SharePoint 2010 Cannot add the specified assembly to the GAC

Error: Cannot add the specified assembly to the GAC in SharePoint 2010

We had a solution deployed numerous times as it houses a line of business process in SharePoint 2010. On performing Upgrade Solution via stsadm or Update-Solution via Power Shell , encountered the error: cannot add the specified  assembly to the GAC.

We started by created a test solution package and deployed it on the environment which worked fine to identify whether the issue was with the Package or environment.

On updating the LOB Solution , it couldn’t add the assembly to the GAC for LOB WSP, on one of the WFE servers.

Performed an IISRESET and restarted the timer service on the failing WFE,  deployed the WSP package again, it did work but when we tried updating it again at the later stage, got the same error.

I had to rely on Process Explorer to figure out what process was using the DLL and from where. The beauty of this tool is, it displays the list of processes running on the server and what DLL’s its using.

You can do a Find for the DLL file from the top menu bar to identify the process which it’s using.

I figured out using the Process Explorer, the Timer Service Process was referring to DLL from c:\windows\assembly\temp

I cleared the Temp folders which had the DLL, performed an IISRESET and restarted the Timer Service

This resolved the issue for me. You will have to identify what process is conflicting and troubleshoot the same accordingly.

How to Calculate the number of WFE server

Here is how you can calculate the number of web front end servers in a SharePoint farm.

Workload Characteristics	Value	Keyword
Total number of users	30000
Total number of unique users per day	20000	N
Concurrency Rate	0.3	C
Requests per day per user	400	RPD
Peak usage ratio	3
Hours in the business day	24
Average peak RPS	83.33333333
% Low-cost requests	0.25
% Medium-cost requests	0.4
% High-cost requests	0.35
Weighted peak RPS	266.6666667
Number of WFEs needed (@100 RPS/server)	2.666666667

Calculate RPS:

N: Total number of unique users ("20,000 of whom access the farm on any given day")

C: Concurrent user rate ("30 percent of the users will use the portal at the same time")

RPD: Requests per day per user ("Each user makes 400 requests in the course of a business day")

Peak usage ratio = 3 ("peak usage can be as much as three times")

Average RPS = (N * C * RPD * Peak Usage)/seconds

Calculate Weighted RPS based on type of usage

High-cost weight:             5

medium-cost weight:     3

low-cost weight:              1

% Low requests = 25% ("25 percent of requests involve tagging documents and similar activities")

% Medium requests =  40% ("40 percent of requests consist of operations such as accessing information in legacy systems")

% High requests = 35% ("everything else")

Calculate the weighted requests:

Weighted high RPS = (Average RPS* %high-cost requests * weight)

For example, high-cost requests have a weight of 5 = (83.3*0.35*5)

Weighted peak RPS = Weighted high RPS + Weighted medium RPS + Weighted low RPS

Calculate number of WFEs:

Number of WFEs is calculated using weighted peak RPS/100

Reference for this is MOC, technet. This is applicable for SharePoint 2010 and 2013.

SharePoint 2010 Error Product / patch installation or server upgrade required

SharePoint 2010 Error Product / patch installation or server upgrade required.

We got this error on Production, though the windows updates on all web front end  and app servers were same. The cumulative updates for SharePoint were same on all boxes.

This tends to happen if there is a mismatch of windows updates or cumulative updates for SharePoint all web front end and application servers.

Automatically install windows updates was turned off.

Agreed a downtime

Run this in Powershell

PSConfig.exe -cmd upgrade -inplace b2b -wait

Somehow this didn’t work and failed had to run this forcefully.

PSConfig.exe -cmd upgrade -inplace b2b –force

This fixed the issue for me. If this had failed, I would have relied on upgrade.log file and ULS logs to understand why the product config failed

SharePoint 2010: Access denied while uploading

This issue caused an absolute nightmare. Basically we have a site created using site template around 20 of them. In all of that only a site collection administrator could upload the document and didn’t get access denied.

But for any one with Contribute or site owners rights experienced access denied when clicking on Add Document or Upload Document/s.

ULS is the way to go does give a hint and resolved this for us.

Created a new site using the same site template and didn’t see an error

On this new site Publishing and Content Organizer features were not activated but on the other 20 odd sites, this feature was activated were we experienced the issue of access denied.

 Site Template didn’t contain publishing and content organizer features in it. This bemused me it worked initially but found that we recently installed Service Pack 1 and June 2011 Cumulative update. Thought this might be causing it but any ways to resolve this

Deactivated Publishing Feature

Deactivated Content Organizer

Deactivated and re-activated Enterprise Feature

Deactivated and re-activated Standard Feature

Boom issue resolved.

This issue occurred for us due to SP 1 and June 2011 CU. I would say always check in ULS logs for more information on why the issue is occuring.

User Profile Syncnronization Service stuck at Starting after Installing Service Pack 1 + June 2011 CU

User Profile Syncnronization Service stuck at Starting after Installing Service Pack 1 + June 2011 CU.

This didn’t happen after installing SP 1 and June 2011 CU. Microsoft says to stop and start the User Profile Services after Installing SP 1 and June CU. That worked for my environment but the issue started after couple of days.

Eventually had to reset and re-provision user Profile service app ( Delete without data and then create the user profile service app and using the existing Social and Profile Databases but not Synchronization that’s for not losing your existing data) but that didn’t solve the problem. Had to run this to resolve the issue I though modified this little bit for my environment.

##Add-PSSnapin Microsoft.SharePoint.Powershell

Get-SPServiceInstance

Copy the ID of User Profile Synchronization from here

Stop-SPServiceInstance 'Place the ID of User Profile Synchronziation without the single quotes'

Go back to Central Admin and check the status if it stopping

If it’s stuck in Stopping, run an IISRESET

Get-SPServiceAppliaction

Copy the ID from here for User Profile Service App

$syncDBType = "Microsoft.Office.Server.Administration.SynchronizationDatabase"

$upaSAType = Get-SPServiceApplication -ID 'b2077e3c-a375-44a3-b0f9-1b82fdd0366a – this is a test ID'

$syncDB = Get-SPDatabase | where-object {$_.Type -eq $syncDBType}

$upa = Get-SPServiceApplication | where-object {$_.TypeName -eq $upaSAType}

$syncDB.Unprovision()

$syncDB.Status = "Offline"

$upaSAType.ResetSynchronizationMachine()

$upaSAType.ResetSynchronizationDatabase()

$syncDB.Provision()

restart-service SPTimerV4

Wait for 5-10 minutes, check the user profile sync and service status, If stopped, Start it.

Wait for 5-10 minutes, after that No Harm in running IISRESET if you don't see it started

My Big Thanks to Spencer Harbar for coming up with this brilliant piece of work.

SharePoint 2010 Kerberos

SharePoint 2010 Kerberos

Business objective for us was to resolve the authentication prompt in Safari browser for MAC users. We have got more than 100 users on MAC it’s a challenge for them and kind of annoying to see the prompt for login credentials in MAC from a user experience perspective. And, also due to some security concerns we wanted to use Kerberos. Single Sign on was the call of the day for MAC users. It’s imperative to understand your business objective before thinking of implementing Kerberos.

Though there is keychain in MAC which stores the password but that doesn’t always work when accessing /editing MS Office documents from SharePoint in Safari. There are ways to configure config file in Mozilla on MAC but it’s daunting to manage this with new releases etc. And, again IT Policies may prohibit users from using Mozilla or something else as supported on MAC is Safari with limitations.

We don’t use PerformancePoint, Power Pivot, SSRS, Excel; services i.e. BI components in SharePoint. It was a straight forward process to implement Kerberos integration with SharePoint 2010.

Initially Idea was to test this and have a proof of concept to move this to the next stage.  Below are the steps to test this:

1)       Understand what service accounts are required.

Service Accounts:

Contoso\spkerberos for the web application

Contoso\sqladmin for the SQL Server

Contoso\spc2wts for Claims to windows service account

2)      In our case I wanted to test this by creating a test service application in test environment

Created a staging web application with claims based authentication: NTLM

http://staging.portal. contoso.com

3)      In DNS, created a host entry called staging.portal pointing to the WFE Server IP address

Note: Recommendation was don’t use CNAME that will cause serious issues as I learnt from the TechNet documentation, it’s a must read and helps a lot to plan for Kerberos.

Spencer Harbar has a fantastic article on SharePoint 2010 and Kerberos, must read would say

http://www.harbar.net/archive/2010/03/31/sharepoint-2010-and-kerberos.aspx

4)      Created the following script to create the SPNs for the service accounts from the SharePoint WFE server and SQL Server

Run this to create service principal names for the service account for web app, claims to windows, sql server

SETSPN -S HTTP/staging.portal Contoso\spkerberos

SETSPN -S HTTP/staging.portal.contoso.com Contoso\spkerberos

ECHO ---------------------------------------------------------------

ECHO Setting Service Principal Name on SQLDB Service Account

ECHO ---------------------------------------------------------------

SetSPN -S MSSQLSVC/databseserver01 Contoso\sqladmin

SetSPN -S MSSQLSVC/databaseserver01.contoso.com Contoso\sqladmin

ECHO ---------------------------------------------------------------

ECHO Setting Service Principal Name on C2W Token Service Account

ECHO ---------------------------------------------------------------

SetSPN -S  SP/C2WTS Contoso\spc2wts

5)      Check the SPNS in the attribute editor of the service Accounts in Active Directory

6)      Change web application authentication from ntlm to negotiate Kerberos

7)      Start claims to windows service

8)      Go to AD and look for delegation properties for all service accounts and delegate trust

9)      Look for event ids 4744 for Kerberos authentication

10)   Use fiddler to track whether it’s using negotiate (Kerberos) or ntlm

Once changes done initially will prompt the login credentials on three of four occasions

Voila now on MAC’S, when accessing SharePoint goes through with ease and without login prompts Nice!

There are other blogs which contains screenshot I just wanted to capture this for a high level understanding of what is required.

SharePoint Foundation Web Application Service Stuck Starting

One of the developers was looking to debug the solution package on a web application from a server which wasn’t hosting the web application as it had visual studio on it. 

Started the Web Application service and it stuck at starting

IISRESET didn’t come to rescue; I had to run the stsadm command by changing the command prompt path to the 14 hives to resolve the service stuck at starting .

stsadm -o provisionservice -action start -servicetype spwebservice

Note: this has to run from the server where you intend to host the web application

And then IISRESET / NOFORCE

There is a KB Article which talks at great length why this happens and how to overcome this:

http://support.microsoft.com/kb/2674684

SharePoint 2010 Port Numbers in DMZ

SharePoint 2010 Port Numbers in DMZ

There is TechNet article to plan security hardening for SharePoint which talks at great length about what port numbers used, for which protocol and for what type of communication.

http://technet.microsoft.com/en-us/library/cc262849.aspx

In this case, we have a single Web Front End server in DMZ/perimeter zone and a database server in the database layer /network. I hope this picture can be a starting point but it’s a must to read Securtiy Hardening article on TechNet before you decide to place your WFE/s in DMZ.

Placing the WFE servers can have an impact especially in performance as there are some limits set for the bandwidth in most of the organizations i.e. for inbound and outbound communication using some packet shaping tools or some other mechanism. And also considerations should be made whether you intend to have your query component of search on WFE’s (in DMZ) or have them on dedicated application servers depending upon the usage. There are various thing from file size , how many times its accessed on a daily basis, updates happening etc.

Ideally, Forefront TMG can change the rules of the game. Forefront TMG will be placed in DMZ and you mayn't need to place WFE/s in DMZ which may improve the performance specially accessing the portal.  

There is a Visio on external access topology for SharePoint which you can download from here but end of the day it all depends on what are the IT policies you have in your company whether a tool like Forefront TMG is affordable or use of it restricted to SharePoint.

http://go.microsoft.com/fwlink/p/?LinkId=187987

Start a discussion around the table with Network/Firewall Consultant, Security Consultant, SharePoint infrastructure, Application manager to start the proceedings.

Expired sessions are not being deleted from the ASP.NET Session State database

Expired sessions are not being deleted from the ASP.NET Session State database

Sometimes you get this in Health Analyser and this one doesn't have an automatic repair option.

Here is how you can fix this:

There is a timer job called State Service Delete Expired Sessions

Run this manually

Give it 5 minutes and refresh the central admin the warning/error should not be there

Please note this job is set to run every hour unless the scheduled has been altered.

If that doesn't work, launch the SQL Server Management Studio
Connect to Your Database Engine
Select State Service Database (you will have proper name if your have taken care off the GUID while provisioning the State Service App or else stateservice_someguid)

Run this query to see any expired sessions

Select * from session against the State Service Database

If  any, run the procedure to clear this: proc_DeleteExpiredItems

Make sure SQL Server Agent is started

You can also create a job as a part of maintenance plan  in SQL Server if required to automate it but the timer job is there to handle this.