User Profile Replication Service : Can not access Destination web service SharePoint 2013 farms

Got the error Start-SPProfileServiceFullReplication : Can not access Destination web service whilst performing one way User Profile Replication between two SharePoint 2013 farm's for About Me and PictureURL properties This worked beautifully whilst performing the Replication on Pre-Prod Farm but not on Prod farms

Did check various bits and pieces for permissions for the farm account as listed on various blogs but was of not much help. 

Performed the following steps to resolve this

Launch SharePoint 2013 Management Shell

Changed the Directory to  C:\Program Files\Microsoft\SharePoint 2010 Administration Toolkit\Replication Engine

Added the PS Snap in

Add-PSSnapin Microsoft.Office.Server.AdministrationToolkit.ReplicationEngine

Tried the command 

Start-SPProfileServiceFullReplication -Destination https://mydestination.contoso.com  -Source http://mysource.contotos.com -EnableInstrumentation -MaxNumberOfThreads 15 -Properties "AboutMe", "PictureURL" -DoSocialReplication

Didn't work, tried accessing the My Site from the server that didn't load even though loop back was disabled.

Was able to access My Site User Profile Service from an end user machine which indicated there was no issue the web service as it was accessible.

Found that the Proxy Server in Internet Explorer Connection Settings was enabled and set to the proxy server on the Front End server from where I was running the command.

Disabled the Proxy in IE, executed the command again boom replication started and was successful. 

At times there are some specific settings which cause the issue. Another day another dollar.

User Profile Synchronization Service stuck in stopping state in SharePoint 2013 farm

We had this issue of User Profile Synchronization Service stuck in stopping state in one of the  SharePoint 2013 farms. Performed the following steps to resolve this.

Log on to the Server where User Profile Synchronization Service was stuck in stopping state.

Make sure the Forefront Identity Manager and Forefront Identity Manager Synchronization Service are using the farm account as the service account

Launch SharePoint 2013 Management Shell

Get the GUID for User Profile Synchronization Service

Get-SPServiceInstance | Select-Object TypeName, ID

Check the status of User Profile Synchronization Service

Get-SPServiceInstance -Identity GUIDOfUserProfileSynchronization

To stop this , type the GUID of User Profile Synchronization Serviec

Stop-SPServiceInstance -Identity GUIDOfUserProfileSynchronization

IISRESET on the front end servers.

Spencer Harbar's article is a must read to understand and troubleshoot the issue.

Failed to load protocol handler OSearch15.HttpHandler.1. Error description: The parameter is incorrect.

Got this error on one of the development machine on SharePoint 2013 while crawling a content source for SharePoint sites.
 
Failed to load protocol handler OSearch15.HttpHandler.1. Error description: The parameter is incorrect.
 
SharePoint Search Content Account had Full Read access on the Web Application.
Tried various steps starting , restarting the following services in the hope this may resolve the issue
 

• SharePoint Server Search 15
• SharePoint Search Host Controller
• SharePoint Timer Service

IISRESET

None worked.
 
Tried stopping and starting the following from Manage Services on Server from Central Admin, no go

• Search Host Controller Service 
• Search Query and Site Settings Service 

Deleted the Search Service Application, Proxy and Re-created the Search Service Application with new Search Proxy

Same error while crawling the Content Source for SharePoint sites.

Deleted the Search Service App Again

Launched ULS Logs while re-creating Search Service Application.

Found that Indexer was already there on C:\Program Files\Microsoft Office Servers\15.0\Data\Office Server\Applications for the old rogue Search Service App and search had to re-create a new one and there was some conflict

Deleted Search Service App one last time

Took a copy of all the files at C:\Program Files\Microsoft Office Servers\15.0\Data\Office Server\Applications
Deleted all the files from here

Re-created the Search Service App with new Proxy and specified the Index file path to different location i.e. D:\Index\ via PowerShell check MSDN for the commands

Deleted the Search Center site , re-created a new one

Ran the crawl , worked fine without any issues.

This solution may not work in your environment, check the ULS to identify and troubleshoot the issue.

Getting results failed: Microsoft.Office.Server.Search.Query.InternalQueryErrorException: Search has encountered a problem that prevents results from being returned. if the issue persists, please contact your administrator.

 
While running a Search on the Search Center as well Local search , on one of the Development farm got this error in SharePoint 2013 Search Center site
 
Getting results failed: Microsoft.Office.Server.Search.Query.InternalQueryErrorException: Search has encountered a problem that prevents results from being returned.  if the issue persists, please contact your administrator.   
 
Performed the following steps to resolve this after looking into ULS logs to identify the issue. Found that the search proxy was too busy to respond.
 
Get the Search Service Application ID

Get-SPServiceApplication
 
Get the Search Service Proxy ID

Get-SPServiceApplicationProxy
Remove the Search Proxy, replace SearchProxyID with the Search Service Proxy ID
 
 
Remove-SPEnterpriseSearchServiceApplicationProxy -Identity <SearchProxyID>
Replace the SearchID

$enterprisesearch = Get-SPEnterpriseSearchServiceApplication <SearchID>
$enterprisesearchproxy = New-SPEnterpriseSearchServiceApplicationProxy  -name SearchServiceProxy -Uri $enterprisesearch.uri.absoluteURI

$enterprisesearchproxy

IISreset

Reset the Indexer not required but did that anyways

Run a full crawl of the content sources

Boom issue resolved. This took some digging in the ULS to understand the exact issue and find the resoulution

Configuring Information Rights Management in SharePoint 2013

In this article, we will go through the steps of configuring Information Rights Management in SharePoint 2013.

I'm using Active Directory Rights Management Service which is in a cluster for the SharePoint 2013 server.

 

Overview of the demo environment I am using.

• Contoso DC: DNS, Active Directory Domain Controller
• Contoso IRM: Active Directory Rights Management Service A
• Contoso CA: Active Directory Rights Management Service B
• SQL01: Primary Replica SQL Server 2012
• SQL02: Secondary Replica SQL Server 2012
• SQLAAG01: Always on Availability Group 01
• FIM01: SharePoint 2013 Server

To install and Configure Rights Management Service and create a cluster, refer to this article which has got the detailed information on how to do do.

http://sp-vinod.blogspot.co.uk/2013/08/installing-and-configuring-active.html

To configure Information Rights Management, navigate to Central Administration > Security
Information Policy > Configure Information Rights Management

This will display three options

• Don not use IRM on this server which is the default value
• Use the default RMS server specified in Active Directory ( The information of this is present in AD Sites and Services)
• Use this RMS Server ( you can specify the IRM website URL which can be load balanced using Network Load Balancer or Hardware Load Balancer)

Select use the default RMS Server specified in Active Directory or RMS Server URL

Click Ok

Regardless of whether you select 2nd or 3rd option, you will have to make sure you have given appropriate rights to ServerCertification.asmx or it won't be able to detect or accept the URL.

This can be found under the  Inetpub > wwwrot > WebsiteName > _wmcs > Certification

If your IRM is in a cluster you will have to perform the permission steps for both the files in the IIS websites which are part of your cluster.

For the demo purpose I have granted read and execute permissions to the Farm account and Everyone.




The information rights management can be applied at Library or List level. There is no option to set this up at Web Applicaiton or Site Collection or Site Level.

Though you can use Powershell command to enable IRM at Web App or Site Collection or Site Level for all Libraries or Lists but this has to be planned for what site requires IRM policies

To Enable Information Rights Management , navigate to respective document library and go to the document library settings

Under Permissions and Management, Click on Information Rights Management



This will present bunch of options based on what you need and you can perform the following

• Create a Permission Policy and Apply it
• Can restrict users from uploading documents
• Can Restriction Access Polixy Expiry Date
• Prevent Users from opening the document in the browser
• Restrict viewers from printing
• Restrict users from writing to a downloaded copy of the document
• Set Access rights expiry date for a downloaded document
• Set restriction on validating login credentials after a certian period for a downloaded document

All this needs to be planned on what you want to achieve based on your requirement to meet the compliance policy you may have in your organization. The policy definition may be a corporate policy for confidential documents defined by Information Security Officer or your business or client needs.

This is a good way of protecting the information but IRM doesn't provide any encryption or decryption of the document based on encoded keys.

Installing and Configuring Active Directory Rights Management Service in a Cluster on Windows Server 2012

In this article, I will cover the installation and configuration of Active Directory Information Rights Management Service as a cluster on Windows Server 2012 with databases on SQL Server Always on Group on SQL Server 2012.

This is a prep work for configuring the Information Rights Management for SharePoint 2013 which I will cover later.

Overview of the demo environment I am using.

• Contoso DC: DNS, Active Directory Domain Controller
• Contoso IRM: Active Directory Rights Management Service A
• Contoso CA: Active Directory Rights Management Service B
• SQL01: Primary Replica SQL Server 2012
• SQL02: Secondary Replica SQL Server 2012
• SQLAAG01: Always on Availability Group 01
• FIM01: SharePoint 2013 Server

Installation and Configuration of AD RMS on the First Server and configuring the Cluster:

I will start with the 

• Installation of Active Directory Rights Management Service on the first server i.e ContosoIRM
• Configuriation of the Additional Steps and creating the cluster

Launch the Server Manager , Click on Add Roles and Features

Click on Next

Click on Next 

Select the Server, Click Next 

Select Active Directory Rights Management Services, Click Next

 Click Next 

Click Next 

Select AD RMS  , Click Next 

Click Install to Start the Installation Process.

Installation may consume around 15 minutes or less

Installation Complete, Click on Close

In the Server Manager, Click on the Falg to Perform the Additional Configuration 

Click on Next

Select Create a new AD RMS root cluster, Click Next

In this scenerio , I am using Always on Availability Group, Click on Specify a Database Server and a Database Instance

I have specified the AAG name  and Selectthe Database Instance

Click Next

Specify the Service Account that has access to the Database Server

 I have gone with the Cryptographic Mode 2 option, click Next

Its good to have a centrally managed key storage but depending upon the required select what you need 

Specify the Cluster Key Password, this will be used while joining the AD RMS Server B in the cluster

Select the Web Site , I have already named the website as ContosoIRM

You can pre-configure the website with DNS Host entry

I will go with http instead of https though the screenshot is for https 

Name the server Licensor Certificate 

This is an important step to register the SCP , I will register it via the configuration wizard. If you have already attempted to install AD RMS on the same server, you will have to delete the RMS from AD Sites and Services to install it again

Click Install to Configure it. Note if you use https the databases will have 443 in the suffix of the database names. 

Click Install to proceed

This may consume again upto 15 minutes

Installation Complete

Now log off and log in back

Launch the Active Directory Rights Management Services  from the metro menu

Here we go the Cluster is configured

Following 3 databases have been created in Always On Group primary replica, I will add the the databases in AAG group later. As I am using http all databases have 80 in the suffix.

2) Installation and Configuration of AD RMS on Server B i.e. ContosoCA

Launch the Server Manager

Install the Active Directory Rights Management Services as covered above.

Once installed, Click on the Flag in Server Manager to perform Additional Configuration Steps , I will cover the steps from here.

Click on Perform Additional Configuration

 

This launches the Configuration Wizard for AD RMS, Click Next

Select Join an existing AD RMS Cluster, Click Next

Specify the Database Server Name , in my case Iwill provide the Always on Availabilty Group name click on Select 
Select Default Instance from the List

It should pick up the Configuration Database name, if not click on the drop down to select the Config database name

Click Next

Specify the same Cluster Key which was used while creating the Cluster i.e. centrally managed key

Click Next

Specify the database service account by clicking on Specify 

Now that I have specified the Service Account details , Click Next

Select the website, you can pre-configuring by creating a blank website with fqdn and bindings. This is important if you want to load balance the AD RMS website.

You can do this by using Microsoft NLB for POC purpose but in real world you would want to use Hardware Load Balancer like F5 or Barracuda to achieve load balancer I won't get into the details of this here as there are good articles which cover the same somewhere else.

In this scenario I'm selecting the default website I created, Click Next.

Click on Install to start the Installation and Configuration

The installation is complete now

Log off and Log in Back, Launch AD RMS

The installation and  configuration of the AD RMS is completed and we created the cluster as well all on Windows 2012 and databases highly available on SQL Server 2012 Always on Group.

There is more to AD RMS i.e. Trust Policies , User Execution, Security policies, policy templates etc. This article is just to illustrate the installation of AD RMS and configuration of the cluster for demo purpose. For more information please refer to the relevant tech net article.

I will configure AD RMS for SharePoint 2013 ad will cover this in some other article.

SharePoint 2013 SQL Server Always On

We will go through the process of using always on Availability group with a Content Farm 1 which is on SharePoint 2013, all components on Windows 2012

Environments

Server	Role	Operating System
SQL01	Primary Replica SQL Server 2012	Windows 2012 Standard
SQL02	Secondary Replica SQLServer 2012	Windows 2012 Standard
ContentFarmB	SharePoint 2013 Enterprise Edition	Windows 2012 Standard
ContosoDC	AD Domain Controller	Windows 2012 Standard
SQLAAG01	Always on Availability Group 1

I have used a script to install SharePoint 2013 and have mentioned a SQL Alias called ContentFarm1 pointing to Always on Availability Group 1 named SQLAAG01

If installing using the vanilla interface you can create a SQL Alias and point it to Always on Availability Group 1 or you can also use Always on Availability Group name

I have already configured Always on Availability group named SQLAAG01 consisting of two replica’s primary SQL01 and secondary SQL02

After you have installed SharePoint server and run the configuration wizard, all databases i.e. the configuration, admin and content databases are created on Primary replica.

You will have to manually add the databases into Always on Availability Group. Here are the steps to follow

The scripted install created two databases i.e. 

• ContentFarm1_Config
• ContentFarm1_Admin

We don't have it yet in the Always on Group.

First take a backup of the two databases as its a prerequisite to have the backup in the tail log

 Expand the AAG Group, Right Click on Availability Database, Click on Add Database

Click on Next 

Select the Database , Click Next

Specify  Data Synchronization location, I have already configured a shared network location called Backup 

Connect to the Secondary Replica , click on Connect

This does an availability group validation , Click Next

Click Next

Now I have got the databases synchronized 

Expand the Availability Database to check if the Databases have been added 

There we have it. Ideally I would script this when doing it in Production environment. This is just for the capturing this in the demo.