If you remember, when you go to the bottom of the Edit Profile page, you will see a section called Newsfeed Settings

Now, lets take a look at this section in central admin under Manage User Properties (under the User Profile Service Application management page). Hover over the Newsfeed Settings title and select Edit to edit it’s properties.

Here you will see that this section is associated with the Sub-type of Profile called Default User Profile Subtype

Trying to deselect this will throw an error, as it has to be associated with some Sub-type.  So lets create another sub-type.  From the Manage Sub-types page, we create a new Sub-type called No Newsfeed.

Now if we go back to edit the Newsfeed Settings section in Manage Properties, we can dis-associate this section from the Default User Profile Subtype.

.

Save everything and now go back to the Edit profile page (give it a minute to catch-up).  No more Activities I am Following section!

So you don’t want your users to be able to personalize pages?  Here’s how.

Central Admin –> Web applications

Select the web application you want to apply changes (sadly this is changes applies to the full web app).

Scroll to the bottom of the list of options and observe the last two.

Clear the options “Add/Remove Personal Web Parts” and “Update Personal Web Parts”, to prevent the user personalizing the web part page.

Now the user cannot personalize the page!

The previous sync connection to AD had a custom connection for the source using an LDAP query:

(&(objectCategory=person)(objectClass=user)( !(userAccountControl:1.2.840.113556.1.4.803:=2)))

Translated means, only give me users and enabled accounts.  Not terribly unusual for a sync connection.

See how easy that was?  Call your directory guy, ask for a query to filter out disabled accounts and non-users, copy string from email, paste into user filter field.  Save. Done.

Nice, so lets do that with our User Profile Connection.

And so the problems begin…

1. Not inclusive, Exclusive!

MOSS 2007 filters were inclusive, i.e you gave it a query that define all users to include in the syncronization.

SPS 2010 does the opposite.  It makes you pick your containers to sync and then you apply exclusion filters.

2. No pasty the query

Either Microsoft decided LDAP queries were to much for SharePoint folk to handle, or they really like trees, or something, but now you have to use an interface to build out your query.  So you create your new connection by specifying your source details (in this case AD forest, and sync account details. Then you populate a shiny tree in a box that represents your directory objects.

Doesn’t that look nice!  So lets go and select our IT group to sync for starters.  They’re in DOMAIN\AMRS\DEPTS\USERS\IT.  No problem

expand DOMAIN

wait…………….

expand AMRS

wait…………….

expand DEPTS

wait………………………………

expand USERS

wait…………………………………………………

Select IT

That was such an efficient experience, and only took me 3 cups of coffee.

CRAP!#!  I just clicked the “select all” (conveniently located close to the ok button), so now I have to do it all again.

Can’t wait until I have to do this in production where I have several containers I want to select.

3. Filters, are painnnnnfulllllll

Well, we have our connection defined, time to add some filters to it.

Lets do the same as before, no disabled accounts and only users as defined by objectClass or objectCategory. 

Easy one first, disabled users is defined by

userAccountControl bit on equals 2.  No problem.  Select userAccountControl from the Attribute list, and wait for it to post back to get the applicable operators….. and wait…. (coz it ain’t that fast).

Great, I set bit on equals 2 and click Add. 

and wait………..

ok, we have our first exclusion filter. 

No problem there, and if that’s the only filter you’d be golden.  But we want more.

Let’s exclude accounts that are not objectClass equals user.

Where’s the objectClass attribute"?

Looks like there isn’t one.  Even though there is. 

Moving onto the objectCategory attribute, which is there.

Select objectCategory attribute.

Wait……………………………….

Set value to not equal person

click Add

Wait……………………………….

Crap.  I forgot to select OR instead of AND for the operator.  Now I have to delete (wait), and re-add (wait).

Ok, lets go with these two filters for now and save them. 

Click OK

Wait……………………………….

And we get a lovely error thanks to the objectCategory attribute.  This correlates to:

Microsoft.ResourceManagement.WebServices.Faults.ServiceFaultException: Unable to process Put message  
at Microsoft.ResourceManagement.WebServices.Client.Resource.Update()   
at Microsoft.ResourceManagement.WebServices.ResourceManager.UpdateResource()   
at Microsoft.Office.Server.UserProfiles.DirectoryServiceConnection.SetExclusionFilters(List`1 exclusionFilters)   
at Microsoft.SharePoint.Portal.UserProfiles.AdminUI.EditConnectionFilters.ButtonOK_Click(Object sender, EventArgs e)   
at System.Web.UI.WebControls.Button.OnClick(EventArgs e)   
at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)   
at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)   
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Make of that what you will, but it basically means we cannot use the objectCategory attribute for filtering (fix coming in SP1 or beyond apparently).

So I try a few different filters, like

Mail Is not equal to * (to exclude accounts that do not have a mail address)

The only way I could get profiles migrated was to only use the disable accounts property.

4. My profiles are there, but they’re not

So another thing I tried is I ran a successful import (only excluding disabled accounts), and got 42 profiles back.  So lets try adding a filter that excludes users that do not have an email address (mail not equals *).

FIM shows my deletions ok.  So that’s promising (even though all these accounts do have an email address ).

So I go back to my user profiles page, and I expect to see a count of 0.  Except I don’t.  I see there are still 42 profiles there.  Huh?  Lets search to see who’s still there.

And there you have it, 42 profiles and none of them visible.  So are they there or not?  I’m so done with this, I really don’t care at this point.

5. What’s my query again?

So lets go back and check my query,as in what containers I selected and what filters I have applied.

Are you kidding me?  I have to reconnect to the source, populate the tree, then navigate all the way down to see what’s selected?

I GIVE UP.

Off to Central Admin > Services on server I go… Find the Synchronization servvice and click “Stop”.  I get:

“An update conflict has occured , and you must re-try this action.  The object UserProfileApplication Name=User Profile Service Application was updated by….”

After a quick Bingle, I come across a post by Chaitu Madala. The issue is related to the file system cache.  Clearing this cache resolves the issue.  There is a kb article at Microsoft support that step you through it for WSS 3.0.  Same steps apply for SharePoint 2010.

Similar to Chaitu, I will repeat the steps for prosperity…

————————————————————————-

Note, I was unable to verify the last step as the file was in use and unreadable using an editor.  But I was able to stop the sync service successfully after clearing the file system cache.

Update-SPProfilePhotoStore –MySiteHostLocation <url to my site host>

When I ran this (logged in as my SharePoint admin account) I got the following error:

The ULS log spits out:

According to TechNet, I should:

Verify that you meet the following minimum requirements: See Add-SPShellAdmin. You must also be a site collection administrator for the My Site host, and you must be a User Profile service application administrator with the Manage Profiles permission.

Well that was all set and I was still getting the error.

It seems the cmdlet  uses the WCF service ProfilePropertyService.svc, so I gave my admin account full control in the Sharing section of the UPS application.

This got me further, but now I’m getting access denied for the my site host database.

So I add my admin account to the database containing my site host as db_owner, then re-run the cmdlet.

Success!  All photos are being added to the my site host library User Photos.

The blog template is pretty much the same one from MOSS 2007, and uses the ol’ school comments functionality (stored in a separate list).  The problem with this is you can also add social comments to a blog post – very confusing.  It’d be nice to disable the blog comments, and just use the social comments.  So lets give it a shot.

What’re we’re going to do is:

1. Remove the blog comments web part from the post page

2. Add the Note board web part

3. Enable the publishing infrastructure site collection feature

Remove Blog Comments web parts

Open the blog site, and click on a post title to get to the post.aspx page.  From the Site Actions menu, select Edit Page.  Once in edit mode, you can delete the Comments and Add Comment web parts.

Deleting the Comments web part

Add Note Board Web Part

The Note Board web part is in the Social Collaboration folder in the web part categories. 

Adding the Note Board web part

Enable the publishing infrastructure site collection feature

If you do not activate the publishing infrastructure feature, the note board will appear to work, but will not store comments correctly.  The note board does not use the correct url for the page, so the notes stored using the web part, will differ from the notes stored using the Tags and Notes button.  See the image below to see what I mean.

The note board web part differences from the Tags and Notes dialog.

If you discover this problem on the note board, activating the publishing infrastructure site collection feature will correct it.

The problem is the page is hard-coded to the page layout from the original site.

The following Powershell script that my buddy Raj wrote will fix the problem:

It’s a little odd that this issue was carried over from 2007 to 2010, but there you go….

“Setup is unable to proceed due to the following error(s): A system restart from a previous installation is pending.”

The problem was related to a registry key “PendingFileRenameOperations” located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager.

Fix

Rename the key to PendingFileRenameOperations1 and you will be able to proceed with the install.

Problem

At one of our client sites, any attempt to browse to a WCF service (any svc page in the /_vti_bin/ library), we were met with an access denied screen.

We blamed everything, claims, WCF registration, .NET 4.0, the guy sitting next door.  We ripped apart the web.config for the web app, and various other web.config files.  With no resolution, we tried installing the ADO.NET data services thinking that might fix it.  Nope.

Resolution

So our next move was to create another web app, and test the virtual services against that. 

Testing the WCF services against the new web application was successful!  So what’s the difference?  They were both created through the UI.

We compared the web.configs, but found nothing obvious.  Then we compared the IIS settings; this is where Scott discovered the problem.  The rogue web app had anonymous disabled. 

Enabling anonymous and resetting IIS fixed the problem.  Doh!  Not sure why this web app had anonymous disabled, but that indeed was the problem.

Thanks to Scott, Mark, James, and Sean for figuring this out.

Object Cache: The super user account utilized by the cache is not configured. This can increase the number of cache misses, which causes the page requests to consume unneccesary system resources.
To configure the account use the following command ‘stsadm -o setproperty -propertyname portalsuperuseraccount -propertyvalue account -url webappurl’. The account should be any account that has Full Control access to the SharePoint databases but is not an application pool account.

So, as instructed, I ran the stsadm command, not realizing the severity of my actions.

What happened was a slew of access denied errors, and more interestingly, was the inability for a user to edit their user profile.

So after some research, I discovered the right way to fix this in a TechNet article Configure object cache user accounts.

Steps

The steps are as follows:

1. Create dedicated user accounts in AD for a superuser and superreader.

2. Grant the super reader account full read access to each web application by editing the User Policy for the web app through Central Admin.

3. Grant the super user account full control to each web application by editing the User Policy for the web app through Central Admin.

4. Run the following Powershell script for each web application (making changes where appropriate):

$wa = Get-SPWebApplication -Identity http://dev.domain.com
$wa.Properties["portalsuperuseraccount"] = "i:0#.w|domain\sp-superuser"
$wa.Properties["portalsuperreaderaccount"] = "i:0#.w|domain\sp-superread"
$wa.Update()

5. Reset IIS

Notes

• Make sure you run this under an account that has Shell permissions to the config database.  Farm account has this automatically.
• Note the account name format as SharePoint sees it.  copy the format in the User Name column under the Web Application User Policy dialog exactly.  For example, if classic, then format is likely <domain>\<user.name>; if claims then likely i:0#.w|<domain>\<user.name>.
• Reset IIS after you run the powershell script.
• If you still see error in the event viewer, it may be that you did set permissions on all web apps.  For example I had to do it on both my primary web app, and the web app that hosted mysites.

 

References

• The official TechNet article.
• Chris O.Brian has a good script to do this all at once.
• SharePoint Stef also has a script to handle this.