SandBox Service Error

http://social.technet.microsoft.com/Forums/en-US/sharepoint2010programming/thread/ff3a5e65-dc5b-4b80-b8c9-752adcc3a903/

Hi Rick, Everybody,

I'm the customer that you referred in your post. For sake of information of the group, here are the specs of the systems that we are using:

- Three separated SharePoint Server 2010 farms (Integration, Q&A, Production), two FE + two Application each, individual instance of SQL 2010 R2 each in the SQL Cluster
- Eight different SharePoint 2010 farms (development), each one in one separated box (Win, SP, SQL, VS)
- Everything running inside the same Domain Controller
- No one has Internet access
- Everything using http (not https)

When we try to install a SandBox solution (very simple solution, just a WebPart with one button and one label: if you push the button, you get "Hello world" in the label), we get in all the twelve environments the message "The sandboxed code execution request was refused because the Sandboxed Code Host Service was too busy to handle the request"

- It is possible to install the solution in the "Solutions" gallery
- This message appears at installation of the WebPart in a page (using IE or Firefox)
- The Sandbox Service is running
- The Sandbox processes run using the super-administrator account (the account used to install the farms)
- If we install the solution in a farm outside the DC, everything works perfectly

After hours making traces we found that the Sandbox solution was trying to find certificate revocations using the Microsoft certificate server (crl.microsoft.com). The solution doesn't use any certificate, and all the other functionality in the farms is running as expected.
Based in our conclusions and as Rick mentioned, we were able to make it working using two different approaches:

1 Modifying the Registry Key that controls the check "Check for publisher's certificate revocation" in Internet Explorer (HKEY_USERS\[SID OF THE SERVICE ACCOUNT]\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing. The value of "State" need to be set to "0×00023e00".)
2 Using a host name in the servers: "127.0.0.1 crl.microsoft.com" (I used this solution and worked fine)

The first approaches is not desirable to be implemented in a production environment and, if the account where is applied is changed anyhow, the workaround will stop working. We are implementing right now the second approach as a temporary workarond, being not happy with it, but it works at least.

Very curious if the modification in the host name works also for the other cases described here.

Gr., Gustavo

---

Gustavo - http://www.gavd.net/ - http://geeks.ms/blogs/gvelez/

SharePoint Log files with size zero byte

The Microsoft SharePoint Foundation Tracing (SPTracev4) service is used by Microsoft SharePoint Foundation 2010 to manage usage log output. When usage logging is turned on, administrators can specify the path that is used to store the usage logs.
In addtion to correct permissions on folder (read, write, and delete permissions) where Logs are written, this thread suggests SPTraceV4 account has to be a member of Performance Log Users and Performance Monitor Users.

http://blog.isaacblum.com/tag/sptracev4/
===============================================================
# Trace Account Details
$TraceAccount = "DomainSPTrace"
$TraceAcctPWD = "Enter The password here"
$SecTraceAcctPWD = (ConvertTo-SecureString $TraceAcctPWD -AsPlainText -force)
# Formatting
$TraceAccountDomain,$TraceAccountUser = $TraceAccount -Split "\"
# Get the tracing service.
$farm = Get-SPFarm
$tracingService = $farm.Services where {$_.Name -eq "SPTraceV4"}
$Cred_TraceAcct = New-Object System.Management.Automation.PsCredential $TraceAccount,$SecTraceAcctPWD
## Add Managed Account for Trace Account
$ManagedAccountTrace = Get-SPManagedAccount Where-Object {$_.UserName -eq $TraceAccount}
If ($ManagedAccountTrace -eq $NULL)
{
Write-Host -ForegroundColor White "- Registering managed account" $TraceAccount
New-SPManagedAccount -Credential $Cred_TraceAcct Out-Null
}
Else {Write-Host -ForegroundColor White "- Managed account $TraceAccount already exists, continuing."}
# Get the managed account.
$managedAccount = Get-SPManagedAccount "$TraceAccount"
If ($tracingService.ProcessIdentity.ManagedAccount -notlike "*$managedAccount*"){
# Set the tracing service to run under the managed account.
$tracingService.ProcessIdentity.CurrentIdentityType = "SpecificUser"
$tracingService.ProcessIdentity.ManagedAccount = $managedAccount
$tracingService.ProcessIdentity.Update()
# This actually changes the "Run As" account of the Windows service.
$tracingService.ProcessIdentity.Deploy()
}

Try{
([ADSI]"WinNT://$env:COMPUTERNAME/Performance Log Users,group").Add("WinNT://$TraceAccountDomain/$TraceAccountUser")
}
catch {Write-Host -ForegroundColor White " - $TraceAccount is already an in the Performance Log Users group, continuing."}
Write-Host "All Done"
======================================================================

Configure object cache user accounts

http://technet.microsoft.com/en-us/library/ff758656.aspx
Important:
The Portal Super User and Portal Super Reader accounts must be separate accounts, and they must not be accounts that will ever be used to log in to the site.
In SharePoint Server 2010, querying for items is linked with the user account that makes the query. Various parts of the publishing feature make queries for which the results are cached in the object cache. These results are cached based on the user making the query. To optimize the cache hit rate and memory requirements, the queries must be based on whether a user can see draft items. When a publishing control requests the object cache to make a query to get data for the control, the cache makes the query, not as the user making the request, but instead it makes the query twice: once as the Portal Super User account and once as the Portal Super Reader account. The results of these two queries are stored in the object cache. The results for the Portal Super User account include draft items, and the results for the Portal Super Reader account include only published items. The object cache then checks the access control lists (ACLs) for the user who initiated the request and returns the appropriate results to that user based on whether that user can see draft items. By adding the Portal Super User and Portal Super Reader accounts to the Web application, the cache must store results for only two users. This increases the number of results that are returned for a query and decreases the amount of memory that is needed to store the cache.
By default, the Portal Super User account is the site’s System Account, and the Portal Super Reader account is NT Authority\Local Service. There are two main issues with using the out-of-box accounts.

1.The first issue is that some items get checked out to System Account, so when a query that includes these items is made, the checked out version of the item is returned instead of the latest published version. This is a problem because it is not what a user would expect to have returned, so the cache has to make a second query to fetch the correct version of the file. This negatively affects server performance for every request that includes these items. The same problem would occur for any user who has items checked out, if that user’s account was set to be the Portal Super User account. This is why the accounts configured to be the Portal Super User and the Portal Super Reader should not be user accounts that are used to log into the site. This ensures that the user does not inadvertently check items out and cause problems with performance.


2.The default Portal Super Reader account is NT Authority\Local Service, which is not correctly resolved in a claims authentication application. As a result, if the Portal Super Reader account is not explicitly configured for a claims authentication application, browsing to site collections under this application will result in an “Access Denied” error, even for the site administrator. This error will occur on any site that uses any feature that explicitly uses the object cache, such as the SharePoint Server Publishing Infrastructure, metadata navigation, the Content Query Web Part, or navigation.

To create the user accounts by using Central Administration
1.Verify that you have the following administrative credentials:
To create the user accounts in Central Administration, you must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site.
2.On the Central Administration Web site, in the Application Management section, click Manage web applications.
3.Click the name of the Web application that you want to configure.
4.On the Web Applications tab, in the Policy group, click User Policy.
5.In the Policy for Web Application window, click Add Users.
6.From the Zones list, select All zones, and then click Next.
7.In the Users box, type the user name for the Portal Super User account.
8.Click the Check Names icon to ensure that the account name can be resolved by the authentication providers on the application server.
9.In the Choose Permissions section, check the Full Control - Has full control box.
10.Click Finish.
11.Repeat Steps 5 through 8 for the Portal Super Reader account.
12.In the Choose Permissions section, check the Full Read - Has full read-only access box.
13.Click Finish.
14.Make note of how the names for the Object Cache Super Reader and Object Cache Super User accounts are displayed in the User Name column. The displayed strings will be different depending on whether you are using claims authentication for the Web application.
To add the user accounts to the Web application by using Windows PowerShell
1.Verify that you meet the following minimum requirements: See Add-SPShellAdmin.
2.Copy the following code and paste it into a text editor, such as Notepad:

$wa = Get-SPWebApplication -Identity ""
$wa.Properties["portalsuperuseraccount"] = ""
$wa.Properties["portalsuperreaderaccount"] = ""
$wa.Update()

Configure object cache user accounts

Configure object cache user accounts

SharePoint 2010 Search Results Customization

http://sharepoint2010search.codeplex.com

Free SharePoint 2010 MasterPages & CSS

http://freespmp.codeplex.com/

Project Description

This project provides a collection of free SharePoint Foundation & SharePoint Server MasterPages.
This includes not only the MasterPages but the overiding CSS.

I welcome contributors to the project whatever your skill level.

If you are interested in the project and would like to contribute or leave feedback please contact me on the dedicated twitter account @FreeSPMP or visit the homepage for the project http://engageinsharepoint.co.uk/freespmp/

Thanks for your interest.

Send document as an email attachment

SharePoint 2010: Send document as an email attachment: "Downalod Send document as an email attachment Hello all, Here I am again with a new utility for your SharePoint deployment – “Send Document..."

Steps to set Form based authentication (FBA) for S...

SharePoint 2010: Steps to set Form based authentication (FBA) for S...: "1. DOWNLOAD FBA User Management Tool Go to “C:\Windows\Microsoft.NET\Framework\v2.0.50727”. 2. Open file “aspnet_..."

Hide Web Part Headers with SharePoint 2010

SharePoint 2010: Hide Web Part Headers with SharePoint 2010: "Hide a web part header in SharePoint 2010. 1. Add a content editor web part to your page. 2. Edit the Web Part 3. Click in the content area..."

Display List In Content Query Webpart

SharePoint 2010: Display List In Content Query Webpart

Increase Upload Size & request timeout period

SharePoint 2010: Increase Upload Size & request timeout period: "First, increase the Maximum Upload Size for a specific web application. Go to the Central Administration > Application Management > Web Appl..."

Remove Social Tags Ribbon Control

SharePoint 2010: Remove Social Tags Ribbon Control: "If you want to remove 'I like It' , 'Tags & Notes ' Then just follow these steps : Open Central Administration Click on System Settings Cl..."

An Approval Workflow for SharePoint 2010 with VS

SharePoint 2010: An Approval Workflow for SharePoint 2010 with Visu...: "Download Approval Workflow Source Code and Example. I have developed an Approval Workflow that can be deployed on SharePoint 2010 and can..."

Fab 40 Templates for SharePoint 2010

SharePoint 2010: Fab 40 Templates for SharePoint 2010: "Now you can download Fab 40 templates for sharepoint 2010 which were not available before. The 'Fantastic 40' templates were created for Wss..."

SharePoint Interview Questions & Answers

SharePoint Interview Questions & Answers: SharePoint General Questions ans Answers: "SharePoint Interview Questions and Answers Q What is SharePoint? Ans SharePoint is a browser based d..."