This document provides information on configuring the User Profile Service Application in SharePoint, including: - Creating the User Profile Service Application and starting the associated services - Configuring synchronization connections to Active Directory and selecting objects to sync - Setting required permissions for the sync account in Active Directory - Configuring properties, metadata, and pictures in user profiles - Importing or exporting profile data from other systems - Troubleshooting common sync issues like proxies and NetBIOS names

1. Sponsors User Profile Store Joshua Haebets SharePoint Solutions Architect Evolve Information Services

2. Joshua HaebetsSharePoint Consultant – Evolve Information Services Principal Consultant / Solutions Architect @jhaebets on Twitter www.linkedin.com/in/jhaebets Blog on the way www.robotsdottxt.com

3. Agenda What is the User Profile Service Application How do you configure it Working with profiles Enhancing the profile service

4. People 4

5. Getting Profiles

6. Windows Identity Foundation 6

7. The Service App. Web Applications http://sharepoint.mycompany.com User Profile Service Sync Service Social DB Profile DB Sync DB

8. Sync Storage Staging during sync Aggregated Data ConnectorSpace (CS) Metaverse (MV) 8

9. 6. Data is sent to MV. Including Exports from UPS. And to AD CS 1. Import from Active Directory Data into AD CS 2. Import from SharePoint UPS into SP CS MV 7. Data sent from AD CS to Active Directory 8. Data check and validated from AD to AD CS 4. Export data from CS to SharePoint UPS AD 5. Import and data confirmation 3. Data is sent to CS 3. Data is sync’d with the MV AD CS SP CS SharePoint UPS 9

10. Data Stores Profile Sync Social Tags, Ratings, Keyword, Bookmarks and Comments Sync Staging DB Profile Data and Activity Feed 10

11. Getting it working 11 Create MySite Host Create the User Profile Service Application Start the User Profile Service Start the User Profile Synchronization Service Configure Synchronization Connections

12. From Central Administration Manage Service Applications  New  User Profile Service Application 12 Create the User Profile Service Application Powershell $ups = New-SPProfileServiceApplication-Name "User Profile Service Application" -ApplicationPool “User Profile Application Pool" -MySiteHostLocation "http://sps-ups/my" -MySiteManagedPath "my/personal" -ProfileDBName “SPS-UPS_ProfileDB" -ProfileSyncDBName “SPS-UPS_SyncDB" -SocialDBName “SPS-UPS_SocialDB" New-SPProfileServiceApplicationProxy -Name "User Profile Service Application Proxy" -ServiceApplication $ups -DefaultProxyGroup

13. From Central Administration Manage Services on Server  User Profile Service  Start 13 Start the User Profile Service Powershell $upservice = get-spserviceinstance | where($_.TypeName.Contains(“User Profile Service”)} Start-spserviceinstance –identity $upservice

14. From Central Administration Manage Services on Server  User Profile Synchronization Service  Start Enter Farm Account Password Farm Account must be local admin on server to provision sync service Farm Account must have logon locally once service has been provisioned Powershell script at the end of the deck 14 Start the User Profile Synchronization Service Powershell – a little harder than most

15. 15 Configure Synchronization Connections Active Directory Domain Services Novell eDirectory(LDAP) Sun Java Directory Service(LDAP) IBM Tivoli (LDAP)

16. Active Directory Permissions Create a service account for Active Directory read and write 16 Isolate roles Manage Permissions Keep domain admins happy

17. Replicate Directory Changes Delegate control on your domain and grant Replicate Directory Changes This give you importpermissions

18. More Permissions Create Child Objects permissions for the User Profile Service Account Using ADSIEdit Allows you to write back to Active Directory…..almost

19. More sync permissions One more in ADSIEdit Advanced  Find UPS Service Account Write All Properties Create All Child Objects There will be two instances

20. Connecting to AD Auto domain controller or specify one Enter the User Profile service account credentials

21. Select the OU/s you want to Sync Say goodbye to LDAP Queries 21 Configure Synchronization Connections

22. Almost there… Connection Filters Easily exclude disabled accounts from sync 22

23. Forefront Identity Manager C:rogram Filesicrosoft Office Servers4.0ynchronization ServiceIShell 23

24. Get Permissions right or… 24 No write back to AD No Sync You can only do Full Sync

25. Performing a Sync

27. Server load and Directory Service Load

28. Or minutes (up to 59) 26

29. 27 Still having trouble?

31. <configuration> <system.net> <defaultProxy> <bypasslist> <add address="[a-z]+DOMAINlan" /> <add address="1921680*" /> </bypasslist> </defaultProxy> </system.net> </configuration> 29 Proxy Override And where are you going to put it…

32. 30 Proxy Override C:rogram Filesommon Filesicrosoft Sharedeb Server Extensions4INwstimer.exe.config Web.config of you Central Administrator Web Application <system.net> <defaultProxy /> </system.net> 3. C:rogram Filesicrosoft Office Servers4.0ynchronization ServiceIShellIISClient.exe.config 4. C:rogram Filesicrosoft Office Servers4.0ynchronization ServiceinIIServer.exe.config Yes that makes four locations

34. If you find profiles are NetBiosNamesername

35. Eg. Netbios.domain.lan

36. Appears as Netbiososhua.haebets

37. Should be domainoshua.haebets

38. Configuration container in ADSI, replication directory changes31 Netbios Names

39. Powershell and only Powershell $ups = get-spserviceapplication | where{$_.displayname.contains(“User”)} $ups.NetBIOSDomainNamesEnabled = $true $ups.update() $ups.NetBIOSDomainNamesEnabled  True 32 Enable Netbios Delete and recreate the connection to the directory store

40. What does it all mean

42. Clients / Accounts

43. Previous Employer

44. Footy Team

45. Write back to Active Directory

46. Never fear, import only by default34

48. Office Locations

49. Job Titles

50. Products

51. Customers

52. Profile Properties can use Managed Metadata 35

53. Profile Properties

54. Sub Types Separate profiles for employee types; Part-time / casual employees Contractors Consultants 37 Work daysStart and/or End Date Vendor / Consultancy Capture only the information you need for each profile type

55. Import or Export Plan what you want to write back. One off import and managed from SharePoint? Can HR managed everything from SharePoint now? 38

56. Profile Properties

57. Email analysis SharePoint reads your emails. Never fear, this is a good thing

58. Pictures Stored in “User Photos” at the rootweb of the MySite site collection 3 versions Large 144x144 Medium 96x96 Small 32x32 Will size by longest edge Write back to AD and see them in Outlook 41

59. BCS Data Source 42 Not with User Profiles Import only

60. Getting data from other systems 43

61. Importing from LOB Systems

62. Data in - data out LOB System to SharePoint AD to SharePoint SharePoint to AD

63. Data in - data out Identity management for the masses

64. Patches……they were quick KB983497 http://support.microsoft.com/kb/983497 Almost completely dedicated to the user profile issues Fixes issues with; large data stores Groups and members SQL locks Delays in sync activity feed

66. Plan what data (properties) you need

67. Create the policies

68. Set the permissions

69. What goes back to your directory service

71. Sponsors Thanks For Listening! Be sure to submit your feedback if you want to be in the draw to win the Xbox 360 and other prizes!

72. # Start the profile synchronization service on a server function Start-ProfileSynchronizationService{ PARAM ( [string] $ProfileApplication = $(throw "You must provide a user profile service application name"), [string] $Machine, [string] $Password = $(throw "You must enter the password of the farm account (SharePoint timer service account)")) $upaApp = Get-SPServiceApplication | ? {$_.name -like $ProfileApplication} if ($Machine -eq $null -Or $Machine -eq"") { # get the current machine $Machine = [System.Environment]::MachineName} $syncService = Get-SPServiceInstance | ? {$_.typeName -like "User Profile Synchronization Service" -And $_.Server.Address -like $Machine} ## get default timer service account $serviceAccount = (Get-SPFarm).DefaultServiceAccount Write-Output([System.String]::Format("Starting user profile sync service on machine {0} for UPA {1}; service account is {2}", $Machine, $upaApp.Name, $serviceAccount.Name)) $upaApp.SetSynchronizationMachine($Machine, $syncService.Id, $serviceAccount.Name, $Password) } ## Use the function Start-ProfileSynchronizationService to start profile synchronization service write-output "Starting user profile sync service" $machine = read-Host("Please enter the server on which you want to run the profile sync service (by default is current machine)") $upa = read-Host("Please enter the UPA name the profile sync service will be associated with") $password = read-Host("Please enter the service account (farm account) password") start-ProfileSynchronizationService -ProfileApplication $upa -Machine $machine -Password $password 51 Start the User Profile Synchronization Service