?
Solved

UPS - going in circles!

Posted on 2011-09-08
18
Medium Priority
?
822 Views
Last Modified: 2012-06-21
ok I'll do my best to explain but I've hit so many obstacles and gone round in circles it may end up being bullet points!
I suspect UPS sync is not doing it's thing. I see this status on the user profile page in central admin:
Profile Synchronization Settings  
User Profile Sync is not currently provisioned.
Synchronization Schedule (Incremental) Every day at 01:00 a.m.

So I start to see what I need to do to get it up and runing.
I try to click create connection but get "unable to navigate to that page while sync in progress"
I read some more I see that sp2010 uses FIM to do syncs. I check the 2 services - both disabled. I enable them and set logon to be the farm account.
I reset IIS
Back to the screen, still can't create a connection.
Back to services and realise I hadn't started them FIM service and FIM sync service... so I try
Cannot start service error 2 file cannot be found
back to Google to read that the UPS service should be stopped before trying to start FIM services.
Can't stop the service - the service cannot accept control messages at this time.

am I in and endless loop? help!
SP enterprise upgraded (in place) from MOSS 2007.
1x WFE 1 x SQL Server (different servers)
0
Comment
Question by:QPR
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 8
18 Comments
 
LVL 16

Expert Comment

by:jessc7
ID: 36510796
What state is your User Profile Synchronization Service in? Look in Central Administration (Not Windows Services), under Manage services on server. Based on your post, it should be "Stopped" or "Starting".
0
 
LVL 38

Expert Comment

by:Justin Smith
ID: 36511902
I'll echo jesse.  NEVER start the FIM services through services.msc.  Stop them and put them back to disabled.

You need to start the User Profile Sync service through Central Admin - Services on Server.
0
 
LVL 16

Expert Comment

by:jessc7
ID: 36511930
Yes, starting from Central Admin is what provisions the services, including setting up the FIM Windows Services. It may take ~15 minutes to start the first time, as it provisions out.

You need to determine if you can start it through Central Admin, or if it gets stuck on "Starting" or goes directly to "Stopped."

That will help provide next steps.
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 29

Author Comment

by:QPR
ID: 36514114
It says starting for a few minutes then goes back to stopped
0
 
LVL 16

Accepted Solution

by:
jessc7 earned 2000 total points
ID: 36514119
Is the SharePoint Farm account in the Local Administrators group on that server?
0
 
LVL 16

Expert Comment

by:jessc7
ID: 36514122
If not, add it, and try again.
0
 
LVL 29

Author Comment

by:QPR
ID: 36514150
I'll check when back Monday but would be amazed if it wasn't especially as the sync seemed to work ok until a while back (since the upgrade I'm guessing)
0
 
LVL 16

Expert Comment

by:jessc7
ID: 36514174
Another thing to consider - you may need to reprovision the User Profile service. See this:

http://www.harbar.net/articles/sp2010ups2.aspx#ups9

There are also other troubleshooting scenarios on that page as well. Good resource.
0
 
LVL 29

Author Comment

by:QPR
ID: 36515127
I rebooted the server as it's doing some strange things. The 2 FIM services disabled themselves.
I searched for manage services on server while I was RDPd to it thinking I was going blind! I had to RDP to a different server and go to central admin to see it? Same account used so no idea why it wasn't there.

Anyways now when I click start it starts!
I go to manage profile services and the status is synchronizing.
I tried so many things I'm not sure what fixed it. I did reboot but then the network admin had donethat 2 days prior. Still no connection defined. I guess it finds AD by itself.
No idea how long it will take or how I can confirm that it's behaving, current stage is sharepoint server import(0) whatever that means
0
 
LVL 29

Author Comment

by:QPR
ID: 36515168
Ok that went through the motions without actually importing anything happening. But now I can add a connection (which I have) and started a full sync. Now sitting at active directory import(0)
0
 
LVL 29

Author Comment

by:QPR
ID: 36515406
Back again :)
This is starting to feel more like a blog than a question!
No luck with the above so this time I specified the actual DC rather than let it try to find it.
Ran it again.
Got the error that it errored on an unexpected step.
Back to Google.
One thing about this mission, I am certainly learning alot more than I would have if I flicked the switch and it worked.

Opened up uls viewer and didn't get much more than that so opened miisclient.exe and found out that the account didn't have replication rights for AD.

So I guess I am going to have to ask the network admin to grant this access for the farm account and maybe, just maybe, I will finally get there!
0
 
LVL 16

Expert Comment

by:jessc7
ID: 36516347
There are specific permissions you need to apply on Active Directory for SharePoint 2010 to be able to import. This is different than it was with SharePoint 2007.

Here are the steps from TechNet:

Grant Active Directory Domain Services permissions for profile synchronization (SharePoint Server 2010)
http://technet.microsoft.com/en-us/library/hh296982.aspx

NOTE: Don't follow the steps for "Grant Create Child Objects and Write permission" unless you want to allow SharePoint 2010 to be able to write back to Active Directory.
0
 
LVL 16

Expert Comment

by:jessc7
ID: 36516354
You may also want to set up exclusion filters, to filter out certain accounts. For example, you may want to exclude disabled user accounts.

Here's a good post on exclusion filters:

Creating User Profile Synchronization Exclusion Filters using the userAccountControl attribute
http://www.harbar.net/archive/2011/02/22/323.aspx
0
 
LVL 29

Author Comment

by:QPR
ID: 36520063
Thanks for those 2 links, great help especially the filtering which I would have never got bitwise=2 etc.
In fact I never would have got anywhere near this stage without your help.
Did a incremental sync after setting the filter to userAccounctControl bit on equals 2 OR userAccounctControl bit on equals 17 and let it go. Now I see user profiles 707. This org has at most 300 current users. It looks like it has brought through service accounts and other non-human stuff despite the filter 17.

I checked out one user who was shown as account name and he now shows as his display name (excellent) but 2 other users still show as account names (no idea why)

This would be the first sync since the upgrade so it recommends doing a users only followed by users/groups so I'll do that.
But should I do a full? I see the page has warning about being absolutely sure and other scary stuff. Is it safe?
0
 
LVL 29

Author Comment

by:QPR
ID: 36520076
ignore bit about some users still showing as account name, must have needed a few minutes to filter through. All fine now.
0
 
LVL 29

Author Closing Comment

by:QPR
ID: 36520080
Awesome help, answered my question and helped me to learn about UPS along the way. many thanks!
0
 
LVL 16

Expert Comment

by:jessc7
ID: 36520512
Glad you got it going! Many hours have been spent by many a SharePoint admin getting User Profile Sync working. :)
0
 
LVL 29

Author Comment

by:QPR
ID: 36520517
I'm almost glad I had to go through it. Best way to learn IMO.
But as I'm finding with Sharepoint, one thing fixed means another thing pops up in it's place!
New question time
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question