harbar.net component based software & platform hygiene

Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Print | posted on Friday, April 23, 2010 7:47 PM

Introduction

There's a ton of stuff out there on User Profile Sync in SharePoint Server 2010. Some of it’s good, some of it’s frankly terrible. TechNet has some of the best material, but unfortunately TechNet’s format restrictions are counter-intuitive. Therefore this article presents an end to end, “rational guide” to setting this up.

[UPDATE: 01/10/2010] TechNet has recently updated its Configure profile synchronization (SharePoint Server 2010) topic, which is greatly improved and now a first class resource. I urge you to check this out.

There are a couple of contentious setup requirements in here. I may discuss those in more depth later. For now, the following steps are required. Don’t try and work around them, UPS will break. The following is the least privilege you can get away with.

You should really read the Architecture Overview below to become acquainted with the moving parts involved, but if you are impatient, you can skip to the procedure itself.

If you are having problems, firstly ensure you are following the steps below exactly. I have a follow up article which also details the most common problems with configuring profile synchronization, which may help. “Stuck on Starting”: Common Issues with SharePoint Server 2010 User Profile Synchronization

 


Architecture Overview

The following logical component diagram provides an overview of the different elements that together deliver the profile synchronisation capability.

[UPDATE 11/09/2010] a new, corrected version of the diagram.

UPASubsystemMCM

Click above to view at full size.

The key components are briefly described below.

 

User Profile Service Application


Note:
A SharePoint Service Application is a logical / conceptual object which is currently very badly articulated. I will be covering service applications in more detail in a future article. The relevant physical assets are described in this article.

 

An IIS Application which sits in the SharePoint Web Services IIS Web Site. The IIS Web Site is on every machine in the farm. When we start the Service Machine Instance later, the IIS Application will be created. It will be named with a GUID and is hosted by an Application Pool (which is also named with a GUID!). It hosts a couple of WCF services (profileproperty and profiledbcache). This is known as a Service Application Endpoint.

image

The Service Application Endpoint has three associated back end databases and other configuration. Pages for managing the Service Application are hosted in Central Administration and are called using a GUID in the query string. The WCFs don’t actually do any work themselves but provide an interface to calling clients and calls other elements of the system.

There can be more than one instance of the User Profile Service Application, but there is a one to one mapping between a Service Application and the User Profile Synchronization Service Service Machine Instance or “SharePoint Service”.

Note: The concept of a Service Machine Instance or “SharePoint Service” (i.e. the items in Services on Server) is very badly articulated in general and the name of course is deeply confusing.

There is also a Service Connection (aka Proxy). This lives within the SharePoint Foundation Web Application Service and allows Service Consumers (Web Applications) to call the Service Application.

 

 

User Profile Service

A “SharePoint Service” in Services on Server. This is not a Windows Service, but some .NET assemblies that do some work with profiles and other elements which are not to do with Synchronising of properties. There are no configuration options. This should run on the machine in the farm you wish to use to host the User Profiles “Role”. When it’s running that machine is known as the Service Machine Instance.

 

image

 

 

 

User Profile Synchronization Service

A “SharePoint Service” in Services on Server. This is a wrapper responsible for the provisioning of the Forefront Identity Manager (FIM) bits. You select a UPS SA to associate with, and need to specify the credentials under which the FIM Services will run. This should run on the machine in the farm you wish to use to host the User Profiles “Role”. When it’s running that machine is known as the Service Machine Instance.

 

image

 

 

 

Forefront Identity Manager

A bundled version of FIM that includes two Windows Services, and associated configuration and data. It is not supported to use the FIM client tool but this can be useful for viewing progress and identifying errors. The two FIM services are configured by the User Profile Synchronization Service SharePoint Service (rolls off the tongue doesn’t it!).

 

The FIM Client is located at C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe

image

Note: For some “social” SharePoint features we require Search and Managed Metadata Service Applications setup – more on that later.

 


Example Scenario

For the purposes of this article we have a very simple example scenario. We have two Web Applications (intranet.sharepoint.com & my.sharepoint.com). The Intranet application will host our corporate published content and the My application will host My Sites.

 

There is other configuration required and in some cases additional permissions required for complex domain environments. However for the scope of this article everything here is all you need.


Preparing the Platform

Before we can administer User Profile Synchronization we must create and configure elements of the supporting infrastructure and SharePoint. We are *not* going to use the Farm Configuration Wizard (FCW). The FCW is useful when standing up demo environments and for simple single server solutions, but it is entirely inappropriate for farm deployments and takes a number of shortcuts to provision a basic setup. We are going to “do it properly” in the same way any real farm deployment would be done.

It is assumed that you have installed SharePoint Server 2010 in Complete mode, and have run the SharePoint Configuration Wizard (SCW) to create a new Farm using DOMAIN\spfarm for the Farm Account. DOMAIN\spfarm is not a domain or machine administrator at this point. Furthermore, once the SCW has completed, you have not run the Farm Configuration Wizard or made any other changes in Central Administration. It is also further assumed that you are not logging onto the server using the Farm Admin account or using it to access central admin!

[UPDATE: 01/11/2010] Also, I assume that you have not used a Fully Qualified Domain Name or IP Address when specifying the SQL Server when running the SharePoint Configuration Wizard (PSConfig). Using either is strongly discouraged, and will lead to failures with the provisioning of the User Profile Synchronization service instance. Stick to a NetBIOS name, or a SQL Server Alias.

The order of setting all this up is important, if you do things in the wrong order it will break and you basically need to start over again unless you enjoy tidying up broken apps and ensuring the File system, registry, config db etc is in a good shape.

[UPDATE: 01/11/2010] While it is not required to get things working, I strongly recommend that you deploy the June or August Cumulative Updates (CU). Preferably the August CU, which offers a much easier installation. These contain numerous fixes related to User Profile Synchronization. Install these preferably before creating your Farm using PSConfig. The August CUs are available at:

  • KB 2352346 - SharePoint Foundation 2010
  • KB 2352342 - SharePoint Server 2010

Create and Configure Accounts and Permissions

The first step is to create some Active Directory accounts which will use as service account identities for Windows Services and SharePoint Application Pools. On a Windows 2008 R2 Domain I recommend creating these accounts within the built in “Managed Service Accounts” Organisational Unit but you need to understand the implication of placing them there. If you don’t, create a new OU called Service Accounts. Create each of these accounts as normal Users and choose the expiry options (never expire, user can’t change password).

  • DOMAIN\spcontent
  • DOMAIN\spservices
  • DOMAIN\spups

image

We need to grant the Replicating Directory Changes permission on the domain to the DOMAIN\spups account. This account will be used to perform the sync, it will not run any services or application pools.

  1. Right Click the Domain, choose Delegate Control… click Next
  2. Add the DOMAIN\spups account, click Next
  3. Select Create a Custom Task to Delegate, click Next
  4. Click Next
  5. Select the Replicating Directory Changes permission and click Next
  6. Click Finish

We also need to grant replicating directory changes on the Configuration Naming Context for the domain.
 

[UPDATE 11/09/2010] this is only required if the NetBIOS name of the Domain is different from the fully qualified name (FQDN). In which case you also need to configure the Service Application (after creation, details in a later step).

  1. ADSIEdit.msc
  2. Connect to the Configuration Partition
    image 
  3. Right click the configuration partition and choose properties
  4. From the Security tab, add the DOMAIN\spups user and give it Replicating Directory Changes permissions
    image

Note: this is not required if you are running SharePoint on a Domain Controller, but you shouldn’t be so don’t! :)

If our Domain Controller is running Windows 2003 or earlier functional level we also need to make the DOMAIN\spups account a member of the Pre Windows 2000 Compatible access built in group.

 

The DOMAIN\SPFARM account requires the log on locally right on the machine running the User Profile Synchronization (FIMSync) service. Grant this right via Group Policy or Local Security Policy on that Machine.

  1. Security Settings - > Local Policies -> User Rights Assignment -> Allow Logon Locally
  2. If on a DC ( you shouldn’t be :)) GPMC.MSC and edit the default domain controller policy
  3. Run gpupdate to refresh the policy change

To provision the UPS service – we must make the DOMAIN\spfarm account a local administrator of the box hosting the UPS service. Once we are done we can remove this. Don’t try and work around this – you won’t succeed!  The local administrator rights are only required during provisioning.

[Update] Please note that any event in your farm that requires the UPS service instance to be provisioned will require the Farm Account be a local admin. Such events include the re provisioning of the service instance following the deployment of a SharePoint Cumulative Update and performing a Farm Backup from Central Administration (which stops and starts the UPS service instance). Don’t forget to ensure that the correct rights are assigned (and actually taking effect) when planning and scheduling your farm operational maintenance tasks.

 

[Update] Changing the rights of a user account requires that account log off and log back on before the changes are applied. As the farm account is running services, you should restart the SPTimerV4 service, or better yet REBOOT THE MACHINE you wish to host UPS on now. If you don't, you will likely run into a stuck "starting" state when you provision the User Profile Synchronization Service Instance later  on. More details at SharePoint 2010 User Profile Sync & Reboots.

 


Create SharePoint Managed Accounts and Web Applications

Register the following accounts as managed accounts in SharePoint Central Admin, Security, Configure Managed Accounts:

  • DOMAIN\spcontent
  • DOMAIN\spservices

There is no point making the DOMAIN\spups account managed as the UPS can’t handle managed accounts.

Create two new Web Applications (my.sharepoint.com & intranet.sharepoint.com)

When creating the first one, also create a Application Pool named SharePoint Content using the DOMAIN\spcontent Managed Account. When creating the second one, select the existing application pool (SharePoint Content).

Note: of course you can use whatever you want here based on your logical architecture design, this is just the cleanest way. Don’t be hosting mysites on the same app as your main content app!

In the my.sharepoint.com web application create a site collection using the My Site Host template. We could also enable self service site creation at this stage, but this is not required. If you go to the mysite web app you will get an error stating the User Profile Service is not available. This is the expected behaviour at this point

Don’t bother with a site collection for intranet.sharepoint.com now unless you really want to!

 


Create the UPS Service Application

  1. Application Management, Manage service applications
  2. From the Ribbon, click New, followed by User Profile Service Application
  3. Give it a sensible name
  4. Create a new App Pool (SharePoint Web Services Default) and use the DOMAIN\SPServices managed account
  5. Accept the defaults for the three Databases
  6. Select the machine in the farm running FIM (well it’s not running yet but this UI is crap it just lists servers in the farm)
  7. Enter the URL of the mysite host (http://my.sharepoint.com) amazingly this step actually validates the target site collection!
  8. Select your managed path and site naming scheme.
  9. Click Create, and wait while the Service Application, Service Connection and Databases are created.

 27-04-2010 17-03-49

[UPDATE 11/09/2010] if the NetBIOS name of the name is different from the fully qualified name (FQDN) you will also need to configure the Service Application to support this. To enable the Service Application to support NetBIOS name resolution, run the following Windows PowerShell:

$upsa = Get-SPServiceApplication –Id <GUID of User Profile Service Application> $upsa.NetBIOSDomainNamesEnabled=1 $upsa.Update()  # To get the GUID of the User Profile Service Application run Get-SPServiceApplication.

Start the UPS related SharePoint Services

  1. System Settings, Manage Services on server
  2. Select the machine in the farm you wish to run this stuff on
  3. Start the User Profile Service (no options)
  4. Start the User Profile Sync Service
  5. Select the Service App you created in the previous section
  6. Enter the Farm Account password (lamer I know, UPS doesn’t understand managed accounts) and click OK.

    image
  7. Wait
  8. Wait :)
  9. Whilst the screen returns immediately the status for the UPS Service will show starting for a while.
  10. It’s provisioning the FIM services and a bunch of other stuff – coffee is an option, it will take around 10 minutes on a VM. Be patient! My baseline time is 240 seconds.
  11. An IIS Reset is required if central admin is on the same box as FIM.
    An IIS reset is always a good choice here even if it isn’t :).

    If you are impatient, an IISReset will ensure that provisioning kicks in immediately, but once it’s complete you will need to run IISReset again before you can manage the User Profile Service Application. 
  12. Once it’s sorted you can see in services.msc that the two FIM services are running as the farm account, you can run MIISclient and it will connect etc.
  13. Remove the Farm account from local administrators on the box running FIM
  14. Depending upon your machine/farm configuration you will also need to enable inbound network connections to MSDTC on the machine hosting FIM. This step is only needed if you are running a named instance of SQL Server.

 

Note: If this step is not successful, DO NOT attempt to configure things manually using Services.msc. You will miss things that are required. You should reboot the machine and run the UPS Provisioning Timer Job (ProfileSynchronizationSetupJob). If the job cannot be found, you should repeat the above procedure.

 


Configure Connections and do a Sync (Import)

  1. Application Management, Manage Service Applications
  2. Click to the right of the UPS Service App and then the Manage button on the Ribbon
  3. In the Synchronization section, click Configure Synchronization Connections
  4. Click Create New Connection
  5. Give the connection a name
  6. Select the Type (Active Directory)
  7. Enter the Forest Name (for simple scenarios this will be the same as your domain name)
  8. Choose Windows Authentication
  9. Enter the DOMAIN\spups account credentials for the connection
    (this is the important bit – this guy is what FIM will use to connect – hence the replicating permissions)

    27-04-2010 18-02-08
  10. Hit the Populate button, and this will test the credentials entered and show a Container Hierarchy tree view.
  11. Don’t select the DOMAIN! :) select a OU! This is the OU from which you want to import/sync. This UI isn't exactly scalable, but it’s what it is.

    27-04-2010 18-04-29
  12. See that Select All button? Don’t ever click that bad boy. It’s way too close to the OK button!
  13. Save the connection by clicking OK. Your connection will be saved and you will be returned to the manage connections page.
  14. Navigate back to Manage Profile Service
  15. In the Synchronization Section click Start Profile Synchronization
  16. On the Start Profile Synchronization page, click OK.
  17. Refresh the Manage Profile Service Page, you will see the progress on the right hand side.

    27-04-2010 18-08-00
  18. It is slooooooooooooooooooooooooooooooooooow!
  19. Click the details link to see some kick ass CSS work in a pop up dialog. This and the Manage Profile Service page DO NOT automatically refresh. You can also see some more GUID love from the SharePoint engineering teams in this UI.
  20. You can also see progress by running miisclient.exe
  21. Note that sync has stages, MIIS will report its complete, but SharePoint still has work to do. Be patient! Even for a import there are eight stages, each of which will be reported in the pop up dialog.
  22. Once it’s complete you will see your imported profiles in the Profiles status on the top right and also in the Manage User Profiles page.

    27-04-2010 18-19-11

If you get sync errors it’s almost certainly replicating directory permissions. 8453 means you haven’t set that properly or you’ve done it on the wrong account. There is NO other reason for this error! If you didn’t set it and your domain admin tells you it’s done, ask for a screenshot.

 


Nice, so what about actually writing back to AD (Sync)?

If you got here you are probably pretty happy. But a bit narked! All we’ve done thus far is to do the same thing we could do with SharePoint 2007 (and SharePoint 2003) – i.e. do a profile import.

To do a Sync you need additional permissions for the DOMAIN\spups account. You must grant the account Create Child Objects on the OU you are Syncing with.

Do this via ADSIEdit.msc by connecting this time to the default naming context of your domain, selecting properties on the OU you are syncing with, and adding the Create Child Objects and Write permissions to the DOMAIN\spups account.

Note we can also do this with ADUC by selecting Advanced Features from the View menu.

27-04-2010 18-27-39

Now, you need to be a little careful here. As you can see above the DOMAIN\spups account is already in the properties (that’s because we added it when delegating the Replicating Directory Changes permission earlier). However we cannot just add the new permissions here. If you do they will be applied to the OU only.

The trouble is that this won’t be reported by the SharePoint UI. You will run a sync, but properties won’t be updated in AD, and the SharePoint UI acts as if everything is just fine and dandy. That kick ass dialog we saw before won’t have any errors. The only place to see the error is in the FIM client UI:

11-05-2010 00-00-45

As you can see the DS_EXPORT phase has issues, and if we click the links it tells us the problem is with permissions to the object in AD.

11-05-2010 00-01-04

OK great, so back to the DC and the AD permissions. Before you click OK in the permissions dialog above, you need to click the Advanced button, find the second entry for the DOMAIN\spups account in the list – the one without any value in the Inherited From column is the one we are interested in:

11-05-2010 00-19-36

Then click Edit, ensure the Apply To combo box is This object and all dependant objects and add the Write all Properties and Create Child Objects permissions.

11-05-2010 00-19-53

Now click OK however many times you need to clear out all these dialogs and check out a user in the OU. It’s permissions will include the ones we need, and we are good to go…. almost…. :)

In addition, all profile properties are Import by default. This is actually entirely reasonable, just think about all those grumpy domain admins – if SharePoint 2010 came along and wrote back to AD by default that would be a bad thing. It also means you can configure the sync on a granular basis for some properties only.

If you want to write back changes you must remove the existing property mapping and recreate it using Export as the direction. Then those properties will be written back to AD during a Sync.

  1. From the Manage Profile Service page, in the People section, click Manage User Properties.
  2. Find the Property you are interested in (I’ll use Work phone in this example) and choose Edit.
  3. Scroll to the Property Mapping for Synchronization section, and take a note of the Attribute (in this case telephoneNumber). Click Remove.

    27-04-2010 18-32-10
  4. In the Add New Mapping section, select telephoneNumber in the attribute drop down and Export in the Direction drop down and click Add.

    27-04-2010 18-33-46
  5. Click OK to save your changes

Now you can go back to the Manage Profile Service page, Make some changes to a the Work Phone property of one of the users from Manage User Profiles, and kick off another Profile Synchronization. This time the value will be updated in Active Directory.

 


Wrap Up

Phew! But hey – it works. Stop complaining. :)

Yes it’s a bit “round the houses” but don’t forget you basically have a FIM instance in your farm, and it’s solid and robust once setup. Here are some final tips and tricks for working with UPS in SharePoint 2010, which I will update over time.

  • You can read a good portion of Snow Crash by Neal Stephenson whilst FIM is being provisioned. If you are an identity management geek you’ll get the joke.
  • Don’t try and work around the Farm Account issue by making the service account another one using Services.msc – it won’t work properly because the UPS related timer jobs are timer jobs and therefore run as the Farm account.
  • Don’t forget to remove the Farm Account from local admins on the box running FIM after provisioning.
  • Don’t use the same account to run the FIM services and perform the sync. I don’t care what TechNet says, that’s a very bad idea.
  • Validate the Active Directory permissions with your admins before proceeding. You can easily spend hours on this and not get anywhere if they are incorrect. Ask for proof (a screenshot) and save yourself the pain.
  • Be patient. Calm down! :) shouting at your computer or cursing out the SharePoint team won’t get you done any quicker.
  • Managing any service app in central admin is a PITA because the breadcrumb is broken. There is no easy way to get back to Manage Profile Service. Copy the link from Manage Service Applications and create a new link called Manage UPS in the Resources List on the home page of Central Administration. 27-04-2010 18-48-06
  • If you are having problems, firstly ensure you are following the steps below exactly. I have a follow up article which also details the most common problems with configuring profile synchronization, which may help. “Stuck on Starting”: Common Issues with SharePoint Server 2010 User Profile Synchronization

Feedback

Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Just went through this guide and everything worked out great. Bravo Spence!

4/24/2010 7:38 AM | Henry Ong
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks for the guide, I followed it when setting up why Dev server. The FIM services didnt start as you mentioned but I was able to figure out and get them working! Thanks again

Regards
Srini
http://sharepointandme.com

4/25/2010 11:32 PM | Srini
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thank you, Great post.. Especially like the Writeback to AD info....

-Ivan

4/26/2010 1:45 AM | Ivan Sanders
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Just at the import stage and everything seems to be going OK. Would just remind people about the IIS reset before the end as without that, things didn't go to plan.

Thanks
Matthew Hughes
@mattmoo2

4/26/2010 11:11 AM | Matthew Hughes
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi
The problems I'm having are that the User Profile Sync service hangs on starting - any ideas why? I've just recreated the UPS service app and I'm trying to start the service again...

4/26/2010 11:16 AM | Jonj
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Also - this step:
"In the my.sharepoint.com web app create a site collection using the My Site Host template."
--> once created - when I browse to the site collection I get an error: "could not load user profile" is this expected as the UP service has not been configured yet?

4/26/2010 11:35 AM | Jonj
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Watched the session at #SPEVO.

Amazed that something this critical to most projects requires such a round-the-houses approach, but c'est la vie.

Great to see the guide up so quickly (as promised!), fantastic job Spence!

4/26/2010 11:57 AM | Martin Hatch
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Jonj: Yes, that's the expected behaviour at that stage of the process.

4/26/2010 11:31 PM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

"Click the details link to see some kick ass CSS work in a pop up dialog" -- haha :)

Great article Spence!!

-Mo

4/27/2010 11:00 PM | Muhanad Omar
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

great article! can't wait for the more coming from you.

4/29/2010 5:56 AM | Yang
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hey Spence, great article. SharePoint Brew has a post describing some additional configuration if you have a multi-domain forest and the domain NetBios name doesn't match the FQDN - http://tinyurl.com/2ep7zr3. I have already run into this at two clients.

I love the new features that integration with FIM brings to SharePoint, but I expect that configuring it correctly is going to bring many people a lot of grief.

4/30/2010 5:31 PM | Chris Beckett
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great write up Spence. Highly appreciated!
Cheers

Z

5/3/2010 8:15 AM | Tobias Zimmergren
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Found this page after toiling with UPS for 2 days... lots of google searches... got as far as the import right, never mind the sync... even got the DTC thing going... oh my!

It beats me how Technet pretends we can set up things like UPS without a basic architecture overview. I started this task not knowing FIM was in the picture.

Thanks for the post,
Javier

5/4/2010 12:36 PM | Javier
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi Spence. It may be a fluke, but I was unable to get this working following your instructions in a least-prveleged installation when logged on with my Setup account. So I reverted to an earlier snapshot and created the User Profile SA while logged on as the Farm account and then started the services, which worked successfully. I wouldn't normally take this approach but it was necessary for the Beta and the RC so I figured I'd try it in RTM as well.

In your test were you logged on as a Setup account (or other local admin) or as the Farm account? I think everything else in your guidance applies, but maybe this is an additional requirement??? I don't have a copy of the ULS errors when it failed but it was registry permissions for MIIS, which is the same as it was on the Beta and RC if memory serves.

Thanks,

Tristan

5/7/2010 9:39 AM | Tristan Watkins
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Nice write up. Do you know anywhere that documents what exactly the "Replicating Directory Changes" permission allows the service account to do? Our AD admins are a little concerned about this (correctly I suspect) and what we can do to make sure that it is only used to grab "public" attributes that all users can see, but not things like the password.

5/11/2010 5:58 PM | Sam Yates
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks for another great article. It's rare to find so much amazing information on one page (and you, sir, have a whole archive of such pages!). I also find that your articles are quite entertaining, especially since in my head, you have the voice of Dr. Sheldon Cooper (from Big Bang Theory)... bazinga. :)

Brannon

5/13/2010 8:33 PM | Brannon Millard
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great article, Now my only issues is this. I am a consultant and implementing for a client. They "require" a MS KB article. I fully trust this solution, but I am getting push back and I know this is asking a lot with MSS only being three weeks old but...

Is there a MS KB article that can be referenced with this?


Keep in mind, I am not asking for me. I have been around long enough and have researched the requirements for the "Master" certification to accept this as gospel, I am just having a hard time getting it past the AD Admin.

Thanks
Eric

5/14/2010 2:26 PM | Eric VanRoy
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi Spencer, Great article. Configuring AD properties on a live domain is certainly going to make AD guys nervous.

5/17/2010 9:31 AM | Paul Grimley
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great article. One minor question. You recommend putting the accounts in the Managed Service Accounts OU in 2008 R2. The only accounts I have had been able to put in there are AD Service Accounts. Are you saying make these AD service Accounts or just plain Domain accounts that are used as service accounts?

5/19/2010 4:20 AM | Michael
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

great article!!!

5/19/2010 10:26 AM | kmhsad
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

In what situations would you need to enable inbound network connections to the DTC (as per step 14 under the Start the UPS related SharePoint Services section)?

5/19/2010 11:44 PM | Kylie
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

enjoy reading this more than once. Great article!
one more question, my farm health analyzer complain that i am using spfarm account for the User Profile Sync service. is this just a false alarm? also you said the UPS can't handle managed account, does that mean i can't change its service account at all? thanks!

5/26/2010 8:48 PM | Yang
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Pingback from www.sosp.fr/blog/Lists/Billets/Post.aspx?ID=33
After a while UPS stopped and we weren't able to re-start it again.
It seems that FIM do not like SQL alias... I wrote a tiny post about that...

6/10/2010 6:25 PM | Romain KEIRSEBILCK
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great post, thank you. Can you explain why we have to make the changes on the Configuration Naming Context? I haven't seen that step published anywhere else and just wonder why it is needed.

Thanks.

6/15/2010 4:22 PM | Chad Cooper
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Best guide I've read around SP2010 UPS.

6/16/2010 6:18 PM | Bart
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great Article,
Worked perfectly, just had to remember to sign on locally as the Farm account when starting the User Profile service!
Where did you get the FIM client UI to check for errors?
Cheers,
Dan

7/8/2010 6:17 AM | Daniel Sanders
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Dan,

There is no requirement to ever log on as the farm account to get this running.

As mentioned in the article "The FIM Client is located at C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe"

7/9/2010 1:03 AM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Works great. Just to be clear folks, follow the instructions exactly as here (other than account names) and you'll be fine.

This is the *only* set of instructions I've found, tried, and proven to work 100% of the time.

Be patient with some steps. It really does take 10 minutes from the freakin' sync service to initialize, even on a quad core.

7/15/2010 7:12 PM | Bil Simser
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

A real life saver. Thanks.

7/28/2010 11:16 PM | Will
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Can the User Profile Service and Synchronization Service only run on a single server? Is there any way to provide redundancy? Thoughts?

8/9/2010 8:15 PM | mcodyw
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Excellent post. I found it very helpful. However, I have a question for you. You say at the beginning that the Farm Wizard doesn't set up the environment properly. From your post we can see changes that need to be made for UPS. What about the rest of the Farm Wizard? If I ran the farm wizard and uncheck UPS, will it set up the rest of the service apps properly and securely? What other areas of concern should I be aware of?

8/11/2010 1:43 AM | Shawn Rasmussen
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks for posting these instructions -- seems to be working (so far) for us!

8/11/2010 1:34 PM | Dave
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks Spence. That was helpful.

8/11/2010 7:54 PM | Vicky
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

This is great post . Thanks for the good work .

9/15/2010 10:36 PM | Umar
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

UPS: Utterly Painful Service

9/16/2010 4:53 AM | Peter
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Found this really useful, cheers Spence, UPS is a nightmare unless you plan your setup, this is a great plan!

9/16/2010 10:59 AM | SPC
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great write-up!

One remark though, both "Configure profile synchronization (SharePoint Server 2010) (MS TechNet)" <technet.microsoft.com/.../ee721049.aspx> and "SharePoint 2010 – Provisioning User Profile Synchronization -
SharePoint Brew - Site Home - MSDN Blogs"
<blogs.msdn.com/.../...ile-synchronization.aspx> seem to disagree with you on granting membership to the "Pre-Windows 2000 Compatible Access" group to DOMAIN\spups. They both claim the membership should go to DOMAIN\spfarm.

BTW, can't and shouldn't we use "Windows Authorization Access Group" instead of the hugely antique "Pre-Windows 2000 Compatible Access" group as is more or less explained here: http://support.microsoft.com/kb/331951 ?

9/16/2010 8:13 PM | bV
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

This Guide has proven to be a lifesaver for me. Thank you. Thank YOU! I followed the steps in this guide and was able to finally get UPS set up correctly. I am now trying to set this up in a new environment and when I get to the step "Configure Connections and Do a Sync".

On Step 11 it displays the OU containers from AD that I should see but what I get in my environment doesn't show an OU for SharePoint Users.

Would you have any ideas why they are not showing up?

Thank you.

9/19/2010 12:57 AM | David Ruyle
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

David, the OU "SharePoint Users" is just an example I have created in this AD domain. It isn't there by default. You will have different OUs in your domain.

9/23/2010 3:47 AM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

bV - the Pre Windows 2000 Compat access should be for the sync account, not the service (farm) account. It is very common for other resources to get the permission requirements mixed up.

9/23/2010 3:48 AM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi All!

Thanks to Spence for this great post. It help me a lot.
Although I have a problem... The User Profiles service is working well, but I cannot entered to managed it. When I try to appears an unexpected error.

Anyone knows what I've done wrong? I entered to manage it with the farm account.

Thanks in advanced,

Pau

10/1/2010 11:52 AM | Pau
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi,

Thank you very much for a great post. I have followed the exact guidelines and got everything working. The only problem I had was that even though I can see the organisation chart, I cannot see any colleagues under 'My Colleagues' tab. Does this require any special settings?

regards,

Anu

10/4/2010 2:59 PM | Anu
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks for writing this article, it was very useful in provisioning my UPS service on my evaluation environment.

I have the Wrox 'Professional SharePoint 2010 Administration' book, which suggests you set your farm up using the initial configuration wizard... It doesn't mention having to add the farm account to the local administrators group or tell you how to provision the service other than through the wizard.

The only issue I had was that after 20 mins there was no sign of my FIM services coming up. Within minutes of me then rebooting the box they provisioned successfully.

10/5/2010 11:12 AM | Conrad Goodman
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Conrad. Yeah that book doens't cover FIM provisioning at all. You shouldn't run the FCW. Check out the article at http://www.harbar.net/articles/sp2010ups2.aspx  for troubleshooting step

10/5/2010 11:50 PM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Anu: the my Colleauge capability is not automatically populated. It's up to the user of a My Site to add colleauges. The My Team can be populated by the Manager Profile Property

10/6/2010 12:01 AM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Spence,

In your introduction section, date is "[UPDATE: 01/11/2010] TechNet has recently updated its Configure profile synchronization (SharePoint Server 2010)".. Is this January 11th?

Just wanted to make sure because technet has updated this article on Sep 30th and wanted to see what date is this referring to?

On the side note, which article you would say has better guidelines - yours or technet? I would like to rely on your article for AD profiles sync but let me know if you think otherwise.

10/6/2010 4:57 PM | Nik Patel
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Nik: the most recent update was September 30th 2010.
in the UK we do dates as DD/MM/YYYY - so 01/11 is 1st November!

Mine is of course the best :) THis one has pictures and even some "jokes"! But they basically both have the same steps. In the interests of full disclousre I contributed to the new TechNet article.

10/6/2010 5:10 PM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks Spence. Going through your article right now.. :)

Anyways, that date is still confusing.. Isn't it should be 1/10.. I am sure you guys are still in october.. No intentions of nitpicking.. :)

Thanks again,

10/6/2010 5:31 PM | Nik Patel
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks

10/6/2010 9:00 PM | Fennix
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Oh my god, Spence, what the hell would I do if you weren't around? Thanks so much for putting this all together. If you ask me, this is probably a bit much for most IT shops that just want to get SharePoint 2010 up and running and have their My Sites working the way they did before. We're definitely taking all this into account on our future migrations. :-)

11/18/2010 8:36 PM | Thomas Carpe
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Its a great post dude .... really help me to understand how to do profile sync

12/23/2010 2:53 PM | Prasad
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great, thank you very much! Loved your wrap-up in particular :)

2/12/2011 3:55 PM | Henrik
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Spence,
Thanks for the detailed write-up! Very insightful.

Despite following all steps repeatedly, I could not get the correct domain prefix for user profiles in my setup (2003 AD, NetBIOS name different than FQDN, December CU).

Finally saw that MS acknowledged the issue here:
Provisioning User Profile Synchronization with December CU?
blogs.msdn.com/.../...zation-with-december-cu.aspx

Resolution was the February CU, which was released last Friday.
blogs.technet.com/.../...-for-sharepoint-2010.aspx

Once the February CU was installed, things worked just like they should have in the first place. :)

3/8/2011 5:11 AM | Parag Mahalley
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks, i follow your guide and now profile sincronization is running smoothly, I can use Audiences in sp 2010!!.

3/17/2011 2:07 PM | Manuel
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks a lot...

3/24/2011 11:51 AM | Daniel Garcia
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi, thanks for an excellent guide.

I have had problems when setting up UPS in a multiple server farm. Namely, I have to stop "User Profile Service" on the servers where the UP Synchronization Service NOT is going to be provisioned before provisioning.

Maybe I am doing something wrong, or is it possible to update the guide on how to do this in a multiple farm setup?

Thanks,

4/3/2011 10:44 AM | audunms
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

audumns: the UPS service instance can only run on a single server in the farm with a single UPA

4/3/2011 5:36 PM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

I'd like to add my thanks for these detailed instructions. I'm sure the collective man-hours you've saved have been enormous!

5/17/2011 8:43 PM | wmholt
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi Spencer

Thank you for a most informative and useful article. This article has literally saved me days of plowing through logs and technet articles.

Really good work.

Thanks

6/16/2011 6:02 PM | Anton Wentzel
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

May I state that this is *the* definitive guide to setting this up. So very, very beneficial. Thanks!

7/12/2011 8:41 PM | Paul
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Yes, this is the definitive guide, but I would remove the comment about the aforementioned MSDN article on this subject up top. I just went through this fun using the June CU and the MSDN documentation - epic fail. Went to MS partner tech support and quickly realized the error of my ways. Started over again, used this work you've done and almost got there on the first try. After a few pretty minor tweaks, based on knowledge gained from your work, and the FIM user boards, the UPS service was running. Thanks...

7/28/2011 8:18 PM | Russ Ramirez
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

This guide is nothing short of AWESOME! I followed the Microsoft instructions and could never get the sync service to start. Thanks to this guide, I got everything working AND now understand what each piece is doing and most importantly why. Makes it a lot easier to request permissions from the AD admins when I can tell them exactly why other than "well Microsoft said so."

8/22/2011 9:48 PM | DubahU
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

It save my life. thank you :)

9/30/2011 6:04 PM | Eakkapan
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks a lot for the wonderful article. It made my work very simple.

Thanks,
Rajan

10/25/2011 10:32 AM | Ranjan
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

It appears that it's failing in my case because I specified the fqdn for the SQL server when I initially configured the farm. What's the solution in this instance?

10/28/2011 4:02 PM | zoobadger
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization


Your instructions worked perfectly on my single farm install, thanks. I tried re-installing on a multi server farm, onto an separate application server (from the central admin server). Just wondering if you know what happens when the FIM services on the application server is disabled and seems dead to the world after the User Profile Synchronization is provisioning. My error is pasted below. Is it because of a manual account change on the FIM service which has been done? Or maybe because it was working before but we re-provisioned the User Profile Sync application?

Thanks,
Corey
Exception occured while connecting to WCF endpoint: System.ServiceModel.ServerTooBusyException: The HTTP service located at s400cbe175:32843/.../ProfilePropertyService.svc is too busy. ---> System.Net.WebException: The remote server returned an error: (503) Server Unavailable. at System.Net.HttpWebRequest.GetResponse() at System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout) --- End of inner exception stack trace --- Server stack trace: at System.ServiceModel.Channels.HttpChannelUtilities.ProcessGetResponseWebException(WebException webException, HttpWebRequest request, HttpAbortReason abortReason) at System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.H... 35c5557b-4060-4a56-995c-64ed04efdbe1

11/2/2011 2:04 PM | Corey
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi Spence,

Our organization has recently upgraded their internal environment to SharePoint 2010. The User Profile Service was first tested in our TEST environment following your guide, without any issues. Everything worked just fine...that is in the TEST environment. Once we moved to production, issues started to happen. Following the exact same steps we'd been following in TEST didn't work. The User Profile Sync tried several times to start but always failed when trying to configure the FIM certificate. The ULS log entries are showing the following:

Provisioning service instance User Profile Synchronization Service.
The service instance User Profile Synchronization Service is successfully provisioned.
UserProfileApplication.SynchronizeMIIS: Begin setup for 'xxxx User Profile Service Application'.
ILMPostSetupConfiguration: ILM Configuration: Validating installation of SQL Service.
ILM Configuration: Error 'ERR_SERVICE_NOT_INSTALLED'.
ERROR ILMPostSetupConfiguration: ILM Configuration: Validating installation of SQL Service FAILED
ILM Configuration: Validating account.
ILM Configuration: Validating the system groups
ILM Configuration: Setting up WMI
ILM Configuration: Setting required permissions
ILM Configuration: Create install config file
ILM Configuration: Update source project
ILM Configuration: Changing service account credentials
ILM Configuration: Setting policy for service account
ILM Configuration: Configuring database
ILM Configuration: Re-starting mms service
ILM Configuration: Checking mms service
ILM Configuration: Configuring XML file.
ILM Configuration: Checking for existing FIM database.
ILM Configuration: Building database.
ILM Configuration: Configuring certificate.
UserProfileApplication.SynchronizeMIIS: End setup for 'xxxx User Profile Service Application'.
UserProfileApplication.SynchronizeMIIS: Begin setup for 'xxxx User Profile Service Application'.

It tries starting the service about a dozen times, then will switch it back to 'Not started'. We've even tried grabbing a copy of the SharePoint servers from Production and dropping them down into another environment, but we can't reproduce the error. It just works everywhere but in Production. Our next step is to have Active Directory refreshed in our TEST environment from a fresh copy of Production to see if that may be the issue.

Any hints or pointers you could give me on this problem would be greatly appreciated. Thanks

Nik

11/4/2011 11:14 AM | Nik Charlebois
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

I have domain admin accounts inside my employee OU and the sp_ups account doesn't seem to have rights to update these accounts. Any ideas how i'd allow sp_ups to update domain admins properties?

12/6/2011 1:43 AM | Todd Wilder
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Any tips on deleting and recreating the User Profile Service in the case when you get "Stuck on Starting"? I'm a little confused as to which of the steps above have to be executed when you aren't starting from scratch, but rather starting from a delete.

Thanks for all the information, though!

12/13/2011 10:54 PM | Erin G.
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

After installing Service Pack 1 and the June CU on our SP 2010 farm (one internal CA, two WFEs in the DMZ) we experienced extreme slowness and broken Navigation controls when accessing the site via CBA. The app is configured to use WinAuth, and extended to use CBA. The WinAuth side of things was not impacted by the upgrade.

Microsoft Support had us start the User Profile Service (not the Synch Service) on both of the WFEs, which immediately resolved the issues with slowness and broken navigation. We could then stop the service on both WFEs and the site still worked. Microsoft Support said starting the service on the WFEs allowed the AD properties to synch up between the servers. We're not really clear on what happened here - just glad it worked! Can anyone shed any light on this?

12/14/2011 4:28 PM | J. Minnerly
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi,

Everything in my farm is working as required except mysite picture synchronization.
Upload a picture in my site for user A, save and exit
Go to people and permission of sitecollection,
Serach for mysite user A.
you can see mySite picture. no issue.
Go to Mysite, Delete mysite picture, Save and exit
Go to people and permission of sitecollection,
Serach for mysite user A.
you can see it is displaying picture not found.

I have run stsadm -sync command
all the user sync job
but nothing change.

Funny thing, if you go to usre profile services and click manage user profile. Search for user A
here you can see "O14_person_placeHolder_96.png" picture without no picture found error.

I goggled and found every site collection use user information list to store the user information. As per my understanding, this list is not getting updated.
Do you know what is the best way to sync user information list with UPA.




12/19/2011 4:20 PM | Manpreet
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi Spencer,

As always, great article - just wondered if you'd done any work with the User Profile Replication Engine (UPRE) at all? In my set up what we want to do is have a centralised farm running the User profile Service but with other farms sending in their profile data into this service.

Is this possible, I can't seem to find any articles about the UPRE at all!

Cheers
Rich

12/20/2011 12:45 PM | Rich
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Very well written (complete) instructions on setting up SharePoint 2010 User Profile Sync and getting it to work with AD for the other Office products to utilize. At first I couldn't get the user profile Photo from the SharePoint MySites to update to the thumbNailPhoto Attribute on my user accounts in AD then I realized that I jumped the gun and didn't read the section on "actually writing back to AD (Sync)" because it was getting late when I was setting it up the previous night and didn't reach that part of the doc.

1/7/2012 4:16 PM | C:\hris
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

What a great resource for User Profile Sync till date. Recently a client faced problem and I got pulled into fixing it. People were aware that this is the best documentation to follow. However, I revisited and made sure as suggested by Harbar, I follow this "exactly" as he suggests. Once follwed "exactly" it just worked like a charm.

Thanks.

1/9/2012 4:44 AM | Soumya
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Maybe I am bad lucked or something but I have tried these instructions line by line many times and I still cannot get the user profile service to launch. I am presently correcponding with microsoft to get to the bottom of this.

3/18/2012 3:19 AM | Paul Drummond
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

I have used this article several times and it's brilliant. Do you have a companion article for a system being upgraded from the 2007 platform? The steps would change and I wondered if that was mapped out anywhere.
Thanks!

4/2/2012 4:23 PM | L Latulippe
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

You are the man!
Thanks a lot.

5/24/2012 12:45 PM | Jag
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great article! I always refer to this whenever I do the UPS configuration. It is also entertaining to read it. :) I was really wondering what PITA means... but LOL...

Thanks!

6/19/2012 3:56 PM | Leomon
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great article, used it as a reference numerous times! Thank you!

6/21/2012 5:47 AM | Matas N
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great article. It works for me!

7/20/2012 9:19 PM | Alex Zoutenbier
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

This article is awesome. It's missing one thing, which is explicitly stating before each set of steps:

ON THE DNS/DOMAIN CONTROLLER SERVER:

ON THE CENTRAL ADMIN SERVER:

ON THE APPLICATION SERVER FOR UPS:

That would be make it an A+

7/27/2012 2:48 PM | Beta Star
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

are you a wizard

8/3/2012 9:25 AM | Dave
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

YYYYYYEEEEEEESSSSSSSSSSS finaly i got this %$%$#@%$#@^&&^%$#&^# to work !!! Thank you !!!!

8/9/2012 10:43 AM | Patry
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Great guide - I'd been fighting with this for days before coming across this site.

9/24/2012 5:47 AM | Mark
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

I used this great resource early this year to provision one of our farms. I'm in a position where I need to provision the service for another farm that sits in an AD forest that trusts (two way) multiple disparate forests across the globe. We have local domain controllers for each of these domains colocated with the farm servers in order to reduce authentication times.

Do you foresee any major issues to following this guide to provision UPS for this scenario? I plan to use accounts in the farm forest to traverse all the domains.

Thanks again

Ron

10/31/2012 11:19 PM | Ron
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hi,

this is a really nice article. Are there chances it will be upgraded to SP2013? Like notes what things have changed??

Thanks!!
Regards
Christian

11/30/2012 11:50 AM | Christian
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

AWESOME GUIDE - got my user profile service running in less than an hour! THANKS!

12/6/2012 8:02 PM | Pete
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Excellent guide, thanks very much.

I just resolved a problem with the UPS Sync Service not starting (long pause while it started one FIM service, but not the other one, then stopped the FIM service and returned to showing Stopped - bullet 7 & 8 under 'Start the UPS related SharePoint Services' above.

After a lot of digging, I found an error in the ULS log, which took me to kb4sp.wordpress.com/... which fixed the error by adding an SPN to the account that is running UPS.

Roy

12/14/2012 2:53 PM | Roy
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

These steps were 1005 valid for SharePoint 2013 as well.
Thanks

12/15/2012 7:50 PM | Daniel Christian
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks for the great write-up! I really wish Microsoft would tighten up the UPS components. Sometimes I feel like they're held together with spit and bubblegum. Is UPS any better in SP 2013? Is it likely to get better in a service or feature pack?

1/16/2013 10:04 PM | Eugene Rosenfeld
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

This is an excellent article, and it helped me get the final kinks out of my installation. Thanks for explaining the important parts, and throwing in some humor to make things easier.

Funny how many times non-Microsoft sources do a better job at making step-by-step guides.

1/23/2013 8:54 AM | Cookie
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Same here! Fantastic guide, I was lost before reading this, thanks again! SS

2/3/2013 1:57 PM | The StaceMeister
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks to your great guidance, I've never really had any serious problems with UPSS.
I've recently built 7 farms for an extensive ALM stack within our organisation and we're due to replace the current SP2010 farm at the end of the month.
one of the last configuration items I need to complete is the two-way sync of certain profile properties back to AD.
This works perfectly and predictably in all but the new production farm.
The problem here is the number of incremental sync's I have to run before attributes are imported back into SharePoint after they've been exported to AD.
I've got duplicate profile properties for a small number of attributes that we want to be written back to AD and then imported back into SharePoint to complete the "two-way" sync.
e.g. 'Mobile' user profile property imports from the mobile attibute in AD.
'Mobile Phone' property was manually created and exports to the 'mobile' attribute in AD allowing users to update their mobile number and keep AD 'current'.
In all of the other farms, as I said, this works fine with the 1st incremental sync exporting the relevant property to AD and the 2nd sync pulling it back into SharePoint.
In the problem farm/domain this can take up to 6 incremental sync's before the attributes are imported from AD.
The export first time every time and there are never any errors in the FIM MIIS client but I can't expect the business to accept this and sign off the project without a better explanation.
Has this been seen elsewhere?
To summarise: No errors in FIM. Properties are exported/written to AD first time, but don't get imported back into SharePoint wihtout a varying number of incremental syncs being run.

2/6/2013 3:39 PM | N03L
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Outstanding article - thanks for such great detail!

I do have a couple of questions however:

1. do the FIMS services on the server that will be running the sync services need to be set to auto. Silly question I know but for some reason, ours was set to disabled and I don't why.

2. after starting through this doc, I get to the point where I should be able to "start the UPS related sharepoint services". Buy my User Profile Sync Services is stuck in starting state. So I backtracked and followed your other doc on this matter. I trashed the current UPS and started anew. Deleted the User Profile Service App + associated data. REbooted server. I'm still seeing User Profile Sync service in a starting state under Manage Services on server! How is this possible if I've deleted the UPS + associated data? For kicks, I tried to start the FIMS services on the server and I get errors that it could not communicate iwth the SyncDB - not surprised by this as I deleted it when I deleted the UPS.

Is there something I'm missing here?

Thanks so much!

Ed

2/13/2013 5:39 PM | Ed
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Everyone, REMEMBER to make the farm account admin on the UPS box!!! Waster couple hours for me.

3/8/2013 2:21 AM | rama
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Excellent! Tnahk you very much!
Andrey

3/21/2013 6:04 AM | Khoma
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Third time is the charm! This step-by-step resource is the definitive guide. I must've read them all. Follow the steps exactly people--it does work.

3/22/2013 7:14 PM | Jason Miller
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Worked for me on the 2nd go around. Thanks

5/31/2013 8:52 PM | Christopher Ottinger
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

The Sharepoint team at my company is requesting I grant them these AD perms. I manage the AD security. I'm struggling to understand why this needs such broad perms when all they want to do is write the thumbnailPhoto attribute. Giving it the perms that MS documents lets it create any object - OU, GPOs, GPLinks, Groups, etc, etc and make any change (except delete) to any object.
You've written a very good article and I wondered if you had any insight. #1 Create ALL Child objects #2 Write ALL properties. The way I see it, this shouldn't need to create ANY objects, all users already have an AD account. And this should only need to write the ThumnbnailPhoto.
Thanks

7/31/2013 2:29 PM | Craig Williams
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

craig, you only need create objects if you need to create ad objects based on a user profile. for a single attribute change this is not needed. indeed you can set attribute level perms if that's all you want

8/1/2013 2:23 AM | harbars
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thank you for the guide it really helped me setup my Dev environment - newbie to SharePoint and managing an existing production setup,

1/14/2014 3:09 AM | Debra
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Fantastic post. I have been trying to troubleshoot a UPSA on SharePoint 2013 issue for a couple of hours now and other blogs have led me down the wrong path. This one has been spot on and you have my thanks.

2/5/2014 3:52 PM | BJones
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Thanks Spence. Great article.

3/6/2014 4:02 AM | Muhammad Masood
Gravatar

# re: Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization

Hey man, you're god!

You've saved my time and brain from blowing!

Many thanks!

6/23/2014 2:42 PM | Den

Post Comment

Title  
Name  
Email
Url
Comment   
Please add 2 and 8 and type the answer here: