Provisioning The User Profile Service Application

July 9 2010 61 comments

As I wrote earlier, SharePoint 2010 ships with a profile synchronization engine from ForeFront Identity Manager. After performing several SharePoint 2010 environment installations, this seems also to be the most fragile part of the SharePoint 2010 architecture especially when using a least privileged accounts install model.

There are lots of content in the blogs and TechNet related to configuring user profile synchronization. In my experience, launching the services has to be done in the order described below. In most of the environments this is enough, but in some places I am still struggling to get this to work. The step 5 seems to be the most critical, as the FIM services create certificates and establish database connections, and there are several error-prone phases in that process.

1. Add the farm account into the local administrators group. This is stated in the TechNet article:

The Server Farm account, which is created during the SharePoint farm setup, must also be a member of the Administrators group on the server where the User Profile Synchronization service is deployed.

There seems to be some conflicting opinions about the correct permissions, as this will cause the SharePoint Health Analyzer to create a warning:

Accounts used by application pools or service identities are in the local machine Administrators group. Using highly-privileged accounts as application pool or as service identities poses a security risk to the farm, and could allow malicious code to execute.

Also grant the Replicate Directory Changes permission for the farm account account used in the synchronization connection. Reboot the server to make sure that all the services using the farm account run with the new privileges.

2. Start the User Profile System Service.

3.  Create User Profile Service Application by using the wizard or PowerShell. Remember that you need to have a site collection for the My Site Host even when you do not plan to use my sites yet.

4. Set the farm account to have full control of the Service Application: select SA from the SA list and use Administrators and Permissions actions in the ribbon.

5. Launch User Profile Synchronization system service. It make take several minutes for the service to move from the starting stated to started state. The system service starts two Windows services with the farm account: first the ForeFront Identity Manager Synchronization Service and then the ForeFront Identity Manager service. While these are launched, monitor the event log to see any errors related to these two services and use the Internet resources to find the answers.

For example if you get a warning event 1004:

Detection of product ‘{90140000-104C-0000-1000-0000000FF1CE}’, feature ‘PeopleILM’, component ‘{1C12B6E6-898C-4D58-9774-AAAFBDFE273C}’ failed. The resource ‘C:\Program Files\Microsoft Office Servers\14.0\Service\Microsoft.ResourceManagement.Service.exe’ does not exist.

grant the Network Service account access to the folder C:\Program Files\Microsoft Office Servers\14.0 as described here.

6. After the system service is in the started state, you should be able to access the SA administration page and configure the profile synchronization according to TechNet. As described in my earlier post, the SharePoint will not update anything in the Active Directory by default even though the synchronization has the export stages as well. Also note that the profile synchronization in SharePoint 2010 takes several minutes compared to 2007 where it was usually a matter of seconds.

As the RTM celebrations are over and Microsoft starts to patch the brand new 2010, I expect the user profile -related binaries to be among the top priority components where the stability and quality should be improved. The first step should be to make the error messages more verbose.

Popularity: 14% [?]

61 comments to “Provisioning The User Profile Service Application”

  1. Good day, Nice submit. We have a problem with the web site around industry, may take a look at? IE even now is definitely the industry director as well as a good portion connected with other people may take out your own wonderful composing because of this problem.

  2. Excellent article. I’m experiencing a few of these
    issues as well..

    louboutin sneakers femme

  3. Admiring the time and effort you put into your blog and detailed
    information you offer. It’s awesome to come across
    a blog every once in a while that isn’t the same outdated rehashed material.
    Great read! I’ve bookmarked your site and I’m adding your RSS
    feeds to my Google account.

  4. back ribs says:

    Fantastic website. Plenty of useful information here.

    I am sending it to several pals ans additionally sharing in delicious.

    And certainly, thanks in your effort!

  5. Instant VPS says:

    Ordinarily I wouldn’t learn report for websites, however desire to declare that this write-up very forced me to take a look at and also take action! Your own way with words has been shocked me. Thanks a lot, great post.

  6. What a information of un-ambiguity and preserveness of precious
    know-how concerning unexpected emotions.

  7. jewelry sets says:

    Hi, I check your blog like every week. Your humoristic style is awesome, keep up the
    good work!

  8. Pretty nice post. I simply stumbled upon your weblog and wanted to mention that I’ve really enjoyed browsing
    your blog posts. After all I will be subscribing to your rss feed and I’m hoping you write once more very soon!

  9. Google says:

    No one routes for the evil villan who’s run off with the hero’s beau,
    same applies to a site that’s been stuck in Google‘s naughty
    corner. * Let you know there are things you can do to improve y0ur ranking.

    But it seems Memorial Day wasn’t important enough to Google.

  10. I am genuinely grateful to the owner of this web site who has
    shared this fantastic piece of writing at at this place.

  11. tutaj says:

    If you are going for finest contents like myself, just pay a visit this web page everyday for the reason that it provides feature contents, thanks

Leave a Reply