How To Create an HTTPS Friendly URL for Your Active Directory Certificate Services (ADCS)

After adding the Active Directory Certificate Services (ADCS) role to your server, you will be able to open up your browser and request a certificate. The problem is that the URL is based off the server name and you have to remember the site name. For example to get to the Certificate Authority (CA) on my backup domain controller, I would have to go to http://dc02/certsrv/default.asp. There are a couple of problems with this URL; one is that it is over HTTP and the other is that I will not remember the URL. Granted, I can always save the URL to my Favorites, but that is not how I roll, and I prefer to keep things simple so that I can remember URLs.
Objective 

The objective of this demonstration is to show how to create a safer, and easier way to get to the Welcome page of the Active Directory Certificate Services web site.

Let's Get Started

As with all things new, it is best to start off this exercise and validate that you can get to your ADCS site on port 80. Once you have your port 80 site up and running, it will be time to create a friendly named URL, such as ca.pcDemo.net. You will want to make sure that the URL meets your naming scheme for internal (inside the firewall) URLs as you do not want to expose your ADCS server to the outside world. After you have come up with a good name, and your boss has OK'd his URL, have a New Host(A) name created. Once the new host name has been added to DNS, validate...

To get the CA on port 443 without error, a certificate will need to be created for the Name entered into DNS. On the ADSI server, open up IIS Manager (Windows Key + R --> inetmgr), select server name and double click on Server Certificates under the IIS Module.

From the Server Certificates page, select the Create Domain Certificate...

Once the Distinguished Name Properties window opens, fill it out correctly.

Click the Next button to continue, which will bring up Online Certification Authority winds. Click the Select button and find the CA that you wish to use to supply the certificate. Then put in your friendly name for the certificate.

Click the Finish button to complete the certificate request. If you have the appropriate permissions, the certificate should have been created and added to the list of available server certificates.

The next step is to create the binding to the Default Web Site.

Start by selecting the Default Web Site, then select Binding from the Edit Site Actions section.

From the Site Bindings window, click the Add... button. From the Add Site Binding window, change the type of connection to HTTPS, and select the appropriate certificate from the SSL certificate drop-down.

Depending on your version of IIS, either the Host name will be grayed out or not. This is running on IIS 8.5 on Server 2012 R2.

At this point your should be able to open up your browser to https://<friendlyname>/certsrv 

IMPORTANT: You will not be able to log-in to the site from your ADCS server. You will want to test from another machine on the domain.

Create the Redirect

Now there is the final step to make life easier for you and your clients, and that is to have a friendly URL name that will be redirected to the CA page on port 443.

Again, select the Default Web Site, and double click on the HTTP Redirect module.

This will bring up the HTTP Redirect window. Enable the redirect to the appropriate location and select the appropriate behavior, and status code.

After you click the Apply link, IIS will create a web.config file for you. IIS has added the following into your web.config file:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <httpRedirect enabled="true" destination="https://ca.pcdemo.net/certsrv" childOnly="true" />
    </system.webServer>
</configuration>

And now, from a browser not located on the certificate server, you should be able to go to http://<friendlyname> and automatically get redirected to https://<friendlyname>/certsrv

How to Redirect from HTTP to HTTPS with URL Rewrite

I ran into an issue with trying to trick IIS into redirecting using the method that I described in my previous blog post HTTP to HTTPS Redirect in IIS7. I tried to get my rewrite configured manually using the out of the box HTTP Redirect in IIS, but was not having much luck.

I did not have all day, so after looking around for a bit, I found a GUI that works with the HTTP Redirect module to make creating the redirect easier. This demonstration will be using Microsoft URL Rewrite Module 2.0 for IIS 7 (x64) with the update Update for URL Rewrite Module 2.0 (KB2749660) (x64). You will need to be an Administrator on the machine where you install the module. There are not any parameters to set during the installation, they are both Next-Next-Finish installations. However, the Update runs a repair installation module, which is still just an N-N-F install. You also have the option to use the Web Platform Installer to install the URL Rewrite module.
If you do not stop IIS before installing, a server reboot will be required.
After installation is complete, you should see the new module added to the sites in IIS

Objective

Our goal is going to take a standard HTTP request for http://sp2010.contoso.com and redirect it to https://sp2010.contoso.com.

Let's Get Started
Please remember that this is a GUI for writing information into your web.config file. It is always best to make a copy of your web.config file before making any changes (GUI based or manually).

To get started, double click on the URL Rewrite module, and select Add Rule(s)... 

which will open a window to select the type of rule template to use.

Start by naming your rule...  Be descriptive as you never know what else you might add at a later date... Then update the Match URL section to match the image below.

If you press the Test pattern... button, and enter a URL such as http://sp2010.contoso.com/sites/sales, take notice of the Capture groups, as you will see the Back Reference used in an upcoming setting. The important take away is that the values of the Back References are for the exact URL that you entered, meaning that the entire URL is ready for the next step in the Redirect.

After closing out the Test Pattern window, in the Conditions section, click the Add... button to create a condition for the redirect rule and set the parameters as seen in the image below.

The Test Pattern for this condition will always fail as it does not test the URI scheme (HTTP or HTTPS).

There are not any changes or additions required for the Server Variables section.

In the Action section, set the parameters based off the image below.

When you are done entering the parameters, click the Apply link and then click the Back to Rules link.

If you have more questions about URL Rewrite and how it works, the Online Help link is very useful.

After pressing Apply, and Back, your URL Rewrite rule should look something like this:

Let's Clean Things Up

You now have the ability to redirect, but have you set your bindings in IIS? And if you are using SharePoint, have you set your Alternate Access Mappings? Don't forget that you will also need an SSL Certificate (preferably a SAN certificate) so that you can create your port 443 binding. Remember that out of the box, IIS 7 will only allow one (1) port 443 binding per server. Please read my other post on how to host more than one URL with port 443 bindings on the same IP address (coming soon).

Troubleshooting

There are a couple of things that you need to keep in mind when using a redirect. 

• You will still need to have the port 80 binding enabled.
• Under the site's SSL Settings, the Require SSL check box should NOT be selected.

Behind the Scenes

The URL Rewrite module is a nice tool that keeps you physically out of your web.config file. As a second reminder, URL Rewrite is a GUI for writing information into your web.config file. It is always best to make a copy of your web.config file before making any changes (GUI based or manually). 

After you hit the Apply link, this is what has been added to the IIS site's web.config file:

If you wish to add the redirect manually, copy/paste below to your web.config file (after backing it up first).

</handlers>
  <rewrite>
    <rules>
      <rule name="HTTP to HTTPS Redirect" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
          <add input="{HTTPS}" pattern="off" />
        </conditions>
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

Update 10/20/2013: Added the web.config information for copy/paste
Update 01/05/2015: Added the link to reference information to download via Web Platform Installer

PowerShell for SharePoint in O365- Getting Started

Getting PowerShell for SharePoint Online up and running is relatively easy, however, you might have to download a couple of things. And if you are new to PowerShell, you could be wondering what can you actually do once you have the SharePoint Online Management Shell installed? So here is a beginners guide on how to get things started on your local machine.

1) Make sure that you have installed Windows PowerShell 3.0. If you do not have PowerShell 3.0, you will need to download the Windows Management Framework 3.0
2) You will need to install the SharePoint Online Management Shell, which can be downloaded from the Microsoft Download Center
3) Run PowerShell, Windows PowerShell, the new SharePoint Online Management Shell or the Windows Integrated Scripting Environment (ISE).
As seen in Figure 1, you can find your new Shell by searching for it. However which ever tool you decide to run, PowerShell, ISE or the Online Shell, you will need to run it as an Administrator. If you do not, you will receive an error, as seen in Figure 2.

Figure 1: Searching for the new Online Management Shell

Figure 2: You will need to Run As Administrator to avoid this error

If you take a close look at the error in Figure 2, notice the Import-Module cmdlet that is used to import the Microsoft.Online.SharePoint.PowerShell module. The cmdlet is using the "DisableNameChecking" parameter; this is because of the use of non-standard verbs. In Figure 3, you can see that the "Upgrade-SPOSite" would be the non-standard verb. You can view the imported cmdlets (verb-noun) by running:

Import-Module Microsoft.Online.SharePoint.Powershell -Verbose

Figure 3: Shows the non-standard verb

In my Windows 8 deployment, the module was automatically added, as seen in Figure 4.

Figure 4: Using ISE, you can verify installation by looking in the Modules drop-down.

One of the great features of running ISE is that users are able to see all the commands available to them. Figure 5 shows all of the commands (verb-noun) available for the Microsoft.Online.SharePoint.PowerShell module.

Figure 5: A list of all available cmdlets for the Online module

4) To be able to start using PowerShell online, you will need to connect to the admin site of your tenant.

Connect-SPOService -Url https://yourTenant-admin.sharepoint.com -Credential username@yourTenant.com

5) Once you are connected, take it for a test drive!

Get-SPOUser -Site https://yourTenant.sharepoint.com

In Figure 6, you can see the results and some interesting accounts used by O365 to help manage your site.


Figure 6: The returned results from the Get-SPOUser cmdlet.

Another benefit of using ISE over just the Management Shell,  is that the Commands tab within ISE will actually help me create my script by showing me the required and available parameters to fill out, as seen in Figure 7.

Figure 7: ISE will show you the parameters available and will insert the command into the Script Pane.

ISE also uses Intellisense, as seen in Figure 8.

Figure 8: Shows the Intellisense parameters available for the Connect-SPOService cmdlet.

If you are still a bit timid to start writing your own commands, an excellent reference for helping you to create PowerShell commands, is Bill Baer's online Windows PowerShell for SharePoint Command Builder. You can download the instruction guide or you can go straight to the command builder website and start creating.

Update: 08/09/2013: Cleaned up verbiage due to late night blog posting...

SharePoint, IIS, 503 errors and GPOs

One of the great things about my job is that I get to spend a bunch of time solving puzzles and fixing peoples' problems. I get to install SQL Server and SharePoint in existing, well established Federal environments. Incase you are unaware, in a segregated, secured environment, such as a Federal Agency, the left hand does not always talk to the right hand. The DNS team works apart from the Exchange Team, who works apart from the AD team, who is isolated from Network Ops team, who works independently from the firewall team, and so forth. Getting things accomplished in such an arena, can be challenging, and usually involves a vertical assent and decent approach, meaning I talk to my counterpart, they talk to their boss, who talks to, for example the AD Team's boss, and then my service accounts get created.
Scenario
I was working with a group out of Alaska and Seattle, WA, to get a SharePoint 2010 Enterprise environment with SQL Server 2008R2 up and running after the group finished a domain migration.
SQL Issues
As with any SharePoint Farm installation, I installed SQL first. Everything seemed to have installed correctly, however after reboot, the SQL Server instance and the SQL Agent instance would not fire up, as seen in Figure 1.

Figure 1: Showing the stopped SQL Server and SQL Agent accounts.
In the process of troubleshooting, I opened up the service instance for the SQL Server Service and verified that the password was correct. As seen in Figure 2, after entering the account password, I was greeted with a message.

Figure 2: Shows that after entering the account password, that the account has been granted the Log On As A Service right.
This pointed me in the right direction for the first problem in this environment. The service accounts that were created in Active Directory (AD) had a GPO rule that new accounts could not Log On As A Service. The new accounts were put into a new Security Group, ran a gpupdate /force (http://technet.microsoft.com/en-us/library/bb490983.aspx), rebooted the server and SQL was now able to be rebooted successfully and have the service instances come up running!
SharePoint Issues
Unfortunately, placing all the service accounts into the new Security Group did not stop all the issues within the Farm. SharePoint installed correctly, and Central Administration(CA) provisioned and started correctly, however, after rebooting the server, I would receive a 503 error when trying to get to CA. Typically you would receive a 503 error when the Application Pool Account for your site has been stopped. After manually starting the account and clicking on the CA link, I would get a 503 error and my Application Pool Accounts would be stopped again, as seen in Figure 3.

Figure 3: After browsing through the IIS sites, the Application Pools would stop.
Which brought up the following in the error logs:
Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          6/28/2013 7:40:21 AM
Event ID:      5021
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      
Description:
The identity of application pool SharePoint Central Administration v4 is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request.  If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.
Event Xml: (removed)
Pretty nice to actually get a message that means something for once. But which account needs the Batch Login Rights? This is Federal Environment, I just cannot ask for all of my accounts to be put into a different GPO. After reading this article on IIS 6 http://technet.microsoft.com/en-us/library/cc179801.aspx and this article that has the same issue,

http://talesfromitside.wordpress.com/2011/12/06/log-on-as-a-batch-job-permissions-removed/

, I was a little bit closer. Finally I read this KB article from Microsoft that really solved the problem:

http://support.microsoft.com/kb/981949 (see Figure 4)

Figure 4: Shows the default permissions and user rights for IIS 7.0, IIS 7.5, and IIS 8.0
So, after having the security policy modified to allow the IIS_IUSRS to Log On As A Batch Job, we ran a gpupdate /force, rebooted the server and the IIS Application Pool was able to stay up and running after trying to access Central Administration.

Update 12/29/2014
Recently, while working with a customer, I ran into interesting issue with my content service account (eg: spContent). I was able to provision my farm, create all of my service accounts, and create my Web Application and Site Collection. I was able to open Central Administration, however, when I tried to browse to the Site Collection URL, I would receive an error.

It was a bit odd that everything else worked, but the web page would not render.
Now, I was in an environment known for having issues with GPO and had a bunch of devices in the background doing all kinds of packet inspection, so I was a bit hesitant as to what could be the error.
Luckily I did find a very helpful blog post: SharePoint 2013: An exception occurred when trying to establish endpoint for context: Could not load file or assembly...
This article basically asks to make sure that Impersonate a client at authentication has local rights.

Summary

Make sure your Service Accounts can Log On As A Service and that your IIS_IUSRS are allowed to Log On As A Batch Job. You might need to have the Impersonate a client at authentication has local rights as well.
Make sure that you do an iisreset after you push your GPO updates (or reboot the server(s)).

Determine Max Users From Requests Per Second (RPS)

While doing some work for a client the other day, I needed to reverse engineer how many users can their farm handle based on the results from a Visual Studio Load Test. Determining the requests per second that the users will generate is easy once you plug in the required information based off of the end users' usage profiles.

Great!  According to the spreadsheet, their web server needs to be able to handle around 208 requests per second.  But if you run a load test on their farm, and you are given an Avg RPS, how many people can your farm handle based off the give utilization statistics?  This was a bit harder to figure out, but eventually I got there.  After plugging in the actual Avg RPS that the farm could handle while the hardware was still in it's "Green Zone" was 11.  When you put that into the spreadsheet, the number of Total Users that should access their environment should be less than 1,320.



You can download the spreadsheet from here: http://sdrv.ms/Xp7Sq0

Synchronizing Your Visio Stencils With SkyDrive

A colleague of mine, Ong (@OngYang), had upload the ITPro_PosterStencils.zip file to one of our project sites, and while I was downloading the zip over my MiFi, I started to thinking (insert joke here).  I thought to myself, that it sure would be nice to have those load into every one of my environments so that I do not have to keep reloading the stencils every time I open up Visio on every machine I use.  I mean, I use SkyDrive to synchronize up everything else, why not my Visio stencils as well.
If you do not have a SkyDrive account set up, you will need some other form of synchronization tool to synchronize your files to all of your computers (laptops, desktops, and yes, even tablets).  From here on out, I will assume that you are using SkyDrive.

1)  Go to your My Documents folder, find your My Stencils folder and move the My Stencils folder to your SkyDrive folder.  You might even already have a linked library folder called My Documents within your SkyDrive already (hopefully).

2)  Download the ITPro_PosterStencils.zip file from here and unzip it into a folder within your My Stencils folder.  You might even think about cleaning up the names of the stencils to make things more organized.

3)  Open up Visio.  Depending on the version of Visio that you are using, things will be a bit different for the next step.  This process is for using Visio 2013.

4)  Click on the General search link to get to your settings menu.

5)  From the general settings tab, find the Options tab.

6)  Within the Visio Options window, click on the Advanced tab.

7)  Scroll all the way to the bottom, and in the General settings section, click the File Locations...  button.

8)  Under the My Shapes heading, you can click the browse button and point to the new My Shapes folder within your SkyDrive.

9)  Click Ok and Ok and create a new drawing.
10)  Under more shapes, you should now be able expand out to see your new stencils.

By following these steps you should now be able to go to all of your Visio clients and point them at your synchronized My Shapes folder which will give you all of your Shapes when loaded.

Using PowerShell to Export Your .WSP Packages

During your upgrade from SharePoint 2010 to SharePoint Server 2013, we will need to make sure that we have all of the appropriate versions of our deployed WSP files.  If you have ever been a guest (consultant) on another farm, and your client has not been able to maintain a valid history of deployments, you could really run into a big upgrade problem.  Luckily for us, Shane Young, with help from Todd Klindt, wrote up a nice blog post on how to export and import your farm solutions using PowerShell called Using PowerShell to export all solutions from your SharePoint 2010 farm and other fun

I am only really worried about the extract portion of the blog, and have modified the script a bit to fit how I run my scripts.

#Get Backup Path
$bkdir = read-host("Enter Folder Location") # Get Backup Path!

# Set Backup Path if you want to hard code your path
#$bkdir = "\\serverName\Shared\Temp" (optional "C:\Temp")

# Verify folder exists
if ((test-path $bkdir) -eq $false ) # Verify folder else create it...
  {
     [IO.Directory]::CreateDirectory($bkdir) 
  }

# Add Snapin
Add-PSSnapin Microsoft.SharePoint.PowerShell -EA 0 

(Get-SPFarm).Solutions | ForEach-Object{$var = $bkdir + "\" + $_.Name; $_.SolutionFile.SaveAs($var)}

Thanks Shane for making life less stressful!

Microsoft SharePoint 2013 Upgrade Planning Template

I have modified the Microsoft Template, and you can find a copy of my upgrade template here: http://sdrv.ms/VqNni7

Getting Your SharePoint Farm Information

As we prepare our upgrade strategy for SharePoint Server 2013, one of the major requirements is documentation of our existing SharePoint 2010 environment.  This is also a good script to run when first getting your hands on an unknown farm.  This should save you a bunch of documentation time.
<Lecture>
In theory, you should be reviewing the output documentation of your environment on a weekly basis.  You could even go as far as importing the results into SQL, and tracking your growth and changes of your SharePoint Farm with SSRS.
</Lecture>
This script will create a folder, go through your farm, and create the appropriate .csv file as long as you have the appropriate permissions to run the script and you have permissions to access the data.

There are several blog posts on how to take all the .csv files and merge them into one .xlsx file.  Here are a couple that I found useful.  You will notice that they call the ComObject Excel.Application, so if you do not have Excel installed or the appropriate Office System Driver Connectivity Components installed, you will get an error.

This post by Jeff Hicks was very informational about how to get everything working:

http://www.petri.co.il/export-to-excel-with-powershell.htm

This page actually has a .ps1 for you to download, but in the Q&A section, imfrancisd has a script that works very nicely as well.

Update (01/10/2012)
Added -Limit All
Update (10/30/2014)
Added a check to see if Backup location ends with "\"
Added URL to Sandbox Solution location for output
Added site structure output for entire farm
Added Disposal of objects
Update (10/21/2015)
Moved Script to Gist
Fixed error in Get Features section thanks to Matthew Bramer (@ionline247)
Cleaned up Get Site Structure section to get ALL webs within each Site Collection by Web Application.

SPSRED: Upgrading your SharePoint and SQL Environments

I was fortunate enough to have scheduled the end of a client engagement to coincide with the start of SharePoint Saturday Redmond.  When I had submitted the topic, I was kind of hoping to not have it selected, as there was a lot of work that would need to be done.  That being said, here is my presentation:

Here is the farm layout:

 Here is the template that I used when creating SQL Cluster and HA Group:

Here is the output file from the Test-SPContentDatabase:

All files are located here:
https://skydrive.live.com/redir?resid=8E55AA8C038225F8!4265