1. HAD04
Building it Right the First Time;
Best Practice SharePoint 2010
Infrastructure Advice
Michael Noel
CCO
@MichaelTNoel

2. Michael Noel
• Author of SAMS Publishing titles “SharePoint 2010 Unleashed,” “SharePoint
2007 Unleashed,” “SharePoint 2003 Unleashed”, “Teach Yourself SharePoint
2003 in 10 Minutes,” “Windows Server 2008 R2 Unleashed,” “Exchange Server
2010 Unleashed”, “ISA Server 2006 Unleashed”, and many other titles .
• Partner at Convergent Computing (www.cco.com / +1(510)444-5700) – San
Francisco Bay Area based Infrastructure/Security specialists for SharePoint,
AD, Exchange, Security

3. What we will cover
• Examine various SharePoint 2010 farm architecture best
practices that have developed over the past year
• Examine SharePoint Best Practice Farm Architecture
• Understand SharePoint Virtualization Options
• Explore SharePoint DR and HA strategies using
Database Mirroring
• Explore other common best practices (RBS, SSL, NLB)
• Examine best practice security for SharePoint
• A large amount of best practices covered (i.e. Drinking
through a fire hose,) goal is for you to be able to take
away at least 2-3 useful pieces of information that can be
used in your environment

4. Architecting the Farm

5. Architecting the Farm
Understanding the Three Tiers of SharePoint Infrastructure
Web
Service Apps
Data

6. Architecting the Farm
Small Farm Examples
• „All-in-One‟ (Avoid)
 DB and SP Roles
Separate

7. Architecting the Farm
Smallest Highly Available Farm
• 2 SharePoint Servers
running Web and Service
Apps
• 2 Database Servers
(Clustered or Mirrored)
• 1 or 2 Index Partitions with
equivalent query
components
• Smallest farm size that is
fully highly available

8. Architecting the Farm
Best Practice „Six Server Farm‟
• 2 Dedicated Web Servers
(NLB)
• 2 Service Application
Servers
• 2 Database Servers
(Clustered or Mirrored)
• 1 or 2 Index Partitions with
equivalent query
components

9. Architecting the Farm
Scaling to Large Farms
• Multiple Dedicated
Web Servers
• Multiple Dedicated
Service App Servers
• Multiple Dedicated
Query Servers
• Multiple Dedicated
Crawl Servers, with
multiple Crawl DBs to
increase
parallelization of the
crawl process
• Multiple distributed
Index partitions (max
of 10 million items per
index partition)
• Two query
components for each
Index partition, spread
among servers

10. Architecting the Farm
FAST Search
• Previously a third party product ($$$$)
• More reasonable pricing now
• Highly tuned and specialized search
engine for SharePoint and also as an
enterprise search platform
• Replaces SharePoint 2010 Native Search
if used
• „Net new‟ features built-in.

11. Architecting the Farm
FAST Search – Comparison Matrix – Slide 1 of 2
SharePoint Search Search SharePoint FAST Search
Feature Foundation Server 2010 Server 2010 Server 2010 Server 2010
2010 Express for
SharePoint
Basic search X X X X X
Best Bets X X X X
Search Scopes X X X X
Crawled and Managed X X X X
Properties
Query Federation X X X X
Query Suggestions X X X X
Relevancy Tuning by Document X X X X
or Site Promotions
Shallow Results Refinement X X X X
Windows 7 Federation X X X X

12. Architecting the Farm
FAST Search – Comparison Matrix – Slide 2 of 2
SharePoint Search Search SharePoint FAST Search
Feature Foundation Server 2010 Server Server Server 2010
2010 Express 2010 2010 for
SharePoint
People Search X X
Social Search X X
Taxonomy Integration X X
Multi-Tenant Hosting X X
Visual Best Bets X
Similar Results X
Duplicate Results X
Search Enhancement based on user context X
Sort Results on Managed Properties or Rank X
Profiles
Deep Results Refinement X
Document Preview X
Rich Web Indexing Support X

13. Virtualization of SharePoint Servers

14. Virtualization of SharePoint Servers
Caveats – Be Sure to Understand Virtualization Concepts

15. Virtualization of SharePoint Servers
Virtual Guest Processor and Memory Guidelines
vCPU RAM RAM RAM
(Bare (Recommend) (Ideal)
Minimum)
Web Only* 2 6GB 8GB 12GB
Service Application 2 6GB 8GB 12GB
Roles Only
Dedicated Search 2 8GB 10GB 16GB
Service App
Combined 4 10GB 12GB 18GB
Web/Search/Servic
e Apps
Database* 4 10GB 16GB 24GB

16. Virtualization of SharePoint Servers
Sample 1: Small Single Server Environment / No HA
 Allows organizations that wouldn‟t normally be able to have a test
environment to run one
 Allows for separation of the database role onto a dedicated server
 Can be more easily scaled out in the future

17. Virtualization of SharePoint Servers
Sample 2: Two Server Highly Available Farm
 High-
Availability
across
Hosts
 All
components
Virtualized
 Uses only
two
Windows
Ent Edition
Licenses

18. Virtualization of SharePoint Servers
Sample 3: Mix of Physical and Virtual Servers – Best Perf
 Highest
transaction
servers are
physical
 Multiple
farm
support, wit
h DBs for
all farms on
the SQL
cluster

19. Virtualization of SharePoint Servers
Sample 4: Scaling to Large Virtual Environments

20. Virtualization of SharePoint Servers
Virtualization Performance Monitoring
• Processor (Host Only) • Network Bandwidth –
● <60% Utilization = Good Bytes Total/sec
● 60%-90% = Caution – <40% Utilization = Good
● >90% = Trouble – 41%-64% = Caution
• Available Memory – >65% = Trouble
● 50% and above = Good
● 10%-50% = OK
• Network Latency - Output
● <10% = Trouble Queue Length
• Disk – Avg. Disk sec/Read or – 0 = Good
Avg. Disk sec/Write – 1-2= OK
● Up to 15ms = fine – >2 = Trouble
● 15ms-25ms = Caution
● >25ms = Trouble

21. Virtualization of SharePoint Servers
Quick Farm Provisioning using VMM/Virtual Center
1. Create new Virtual Guest (Windows Server 2008
R2)
2. Install SP2010 Binaries. Stop before running
Config Wizard
3. Turn Virtual Guest into Template, modify template
to allow it to be added into domain
4. Add PowerShell script to run on first login, allowing
SP to be added into farm or to create new farm
End Result - 15 minute entire farm
provisioning…quickly add servers into existing farms
or create new farms (Test, Dev, Prod) on demand

22. Data Management

23. Data Management
Distribute Data Across Content DBs and Site Collections
• Start with a distributed architecture of content
databases from the beginning, within reason
(more than 50 per SQL instance is not
recommended)
• Distribute content across Site Collections from
the beginning as well, it is very difficult to extract
content after the face
• Allow your environment to scale and your users
to „grow into‟ their SharePoint site collections

25. Data Management
Binary Large OBject (BLOB) Storage
• BLOBs are unstructured content stored in
SQL
• Includes all documents, pictures, and files
stored in SharePoint
• Excludes Metadata and Context, information
about the document, version #, etc.
• Until recently, could not be removed from
SharePoint Content Databases
• Classic problem of structured vs.
unstructured data – unstructured data doesn‟t
really belong in a SQL Server environment

26. Data Management
Getting your BLOBs out of the Content DBs
• Can reduce dramatically the size of Content DBs, as upwards
of 80%-90% of space in content DBs is composed of BLOBs
• Can move BLOB storage to more efficient/cheaper storage
• Improve performance and scalability of your SharePoint
deployment – But highly recommended to use third party

27. SQL Database Optimization

28. SQL Database Optimization
Content Databases Distributed Between Multiple Volumes
Volume #1 Volume #2 Volume #3 Volume #4
DB-A DB-B DB-A DB-B DB-A DB-B DB-A DB-B
File 1 File 1 File 2 File 2 File 3 File 3 File 4 File 4
Tempdb File 1 Tempdb File 2 Tempdb File 3 Tempdb File 4

29. SQL Database Optimization
Content Databases Distributed Between Multiple Volumes
• Break Content Databases and TempDB into multiple files
(MDF, NDF), total should equal number of physical
processors (not cores) on SQL server.
• Pre-size Content DBs and TempDB to avoid
fragmentation
• Separate files onto different drive spindles for best IO
perf.
• Example: 50GB total Content DB on Two-way SQL Server
would have two database files distributed across two sets
of drive spindles = 25GB pre-sized for each file.

30. SQL Database Optimization
TempDB Best practices
• TempDB is critical for performance
• Pre-size to 20% of the size of the largest content
database.
• Break into multiple files across spindles as noted
• Note there is a separate TempDB for each
physical instance
• Note that if using SQL Transparent Data
Encryption (TDE) for any databases in an
instance, the tempDB is encrypted.

31. SQL Database Optimization
SQL Maintenance Plans
• Implement SQL Maintenance Plans!
• Include DBCC (Check Consistency) and either
Reorganize Indexes or Rebuild Indexes, but not both!
• Add backups into the
maintenance plan if they
don‟t exist already
• Be sure to truncate
transaction logs with a T-
SQL Script (after full
backups have run…)

32. SQL Database Optimization
Truncate Transaction Logs Sample Statement
USE CompanyABC_SP2010_ContentDB01;
GO
ALTER DATABASE CompanyABC_SP2010_ContentDB01
SET RECOVERY SIMPLE;
GO
DBCC SHRINKFILE
(CompanyABC_SP2010_ContentDB01_log, 100);
GO
ALTER DATABASE CompanyABC_SP2010_ContentDB01
SET RECOVERY FULL;
GO

33. High Availability and Disaster
Recovery

34. High Availability and Disaster Recovery
Data Tier – Clustering vs. Mirroring
• Clustering is Shared Storage, can‟t survive
storage failure, makes Mirroring more
attractive
• Clustering fails over more quickly
• Mirroring is not supported for all
databases, but Clustering is
• Both Clustering and Mirroring can be used
at the same time (Instance to Instance)

35. High Availability and Disaster Recovery
Data Tier – SQL Database Mirroring
• Introduced in SQL 2005 SP1
• Greatly improved in SQL 2008 and now SQL 2008
R2
• Available in Enterprise and Standard (Synchronous
only) editions
• Works by keeping a mirror copy of a database or
databases on two servers
• Can be combined with traditional shared storage
clustering to further improve redundancy
• SharePoint 2010 is now Mirroring aware!
• Upcoming SQL 2012 has some great Mirroring
improvements (Multiple copies of databases, both
asynch and synch, and read-only copies in remote!)

36. High Availability and Disaster Recovery
Data Tier – Database Mirroring Model #1 – Single Site
• Single Site
• Synchronous
Replication
• Uses a SQL Witness
Server to Failover
Automatically
• Mirror all SharePoint
DBs in the Farm
• Use a SQL Alias to
switch to Mirror
Instance

37. High Availability and Disaster Recovery
Data Tier – Database Mirroring Model #2 – Cross-Site with HA
• Two Sites
• 1-10 ms
Latency
max
• 1Gb
Bandwidth
minimum
• Farm
Servers in
each
location
• Auto
Failover

38. High Availability and Disaster Recovery
Data Tier – Database Mirroring Model #2 – Remote Farm
• Two Sites
• Two Farms
• Mirror only
Content
DBs
• Failover is
Manual
• Read-only
Mode
possible
• Must Re-
Attach and
Re-Index

39. High Availability and Disaster Recovery
Data Tier – Database Support for Mirroring – Slide 1 of 2
Synchronous Asynchronous
Mirror Mirror
Support Support
Configuration X
Central Administration content X
Content Databases X X
Usage and Health Data Collection
Business Data Connectivity X
Application Registry service * (BDC Upgrade)
Subscription Settings service * (PowerShell X
Enabled)
Search – Search Administration X
Search - Crawl X
Search - Property X

40. High Availability and Disaster Recovery
Data Tier – Database Support for Mirroring – Slide 2 of 2
Synchronous Asynchronous
Mirror Mirror
Support Support
User Profile - Profile X
User Profile - Synchronization
User Profile – Social Tagging
Web Analytics - Staging
Web Analytics - Reporting X
Secure Store X X
Stage X
Managed Metadata X
Word Automation Services X
PerformancePoint X

41. High Availability and Disaster Recovery
Two Node/Two Instance Cluster – Take Advantage of both
servers

42. High Availability and Disaster Recovery
Network Load Balancing
• Hardware Based Load Balancing (F5,
Cisco, Citrix NetScaler – Best
performance and scalability
• Software Windows Network Load
Balancing fully supported by MS, but
requires Layer 2 VLAN (all packets must
reach all hosts.) Layer 3 Switches must
be configured to allow Layer 2 to the
specific VLAN.
• If using Unicast, use two NICs on the
server, one for communications between
nodes.
• If using Multicast, be sure to configure
routers appropriately
• Set Affinity to Single (Sticky Sessions)
• If using VMware, note fix to NLB RARP
issue (http://tinyurl.com/vmwarenlbfix)

43. High Availability and Disaster Recovery
Windows Software Network Load Balancing
Recommendations
• Best Practice – Create Multiple Web Apps with Load-
balanced VIPs (Sample below)
● Web Role Servers
• sp1.companyabc.com (10.0.0.101) – Web Role Server #1
• sp2.companyabc.com (10.0.0.102) – Web Role Server #2
● Clustered VIPs shared between SP1 and SP2 (Create A
records in DNS)
• spnlb.companyabc.com (10.0.0.103) - Cluster
• spca.companyabc.com (10.0.0.104) – SP Central Admin
• spsmtp.companyabc.com (10.0.0.105) – Inbound Email VIP
• home.companyabc.com (10.0.0.106) – Main SP Web App
(can be multiple)
• mysite.companyabc.com (10.0.0.107) – Main MySites Web
App

44. SharePoint Installation

45. SharePoint Installation
Scripted Installations
• Good to understand how to install SharePoint
from the command-line, especially if setting up
multiple servers.
• Allows for options not available in the GUI,
such as the option to rename databases to
something easier to understand.
• Use PowerShell with SharePoint 2010
• Sample scripts available for download…

46. SharePoint Installation
Samples Scripts – http://tinyurl.com/SPFarm-Config
Function Configure-SPSearch {
PARAM($AppPool, $FarmName, $SearchServiceAccount)
$searchServiceInstance = Get-SPEnterpriseSearchServiceInstance -local
Start-SPEnterpriseSearchServiceInstance -Identity $searchServiceInstance
$dbName = $FarmName + "_SearchServiceApplication"
$searchApplication = New-SPEnterpriseSearchServiceApplication -Name "$FarmName Search Service Application" -ApplicationPool $AppPool -
DatabaseName $dbName
$searchApplicationProxy = New-SPEnterpriseSearchServiceApplicationProxy -name "$FarmName Search Service Application Proxy" -SearchApplication
$searchApplication
Set-SPEnterpriseSearchAdministrationComponent -SearchApplication $searchApplication -SearchServiceInstance $searchServiceInstance
$crawlTopology = New-SPEnterpriseSearchCrawlTopology -SearchApplication $searchApplication
$crawlDatabase = Get-SPEnterpriseSearchCrawlDatabase -SearchApplication $searchApplication
New-SPEnterpriseSearchCrawlComponent -CrawlTopology $crawlTopology -CrawlDatabase $crawlDatabase -SearchServiceInstance
$searchServiceInstance
while($crawlTopology.State -ne "Active")
{
$crawlTopology | Set-SPEnterpriseSearchCrawlTopology -Active -ErrorAction SilentlyContinue
if ($crawlTopology.State -ne "Active")
{
Start-Sleep -Seconds 10
}
}
$queryTopology = New-SPenterpriseSEarchQueryTopology -SearchApplication $searchApplication -partitions 1
$searchIndexPartition = Get-SPEnterpriseSearchIndexPartition -QueryTopology $queryTopology
New-SPEnterpriseSearchQueryComponent -indexpartition $searchIndexPartition -QueryTopology $queryTopology -SearchServiceInstance
$searchServiceInstance
$propertyDB = Get-SPEnterpriseSearchPropertyDatabase -SearchApplication $searchApplication
Set-SPEnterpriseSearchIndexPartition $searchIndexPartition -PropertyDatabase $propertyDB
while ($queryTopology.State -ne "Active")
{
$queryTopology | Set-SPEnterpriseSearchQueryTopology -Active -ErrorAction SilentlyContinue

47. SharePoint Installation
Some Manual Service Apps Still Required
• Due to complexity and/or bugs, certain
Service Apps will need to be manually
configured in most cases.
• This includes the following:
● PerformancePoint Service Application
● User Profile Service Application
● Web Analytics Service Application

48. SharePoint Installation
Document the Configuration and Monitor Changes
• Document all key settings in IIS, SharePoint, after
installation
• Consider monitoring for changes after installation for
Config Mgmt.
• Fantastic tool for this is the SPDocKit - can be found at
http://tinyurl.com/spdockit

49. Security

50. SharePoint Security
Layers of Security in a SharePoint Environment
• Infrastructure Security and Best practices
● Physical Security
● Best Practice Service Account Setup
● Kerberos Authentication
• Data Security
● Role Based Access Control (RBAC)
● Transparent Data Encryption (TDE) of SQL Databases
● Antivirus
• Transport Security
● Secure Sockets Layer (SSL) from Server to Client
● IPSec from Server to Server
• Edge Security
● Inbound Internet Security (Forefront UAG/TMG)
• Rights Management

51. SharePoint Security
Infrastructure – Sample List of Service Accounts
Service Account Name Role of Service Account Special Permissions
COMPANYABCSRV-SP-Setup SharePoint Installation Account Local Admin on all SharePoint servers (for
install of SP).
COMPANYABCSRV-SP-SQL SQL Service Account(s) – Should be separate Local Admin on Database Server(s)
admin accounts from SP accounts. (Generally, some exceptions apply)
COMPANYABCSRV-SP-Farm SharePoint Farm Account(s) – Can also be N/A
standard admin accounts. RBAC principles
apply ideally.
COMPANYABCSRV-SP-Search Search Account N/A
COMPANYABCSRV-SP-Content Default Content Access Account Read rights to any external data sources to
be crawled
COMPANYABCSRV-SP-Prof Default Profiles Access Account Member of Domain Users (to be able to read
attributes from users in domain) and
„Replicate Directory Changes‟ rights in AD.
COMPANYABCSRV-SP-AP-SPCA Application Pool Identity account for SharePoint DBCreator and Security Admin on SQL. Create
Central Admin. and Modify contacts rights in AD OU used for
email.
COMPANYABCSRV-SP-AP-Data Application Pool Identity account for the N/A
Content related App Pool (Portal, MySites, etc.)
Additional as needed for security.

52. SharePoint Security
Infrastructure – Enable Kerberos when using Classic-Auth
• When creating any Web Applications in Classic-mode, USE
KERBEROS. It is much more secure and also faster with
heavy loads as the SP server doesn‟t have to keep asking for
auth requests from AD.
• Kerberos auth does require extra steps, which makes people
shy away from it, but once configured, it improves security
considerably and can improve performance on high-load
sites.
• Should also be configured on SPCA Site! (Best Practice =
Configure SPCA for NLB, SSL, and Kerberos (i.e.
https://spca.companyabc.com)

53. SharePoint Security
Data – Role Based Access Control (RBAC)
• Role Groups defined within Active Directory (Universal
Groups) – i.e. „Marketing,‟ „Sales,‟ „IT,‟ etc.
• Role Groups added directly into SharePoint „Access
Groups‟ such as „Contributors,‟ „Authors,‟ etc.
• Simply by adding a user account into the associated
Role Group, they gain access to whatever rights their
role requires.
User1
Role SharePoint
Group Group
User2

54. SharePoint Security
Data - Transparent Data Encryption (TDE)
• New in SQL Server
2008
• Only Available with
the Enterprise
Edition
• Seamless
Encryption of
Individual Databases
• Transparent to
Applications,
including SharePoint

55. SharePoint Security
Data - Use SharePoint-Aware Antivirus (3rd Party or FPS)

56. SharePoint Security
Transport - Secure Sockets Layer (SSL) Encryption
• External or Internal Certs highly
recommended
• Protects Transport of content
• 20% overhead on Web Servers
• Can be offloaded via SSL offloaders if
needed
• Don‟t forget for SPCA as well!

57. SharePoint Security
Transport – IPSec from Server to Server
• By default, traffic between SharePoint
Servers (i.e. Web and SQL) is
unencrypted
• IPSec encrypts all packets sent
between servers in a farm
• For very high security scenarios when
all possible data breaches must be
addressed

58. SharePoint Security
Edge – Forefront Unified Access Gateway

59. SharePoint Security
Rights Management - Active Directory Rights Management
Services
• AD RMS is a form of Digital Rights
Management (DRM) technology, used in
various forms to protect content
• Used to restrict activities on files AFTER
they have been accessed:
● Cut/Paste
● Print
● Save As…
• Directly integrates with SharePoint DocLibs

60. For More Information
• SharePoint 2010 Unleashed from SAMS Publishing
(http://www.samspublishing.com)
• Windows Server 2008 R2 Unleashed and/or Hyper-V
Unleashed (http://www.samspublishing.com)
• Microsoft „Virtualizing SharePoint Infrastructure‟
Whitepaper (http://tinyurl.com/virtualsp)
• Microsoft SQL Mirroring Case Study
(http://tinyurl.com/mirrorsp )
• Failover Mirror PowerShell Script
(http://tinyurl.com/failovermirrorsp )
• SharePoint Kerberos Guidance
(http://tinyurl.com/kerbsp)
• SharePoint Installation Scripts
(http://tinyurl.com/SPFarm-Config)
• SharePoint Documentation Toolkit
• (http://tinyurl.com/SPDocKit)
• Contact us at CCO.com

61. Your Feedback is Important
Please fill out a session evaluation form
drop it off at the conference registration
desk.
Thank you!

62. Michael Noel
Twitter: @MichaelTNoel
www.cco.com
Slides: slideshare.net/michaeltnoel