user | Bugra Postaci's Blog

PeoplePicker – Double Users and Diacritic issue

05/02/2015 Leave a comment

Well, it is an another well know issue by Microsoft.
Here you can find some definitions:

* Experiencing inconsistencies with some user profiles where the user Account name attribute is observed to vary between e.g. Domain\aloş and Domain\alos . This is observed in SharePoint Central Administration > User Profile Service Application > Manage User Profiles and Edit User Profile sections and therefore impacting approval workflows where they are using InfoPath Forms .

*Connecting local domain to Sharepoint server, in domain are login with diacritics, in sharepoint there are login of users with diacritics – wrongly displayed .Also when search for the user in people picker we get two users account one with account name with diacritics and second without it.
In UPA profile contains correct account name (without diacritics)

Issue Reproduce:
Add a user in Active Directory. In example we are adding TESTMOSS2010T\Berkc user.

For first time login the SharePoint as a Site collection administrator (which should be different that our test account)
And try to grant permission the user but use diacritic as berkç (use ‘ç’ instead of ‘c’)

When you check and verify the user, move and keep Mouse over the validated user text , that will Show us the account
As you can see it is “TESTMOSS2010T\berkç” . Well so far so good . SharePoint accept it without any problem when you click the OK.

If you search from user it will Show you just one with “berkç”

If we try without diacritics like “berkc” it is also accepted .

But wait a minute , If you keep Mouse over the validated user text , that still show us the account as
“TESTMOSS2010T\berkç” .

Hmm , thats looks strange . (Well actually SharePoint has already saved the data in UserInfo table & UserInformation List as ‘berkç’) and SharePoint is clever enough to understand this is same user.
(because they have same SID) PS: If the SIDs are different well it is tottally different problem and out of scope for this article 🙂

You can see in UserInfo table

And User Information List

Well , I dont want to use it like this. This user should be “TESTMOSS2010T\berkc” so how can i change it .
Move-SPUser will helps here.

$user = get-spuser -Identity “TESTMOSS2010T\berkç” – web <web Url>
Move-SPUser -identity $user -NewAlias “TESTMOSS2010T\berkc” -IgnoreSID
(In some scenarios it doesn’t work , so in that condition you may need to delete user from SharePoint and add again )
After i changed that user account , hmm i can see now 2 account if i search from people-picker .

Why ? The reason is LSA cache . Because very first time we make a query to AD as “berkç” and AD accepted it (Well the configuration of AD user resolution for diacritics is a different issue so i don’t mention here) and Server LSA cache has stored as “berkç” . So PeoplePicker has uses both SharePoint DBs and AD Resources to Show results . In that condition SharePoint DB (User Information List) returns “berkc” and AD query bypassed by LSA – Show us “berkç”

The LSA maintains a SID cache on domain member computers. This cache stores mappings between SIDs and user names. If the SID information exists in the local cache, the LSA returns the cached user name information instead of checking whether the user name has changed.
The local SID cache helps reduce domain controller workload and network traffic. However, inconsistency may occur between the local cache and the domain controllers.

If you want to get rid-off this behavour ; disable LSA cache: http://support.microsoft.com/kb/946358.

To work around this issue, disable the local SID cache on the domain member computer. To do this, follow these steps:

Open Registry Editor.To do this in Windows XP or in Windows Server 2003, click Start, click Run, type regedit, and then click OK.
To do this in Windows Vista and newer, Click Start, type regedit in the Start Search box, and then press ENTER.
Locate and then right-click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Point to New, and then click DWORD Value.
Type LsaLookupCacheMaxSize, and then press ENTER.
Right-click LsaLookupCacheMaxSize, and then click Modify.
In the Value data box, type 0, and then click OK.
Exit Registry Editor.

Note The LsaLookupCacheMaxSize registry entry sets the maximum number of cached mappings that can be saved in the local SID cache. The default maximum number is 128. When the LsaLookupCacheMaxSize registry entry is set to 0, the local SID cache is disabled.

Unfortunately there is no other resolution for this design.

Filed under Sharepoint 2010, SharePoint 2013 Tagged with Diacritic, Double, LSA, PeoplePicker, user

Unable to sync user titles for Welcome name in SharePoint

12/04/2014 Leave a comment

Hello ,

If you facing this problem you may read my previous post.
https://blog.bugrapostaci.com/2011/06/22/sharepoint-2010-change-your-display-of-wellcome-name

In this post i have adding another powershell script that detects and fixes this problems for a workaround.
# THIS CODE-SAMPLE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR # FITNESS FOR A PARTICULAR PURPOSE. <#

#Add SharePoint PowerShell SnapIn if not already added
if ((Get-PSSnapin “Microsoft.SharePoint.PowerShell” -ErrorAction SilentlyContinue) -eq $null) {
Add-PSSnapin “Microsoft.SharePoint.PowerShell”
}

if( $args.Length -eq 0) {
write-host “Usage : Missing ”
exit
}

$MissMatchCount = 0
$NoProfile = 0;
$NoPrefferedName = 0
$TotalUser = 0
$Matched = 0
$Fixed = 0

write-host “Intializing…”
$site = new-object Microsoft.SharePoint.SPSite($args[0]);
$ServiceContext = [Microsoft.SharePoint.SPServiceContext]::GetContext($site);
$ProfileManager = new-object Microsoft.Office.Server.UserProfiles.UserProfileManager($ServiceContext);

foreach($siteUser in $site.RootWeb.SiteUsers)
{
write-host “Checking -> AccountName: ” $siteUser.LoginName ” ID:” $siteUser.ID
try
{
$profile = $ProfileManager.GetUserProfile($siteUser.LoginName);
}
catch
{
write-host “Unable to get profile for user” $siteUser.LoginName -foregroundcolor red
$NoProfile++
$TotalUser++
Write-host “————-”
continue;
}

$AccountName= $profile[[Microsoft.Office.Server.UserProfiles.PropertyConstants]::AccountName].Value
$PreferredName = $profile[[Microsoft.Office.Server.UserProfiles.PropertyConstants]::PreferredName].Value

write-host “Profile Data -> Account: ” $AccountName ” DisplayName:” $siteUser.DisplayName ” PrefferedName:” $PreferredName

if( $accountName -ne $siteUser.LoginName)
{
write-host “Account MissMatch -> LoginName: ” $siteUser.LoginName ” Profile Account:” $AccountName -foregroundcolor red
}

if( $PreferredName -ne “NONE” )
{
if($PreferredName -ne $siteUser.DisplayName)
{
write-host “MissMatch :” $siteUser.LoginName ” DisplayName:” $siteUser.DisplayName ” PrefferedName:” $PreferredName -foregroundcolor yellow
$MissMatchCount++

#Set-SPUser -identity $siteUser.LoginName -Displayname $PreferredName -web $args[0]
#$Fixed++
}
else
{
Write-host “OK”
$Matched++
}
}
else
{
$NoPrefferedName++
}
Write-host “————-”
$TotalUser++
}

Write-host “Results”
write-host “Total User : ” $TotalUser
write-host “Total Matched User Count : ” $Matched
write-host “Total Fixed User Count : ” $Fixed
Write-host “Total Missmatch User Count : ” $MissMatchCount
Write-host “Total Missing Profile User Count : ” $NoProfile
write-host “Total Empty Preffered Name user Count : ” $NoPrefferedName

For fixing option just activate the line by deleting “#” charecter.

#Set-SPUser -identity $siteUser.LoginName -Displayname $PreferredName -web $args[0]
#$Fixed++

Usage is simple:
Save the script in your drive as ps1 file.

C:\> .\syncuser.ps1 <SiteUrl>
Exp
C:\> .\syncuser.ps1 http://blog.bugrapostaci.com

PS: To get output in a text file is a little tricky but you can do it like this.
Start a Command Prompt ( Not Powershell! )
Type following command
C:\> powershell .\syncuser.ps1 http://blog.bugrapostaci.com > .\results.txt

Filed under Sharepoint Tagged with Profile, set-spuser, Sync, user, UserInfo, Welcome

Getting Last Accessed user for a SharePoint Site

02/04/2013 Leave a comment

Assume that you would like to get last accessed users for a specific site or web in SharePoint. The correct approch is creating a custom IIS Module to get update statistics by every request. If you dont want to do that there you may alternatively use following method.

But we have some conditions:
1) Usage and Health Data Collection Service Application is running.
2) And Microsoft SharePoint Foundation Usage Data Import job running in a small interval (one hour maybe). (Because the data first stores in a Usage file in file System and when the timer job has been executed that data transfered to you Logging Database) Thats mean it is not real time. (If you would like a statistics in real time i suggest that use a custom IIS module)

Than you can search the last 5 accessed user from SQL Server Management Studio by quering Logging Database Server (It would be delayed by interval of Import Timer Job)

Declare @serUrl as nvarchar(MAX), @sitUrl as nvarchar(MAX) , @wUrl as nvarchar(MAX)
Declare webcursor CURSOR FOR select serverurl,siteurl,weburl from RequestUsage group by ServerUrl,SiteUrl,WebUrl
Open webcursor

FETCH NEXT FROM webcursor INTO @serUrl,@sitUrl,@wUrl
WHILE @@FETCH_STATUS = 0 
BEGIN
PRint 'ServerUrl: ' + @serUrl + ' Site Url:' + @sitUrl +  ' Web Url:' + @wUrl
select Top 5 LogTime, UserLogin,ServerUrl,SiteUrl,WebUrl from RequestUsage 
where ServerUrl = @serUrl and SiteUrl = @sitUrl and WebUrl =  @wUrl
--Dont Forget to Exclude SharePoint\system , Central Administration Web Site, Crawler Account, And Timer Service Account for correct results.
and ServerUrl <> 'http://contoso.com:32843'  and UserLogin <> 'SHAREPOINT\system' and UserLogin<> 'Contoso\Crawler'
order by LogTime desc 
FETCH NEXT FROM webcursor INTO @serUrl,@sitUrl,@wUrl
END
CLOSE webcursor
DEALLOCATE webcursor

Filed under Sharepoint Tips & Tricks Tagged with Accessed, Analytics, Health, Sharepoint, TimerJob, user

Failed to create the Pages library – SharePoint 2010

21/04/2012 Leave a comment

When try to create a new site ( Publishing Site ) under your site collection Event log message was: ‘Failed to create the ‘Pages’ library.’.
Exception was: ‘Microsoft.SharePoint.SPException: User cannot be found.
at Microsoft.SharePoint.SPUserCollection.get_Item(String loginName)
at Microsoft.SharePoint.Workflow.SPWorkflowNoCodeSupport.LoadWorkflowBytesElevated(SPFile file, Int32 fileVer, Int32& userid, DateTime& lastModified)

the error caused by the user who created the latest revision of the workflow no longer exists in the site collection.

1) Download and install Sharepoint Designer 2010 if you already do not have it on your system.
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=16573

2)In Sharepoint Designer, please open the root web

3)Go to All files > _Catalogs> wfpub

4)Check out and then Check in all Publishing Workflow configuration files:

5)De-activate and re-activate the publishing Feature from Site Settings

Important: Please proceed with a full farm backup before proceeding with this . It would also be beneficial for your users if you could implement the action plan outside of your regular business hours.

Filed under Sharepoint 2010 Tagged with Feature, Library, Pages, Publishing, SPS2010, user, wfpub

Sharepoint 2010 How to give “Replicate Directory Changes” permission to User Profile Sync Account

28/03/2012 1 Comment

in Technet sometimes is getting hard to find what you are seeking because of it separated more than one article. So i decided that create and collect in one article for this issue for easy share. As you know the synchronization account for a connection to Active Directory Domain Services (AD DS) must have the following permissions:
Before do apply this permissions you already decided which account is your user profile sync account and needless to say it must be an AD account .

1) It must have Replicate Directory Changes permission on the domain that you will synchronize with.
Important: The Replicate Directory Changes permission allows an account to query for the changes in the directory. This permission does not allow an account to make any changes in the directory

To grant Replicate Directory Changes permission on a domain:

On the domain controller, click Start, click Administrative Tools, and then click Active Directory Users and Computers.
In Active Directory Users and Computers, right-click the domain, and then click Delegate Control.
On the first page of the Delegation of Control Wizard, click Next.
On the Users or Groups page, click Add.
Type the name of the synchronization account, and then click OK.
Click Next.
On the Tasks to Delegate page, select Create a custom task to delegate, and then click Next.
On the Active Directory Object Type page, select This folder, existing objects in this folder, and creation of new objects in this folder, and then click Next.
On the Permissions page, in the Permissions box, select Replicating Directory Changes (select Replicate Directory Changes on Windows Server 2003), and then click Next.
Click Finish.

2) If the NetBIOS name of the domain differs from the fully qualified domain name, the synchronization account must have Replicate Directory Changes permission on the cn=configuration container

To grant Replicate Directory Changes permission on the cn=configuration container:

On the domain controller, click Start, click Run, type adsiedit.msc, and then click OK.
If the Configuration node is not already present, do the following:
1. In the navigation pane, click ADSI Edit.
2. On the Action menu, click Connect to.
3. In the Connection Point area of the Connection Settings dialog box, click Select a well know Naming Context, select Configuration from the drop-down list, and then click OK.
Expand the Configuration node, right-click the CN=Configuration… node, and then click Properties.
In the Properties dialog box, click the Security tab.
In the Group or user names section, click Add.
Type the name of the synchronization account, and then click OK.
In the Group or user names section, select the synchronization account.
In the Permissions section, select the Allow check box next to the Replicating Directory Changes (Replicate Directory Changes on Windows Server 2003) permission, and then click OK.

3) If you will export property values from SharePoint Server to AD DS, the synchronization account must have Create Child Objects (this object and all descendants) and Write All Properties (this object and all descendants) permissions on the organizational unit (OU) that you are synchronizing with.

To grant Create Child Objects and Write permission:

On the domain controller, click Start, click Run, type adsiedit.msc, and then click OK.
If the Default naming context node is not already present, do the following:
1. In the navigation pane, click ADSI Edit.
2. On the Action menu, click Connect to.
3. In the Connection Point area of the Connection Settings dialog box, click Select a well know Naming Context, select Default naming context from the drop-down list, and then click OK.
In the navigation pane of the ADSI Edit window, expand the domain, expand the DC=… node, right-click the OU to which you want to grant permission, and then click Properties.
On the Security tab of the Properties dialog box, click Advanced.
In the Advanced Security Settings dialog box, select the row whose value in the Name column is the synchronization account and whose value in the Inherited From column is <not inherited>, and then click Edit. If this row is not present, click Add, click Locations, select Entire Directory, click OK, type the synchronization account, and then click OK. This adds the appropriate row, which you can now select.
Important:Do not select the row for the synchronization account that is inherited from another location. Doing so would only enable you to apply the permissions to the OU and not to the contents of the OU.
In the Permission Entry dialog box, select This object and all descendant objects from the Apply to box, (select This object and all child objects on Windows Server 2003), select the Allow check box in the rows for the Write all properties and Create all child objects properties, and then click OK.
Click OK to close the Advanced Security Settings dialog box.
Click OK to close the Properties dialog box.
Repeat steps 3 through 8 to grant permissions on any additional OUs.

For default configuration, i mean if you just read from Active Directory and not planning to export , you may need to apply just first 2 permission.
If you want to test that 2 permissions are correct you can use fallowing script described fallowing article.
https://blog.bugrapostaci.com/2011/04/27/checking-replication-directory-changes-for-account-by-powershell/

For more information please read:
http://technet.microsoft.com/en-us/library/8451dde9-bbd1-4285-bc24-71bd795fb912
http://technet.microsoft.com/en-us/library/0eeb69e0-c799-4da1-b3ec-c0cc4efd585e

Filed under Sharepoint 2010 Tagged with Account, Active, AD, ADSI, Changes, CN=Configuration, Directory, Grant, Permission, Priviledge, Profile, Replicate, Syncronization, user

← Older posts

Bugra Postaci's Blog

PeoplePicker – Double Users and Diacritic issue

Unable to sync user titles for Welcome name in SharePoint

Getting Last Accessed user for a SharePoint Site

Failed to create the Pages library – SharePoint 2010

Sharepoint 2010 How to give “Replicate Directory Changes” permission to User Profile Sync Account

RSS Register

Search

Inside my brain

Categories

Top Posts

My Recents

Archives