Installing and configuring ADRMS in MOSS 2007

  Installing and configuring ADRMS in MOSS on windows server 2008 OS

Installation of AD RMS (Active Directory Rights Management Services) can be performed using the Server Manager utility, by adding the AD RMS role to the server:

1. Open Server Manager (To open, click on Start and then Control Panel and then Administrative Tools and then Server Manager).

2. In the Nodes pane, select Roles and then click the Add Roles link in the tasks pane.

3. Click Next at the welcome page.

4. On the Select Server Roles page, check the box for Active Directory Rights Management Services. If prompted to add additional services and features such as IIS or the Message Queuing Service, choose to add the Required Role Services and then click Next to continue.

5. Review the Introduction page, and click Next to continue.

6. On the Select Role Services page, select which components to install. In this case, only the core AD RMS role service is installed. Click Next to continue.

7. On the AD RMS Cluster page, choose to Create a New AD RMS Cluster and then click Next to continue.

8. On the Select Configuration Database page, choose whether to install the limited Windows Internal Database service (not recommended) or to create an RMS database on a separate server running SQL Server 200x.

9. On the Specify Service Account page, choose which service account will be used for RMS (Rights Management Services) by using the Specify button. It cannot be the same account that is used to install AD RMS.

10. On the subsequent page, select Use AD RMS Centrally Managed Key Storage and then click Next.

11. Enter a strong password when prompted, and click Next to continue.

12. Confirm which IIS website (Default Web Site for a dedicated build) will hold the AD RMS web services, and click Next to continue.

13. Type in the FQDN (Fully Qualified Domain Name) that will be used for the AD RMS service. For this example, enter rms.companyabc.com, and then click the Validate button. The FQDN must already be set up to resolve to the IP address of the IIS website on the RMS server. Click Next to continue.

NOTE: Using an SSL certificate for an HTTPS connection to the RMS server is recommended, and can be enabled from this wizard.

14. Enter a descriptive name for the RMS cluster, and click Next to continue.

15. On the AD RMS Service Connection Point Registration page, click Next to register the Service Connection Point (SCP) in AD DS.

16. If installing IIS at the same time, accept the defaults for setup by clicking Next, and then clicking Next again.

17. Click Install to finalize the installation wizard. It may take some time for the installation to complete.

18. Click Finish when the wizard is complete. Restart the server and log back on to complete the install.

Configure IRM on MOSS server:

                                                        Go to the Central admin site -> Operation - > Information Rights Management ->Select “Use the default RMS server specified in Active Directory” ->Click OK.

Check the IRM functionality working on SharePoint site:

1.       Open the SharePoint site -> select the shared document where do you want enable IRM->go to the document library settings ->information rights management->Enable “ Restrict permission to documents in this library on download” and give the policy name and description and Click Ok.

2.       Upload the word document to the Enable IRM document library

3.       Download the uploaded document from the document library

4.       When opening the document, it should show that the document protected.

5.       You could not make the print of the document as well.

NOTE:

1.        IRM protector is not available in windows SharePoint services and Foundation 2010 in out of box but we could use custom IRM protector on both.

2.       IRM protector available in SharePoint server’s edition in out of box.

Login failed:The login is from an untrusted domain

I have received the following error message "ERROR “Unknown SQL Exception 18452 occured. Additional error information from SQL Server is included below. Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.” in Event Viewer when sharepoint server trying to connect SQL server.

        

Cause:

           This issue because of connectivity issue between AD and SQL server.

 

Resolution:

               

1. check the time zone and date and time between AD and SQL server, if any changes, please correct it and restart the client machine

2.Still if you face the issue, run the following command on client machine

gpudpate /force

gpupdate /sync

 

3. Still if you face the issue, rejoin the SQL machine in th domain(in my case, i have rejoin the domain)

 

 

Failed to start the database service mssql$microsoft##SSEE

I was install WSS 3.0 with standalone mode which will installed SQL Embeded Edition by default. When i was trying to running sharepoint configuration wizard, I was received the following Error message "failed to start the database service mssql$microsoft##SSEE.Repair this product by selecting it from the add/remove programs menu"

Cause:
            By Default Network Service account is the Startup service account for SQL Embeded Edition but Network service Account does not have permission in SQL Embeded installation location(C:\windows\SYSMI) and .Net Framework 2.0 location.

Resolution:
                 Give the permission of  SQL Embeded installation  path and .net Framework 2.0 Path for Network Service Account.


           

TF14091: you cannot perform this operation on workspace

I got the following Error message, " TF14091: you cannot perform this operation on workspace " because you are not the owner of the workspace" and it  takes old login credentials but we login the current login details. when trying to open TFS project in vistual studio 2010.

Cause:

           Visual studio caches the credential details. so It tooks old credential for the login

Solution:

             For removing the credentil cache file, run the below mentioned command on visual studio command prompt.

tf workspaces /remove:*

IIS Admin Service service terminated due to speficified not found

I was not able browse any site in the local machine and finally found that IIS admin Service is stopped.
I have tried to start the IIS admin service but I have received the following Error Message.
"IIS Admin Service service terminated due to speficified not found". 

Cause:
             For starting IIS admin service required two XML files such Metabase.XML and MBSchema.XML. If any one of the files missed or crashed, the IIS admin service wont be start.

 

Solution:

              In my case metabase.xml file missed in the following location C:\Windows\System32\Inetsrv. So I have restored metabase.xml file from the following location C:\Windows\System32\Inetsrv\History.

The server encryption keys could not be accessed. Event ID 6208

I have received the following error message when trying to open the User profile service application using Central Admin site in sharepoint 2010  "The server encryption keys could not be accessed.
User Action
Verify that the service account has permissions to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Identity Manager\2010\Synchronization Service
If the problem persists, run setup and restore the encryption keys from backup."
Event ID 6208

Cause:
           This issue because of most of the cases when changing the configured service account to other Account and may be removed the service account from the SQL.

Resolution:
1. check the your changed service account
2. then check the changed service account has the permission in the user profile Database
3.Then Stop user profile synchronization service and Start the User profile synchronization service
4. Make sure forefront services are started and User profile synchronization service is started.
5. Now User profile service application should open.

Move Sharepoint server from Domain to another domain

Move/migrate Sharepoint server  from one domain to another domain

Example: Move sharepont fron mumbai domain to chennai domain.

1.       We have to take the backup of all sharepoint databases and all webconfig and if we have any customization.

2.       Need to take the list of web application pool identity Accounts details.

3.       Now Remove the mumbai domain and join to new domain chennai.com

4.       Create the sharepoint account and add that sharepoint Account to the below groups in the sharepoint machine.

Local administrators,WSS_WPG,WSS_admin and IIS_WPG

5.       Now we need to do 3^rd step in SQL machine and add the sharepoint Account in local administrator group and  Open the sql management studio and do the following steps

5a. create a new login for sharepoint account and assign the following roles DB creater and security Admin.

               5b.  Give the DB owner permission for the sharepoint account  for all sharepoint DB using user Mapping option in the user Account property.

6.       Now login to the sharepoint server using sharepoint Account and run the following stsadm commands

6a. stsadm.exe –o updatefarmcredentials –userlogin chennai\testspuser –password test@123

6b. stsadm.exe –o updateaccountpassword –userlogin chennai\testspuser –password test@123 -noadmin

6c. stsadm.exe –o spsearch –farmserviceaccount chennai\testspuser –farmservicepassword test@123

6d. stsadm.exe – o osearch –farmserviceaccount chennai\testspuser –farmservicepassword test@123

6e. the below command for SSP

      Stsadm.exe –o editssp –title SSPname –ssplogin chennai\testspuser –ssppassword test@123

Finally restart IIS with noforce

7.       Check that central admin pool and Sharepoint service account are changed using IIS and Service manager.

8.       Now open the central admin and change the all web application pool account and change the site collection administrator credentails

9.       Then migrate the old  domain users to new domain account using the below stsadm command

9a.stsadm.exe –o migrateusers –oldlogin mumbai\testuser –newlogin chennai\testuser -ignoresidhistory