The TechNet content about this topic has been updated to incorporate the information in this blog. Please refer to it if you need guidance on setting up user profile synching in SharePoint Server 2010 Beta.
http://technet.microsoft.com/en-us/library/ee721049(office.14).aspx
Thanks!
Dave Pae
SharePoint TPM
[Note: Windows Server 2008 R2/Windows 7 WCF hotfix is now available and this post has been updated.]
Before we get into the deep details, I want to share a high-level checklist to setup User Profile syncing on Windows Server 2008. Once the WCF hotfix for Windows Server 2008 R2 is available, this guidance will work on R2. This checklist is for beta only - we plan to improve how this works by RTM.
- Check that your system meets minimum requirements: http://technet.microsoft.com/en-us/library/cc262485(office.14).aspx
- Start with a clean OS install
- Check that the WCF hotfix is installed
Windows Server 2008 WCF hotfix http://go.microsoft.com/fwlink/?linkID=160770
Windows Server 2008 R2/Windows 7 WCF hotfix http://connect.microsoft.com/VisualStudio/Downloads/DownloadDetails.aspx?DownloadID=23806
- Check that you have done a "Complete" install of SharePoint Server 2010
- Check that the setup/farm admin account has "Replicating directory changes" in your test domain
- Use the farm configuration wizard to setup all the service applications and successfully create a site collection
- Check that statistics (i.e. Number of User Profiles, etc.) appear on the User Profile Service Application page
- Start the User Profile Synchronization Service and status changes to "Started" - this can take some time and this will configure and start the Forefront Identity services for you (do not try to manually set the logon credentials and start the service)
- Setup an Active Directory Connection
- Start a full Profile import
Now onto the full details to setup the User Profile synching...
When using SharePoint 2010 Beta, if you need to synchronize bulk users and groups with AD or LDAP, you’d likely be using the user profile synchronization functionality in SharePoint. This functionality is the backbone to turning the profile store into a ‘person’ store with interesting information from AD/LDAP or BDC sources, including hierarchy and group information that can be used to drive functionality such as audiences or hierarchy driven business processes.
We’ve done an overhaul of this feature in 2010, which is also leading to some growing pains for us through the Beta. We’ve a set of steps that you can follow to successfully bring users and groups into the profile store, and despite the fun and temptation of playing, we highly recommend you follow these steps.
For brevity, I am going to list the steps for AD only. In place of reading these steps as you go along, please give this a full read and then follow the steps. Note that quite a few of these steps are because of known issues in the Beta and we are working towards fixing them for RTM.
Prepping for Provisioning the User Profile Synchronization Service
1. After provisioning the User Profile Service Application, ensure that the service is running by going to the Manage Services on Server page in central admin, and if the User Profile service does not show as started, click start on User Profile Service. Do not try to start the User Profile “Synchronization” Service at this time (it’s listed right underneath the User Profile Service).
2. Permissions (for the account you are logged in as, when provisioning or configuring the user profile synchronization service)
a. In order to run the User Profile Synchronization service, you must be a farm admin. Running the user profile synchronization service requires a farm topology decision (where to run it and when), which is a farm admin operation across the SharePoint services platform.
b. Ensure that the farm admin running the farm timer job (typically the account you specified during install unless explicitly changed after install) is a local admin on the box where you are going to run the sync service.
c. This account should also be added to the user profile administrators with full control privileges.
d. While rare, please ensure that this account is not excluded by policy from being able to logon-locally on the machine where sync will be provisioned and run.
Provisioning the User Profile Synchronization Service
3. Now, start the User Profile Synchronization Service, by going to the Manage Services on Server page in central admin and clicking start on the User Profile “Synchronization” service. When you hit start, service will ask you to associate a User Profile Service Application with it, select the User Profile Service Application you created earlier and hit OK.
4. Wait a few minutes to allow for provisioning, verify that the User Profile Synchronization Service shows Started on the Manage Services on Server page, and then check the following items on the machine where the sync service is running
a. Run services.msc and check if the windows services “Forefront Identity Manager Synchronization Service” and “Forefront Identity Manager Service” are running. Do not start them here manually.
b. Check the folder %Programfiles%\Microsoft Office Servers \14.0\Synchronization Service\MaData to see if there are two subfolders \ILMMA and \MOSS-XYZ (where XYZ is the name of your user profile service application). These folders will be empty at this time.
5. Issue an IISReset on the machine where user profile sync service was provisioned.
Prepping for Connection Creation
6. Before you proceed with creating connections to bring data in, it’s good to pause and spec out what containers you’d be selecting for your connection, where the users are, where the groups are etc. It’s important to get the connections right, before kicking-off sync. We highly recommend that you spec one connection per forest and do not create multiple connections to the same forest.
7. In order to be able to sync with AD, you need to have an account that can be used to call AD and identify what has changed since a given time (in other words, an account that is capable of reading the AD change log). This right is called “Replicate Directory Changes” in AD lingo. This right does not allow for writing or modification of AD objects. You’d need this account name and password when you create a connection. This account can be the same or different than the farm or UPA admin account. Please do not proceed without having an account with these rights, even if you don’t plan to do incremental synchronization. This AD right is required for both full and incremental sync.
Creating a Connection
8. To create a connection with your AD source, you must logon locally on the central admin box. User the Configure Synchronization Connections link in the user profile service central admin page for connection creation.
9. Majority of the items on the connection creation page are intuitive. Specify the fully qualified domain name for the forest, and specify the DC. Ensure that both the forest and the DC are directly reachable from the machine where you provisioned the user profile sync service.
10. You’d likely leave the Authentication provider type to “Windows Auth”.
11. Right below the authentication provider fields, you’d see the account name and password fields for the AD account you procured in step 7.
12. Select Populate Containers and carefully chose the right containers for your connection. For example, find out which containers have the users, if you don’t want to bring in anything else. We have some trouble with this control in IE8, so press F12, and select IE7 in the dev tools window that pops up.
13. If you had additional connections to create, create them all now.
Configure Users or Users and Groups
14. Based on the numbers of users and groups in your system, it can take much longer to sync users and groups, then syncing users only. So to get you started, we’ve provided for a Users-only option under Configure Synchronization Settings link. Select Users-only for the first full run.
Additional Settings
15. We don’t cover the details in this blog, but you can setup additional property mappings and filters at this time, if absolutely needed. If you can live without filtering out data or mapping specific custom properties, it might be best to proceed without them.
Running Sync
16. At this point, you can go to Start Profile Synchronization, select Start Full Synchronization and click ok. Depending upon the number of objects, the first full sync can take many hours to complete. We expect the performance to improve with RTM but after the first full sync, the incremental syncs should be much faster.
What to Expect Next
17. We have bunch of kinks to work out in the status that you see on the right side of the user profile service admin page. For example, if you see the number in the status going down, that means the sync run has just moved from one stage of synchronization to another and are now showing the number for that stage. We are also working on a tool to let you stop a bad run, but in the meantime, it’s not recommended that you stop a sync run brute force. This can get you in a tough state that requires special database-level steps to recover from.
18. If you are running sync for the first time, and you already have the User profile service live, for example users can use their MySites and Profiles, they might see changing organization charts as users come in and managers get attached. This should all clear up once the sync run is complete.
19. Along with the user number shown in the status, you can also search for a known profile or accounts that start with a known domain name in Manage User Profiles page. Note that you are going to not see any users listed here, but they are there, you just have to search for them.
Running Incremental Sync
20. Once the full sync step is complete, you can flip the “Users only” setting to “Users and Groups” and run an incremental sync (or schedule an incremental job).