SharePoint Patches are now part of Windows Update

Starting with the February 2015 CUs, all SharePoint updates will be part of the Windows Update.

In a blog from Stefan Goßner, he indicates the changes will start with this months' CU.

SharePoint February 2015 CU

What does this mean to you?

1. Should I configure my server for auto update?
No, it is always best practice to schedule your windows server update. Change your Windows update configuration to notify you when there are updates ready to be installed, or schedule a manual check of your Windows Update. This way, you can coordinate your updates on all your servers in your farm at the same time.

2. Should I run the Windows Update on all the servers?
Yes. If you run your Windows Update on one server in the farm, then you will have to run it on all servers in the farm, so all servers have the same patch level.

3. Should I run the Configuration Wizard after the Windows Update?
Yes. You have to run with Configuration Wizard every time you have a Windows Update that includes a SharePoint patch.

In a nutshell, you need to plan your Windows Update for your SharePoint farms the same way you have done it in the past. What have changed is the patches are now pushed down to your server and it is up to you to manage it according to Microsoft's recommended approach. Always apply your patches in your Development and Pre-Production Environments before applying them to your Production farm. Make sure you do your homework from testing perspective and backups before applying any patches.

However, it is always recommended to apply the latest security updates to your environment as they contain important fixes to the platform.

Enable PDF Preview in SharePoint Search Result

This article describes how you can enable PDF preview in the search core results web part.

By default, PDF previews are not turned on in the search core results web part. Office Web Apps only supports Office documents such Word, Excel, PowerPoint, ad OneNote, but there is no support to preview other documents such as PDF.

To be able to preview PDF documents, you will have to develop your own preview panel to show it. There are 2 options in enabling previews for PDF:

Option 1: Create a custom PDF Hover Display Template

Here are the steps to create a custom Display Template:

  1. Navigate to /_catalogs/masterpage/Display Templates/Search
  2. Take a backup copy of the Item_PDF_HoverPanel.html display template. Even the masterpage list has version control enabled, it is better to keep a clean copy of this display template. Name the back-up Item_PDF_HoverPanel-original.html. Note that taking a backup means, downloading a copy of the display template locally to your machine, renaming it locally, and then re-uploading it to SharePoint.
  3. Download Item_PDF_HoverPanel.html to your desktop and open it with Notepad or any other HTML editor
  4. Replace the following code:

     <div id="_#= $htmlEncode(id + HP.ids.header) =#_" class="ms-srch-hover-header">

              _#= ctx.RenderHeader(ctx) =#_

     </div>

     <div id="_#= $htmlEncode(id + HP.ids.body) =#_" class="ms-srch-hover-body">

             _#= ctx.RenderBody(ctx) =#_

     </div>

    With this code

    <object data="_#= ctx.CurrentItem.Path =#_" type="application/pdf" width="500px" height="450px">

                     <p>You do not have a PDF applicaiton to preview this document.

                    You can <a href="_#= ctx.CurrentItem.Path =#_">click here to download the PDF file.</a></p>

    </object>
     

  5. Save
  6. Upload Item_PDF_HoverPanel.html to replace the existing one on the server
  7. Publish Item_PDF_HoverPanel.html
  8. Refresh your search results

Option 2: Use Word Hover Display Template

This option does not require any coding or change to the Display Template, but configuration which Template PDF should use. Here are the steps to change the use of a display template for PDF:

  1. Go to Site Settings à Result Types under the root site collection
  2. Locate PDF
  3. Click on the dropdown list and select Copy
  4. Name it PDF with Preview
  5. Under What should these results look like?, pick Word Item
  6. Click Save
  7. Refresh your search results

Disadvantage:

There is a disadvantage for each option:

  1. Option 1: It is dependent on having a PDF reader installed on the desktop to render its content. If you don't have it installed, then the preview will not show up. This can be a problem for mobile users who might not have PDF installed on their devices.
  2. Option 2: The PDF application menu items will not show up if you are rendering PDF content through a Word viewer (OWA). This means, other than opening the document, users will not be able to post any action against the PDF result item such as saving, printing the document, etc…

User Profile Synchronization Service – Access is denied

Sometimes, when you first create your User Profile Service Application and you configure your first Synchronization Connection, (or any new Synchronization Connection), you might notice that the service is not synchronizing from Active Directory, and you wil receive Access is Denied error in the event log.

Reviewing the ULS logs shows the following errors:

UserProfileApplication.SynchronizeMIIS: Error updating users with FIM permissions: Microsoft.ResourceManagement.WebServices.Faults.ServiceFaultException: Unable to process Create message   

 at Microsoft.ResourceManagement.WebServices.Client.ResourceTemplate.CreateResource()   

 at Microsoft.Office.Server.Administration.UserProfileApplication.UpdateFIMUser(SchemaManager schemaManager, String userName, String accountName, String domain, Byte[] userSid)   

 at Microsoft.Office.Server.Administration.UserProfileApplication.SynchronizeMIISAdminsList(Hashtable htPermittedUsers)   

 at Microsoft.Office.Server.Administration.UserProfileApplication.SetupProfileSynchronizationEnginePermissions().

UserProfileApplication.SynchronizeMIIS: Failed to configure ILM, will attempt during next rerun. Exception: Microsoft.ResourceManagement.WebServices.Faults.ServiceFaultException: Unable to process Create message   

 at Microsoft.ResourceManagement.WebServices.Client.ResourceTemplate.CreateResource()   

 at Microsoft.Office.Server.Administration.UserProfileApplication.UpdateFIMUser(SchemaManager schemaManager, String userName, String accountName, String domain, Byte[] userSid)   

 at Microsoft.Office.Server.Administration.UserProfileApplication.SynchronizeMIISAdminsList(Hashtable htPermittedUsers)   

 at Microsoft.Office.Server.Administration.UserProfileApplication.SetupProfileSynchronizationEnginePermissions()   

 at Microsoft.Office.Server.Administration.UserProfileApplication.SetupSynchronizationService(ProfileSynchronizationServiceInstance profileSyncInstance).

The best way to troubleshoot this issue is to look at why the FIM Synchronization service is failing to sync. To do so, you will need to launch the FIM client miisclient.exe that is located under <%Install Dir%>\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell.

When you launch the client, as per picture 1:

  1. Click on the Management Agents
  2. Click on the Synchronization Connection you created in the UPSA
  3. Under Actions, Click on Configure Run Profiles


Picture 1

In the Run Profiles, you should see all the synchronization profiles, and you might notice 2 steps per profile as per picture 2.


Picture 2

For example, in the DS_EXPORT profile, you might find Step 0 with a GUID as a Partition value, then a Step 1 with the correct forest info as the Partition value.

If this is the case, then you need to delete the Step that has the GUID as a Partition value and keep the step with the correct forest info.

In some cases, if you run the synchronization job, and you monitor the status under the FIM Client Operations tab, you will find at what specific run profile the job is failing, with an access is denied error, With that, you can directly go to the specific run profile instead of going through all of them. However, it is a good idea to go through all the profiles to make sure you don't have extra steps that is messing up your synchronization job.

Also, in some scenarios, you might find only one step with a GUID as a Partition value. In this case, you will need to delete the step and create a new one, by clicking on New Step. With this in mind, make sure you select the right value for the run profile. Follow the wizard and select the right forest from the dropdown menu.

After completing your manual clean-up, try running the Synchronization job from Central Admin. No IISRESET is needed. this should fix the access is denied issue and the job will complete successfully.

Solving Creating Certificate with User Profile Synchronization Service

​While you are provisioning UPA, you may run into issues starting the User Profile Synchronization Service (UPSS), or the UPSS is stuck on “starting”.

There are few article that greatly explain on how to create UPA and UPSS, such at this TechNet article, or many great articles to debug issues with UPA such as this article: http://www.harbar.net/articles/sp2010ups2.aspx.

In my case, I have configured many UPSS and I have ran into some issues where I was able to resolve. The latest issue I encountered was pretty puzzling, and it took me few days to resolve it.

My UPSS will stop couple of minute after starting it.  I will always get the Certificate creation errors:

  1. In the event logs, I get: ILM Certificate could not be created: netsh http error:netsh http add urlacl url=http://+:5726/
  2. Looking at the ULS logs, I got ‘ERR_SERVICE_NOT_INSTALLED’ ILMPostSetupConfiguration: ILM Configuration: Validating installation of SQL Service FAILED

I have tried everything, including this great post http://henrikfromsweden.blogspot.ca/2011/01/solving-configuring-certificate-hang.html, but nothing worked.

In my case, I am not using any SQL named instances, I have deleted all the FIM certificates, deleted the UPA, restarted the server, and gone through the possible steps detailed in many articles with no luck.

Finally, I noticed the farm account has not been added to the WSS_WPG and WSS_Admin_WPG groups, even though the steps of adding them have been successfully completed based on the ULS logs. This triggered a good question. I tried manually adding the farm account to the groups, but sure enough few seconds later they disappeared. AHA!!! There was an AD policy preventing any configuration service or user to add any account to a local group. After a quick modification to the AD policy, I deleted all the certificates, deleted the UPA, restarted the server and recreated UPA and UPSS and sure enough everything worked without hiccups.

If you run into similar issues and you have exhausted all the possible fixes, double check your AD and GPO policies to make sure they are not reverting back changes made by the timer services job.