User profile service application configuration for SharePoint 2010 was not an easy task that can be completed in few clicks like many other services when it was released. It is interesting to see how different components are working and relying on each other to make this service work. It was very different then MOSS 2007.
Now after the release of 2013 this was the first thing I wanted to see if anything has changed or any different from 2010 , but process is pretty much same as it was in 2010 other than a little UI difference .
If you have done this for 100+ times like me in 2010 you will be good to go with 2013.
Just in case you don’t want to miss a step I have listed all steps below for reference with screen shots, enjoy.
My Environment,
Fresh build of SharePoint 2013 on VM with the SQL server, machine is part of the domain. User profile service application is never configured before and as Microsoft recommended I will use multiple account for least privilege. My site has not been set up yet as well.
Accounts used for configuration
DomainSPUPS : this account will be used to synchronize profiles from AD to SharePoint and also has replicate directory change rights
DomainSPFarm: This is the same account used to run configuration wizard to connect with Database server and is also app pool account for central administration site
DomainSPMySpaceAppPool : will be used as application pool account for my site web application
DomainSPUPSAAppPool : This account will be used as application pool identity for user profile service application
1- Set permissions for Sync account (SPUPS)
- Click on Start > Administrative Tools > Active Directory Users and computer
- Right click on domain name and click on delegate control.
- Delegate control wizard will start > click next to next page > add account that you want to use for profile synchronization, in this case its SPUPS
- Once user is added click on next
- On next screen “ Task to Delegate” check “ create a custom task to delegate” and click next twice
- On permissions page click on “Replicate Directory changes” and click next and then click on Finish to close the wizard.
You can also set the permissions on configuration partition, this is not required if you are building a VM for your testing purpose but its good to have to avoid issues later on
- Click Start > Run > Type “ ADSIEDIT.msc” >
- Right click on ADSI Edit in console and click on “connect to..”
- Select “configuration” in Connection Point section of box as shown in screen shot and click ok
- Expand recently connected “Configuration “ Node and select properties after right click and go to security Tab as shown in the screens shot below
- Click on add and enter account (SPUPS) and select “Replicate Directory Changes” as shown below
2- Set permissions for Farm account
- You need to give farm account “allow log on locally “ rights you can do this by going to start > administrative tools > local security policy
- Expand Local policies > user rights assignments > select allow log on locally in the box on the right side.
- Click on add button and add your farm account here as shown below in the screens shot.
Important
You need to make your farm account ( SPFarm) administrator on the box where profile synchronization is running ( most of the times its your application server ) .
Once everything is up and working fine you can remove it from admins group, but if you back up your service application or install CUs or Service Pack in future or in short anything that will restart user profile service you need to add this account back in admins group (I learn this when struggling with 2010). Now if you want to leave it in admins group I don’t see any harm. Or you can make sure every time provisioning is needed for this service application, add farm account in local admins group and then remove after.
3- Let’s create MySite host web application
We don’t need screen shots for how to create a web application > site collection. Once done if you try to browse the site you will get error as user profile service application is not created and configured yet and
From central administration click on Application Management > Manage Web Applications.
- Click on New in the ribbon on the top and fill out the form.
- Create a new site > I will use port 80 > enter host header> create a new app pool >select application pool account from the drop down > OK
- I will highly recommend to use separate account as application pool account for my site web application. In this case I am using DomainMySpaceAppPool.
- After you click ok it will take you next screen where you can create site collection using My Site Host template .
- Once done if you try to browse the site you will get error as user profile service application is not created and configured yet so it’s ok. This is good error.
4- Create User profile Service Application
Please follow the steps below to create user profile service application .
- Go to Central Administration
- Application management > Manage service application (under service applications) > click on New drop down in the ribbon > user profile service application.
Enter information below
- Select create a new app Pool
- Enter name of app pool
- Select configurable and select account specified for application pool identity ,
- Leave the rest as default
- In My Site Host URL enter url for my site you create earlier
- I will select default managed path
- Click OK
5- Step 4 above will create few services in your farm but they are not running. It’s time to Start those services now before we configure them,
- Go to Central Administration > under system settings click on manage services on server> scroll down to two new services
- User profile service
- User profile synchronization service
- Both services are in stopped status (in screen shot they have been started )
- Start user profile service
- Wait for service to start.
- Start user profile sync service and select
- Service application we created in step 4 from drop down
- Enter farm admin account mentioned in the beginning
- Enter password to see the magic
OK, So there is no magic, most of the articles and experts suggest waiting at this point and I suggest a little longer wait , it also depends how your farm and number of servers, DC has been set up .
At this point farm account is being used to start more services on the server so if you go to services console of your SharePoint server you will see two new services also called FIM
After a wait (10 to 30 min) you can see those two services will be in started mode and account they are running under will be the farm account entered earlier.
At this point once all services are running an IISRESET is good option and Reboot is also suggested. So let’s do both (thou IISRESET can do it but both is + to be on the safe side)
6- This is the time to configure user profile import connection and set up import so let’s start
- Go to Central Administration > application management > Manage service application > click on user profile service application you just created in step 5 ( leave proxy alone)
- It will bring you to Manage Profile Service Page
- Click on “Configure Synchronization Connections” in Synchronization section
- On the next screen lick on New to create a new connection
- Enter info as mentioned below
- Enter connection name
- Enter forest name/domain name
- Enter account name mentioned above that will be used for synchronization , this is the same account we configured permissions for in step above. In my case it is SPUPS
- Enter password for SPUPS
- Confirm password for SPUPS
- Port is 389 by default
- Click on populate container
- Once container is populated you can see your directory structure and select OU you want to import in to the SharePoint farm , I will highly recommend not to select All , as this will import lots of other stuff that is not needed here , depending on y our AD set up .
- Once click on go back to the “Manage Profile Service” page
- Start profile synchronization by clicking in synchronization section
- You can see the status of synchronization on the right side of the page . it will show zero ( 0) in the first line for Number of User Profiles , you can refresh the page and see status , it takes time but again it depends how many OU you have selected while setting up sync connection .
- Once done it sill set status to Idle and you will see expected number in “number of user profiles” line section on the right side of page .
You can also check profiles that have been imported by going to “Manage User Profile” page and find user there.
Feel free to suggest or comment on this .