Author Archives: Vladilen.com

Hybrid SharePoint 2013/2016

Step-by-step script of my recent Hybrid SharePoint 2016 – Office 365 implementation:

 

Office 365 Prerequisites

  • set and configure custom domain name
  • synchronize users (e.g. like this)
  • provide Office 365 licenses for hybrid users
  • (for hybrid search or Sharepoint 2016 DLP) provide license for farm account

On-Premises AD prerequisites

  • AD group “HybridUsers” for hybrid users

On-premises SharePoint Prerequisites

  • managed metadata service application
  • user profiles service application
    • user profiles are synchronized (incl. User Principal Name and Work email)
    • MySites
    • Audience for HybridUsers AD group
  • app management service application
  • subscription settings service application
  • secure store service application
  • SP1 + September 2015 CU

On-Premises AD prerequisites

  • AD group “HybridUsers” for hybrid users

Certificates

  • certificate to replace the default SharePoint STS certificate
    • no special requirements for subject
    • self-signed (lab/test)
    • public authority (production)

If you plan for inbound search of hybrid BCS – there are some more requirements

 

Steps:

Create S2S trust, i.e. trust relationship between on-premises SharePoint and Office 365.

  • replace default STS certificate
  • upload certificate to Office 365
  • add SPN to Azure AD
  • register SPO application principal
  • set authentication realm (align this with high-trusted app environment)
  • configure on-prem proxy for Azure AD

(scripts: https://technet.microsoft.com/library/dn197169.aspx)

 

Hybrid Sites and Hybrid OnDrive for Business

  1. goto Office 365 admin center -> SharePoint admin
  2. copy mysites site collection name (https://ecm-my.sharepoint.com)
  3. goto on-prem SharePoint CA -> Office 365 -> Configure hybrid OneDrive…
    • enter “My Site URL” from “2” Office 365 mysites site collection name
    • (optional) enter specific audience – “hybrid users”
    • select hybrid features – “OneDrive only” or “OneDrive and Sites”

Hybrid Sites Hybrid OnDrive for Business warnings:

  • you cannot activate hybrid sites w/o activating hybrid OneDrive for Business
  • users need to re-follow migrated sites
  • custom profile properties require additional steps
  • existing mysites content will not be migrated – consider
    • 3-rd party tools or
    • PowerShell(?) or
    • manual “old sync->backup->.stop sync -> new sync -> restore from backup -> sync” for every user

 

 

Sources:

SharePoint <-> Office 365 users synchronization, ADFS and WAP

Azure AD Connect

Prerequisites:

  • (existing) AD DC
  • (new) DirSync Server, joined to domain (e.g. ds.domain.local), OS = Windows Server 2012 R2
  • domain admin and local admin account
  • Office 365 global admin account

steps:

  • add your domain to your Office 365 environment in advance (it takes time)
  • add .net 3.5 and .net 4.5 features to the DirSync server
  • ensure your account is local admin and domain admin and Enterprise Admin
  • go to Office 365 admin center, Settings, Services and Add-Ins, Directory Synchronisation, Start Wizard and follow instructions (start check etc.)

 

ADFS

Prerequisites:

  • (existing) AD DC
  • (new) ADFS Server, joined to domain (e.g. fs.domain.local), OS = Windows Server 2012 R2
  • (new) WAP Server (e.g. wap.domain.local)
  • (create new) account for ADFS (like domain\adfs-svc) and make it local admin on ADFS Server
  • let say our service name is “adfs.domain.com” ( server name is “fs.domain.local”), then we need to
    enroll a certificate for service name (i.e. adfs.domain.com), not a wildcard

    • Subject name and subject alternative name must contain your federation service name, such as adfs.domain.com
    • Subject alternative name must contain the value enterpriseregistration followed by the UPN suffix of your organization, such as, for example,enterpriseregistration.domain.local
    • Subject alternative name must contain the value certauth followed by the adfs service name, e.g. certauth.adfs.domain.com
    • set private key as exportable
  • export this certificate (with password)
  • ensure A record in internal DNS for service name (i.e. adfs.domain.com) points to ADFS server (“fs.domain.local”)

 

steps:

  1. create A-record for adfs.domain.com pointing to fs.domain.local
  2. (login on ADFS Server as adfs-svc), add (install) Active Directory Federation Services role
  3. Configure role
    1. choose “create the first…”
    2. provide domain admin account credentials
    3. choose SSL certificate (adfs.domain.com) and service name (same name),
      provide FS display name
    4. specify a domain user account (use an existing adfs-svc) and password
    5. create database (or use existing sql)
  4. Check configuration 
    1. go to “https://localhost/adfs/ls/idpinitiatedsignon.htm” (ignore certificate error, and do not login)
    2.  

 

WAP

 

  1. Add role “Remote Access”, features by default, choose role services “Web Application Proxy”, add features.
  2. import certificate
  3. Configure role: enter FS name (adfs.domain.com), provide credentials (domain\adfs-svc)
  4. Create A-record on external DNS for FS name (adfs.domain.com) pointing to WAP external IP

 

 

==================

Based on

 

Create New Performance Point Service Application failed

Create New Performance Point Service Application failed with “Address(int ) is an invalid or loopback address.  Specify a valid server address.”

 

$newServiceApplication = New-SPPerformancePointServiceApplication -Name $serviceName -ApplicationPool $applicationPool -DatabaseServer $dbServer -DatabaseName $serviceDB
New-SPPerformancePointServiceApplication : System.Object&, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 Address(int ) is an invalid or loopback
address.  Specify a valid server address.
At line:1 char:26
+ $newServiceApplication = New-SPPerformancePointServiceApplication -Name $service …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (Microsoft.Perfo…viceApplication:NewSPPerformanc…viceApplication) [New-SPPerformancePointServiceApplication], ArgumentException
    + FullyQualifiedErrorId : Microsoft.PerformancePoint.Scorecards.NewSPPerformancePointMonitoringServiceApplication

 

Solytion: provide fixed sysadmin sql server role for the account you run script.

Orphan SharePoint sites vs orphan content databases

Note: the article below is for on-prem SharePoint. For Microsoft 365 orphan/ownerless resources – sites, groups – please check 
– Ownerless Microsoft 365 groups, teams and sites Q&As 
– Microsoft 365 ownerless groups policy email template format and content
– Orphan Microsoft 365 groups in large environments

Remove orphan sites from SharePoint content database

Problem: When you patch SharePoint or perform database-attach migration or just do Test-SPContentDatabase, sometimes you can see errors with category “SiteOrphan”. Although it says “UpgradeBlocking : False”, Ignoring this error may cause severe issues, even data loss.
Continue reading →

SharePoint 2013 Streamlined Architecture

Based on “Streamlined Topologies for SharePoint Server 2013” diagram from Microsoft (“Topology design guidance for maximizing system resources”), 

Simplified for 4-servers high-available 3-tier farms:

  Services

Front-End Servers

Service applications, services, and components that serve user requests directly are placed on front-end servers. These servers are optimized for fast performance.

Low and Very low latency.
  • Access
  • BDC
  • Cache
  • MMS
  • Secure Store
  • State 
  • Subscription Settings
  • UPSA
  • User Code
  • Visio
  • Excel Calculation
  • Performance Point
  • Project
  • Search Query
  • Web Application/CA

Batch-Processing Servers

Service applications, services, and components that process background tasks are placed on a middle-tier of servers referred to as batch processing servers. These servers are optimized to maximize system resources. These servers can tolerate greater loads because these tasks do not affect performance observed by user
  • UPSA Sync
  • Workflow Timer Service
  • Machine Translation
  • Word Automation
  • Work Management
  • Search Crawl Target (Web Application)
  • Search Crawl/Analytics
  • PowerPoint conversion 

 

step-by-step SharePoint Setup with AutoSPInstaller

(the article is under construction)

How to setup SharePoint 2013/2016/2019 using AutoSPinstaller

the quick and easy way which can be used in your lab environment, as well in test and even in production and later be scaled-out, as performance and/or availability requirements grows up

Assume 3-tier topology – Front-End Server, Batch-Processing Server and SQL Server. Accounts according to least privilege principle.

Treat all server names, account names and domain names in this article are “for example”, i.e. you should use your own names.

What you must already have/get:

  • AD (Active Directory)

Prepare (request) hardware (virtual machines):

  • SP16SQL1 for SQL Server 2016
  • SP16WFE1 for SharePoint 2016 Front-End Roles
  • SP16BPS1 for SharePoint 2016 Batch-Processing Roles

SP16SQL1 for SQL Server 2016

refer to Microsoft SharePoint 2016 requirements for hardware specifications, but as minimum:

  • any 64-bit 4-core server CPU
  • RAM 4 GB for lab/test and 16+ GB for prod
  • HDD min 80 GB for system drive, 80 GB drive for application/data

Install MS Windows Server 2016 with GUI.
Configure time zone and time, static IP, name, language, region.
Add to domain.
Add App Server role, install updates, check event logs, resolve errors if any.

SP16WFE1 and SP16BPS1 for MS SharePoint 

refer to Microsoft SharePoint 2016 requirements for hardware specifications, but as minimum:

  • any 64-bit 4-core server CPU
  • RAM 8-12GB for lab/test and 16-24GB for prod
  • HDD min 80GB for system drive, 80GB drive for application

Install MS Windows Server 2016 with GUI.
Configure time zone and time, static IP, name, language, region.
Add to domain.
Add App Server role, install updates, check event logs, resolve errors if any.

Create (request) AD accounts:

– SQL-Adm
– SQL-Svc

– SP-Adm
– SP-Farm
– SP-Svc
– SP-PortalAppPool
– SP-ProfilesAppPool
– SP-CacheSuperUser
– SP-CacheSuperReader
– SP-ProfileSync
– SP-SearchService
– SP-SearchContent
– SP-ExcelUser
– SP-VisioUser
– SP-PerfPointUser

and

– SP_farm_administrators security group

add SP-Adm (and personal admin accounts) to SP_farm_administrators group

provide “Replicate Directory Changes” AD permissions to SP-ProfileSync account (refer to this how to article)

 

SQL Server:
add SQL-Adm to local administrators

SP Server:
add SP_farm_administrators group to local administrators group

Setup

on SQL Server:
login as SQL-Adm to install  MS SQL Server 2016

  • start MS SQL Server 2016 setup
  • features: Database Engine Services, (optional) Reporting Services – SharePoint
  • Directories: change to non-system drive
  • (optional) name instance
  • Service Accounts: use SQL-Svc as service account for SQL Server Agent and SQL Server Database Engine 
  • Server Configuration: AddCurrentUser
  • Data directories: ensure non-system drive is used
  • Windows Firewall and Advanced Security->Inbound Rules->New Rule->
    • Port TCP 1433-1434 Allow
    • Port UDP 1434 Allow

since “SQL Server Management Studio” is not a part of SQL Server, but distributed separately, you need to

  • download “SQL Server Management Studio” (any version – 2016+) and
  • install it on any machine – SQL, SharePoint or your personal workstation, then
  • start SQL Server Management Studio->Security->Logins
    • add SP_farm_administrators with roles securityadmin, dbcreator, public
  • SQL SQL Management Studio->Right Click on instance name->select properties->Advanced->Change Max Degree of Parallelism to 1

on SharePoint Server:
login as SP-Adm

  • (optional) setup MS SQL Server 2016 feature Reporting Services – add-in for SharePoint
  • check connection to SQL server
    • create empty file with extention .udl (create text file and rename it to sql.udl)
    • double-click it
    • enter server name, choose Windows NT integrated security, select database, Test Connection
    • if failed – check on SQL Server if protocol TCP/IP activated for remote access (SQL Server Configuration Manager -> SQL Server Network Configuration -> Protocols… -> TCP/IP -> Enable)
      check firewall
  • download AutoSPInstaller, unzip it, explore content

Generally, the steps are

  • install/configure prerequisites (Windows roles, some additional software)
  • install SharePoint binaries (SharePoint itself, language packs, updates)
  • create/configure farm (create configuration database, service applications, web applications etc.)

AutoSPInstaller is able to handle all steps, but personally I prefer to install prerequisites and SharePoint manually, and use AutoSPInstaller only to create/configure farm. If so, we will need only “Automation” folder from autospinstaller.zip

Prerequisites

I’d recommend copy all content from source SharePoint image to a folder. 

run prerequisiteinstaller.exe. It will take care of

  • Web Server (IIS) Role
  • Microsoft SQL Server 2012 Native Client
  • Microsoft ODBC Driver 11 for SQL Server
  • Microsoft Sync Framework Runtime v1.0 SP1 (x64)
  • Windows Server AppFabric
  • Microsoft Identity Extensions
  • Microsoft Information Protection and Control Client 2.1
  • Microsoft WCF Data Services 5.6
  • Microsoft .NET Framework 4.6
  • Cumulative Update Package 7 for Microsoft AppFabric 1.1 for Windows Server (KB3092423)
  • Visual C++ Redistributable Package for Visual Studio 2012
  • Visual C++ Redistributable Package for Visual Studio 2015
     

(optionally, you can run powershell:

Add-WindowsFeature Web-Server,Web-WebServer,Web-Common-Http,Web-Static-Content,Web-Default-Doc,Web-Dir-Browsing,Web-Http-Errors,Web-App-Dev,Web-Asp-Net,Web-Net-Ext,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Health,Web-Http-Logging,Web-Log-Libraries,Web-Request-Monitor,Web-Http-Tracing,Web-Security,Web-Basic-Auth,Web-Windows-Auth,Web-Filtering,Web-Digest-Auth,Web-Performance,Web-Stat-Compression,Web-Dyn-Compression,Web-Mgmt-Tools,Web-Mgmt-Console,Web-Mgmt-Compat,Web-Metabase, WAS,WAS-Process-Model,WAS-NET-Environment,WAS-Config-APIs,Web-Lgcy-Scripting,Windows-Identity-Foundation,Xps-Viewer

an then prerequisiteinstaller.exe )

It might require you to restart the server, then prerequisiteinstaller.exe will continue until you see “Installation Complete” message. Finally you must see “Installation Complete. All required prerequisites have been installed or enabled” message.

Now run setup.exe

Be ready to provide your SharePoint product key. You can use SharePoint trial key from here for test or evaluation environment. 

From Server Type choose “Complete” (for SharePoint 2013 only – option chosen by default).

NB! Choose File Location on “File Location” tab. I’d recommend install SharePoint on separate drive (e.g. E:).

Note that it says: “If you intend to use this computer as a search server, the search index files will be stored on the local drive. These files can be very large , so ensure that there is sufficient free space on the selected drive. To change where Microsoft SharePoint Server 2016 will store it’s index files…”

You might say that it is possible to configure index files location during provisioning Search Index component. 
Yes, I absolutely agree. But! There is also Analytics Processing Component, and during it’s work, it generates temporary files under “C:\Program Files\Microsoft Office Servers\15.0\Data\Office Server\Analytics_GUID\AE\AnalyticsProcessingComponent1” which might be very big in size, and that location could not be “legally” changed. So if you miss this point, you might be required to reinstall SharePoint binaries later. See also this. 

After binaries installed, you should see “Run Configuration Wizard” “To complete configuration of your server, you must run the SharePoint Product Configuration Wizard”… 
Remove the checkmark “Run the SharePoint Product Configuration Wizard now” (untick this).
I.e. Do not run Product Configuration Wizard for now. Farm will be configured later via PowerShell AutoSPInstaller script.

If you need language packs – it’s time to install language packs. 

Now you are good to install Cumulative Update. Latest for test/lab environment, latest tested for production. Check updates against regressions (e.g. with Todd Klindt). 

Do not run Product Configuration Wizard.

Now let us have a closer look into AutoSPInstaller Automation folder.

у AutoSPInstallerInput.xml убираем атрибут “read only” файловой системы
AutoSPInstallerInput.xml правим так:
        <PIDKey></PIDKey> вбиваем ключ (можно триальный отсюда, потом вручную сменим на постоянный)
        <SKU>Enterprise</SKU> вбиваем Standard или Enterprise (ключ тогда должен быть соответствующий)
        <AutoAdminLogon Enable=”false” Password=”” /> вбиваем true и пароль, если хотим чтобы сервер каждый раз сам логинился (предполагается несколько перезагрузок)
        <Passphrase></Passphrase> вбиваем пароль/ключ (используется для присоединения дополнительных серверов к ферме)
        <Account…  везде, где встречаем DOMAIN\ или @domain, исправляем на наши реальные данные так:
            <Username>DOMAIN\SP_Farm</Username> , заменяем DOMAIN на настоящее имя нашего домена, оставляем название и имя учётки (SP_Farm) как есть
            <Password></Password> вбиваем пароль
            <Email>spfarm@domain.com</Email> вбиваем e-mail
        <CentralAdmin Provision=”true”>… ставим порт какой удобно, например <Port>2013</Port>
        <Database> первое упоминание делаем так
           <DBServer></DBServer>  вбиваем алиас для SQL Server (например <DBServer>SP3SQLAL</DBServer>)
                     DBInstance=”SERVER\INSTANCE” правим на только имя сервера (например, DBInstance=”SP3SQL1″)
            <DBPrefix>AutoSPInstaller</DBPrefix> меняем на удобный нам, например <DBPrefix>SP</DBPrefix>
        остальные упоминания <Database> не трогаем (оставляем пустыми как есть)
        <ManagedAccounts> домен и пароль  меняем на свой, всё остальное – названия акаунтов и сами акаунты – оставляем как есть
        <Logging><LogDiskSpaceUsageGB></LogDiskSpaceUsageGB> поставить приемлемое для своего дискового пр-ва значение, например 5
        <AppManagementService если вы в состоянии это сделать, то оставляем Provision=”true”
                и следуем инструкциям, например Setting up your App domain for SharePoint 2013
                иначе – ставим Provision=”false”

  • Собственно установка
    • Запускаем от имени администратора (Run As Administrator) батничек AutoSPInstallerLaunch.bat
    • Но не идём курить, как некоторые советуют, а пьем чай и наблюдаем, т.к. иногда срабатывает UAC и надо тыкнуть “OK”
    • Если скрипт почему-то “слетает”, то смотрим “почему”, поправляем и запускаем снова, ничего не меняя в других настройках.

Последействия:
        <AutoAdminLogon Enable=”false” Password=”” /> стираем пароль
        <Passphrase></Passphrase> стираем

поправить параметры логирования под себя

если есть exchange, можно настроить OutgoingEmail и сам Exchange

 

Notes:

if you plan federated SharePoint environment, i.e. having Publishing (Service) Farm and Consuming (Content) Farm – plan for SQL aliases carefully.

 

Sources:

Brian Lalancette: AutoSPInstaller 

Technet: Account permissions and security settings in SharePoint 2013
Technet: Install SharePoint 2013
Technet: Hardware and software requirements for SharePoint 2013
CodePlex: Automated SharePoint 2010/2013 PowerShell-based installation script
Technet: virtual environment for SharePoint 2013
Setting up your App domain for SharePoint 2013

F5 Load Balancing for SharePoint 2016

 

Management Tools Basic+Complete;