Avoiding Administrator Blunders

            Scott Hoag and Dan Usher
#spsPhilly #Blunders
Thanks To Our Sponsors!




#spsPhilly #Blunders
SharePoint User Group




                       www.TriStateSharePoint.org
                       info@TriStatePoint.org
                       @tristateSP

#spsPhilly #Blunders
SharePoint Network




#spsPhilly #Blunders
who am I?




#spsPhilly #Blunders
who’s that other guy?
                       Dan
                       Usher

                       usher




#spsPhilly #Blunders
about you




#spsPhilly #Blunders
rules of the road




#spsPhilly #Blunders
#spsPhilly #Blunders
#spsPhilly #Blunders
creating orphans




#spsPhilly #Blunders
permissions management

                                                  Permissions…



                                             Permissions!


                              Permissions!
                              Permissions!
                              Permissions!




#spsPhilly #Blunders
publish




#spsPhilly #Blunders
the recycle bin




#spsPhilly #Blunders        Manage the Recycle Bin of a site
testing workflows as a deity




         > stsadm –o setproperty –pn declarativeworkflowautostartonemailenabled –pv true




#spsPhilly #Blunders                              declarativeworkflowautostartonemailenabled (Property
deleting the wrong item




#spsPhilly #Blunders
web part fun…




#spsPhilly #Blunders
#spsPhilly #Blunders
tune your analytics




                       Dataset Characteristics                              Value
                       SharePoint components                                30k
                       Unique users                                         117k
                       Unique queries                                       68k
                       Unique assets                                        500k
                                                                            511TB per years
                                                                            73TB per 7day
                                                                            200GB foryear
                       Reporting DB data size?




                               Capacity requirements for the Web Analytics Shared Service in SharePoint Server
#spsPhilly #Blunders
permissive file handling



            > $webApp = Get-SPWebApplication("http://intranet.contoso.com")
            > $webApp.AllowedInlineDownloadMimeTypes.Add("application/pdf")
            > $webApp.Update()




#spsPhilly #Blunders
running in circles




                 KB896861




#spsPhilly #Blunders        DisableLoopbackCheck & SharePoint: What every admin and developer should
pausing IIS




#spsPhilly #Blunders
lost passphrases

          > $passphrase = ConvertTo-SecureString -asPlainText -Force
          > Set-SPPassPhrase -PassPhrase $passphrase -Confirm




                       TechNet
                       CodePlex




#spsPhilly #Blunders
certificate revocation list
            <psuedocode>
                 if (!server.HasInternetConnectivity()) {
                      server.DisableCRLCheck();
                 }
            </psuedocode>




            SOFTWAREMicrosoftWindowsCurrentVersionWinTrustTrust ProvidersSoftware Publishing




#spsPhilly #Blunders                        Certificate Revocation List Check and SharePoint 2010 without an Internet
#spsPhilly #Blunders
hardware and software requirements




#spsPhilly #Blunders
not enough service accounts




#spsPhilly #Blunders
primary service accounts
            Account         Purpose                                  Requirements
            SQL Server      Runs SQL Server                          •   Domain user account
                                                                     •   No rights in SharePoint
            Setup Account   Installs the bits and performs initial   •   Domain user account
                            configuration                            •   Member of Local Admins on each
                                                                         server in the farm
                                                                     •   securityadmin and dbcreator on SQL
                                                                         instance
            Farm Account    Used for configuring and managing        •   Domain account
                            the farm and runs primary services       •   Additional rights are automatically
                            (e.g. SPTimerV4)                             granted as part of installation (both
                                                                         server and SQL)




#spsPhilly #Blunders
other service accounts
       Account                Purpose                                   Requirements
       MySites                Worker process identity for MySites       •   Domain user account
       Application Pool                                                 •   Managed account
       Content                Worker process identity for Content       •   Domain user account
       Application Pool       web applications                          •   Managed account
       Services               Worker process identity for Service       •   Domain account
       Application Pool       Application Pools                         •   Managed account
       Search Service         Process identity for SharePoint           •   Domain account
       Process                Foundation (Help) search service          •   Managed account
                              and SharePoint Search service
       Search Service         Used to crawl content specified in        •   Domain account
       Default Content        content sources
       Access
             User Profile Import Account used to import (and            •   Domain account
             Account             optionally export) user data from an   •   Replicate Directory Changes in AD
#spsPhilly #Blunders
                                 identity store
still more service accounts
            Account        Purpose                             Requirements
            Object Cache   Processes items in the object cache •   Domain user account
            Super User     of a web application                •   Managed account
                                                               •   Full Control User Policy on target web
                                                                   application(s)
            Object Cache   Processes items in the object cache •   Domain user account
            Super Reader   of a web application                •   Managed account
                                                               •   Full Read User Policy on target web
                                                                   application(s)




#spsPhilly #Blunders
running the farm configuration wizard




#spsPhilly #Blunders
sql foibles




#spsPhilly #Blunders
#spsPhilly #Blunders
sandboxed solutions…




                       HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTRPC


                       HKEY_USERSAccountSIDSOFTWAREMicrosoftWindowsCurrentVersionWinTrustTrust
                       ProvidersSoftwarePublishing


#spsPhilly #Blunders
managing managed paths




#spsPhilly #Blunders
trim your (audit) logs




                       > stsadm -o trimauditlog –date 20120502 –databasename SP2010_Content_FEDSPUG


#spsPhilly #Blunders
trim your (audit) logs




#spsPhilly #Blunders
setting up Kerberos




#spsPhilly #Blunders   Configuring Kerberos Authentication for Microsoft SharePoint 2010 Products
questions




#spsPhilly #Blunders
find us

                              @ciphertxt                  @usher

                       scott.hoag@appliedis.com    usher_daniel@bah.com
                             http://psconfig.com        http://www.spdan.com




#spsPhilly #Blunders

SharePoint Saturday Philly - SharePoint 2010 Administrative Blunders

  • 1.
    Avoiding Administrator Blunders Scott Hoag and Dan Usher #spsPhilly #Blunders
  • 2.
    Thanks To OurSponsors! #spsPhilly #Blunders
  • 3.
    SharePoint User Group www.TriStateSharePoint.org info@TriStatePoint.org @tristateSP #spsPhilly #Blunders
  • 4.
  • 5.
  • 6.
    who’s that otherguy? Dan Usher usher #spsPhilly #Blunders
  • 7.
  • 8.
    rules of theroad #spsPhilly #Blunders
  • 9.
  • 10.
  • 11.
  • 12.
    permissions management Permissions… Permissions! Permissions! Permissions! Permissions! #spsPhilly #Blunders
  • 13.
  • 14.
    the recycle bin #spsPhilly#Blunders Manage the Recycle Bin of a site
  • 15.
    testing workflows asa deity > stsadm –o setproperty –pn declarativeworkflowautostartonemailenabled –pv true #spsPhilly #Blunders declarativeworkflowautostartonemailenabled (Property
  • 16.
    deleting the wrongitem #spsPhilly #Blunders
  • 17.
  • 18.
  • 19.
    tune your analytics Dataset Characteristics Value SharePoint components 30k Unique users 117k Unique queries 68k Unique assets 500k 511TB per years 73TB per 7day 200GB foryear Reporting DB data size? Capacity requirements for the Web Analytics Shared Service in SharePoint Server #spsPhilly #Blunders
  • 20.
    permissive file handling > $webApp = Get-SPWebApplication("http://intranet.contoso.com") > $webApp.AllowedInlineDownloadMimeTypes.Add("application/pdf") > $webApp.Update() #spsPhilly #Blunders
  • 21.
    running in circles KB896861 #spsPhilly #Blunders DisableLoopbackCheck & SharePoint: What every admin and developer should
  • 22.
  • 23.
    lost passphrases > $passphrase = ConvertTo-SecureString -asPlainText -Force > Set-SPPassPhrase -PassPhrase $passphrase -Confirm TechNet CodePlex #spsPhilly #Blunders
  • 24.
    certificate revocation list <psuedocode> if (!server.HasInternetConnectivity()) { server.DisableCRLCheck(); } </psuedocode> SOFTWAREMicrosoftWindowsCurrentVersionWinTrustTrust ProvidersSoftware Publishing #spsPhilly #Blunders Certificate Revocation List Check and SharePoint 2010 without an Internet
  • 25.
  • 26.
    hardware and softwarerequirements #spsPhilly #Blunders
  • 27.
    not enough serviceaccounts #spsPhilly #Blunders
  • 28.
    primary service accounts Account Purpose Requirements SQL Server Runs SQL Server • Domain user account • No rights in SharePoint Setup Account Installs the bits and performs initial • Domain user account configuration • Member of Local Admins on each server in the farm • securityadmin and dbcreator on SQL instance Farm Account Used for configuring and managing • Domain account the farm and runs primary services • Additional rights are automatically (e.g. SPTimerV4) granted as part of installation (both server and SQL) #spsPhilly #Blunders
  • 29.
    other service accounts Account Purpose Requirements MySites Worker process identity for MySites • Domain user account Application Pool • Managed account Content Worker process identity for Content • Domain user account Application Pool web applications • Managed account Services Worker process identity for Service • Domain account Application Pool Application Pools • Managed account Search Service Process identity for SharePoint • Domain account Process Foundation (Help) search service • Managed account and SharePoint Search service Search Service Used to crawl content specified in • Domain account Default Content content sources Access User Profile Import Account used to import (and • Domain account Account optionally export) user data from an • Replicate Directory Changes in AD #spsPhilly #Blunders identity store
  • 30.
    still more serviceaccounts Account Purpose Requirements Object Cache Processes items in the object cache • Domain user account Super User of a web application • Managed account • Full Control User Policy on target web application(s) Object Cache Processes items in the object cache • Domain user account Super Reader of a web application • Managed account • Full Read User Policy on target web application(s) #spsPhilly #Blunders
  • 31.
    running the farmconfiguration wizard #spsPhilly #Blunders
  • 32.
  • 33.
  • 34.
    sandboxed solutions… HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTRPC HKEY_USERSAccountSIDSOFTWAREMicrosoftWindowsCurrentVersionWinTrustTrust ProvidersSoftwarePublishing #spsPhilly #Blunders
  • 35.
  • 36.
    trim your (audit)logs > stsadm -o trimauditlog –date 20120502 –databasename SP2010_Content_FEDSPUG #spsPhilly #Blunders
  • 37.
    trim your (audit)logs #spsPhilly #Blunders
  • 38.
    setting up Kerberos #spsPhilly#Blunders Configuring Kerberos Authentication for Microsoft SharePoint 2010 Products
  • 39.
  • 40.
    find us @ciphertxt @usher scott.hoag@appliedis.com usher_daniel@bah.com http://psconfig.com http://www.spdan.com #spsPhilly #Blunders