at the Fusion log as described in http://soerennielsen.wordpress.com/2009/01/14/fixing-the-timer-service-when-everything-breaks-down/ but think I'm in too deep.

What's curious is that the Timer Service stopped functioning around the time the web application was extended in order to support HTTPS and there are some new files in C:\windows\assembly\GAC_MSIL. However, I am unable to make any connection. As far as I can tell, my assemblies in the GAC are not corrupted since all other functions appear to be working.

SP2013Beta: Adding site (SPWeb) users

I ran into a several relatively trivial issues with adding users to the Members and Owners groups in SharePoint 2013 Beta

My administrator user does not have a Site Settings option under the gear icon at the My Site. However, this was available under my Home site ("/"), so doing some URL mangling, I was able to get the My Site Permissions page by going to /my/_layouts/15/user.aspx

Note that "All Authenticated Users" is now called "Everyone"

The people picker doesn't look like it's working. I get a "Sorry, we're having trouble reaching the server". However, I am able to add users (ie: Share, in SP2013 speak) if I enter the complete name in the picker.

Finally, the "Send an email invitation" setting is checked by default and only accessible after you expand Show Options. That is annoying.

New-SPAlternateURL : You must specify the default zone URL for all Web applications ...

I was configuring AAM using Powershell. I wanted my current Default URL to be my new Intranet URL and to use a new URL as my Default. To add a setting for a new zone, I was using New-SPAlternateURL. 


$app = Get-SPWebApplication
New-SPAlternateURL -WebApplication $app -Zone "Intranet" -Url $app.Url
...

However, this is what I am getting:

New-SPAlternateURL : You must specify the default zone URL for all Web applications. To delete the Alternate URL Collection, remove the public URLs in all other zones, and then remove the default zone URL


It turns out this is the error message you get when you try to use the same URL for more than one zone. It would have been nice if the error message actually said that. So now my code is like this:


$app = Get-SPWebApplication
$intranetUrl = $app.Url
Set-SPAlternateURL -Identity $app.Url -Zone "Default" -Url $defaultUrl
New-SPAlternateURL -WebApplication $app -Zone "Intranet" -Url $intranetUrl