Starting the User Profile Synchronization Service

Hello my friend!
Me and you obviously have something in common; we've experience the joy of configuring SharePoint 2010's User Profile Synchronization Service.
You've read all the other blog post's and now you're here. There isn't much I can tell you that you probably haven't read... most of the issues are caused by not following Microsoft instructions: http://technet.microsoft.com/en-us/library/ee721049.aspx#StartUPSSProc, and the fact that Forefront Identity Manager (FIM) is a PoS :)

One of the most important lines is: After the User Profile Synchronization service is started, the farm account is no longer required to be an administrator on the synchronization server. To improve the security of your SharePoint Server installation, remove the farm account from the Administrators group on the synchronization server. 

That means the account HAS to be in the local Administrators group before you can start it.

Other things to take in to consideration:

1. In a multi-server farm "Network Service" and SP account which is starting the User Profile Synchronization Service should also have (Component Services) Local Launch and Activation rights on:
1. Forefront Identity Manager Controller Object {36574FCB-E5F2-4C55-AA06-146B2B8FBD95}
2. Forefront Identity Manager Management Agents {10B6A600-6EE8-44F3-AC02-2CA42B08A2B5}
3. Forefront Identity Manager Script Host Loader {76032766-22CF-497D-BA0D-4F0583F05D15}
4. Forefront Identity Manager Synchronization Service {835BEE60-8731-4159-8BFF-941301D76D05}
2. A quick way to make sure your account has rights to launch FIM Synchronization Service is to login using the account and run C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe
3. Verify there is only 1 ForefrontIdentityManager Trusted Root Certificate
   Winows Key + R (run): mmc > Ctrl + M > Certificates > Add > Computer Account > Local
   If there are more delete ALL of them and restart the service from Central Admin.
4. Verify that both ForeFront Identity Manager services are set to Automatic and the Log On As identity is your SP account.
5. Make sure the SP account is an owner or at the very least FIM_SynchronizationService of  the User Profile Sync DB's
6. Give the "Network Service" account read/execute rights to "C:\Program Files\Microsoft Office Servers\14.0" directory.
7. Check the Application Pool is running and/or Recycle it.
   It will be the App Pool which is running "C:\Program Files\Microsoft Office Servers\14.0\webservices\Profile"
8. Try reinstalling FIM it's in your SP2010 install
   SPS2010\Global\Ppl\pplwfe.msi
   There's an update in the December 2010 CU "pplwfe-x-none.msp"
9. If you have set NetBiosDomainNamesEnabled on the User Profile Service application to True you may get Error: Unable to process Create message when you try a new Configure Synchronization Connection if you installed the SP2010 December 2010 CU; in this case you're stuffed and it's broken until MS release the Feb 2011 CU.
   To enable netbios names read: http://blogs.msdn.com/b/spses/archive/2010/04/01/sharepoint-2010-provisioning-user-profile-synchronization.aspx
10. User Profile Synchronization Service suck on "Starting"
    Try running the "ProfileSynchronizationSetupJob" timer job, then check the Timer Job Status page... chance are the Progress is 0%
    I've had this issue and I went home came back the next day and it was done.
11. ProfileSynchronizationSetupJob is stuck on "Pausing"... Delete the Timer service cache.
    Read: http://support.microsoft.com/kb/939308/en-us
12. If you've tried all of the above it's now time to do what you've been holding out on... yup trawl through the damn logs.
1. Read: http://blogs.msdn.com/b/spses/archive/2010/12/02/guide-to-user-profile-service-application-upa-part-2-setting-up-the-user-profile-service-application.aspx
2. Enable verbose logging for the Microsoft.ResourceManagement.Service.exe and SharePoint Portal Server > User Profiles
13. Don't be afraid of restarting the server... with any luck it might all just work after.

Geohot Rocks! ...hmmm I mean Raps!

SPS 2010 Silverlight Error if page security verification disabled

After disabling page security verification on the web application (CA > Manage web applications > General Settings > Security validation is: Off ) Silverlight stopped working when trying to create Sites/Lists.

Error
An unhandled exception occured in the Silverlight Application

At this stage the only fix is to enable page security verification.

Session "OfficeSearch14HealthSession" failed to start with the following error: 0xC0000035

Issue:
Session "OfficeSearch14HealthSession" failed to start with the following error: 0xC0000035

Cause:
The Search Health Monitoring - Trace Events job can't access a Health Monitoring resource.
The offending class is Microsoft.Office.Server.Search.Monitoring.TraceDiagnosticsProvider this job is run every minute and if it conflicts with another job accessing the same resource it will fail.
The following PS command will return Jobs scheduled to run < every 5 minutes:
Get-SPTimerJob | Where {$_.IsDisabled -eq $FALSE -and $_.Schedule.Description -eq "Minutes" -and $_.Schedule.Interval -lt "5"} | Foreach-Object{$_.PSObject.Properties | Select-Object Name,Value;}

Fix:
Changed the Search Health Monitoring - Trace Events job schedule to every 2 minutes, if you really want to have clean logs.
Update: I'm working on the fix but it seems related to current SP log file.

Proactively monitoring SPS 2010 and MOSS

I was recently introduced to what is now a critical tool. The ULS Viewer http://code.msdn.microsoft.com/ULSViewer

The ULSViewer tool performs various actions against the data from ULS log files in order to better analyze it. ULSViewer allows the user to: 

• Highlight data of importance to the user on the fly
• Bookmark log entries
• Append logs to other logs in order to track trends
• Hide unimportant data
• Only view critical log entries by sorting data by severity
• Write rules to prompt the user when certain events occur
• View your data in a spreadsheet instead of the text file ULS generates
• Monitor remote machines logs that are running ULS services
• Open multiple logs at the same time in order to compare log files.
• Open logs files from multiple machines at the same time.

BMW K1300R Wins Bad Motor Works Wonky Bike of the Year

Movie of the day: Mr. Nobody

I watched the extended version of Mr. Nobody the other night. I thought director Jaco Van Dormael did a fantastic job with the great attention to detail. Jared Leto was good too.

Mr. Nobody
imdb.com