احصائيات المدونة
Sunday, August 14, 2011
Access Denied in SharePoint Website
Sunday, August 7, 2011
Unable to load assembly group - The user assembly group provider threw an exception
While developing a sandboxed solution in SharePoint 2010 using the Visual Studio 2010 SharePoint developer tools it happened that I wasn’t able to deploy the solution using F5.
The error message wasn’t exact on how to solve the problem:
Error occurred in deployment step 'Add Solution': Unable to load assembly group. The user assembly group provider threw an exception while trying to provide user assemblies for the specified assembly group.The detailed information about the error is the following:
While doing a search I found a suggestion to change the account for the ‘SharePoint 2010 User Code Host’.Unable to load assembly group. The user assembly group provider threw an exception while trying to provide user assemblies for the specified assembly group. - Assembly group id: ", GroupId = "<SOME_ID>"" - Inner Exception: System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at Microsoft.SharePoint.Library.SPRequest.GetListsWithCallback(...) at Microsoft.SharePoint.SPListCollection.EnsureListsData(...) at Microsoft.SharePoint.SPListCollection.Undirty() at Microsoft.SharePoint.SPBaseCollection.GetEnumerator() at Microsoft.SharePoint.SPWeb.GetCatalog(SPListTemplateType typeCatalog) ...
The developer image was set up by a colleague who didn’t use the farm account as the domain account for the SharePoint 2010 User Code Host service.
Here you can see the service... while trying to debug I realized that the given account on the right side was not the one I expected.
So I used the services under administrative tools and changed the domain account to the SharePoint 2010 farm account:
Changing the account solved my problem:
At the end I was able to deploy the sandboxed solution.
RSS Feeds using RSS WebPart
“The requested RSS feed could not be displayed. Please verify the settings and url for this feed. If this problem persists, please contact your administrator.”
So what do you need to do?
You need to specify the proxy server in the Web.Config, using the System.Net element. Below are the steps in accomplishing that…
1. Open up the web.config file (eg: C:\inetpub\wwwroot\wss\VirtualDirectories\80)2. Look for the xml node <system.net> (on line 669 for me)3. There should be a <defaultProxy> xml node inside <system.net>. If you don't, create it.4. There should be a <proxy> xml node inside <defaultProxy>. If you don't, create it.5. If you have a autoDetect="True" attribute, remove it as it isn't needed if you are specifying a proxy.6. Add the following attributes to the <proxy> xml node. proxyaddress="http://proxy.company.com:8080" bypassonlocal="true"Your lines would like like this:
<system.net><defaultProxy><proxy proxyaddress="http://10.28.1.253:3128" bypassonlocal="true" /></defaultProxy></system.net>7. Save the web.config.
8. Go to the Command Line (CMD) and type: iisreset
9. You are ready to go.
If you have an authenticated RSS feed, then you would need to work with Kerberos authentication, which is a whole new ball game!
A Good RSS feed to test with is one of the BBC news feeds:
BBC News for England - http://feeds.bbci.co.uk/news/england/rss.xml
BBC Sports News - http://newsrss.bbc.co.uk/rss/sportonline_uk_edition/front_page/rss.xml
(Thanks to Technet and Kit Kai’s Tech Blog for help with this - http://community.sgdotnet.org/blogs/kitkai/archive/2007/04/04/Consuming-RSS-Feeds-using-RSS-WebPart-.aspx)
Thursday, July 28, 2011
Error message when you open a Web site by using Basic authentication in Expression Web on a computer that is running Windows Vista: “The folder name is not valid”
Error message when you open a Web site by using Basic authentication in Expression Web on a computer that is running Windows Vista: “The folder name is not valid”
SYMPTOMS When you open a Web site by using Basic authentication in Microsoft Expression W...
WORKAROUND Warning Serious problems might occur if you modify the registry incorrectly by u...
To work around this issue, follow these steps:
- Click Start, type regedit in the Start Search box, and then click regedit in the Programs list.
- Locate and then right-click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
- Point to New, and then click DWORD (32-bit) Value.
- In the right pane, type BasicAuthLevel to name the new registry entry, and then press ENTER.
- On the Edit menu, click Modify.
- In the Value data box, type 2, and then click OK.
Note The mapping is as follows:- 0 - Basic authentication disabled
- 1 - Basic authentication enabled for Secure Sockets Layer (SSL) shares only
- 2 or greater - Basic authentication enabled for SSL shares and for non-SSL shares
- Restart the computer.
MORE INFORMATION Basic authentication is one form of user authentication where a user is identifi...
When the server is configured to use Basic authentication, the client computer transmits the users' credentials to the server. If the channel is not encrypted, such as in typical HTTP traffic, a malicious user on another computer on the network can possibly intercept the user name and the password of that user.
By default, Basic authentication is disabled in Windows Vista. When Basic authentication is disabled, either the client computer uses a different authentication method (if the server supports a different authentication method), or the request fails.
Wednesday, June 8, 2011
User profiles Sync DB doesn't have Tables or Stored Procedures
User profiles Sync DB doesn't have Tables or Stored Procedures
Tuesday, June 7, 2011
How to configure User Profile Service with Powershell
$sb = {
Add-PSSnapin Microsoft.SharePoint.PowerShell
$DBServer = "SharePoint_Alias"
$ProfileDBName = "SP2010_ProfileDB"
$SocialDBName = "SP2010_SocialDB"
$SyncDBName = "SP2010_SyncDB"
$saAppPool = Get-SPServiceApplicationPool "SharePoint User Profiles"
$UPSAppName = "SP2010 User Profile Service Application"
$upa = New-SPProfileServiceApplication -Name "$UPSAppName" -ApplicationPool $saAppPool -ProfileDBName "$ProfileDBName" -ProfileDBServer $DBServer -SocialDBName "$SocialDBName" -SocialDBServer $dbServer -ProfileSyncDBName "$SyncDBName" -ProfileSyncDBServer $dbServer
$proxy = New-SPProfileServiceApplicationProxy -name "SP2010 User Profile Service Application Proxy" -MySiteManagedPath "sps" -DefaultProxyGroup -ServiceApplication $UPA
}
$FarmUsername = "DOMAIN\ACCOUNT-SP-setup"
$serverName1 = "myServerName1"
$FarmPassword = 'Passw0rd!'
$FarmPassword = (ConvertTo-SecureString -String "$FarmPassword" -AsPlainText -force)
$cred = New-Object System.Management.Automation.PsCredential $FarmUsername,$FarmPassword
Invoke-Command -ComputerName $serverName1 -ScriptBlock $sb -Credential $cred
Configure User Profile Synchronization Service
There are further here
on the SharePoint blog as there are issues with following least priviledge install e.g. having separate Active Directory Domain User Accounts for each role in farm. To get as far as I did I used Active Directory Domain Administrator user account for everything. Full credit goes to @givenscj
for his help getting through this!
There are some IE8 bugs in the current UI...so push F12 
Click "Browser Mode: IE8 Compat View" and select "Internet Explorer 7".
Click "start" on "User Profile Synchronization Service"
Click "OK"

Click on "monitoring" on left hand side and then click on "Review Job Definitions"
Click on "Running Jobs" on left hand side
You should now see ProfileSynchronizationSetupJob running
Keep refreshing until it disappears and then you'll notice it'll disappear. Click on "Job History" on left hand side, you should see the job with status of Successful.
In Windows Services you should now see Forefront Services both started and running under your administrator account.
Click on "Application Management" then click on "Manage service applications"
Scroll down and click on "User Profile Service Application"
Click on "Configure Synchronization Connections"
NOTE: you may see the below error, if you do simply do an IISRESET
Click Create New Connection
Fill in details
Click "Populate Containers" button then expand tree and select "Users" OU tree node and then click "OK".
NOTE: Clicking "Select All" does not work in this build!
You should now see a connection in this list.
NOTE: if you get to next screen and nothing shows, please ensure both Forefront Windows Services are started.
Go back to "User Profile Service Application" page from "Manage Service Applications"
Click "Start Profile Synchronization"
Select "Start Full Synchronization" then click "OK".
NOTE: this will take a few minutes as a job is scheduled to do this.
Now if you click "Manage User Profiles" you'll see the User Profiles coming through
In Beta 2 it is normal to see these warning errors in the Event Log.
Also note that you cannot edit the connections because of a JavaScript error.
For more information on the User Profile imports go to:
C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\ and run MSIISClient.exe

If you get this error:
"Cannot navigate to the requested page while User Profile Synchronization is running. Please wait for the current Sychronization run to finish."
You will need to restart the machine (you can most likely just restart the services too)
FIM – Forefront Identity Manager Failed to Connect to SQL Server
ISSUE
=====
SharePoint 2010 connects to a SQL Instance
In SharePoint 2010 FIM is used for importing and synchronising user profiles by the User Profile Service Application. Starting the User Profile Synchronising Service (from Central Admin – System Settings – Mange Service on Server) Fail’s. Reviewing the Event log you receive the following error message:
Log Name: Application
Source: FIMSynchronizationService
Date: 13/07/2010 15:19:37
Event ID: 6324
Task Category: Server
Level: Error
Keywords: Classic
User: N/A
Computer:
Description:
The server encountered an unexpected error and stopped.
Resolution
=========
Somehow the SQL Instance information for the FIM Synchronising Service is missing
To resolve the issue add the SQLInstance name to the following Reg key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FIMSynchronizationService\Parameters]
"SQLInstance"="
Monday, June 6, 2011
Sunday, June 5, 2011
User profiles Sync DB doesn't have Tables o...
Saturday, June 4, 2011
The EXECUTE permission was denied on the object ‘proc_GetProductVersions’- Insufficient SQL database permissions for user
With SharePoint 2010 RTM production farm, the following error was being logged in application event logs with severity level Critical when users try to open some of the site administration pages। An example is Site Actions > More Options page।
Insufficient SQL database permissions for user ‘Name:
The EXECUTE permission was denied on the object ‘proc_GetProductVersions’, database ‘SharePoint_Config’, schema ‘dbo’.
In order to resolve the issue, I provided Execute permission to the database role “WSS_Content_Application_Pools” into the stored procedure “proc_GetProductVersions”. I performed the following steps to do this.
1.In the database server, expand SharePoint Config database and naviage to Programmability/Stored Procedures/dbo.proc_GetProductVersions using SQL Server Management Studio.
2.Right click on the above stored procedure and select Properties.
3.On the popup screen, select Permissions on the left and click Search button.
4.On the new popup screen, click Search, select [WSS_Content_Application_Pools] database role and click OK.
5.Click OK again.
6.On the first popup screen, select the role, check Execute permission and click OK.
There is no need to restart any services for this change to take effect.
Error 7043 "Load control template file /_controltemplates/TaxonomyPicker.ascx failed"
http://support.microsoft.com/kb/2481844
This is not causing any issues except for a wrong ULS log message a single time in a web application process life time, the exception is caught and that template file is skipped. This message should be treated as log noise and can be ignored.
To change this behavior:
1-Navigate to /14/TEMPLATE/ControlTemplates/TaxonomyPicker.ascx user control
2-Open the user control in a text editor and locate the first line
3-Find the character string , and replace with a comma ‘,’ (without quotes).
4-Save the user control
The above solution from Microsoft doesn't work for me.
The solution is to rename the file "TaxonomyPicker.ascx" to "TaxonomyPicker.ascx_bug"
Tuesday, May 31, 2011
SandBox Service Error
Hi Rick, Everybody,
I'm the customer that you referred in your post. For sake of information of the group, here are the specs of the systems that we are using:
- Three separated SharePoint Server 2010 farms (Integration, Q&A, Production), two FE + two Application each, individual instance of SQL 2010 R2 each in the SQL Cluster
- Eight different SharePoint 2010 farms (development), each one in one separated box (Win, SP, SQL, VS)
- Everything running inside the same Domain Controller
- No one has Internet access
- Everything using http (not https)
When we try to install a SandBox solution (very simple solution, just a WebPart with one button and one label: if you push the button, you get "Hello world" in the label), we get in all the twelve environments the message "The sandboxed code execution request was refused because the Sandboxed Code Host Service was too busy to handle the request"
- It is possible to install the solution in the "Solutions" gallery
- This message appears at installation of the WebPart in a page (using IE or Firefox)
- The Sandbox Service is running
- The Sandbox processes run using the super-administrator account (the account used to install the farms)
- If we install the solution in a farm outside the DC, everything works perfectly
After hours making traces we found that the Sandbox solution was trying to find certificate revocations using the Microsoft certificate server (crl.microsoft.com). The solution doesn't use any certificate, and all the other functionality in the farms is running as expected.
Based in our conclusions and as Rick mentioned, we were able to make it working using two different approaches:
1 Modifying the Registry Key that controls the check "Check for publisher's certificate revocation" in Internet Explorer (HKEY_USERS\[SID OF THE SERVICE ACCOUNT]\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing. The value of "State" need to be set to "0×00023e00".)
2 Using a host name in the servers: "127.0.0.1 crl.microsoft.com" (I used this solution and worked fine)
The first approaches is not desirable to be implemented in a production environment and, if the account where is applied is changed anyhow, the workaround will stop working. We are implementing right now the second approach as a temporary workarond, being not happy with it, but it works at least.
Very curious if the modification in the host name works also for the other cases described here.
Gr., Gustavo
Gustavo - http://www.gavd.net/ - http://geeks.ms/blogs/gvelez/
Monday, May 30, 2011
SharePoint Log files with size zero byte
In addtion to correct permissions on folder (read, write, and delete permissions) where Logs are written, this thread suggests SPTraceV4 account has to be a member of Performance Log Users and Performance Monitor Users.
http://blog.isaacblum.com/tag/sptracev4/
===============================================================
# Trace Account Details
$TraceAccount = "DomainSPTrace"
$TraceAcctPWD = "Enter The password here"
$SecTraceAcctPWD = (ConvertTo-SecureString $TraceAcctPWD -AsPlainText -force)
# Formatting
$TraceAccountDomain,$TraceAccountUser = $TraceAccount -Split "\"
# Get the tracing service.
$farm = Get-SPFarm
$tracingService = $farm.Services where {$_.Name -eq "SPTraceV4"}
$Cred_TraceAcct = New-Object System.Management.Automation.PsCredential $TraceAccount,$SecTraceAcctPWD
## Add Managed Account for Trace Account
$ManagedAccountTrace = Get-SPManagedAccount Where-Object {$_.UserName -eq $TraceAccount}
If ($ManagedAccountTrace -eq $NULL)
{
Write-Host -ForegroundColor White "- Registering managed account" $TraceAccount
New-SPManagedAccount -Credential $Cred_TraceAcct Out-Null
}
Else {Write-Host -ForegroundColor White "- Managed account $TraceAccount already exists, continuing."}
# Get the managed account.
$managedAccount = Get-SPManagedAccount "$TraceAccount"
If ($tracingService.ProcessIdentity.ManagedAccount -notlike "*$managedAccount*"){
# Set the tracing service to run under the managed account.
$tracingService.ProcessIdentity.CurrentIdentityType = "SpecificUser"
$tracingService.ProcessIdentity.ManagedAccount = $managedAccount
$tracingService.ProcessIdentity.Update()
# This actually changes the "Run As" account of the Windows service.
$tracingService.ProcessIdentity.Deploy()
}
Try{
([ADSI]"WinNT://$env:COMPUTERNAME/Performance Log Users,group").Add("WinNT://$TraceAccountDomain/$TraceAccountUser")
}
catch {Write-Host -ForegroundColor White " - $TraceAccount is already an in the Performance Log Users group, continuing."}
Write-Host "All Done"
======================================================================
Configure object cache user accounts
Important:
The Portal Super User and Portal Super Reader accounts must be separate accounts, and they must not be accounts that will ever be used to log in to the site.
In SharePoint Server 2010, querying for items is linked with the user account that makes the query. Various parts of the publishing feature make queries for which the results are cached in the object cache. These results are cached based on the user making the query. To optimize the cache hit rate and memory requirements, the queries must be based on whether a user can see draft items. When a publishing control requests the object cache to make a query to get data for the control, the cache makes the query, not as the user making the request, but instead it makes the query twice: once as the Portal Super User account and once as the Portal Super Reader account. The results of these two queries are stored in the object cache. The results for the Portal Super User account include draft items, and the results for the Portal Super Reader account include only published items. The object cache then checks the access control lists (ACLs) for the user who initiated the request and returns the appropriate results to that user based on whether that user can see draft items. By adding the Portal Super User and Portal Super Reader accounts to the Web application, the cache must store results for only two users. This increases the number of results that are returned for a query and decreases the amount of memory that is needed to store the cache.
By default, the Portal Super User account is the site’s System Account, and the Portal Super Reader account is NT Authority\Local Service. There are two main issues with using the out-of-box accounts.
1.The first issue is that some items get checked out to System Account, so when a query that includes these items is made, the checked out version of the item is returned instead of the latest published version. This is a problem because it is not what a user would expect to have returned, so the cache has to make a second query to fetch the correct version of the file. This negatively affects server performance for every request that includes these items. The same problem would occur for any user who has items checked out, if that user’s account was set to be the Portal Super User account. This is why the accounts configured to be the Portal Super User and the Portal Super Reader should not be user accounts that are used to log into the site. This ensures that the user does not inadvertently check items out and cause problems with performance.
2.The default Portal Super Reader account is NT Authority\Local Service, which is not correctly resolved in a claims authentication application. As a result, if the Portal Super Reader account is not explicitly configured for a claims authentication application, browsing to site collections under this application will result in an “Access Denied” error, even for the site administrator. This error will occur on any site that uses any feature that explicitly uses the object cache, such as the SharePoint Server Publishing Infrastructure, metadata navigation, the Content Query Web Part, or navigation.
To create the user accounts by using Central Administration
1.Verify that you have the following administrative credentials:
To create the user accounts in Central Administration, you must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site.
2.On the Central Administration Web site, in the Application Management section, click Manage web applications.
3.Click the name of the Web application that you want to configure.
4.On the Web Applications tab, in the Policy group, click User Policy.
5.In the Policy for Web Application window, click Add Users.
6.From the Zones list, select All zones, and then click Next.
7.In the Users box, type the user name for the Portal Super User account.
8.Click the Check Names icon to ensure that the account name can be resolved by the authentication providers on the application server.
9.In the Choose Permissions section, check the Full Control - Has full control box.
10.Click Finish.
11.Repeat Steps 5 through 8 for the Portal Super Reader account.
12.In the Choose Permissions section, check the Full Read - Has full read-only access box.
13.Click Finish.
14.Make note of how the names for the Object Cache Super Reader and Object Cache Super User accounts are displayed in the User Name column. The displayed strings will be different depending on whether you are using claims authentication for the Web application.
To add the user accounts to the Web application by using Windows PowerShell
1.Verify that you meet the following minimum requirements: See Add-SPShellAdmin.
2.Copy the following code and paste it into a text editor, such as Notepad:
$wa = Get-SPWebApplication -Identity "
$wa.Properties["portalsuperuseraccount"] = "
$wa.Properties["portalsuperreaderaccount"] = "
$wa.Update()
Back to the top