harbar.net

User Profile Service Application Sync Database Maintenance with the February 2012 Cumulative Update

Spence — Sun, 15 Apr 2012 18:31:57 GMT

Since the release of SharePoint Server 2010, the maintenance of the User Profile Service Application (UPA) Sync DB has been extremely problematic. I’m not talking about “standard” database maintenance tasks here, you know those routine tasks you should be performing on your environment but that seldom are implemented by those running operational service :). This is all about the Sync DB retaining data that it shouldn’t. There is quite a lot of confusion out there surrounding this topic in general and it has certainly hit a lot of customers, hard.

The fundamental issue stems from the choice of the build of FIM bundled with SharePoint. Whilst that build has changed over time with updates, the necessary stored procedures to clean out the history of sync runs were missing. This in almost all cases leads to a unwieldy Sync DB, and that’s putting it politely. Even in small scale VM environments such as test labs and the like the Sync DB can become massive over time when running regular sync tasks. Imagine that in production for a real deployment for 250,000 users and the problem is a considerable challenge!

You may have found on the interwebz a dodgy SQL script which was provided to a customer and then unfortunately was posted to the tubes. This would approximate the necessary clean up. However that script is NOT supported, and it only actually works on three specific builds of the product anyway.

Therefore the official guidance has been for a very long time to throw away and recreate the UPA (whilst retaining the Profile and Social DBs) and re-provisioning the UPS service instance, which results in a nice clean Sync DB.

Far from an ideal solution, especially considering all of the Synchronization Connections, Filters and Mappings must be re-created in this scenario (and there is no way to automate connections and filters in a supported and reliable fashion). And of course a Full Sync needs to be run after the provisioning, not in large environments a trivial operation.

Thankfully one of the improvements in the February 2012 Cumulative Update is finally the inclusion of six new Stored Procedures that together deal with deleting unnecessary history during sync operations.

Now finally the Sync DB will remain at a sensible size, commensurate with the number of objects you are syncing. Assuming you of course are also performing the appropriate regular database maintenance tasks.

Since this release I’ve fielded a number of questions from those who are battle hardened with SharePoint 2010 CUs. They ask, can we add these stored procedures to our deployment without deploying the February 2012 CU? Of course the answer to this is “no”. Or more accurately, “hell, NO!”. Even if it was supported, which is most definitely is not, it wouldn't work.

There are two new “core” FIM sprocs that support the four ones responsible for clean up (DeleteObjectReferences, TruncateObjectsInternal, TruncateInstanceData and TruncateSystemObjects). However a total of 49 other sprocs and three tables must be also updated to make the overall solution work. Also, there are other schema updates in the Sync DB to support additional fixes in this CU. So just don’t go there. There’s no cheat, there’s no shortcut, if you want automatically managed Sync DB, you must deploy this CU.

Whilst I’m at it I will also highlight another important UPA related aspect of this CU. There are a number of scenarios where when implementing the NetBIOSDomainNamesEnabled property, during Full Sync some profiles may not be imported. The majority of these problems have now been resolved. Not 100% but pretty damn close, and we have a careful eye on this.

It’s also worth noting that the build of FIM in the February 2012 CU has been revved to 4.0.2450.47. There are other fixes in the CU, but they are extremely edge. What you can do is take it from me as red that the February 2012 CU is a critical element for the User Profile Synchronization service instance.

What Every SharePoint Admin Needs to Know About Host Named Site Collections

Spence — Wed, 28 Mar 2012 17:55:36 GMT

My buddy and all round decent bloke, Kirk Evans, a PFE from Texas way has put together a great blog post on Host Named Site Collections (HNSC) in SharePoint 2010. This should be considered essential reading for SharePoint infrastructure types (IT Pros as Microsoft so offensively buckets them :)).

HNSC are often referred to as Host header site collections, and are greatly misunderstood by the field at large. Indeed some SharePoint “experts” have recently made some rather silly statements about them, suggesting they should be avoided.

Admittedly many moons ago there were statements about that from Microsoft but they referred explicitly to the associated feature “User Account Creation Mode”, and not HNSC, which are alive and well. Indeed HNSC are a fundamental design consideration for *every* SharePoint deployment.

Go check out Kirk’s write up…

What Every SharePoint Admin Needs to Know About Host Named Site Collections

Sixth edition of the free DIWUG SharePoint Magazine

Spence — Mon, 12 Mar 2012 14:13:10 GMT

The best free SharePoint magazine published online, the DIWUG SharePoint e-Magazine, have released their sixth edition. As usual this is a great edition with a mix of articles written by SharePoint community members.

I contributed a two part article series, of which part one is featured in this magazine:

Real World Service Application federation with SharePoint 2010 Part One
One of the most powerful new infrastructure capabilities in SharePoint Server 2010
is that of Service Application Federation. Enabled by the new Service Application
architecture, Service Application Federation allows the “publishing” of some service
applications across farms. This ability provides a significantly improved model for flexible
deployment allowing SharePoint 2010 to scale much further than previous versions, and
to enable some interesting and powerful scenarios not possible in the past.
This article will cover the basic capability along with a walk through of the required
configuration.

Also in this edition are articles by our newly minted MCA, Wictor Wilén, Jasper Oosterveld and Andrew Connell.

Check it out over at the DIWUG site!

Six months with the Cambridge Audio Sonata NP30

Spence — Sat, 18 Feb 2012 21:15:50 GMT

Back in July last year I finally, after much procrastination, plumped for a new tune streamer. Whilst I posted a few thoughts shortly after my purchase, many folks have asked me about it since and so here is a more considered review of the Cambridge Audio Sonata NP30 after about six months of real use.

[UPDATE 09/05/2012] A few weeks after I posted this review, Cambridge Audio shipped a significant firmware update. After a couple of months running this version I have added additional comments to the review below.

Actually before I dive in I will take this opportunity to sardonically pour scorn and derision on “Hi-Fi” rag reviews which after talking about the industrial design of some gear then claptrap with phrases such as “helped the sound retain cohesion and musicality” or “slightly thin and lacking in body”. That friends is 100% unadulterated bullshit. You know these folks have a Dilbert “Hi-Fi” hogwash generator. Never mind the fact they only listened for an hour anyway (if that) believe it or not those two examples were from a review of a USB cable!!! Those magazines are as much use as a chocolate fireguard. If you want a real mag get Tone Audio, but it would be much better to actually listen to the thing in question.

With that little rant out of the way a little recap of what the NP30 is all about. Its a simple, cheap network music player. Definitely at the lower end of the market at £400, “better” than a Squeezebox or Sonos but nowhere close to a Linn. There are a number of areas where features and spec are compromised due to the price. It competes with the Denon and Marantz units in the same price range. It plays tunes from a UPnP server or via Internet stream and includes a mid range DAC and a few other useful functions.

My music library is approximately 2Tb, around 3,000 “albums” with another 2,000 CDs to rip plus a reasonably large collection of concerts etc. About 90% of the material is FLAC with about 10% “hi def” (greater than 44.1/16). It’s a dead cert guarantee the library will keep growing! Over the last year or so I’ve been increasingly choosing higher definition content. All this stuff sits on my Windows Home Server which runs Asset UPnP server. Yup, WHS 2011 still doesn’t support streaming FLAC natively!

For about four months I was playing the NP30 thru a Sony STR-VA555ES receiver (2002’s finest!) and a pair of SSK-70EDs (still the best!). In December I replaced the receiver with a STR-DA5600ES (a story for another day and nothing to do with the NP30). Almost always I play the NP30 via the RCA outs using 2 Channel Direct.

Here’s the NP30 sitting snuggly at home (click to view at full size):

Industrial Design and Hook-ups

Looks wise it’s kinda nice assuming you like the CA approach and it matches their other Sonata products. The unit is about 60% the width of real hi fi (exactly the same width of an XBOX 360 Slim) which is a little annoying to me, and the face is definitely cluttered. Operation via the front panel is exceptionally good, especially the jog shuttle.

The dot matrix style display is reasonable, but you can’t read it from 15 feet. Compared to the display on a decent receiver the dots are too large and therefore blurred at a distance. Cheap basically. There are two levels of display brightness but sadly no option to turn off the display, a major disappointment. Also, the display is not wide enough for decent display of track information.

Whilst the NP30 has wireless, I have it hooked up to the LAN via a switch in the receiver. It has a nice “try the LAN first and if not there use WLAN” mode, but I have it set to use LAN only. Doing this improves the boot time a little.

CA amusingly enough “strongly recommends” using LAN for FLAC rather than wireless. They suggest that in their experience LAN is better for streaming “hi res” content . Funny how these audio geeks don’t know shit about networking ehh? :). Similarly amusing is that the unit only ships with a 100Mb/s NIC, and the WLAN doesn’t support 5Ghz. Oh dear, not that you really need anything more, it’s poor form. Cheap, again.

It also comes with a remote control, a nice one similar to all the other CA remotes, which replicates the front panel operations except the jog shuttle. More good news is this guy is easily switched out for a universal remote without having to worry about dodgy power toggle issues.

Round the back aside from the LAN port are a couple RCA outs and SPDIF and TOSLink. I use the RCA outs but have the SPDIF hooked up as well for comparison. It has both front and rear USB ports for playing back stuff from a memory stick or hard drive, but this is extremely limited as metadata browsing doesn’t work so I’ve used them once to test and that’s it. Pointless inclusion really.

Boot time is a bit crap, not a huge issue but sadly similar to a blu ray deck. Since I got the unit there has been a grand total of zero firmware updates.

[UPDATE 09/05/2012] Cambridge Audio shipped a significant firmware update on March 7th 2012. You can get it here.

Sound Quality, Formats and Performance

OK, so what about the money? One thing that the NP30 does excel at is playback. Assuming you have your platform hygiene taken care of, it provides exceptional audio performance for something so cheap. It completely blows the likes of Squeezebox and Sonos away. There’s no better streamer in terms of SQ for the price. It’s an “in the pocket” player. Mainly due to the Wolfson WM8728 DAC it’s most at home with lively tunes (e.g. rhythm and blues or jazz). Which is just the ticket. It’s no slouch with classical either, a very well rounded player indeed. I am still surprised by the SQ of this thing. Compared to some “external DACs” you can pay the same money for the NP30 which eats their lunch.

Now of course what you feed it counts. The unit supports most “popular” formats, although no ALAC so if that’s your bag the NP30 is not for you (and shame on you for being a iFreak!). The max it can stream is 96/24. This is somewhat disappointing but again for £400 you can’t really complain, and besides whilst I have a lot of 96/24 I have only 20 odd 192/24 albums so it’s not a huge deal for me. Virtually all my stuff is FLAC with very few bits and bobs as MP3.

I always listen via the RCAs with Analog Direct on the amp. I’ve compared this to the digital out and using the amp’s (very impressive) DAC, and I prefer the warmer sound of the NP30. Interestingly hitting the “portable audio” DSP button on the amp deadens the sound into a horrible muddy mess. The NP30 provides lovely tone for 44.1/16, and really sings when you feed it 96/24.

Now low bit rate MP3. Seriously, if your stuff is all MP3 just get a Squeezebox or an amp with a USB hook-up. Seriously! However the NP30 does do a great job of making low rate MP3 sound half decent via up sampling. It’s nowhere close of course, but it does make a very noticeable difference. In this case, the amp’s DSP is actually better at dealing with crappy VBR or LBR MP3 sources.

Time out for another mini rant… WTF is up with all these bandits selling “external DACs” and “headphone amps” for PCs? Godang! What a lot of old tosh. Hey let’s spend £500 on some silly box and another £200 on some silly pair of fashion headphones. Erm no. Them shitty MP3s you got from iTunes are shit. Crap in, crap out. Get some better source material. Bandits! You can’t tell me Louis Johnson sounds funkier cos u got a silly DAC and silly fashionista cans!

So it sounds nice, what about performance? It’s rock solid. However there is a huge “it depends” here. And what it depends upon is the reliability and setup of your network and UPnP source. The thing can play for days with no stutter, skips or anything like that. But if your WLAN is dodgy, then you will get all of that. Same for the server, if this is underpowered or busy doing something else you will hit problems. Just as the source file format is important so is this stuff. I cannot stress how important it is you get this stuff down. In comparison to Squeezebox, the NP30 is defiantly less forgiving here. But once you get it right it’s rock solid, like a brick house.

Worth noting that you may think it’s all hunky dory, and then later attempt to play FLAC. FLAC will demand much more of the NP30’s NIC than MP3. In other words your setup could be fine for MP3 but when playing FLAC you might experience lags and long pauses. This can be resolved by network configuration, again the NP30 is less forgiving and you may need otherwise undesirable configuration due to whatever the NP30 “standard” is. This is an area that CA should definitely look to improve via a firmware update.

[UPDATE 09/05/2012] The firmware update addresses many common problems with dodgy network devices and configuration.

One huge gap, no pun intended, is that it can’t do gapless playback. This is a serious omission. CA state that they would like to add it but “it’s hard to do”. Pathetic. It’s only hard to do for MP3, and the Squeezebox can do it for less than £150. The only way to listen to say Dark Side Of The Moon properly is to play a single file of the entire album. Extremely poor indeed, there is no valid technical reason why they couldn’t put out a firmware update to allow gapless playback of FLAC.

This is another area where the network setup is critical. For example, let’s say you got Bob Fox over to configure the jumbo frames setting of your server NIC. That could lead to very noticeable and annoying gaps between tracks. If on the other hand you configure the NIC correctly, the gaps are much shorter. Make sure again you check this and also any configuration options here in your UPnP server.

Other Source Material

The NP30 also comes with support for a bunch of Internet streams, these are dependant upon region, but I have Aupeo!, Live365, MP3Tunes and BBC iPlayer. Some of these may of course require a subscription. Note there is no Spotify.

You can also add podcasts and internet radio via a Web based control panel. I must admit I really don’t care too much about this stuff. It’s not exactly a great feature. I used to have the same stuff on my Netgear NP101 and that was 10 years ago. I have some configured like Soma FM for background noise when I want that, but that’s about it. Nothing really to make a big fuss about. Especially seeing as CA haven’t updated the services available since launch.

Usability – there’s an app for that

As I mentioned earlier, the built in display has numerous flaws. For a small library it might be just about OK, but for any reasonable collection it’s extremely limited. There are not enough characters for most album titles to fit without scrolling so you have to wait for it to scroll in many cases. Furthermore, you have quite a few clicks before you can even browse the server. You have to hit down a couple times to select Media, then select the server – only then are you into whatever you have configured the UPnP server to show (more on that in a bit). CA should really add the ability to add a given server as a one click favourite.

The bottom line is that the display isn’t intended to be the primary interface and it seems very much like an afterthought.

[UPDATE 09/05/2012] The March firmware update does improve browsing of UPnP servers, and also introduces “quick scroll” for improved front panel navigation. UPnP browsing is much snappier and responsive. Gaps between tracks are also slightly smaller.

Aight, so 2Tb music dude, how do you browse that?

Browsing a large collection is the still unsolved problem of digital media, regardless of vendor. It’s been a problem since the first players and we are a long way from a solution. With physical media, many thousands of albums is incredibly easy to browse and select. Of course not without it’s own disadvantages, and I am most definitely “all in” when it comes to digital tunes. However, whilst there are numerous approaches to large library navigation none are there yet. Things like media centre UIs etc. But the problem is, for serious listeners the TV isn’t on, and in many cases doesn’t exist in the room anyway. An auxiliary display or tablet is far from optimal either. All of the decent ones are thousands of pounds. This is one area where Sonos excels but again large libraries suffers. The bottom line is that an “on line” library in terms of browse and select comes no where close to a bookshelf.

The single biggest influencing factors of your NP30 usability aside it’s character flaws, is how you configure your UPnP server and how you tag your source material. The more effort you put in here, the better your usability will be. Don’t accept the default library of the UPnP server if you don’t like it! You must put the effort in here. Again, crap in, crap out.

But even with all that hard work done (and maintained), you still need to be able to browse and select. CA’s “answer” to this conundrum is their “free” UuVol application.

Interestingly while CA decided to let you pick any UPnP server, if you don’t like the front panel or remote control options, you are locked in to an iPad/iPhone/iTouch app, UuVol.

UuVol (yup, silly name) doesn’t work on Android, Windows Phone, Windows PC, or Mac. In other words, if you don’t have an iThing, you are screwed. And a first gen iTouch won’t work either. This isn’t good.

Squeezebox on the other hand lock you into their server, but app dev is open and the best ones are all not from Logitech. Linn have open app dev as well and some excellent apps themselves.

What makes this such a killer thou, is that the UuVol app is so painful. Really poor. If it was good it wouldn’t be such an issue. I have an iPad anyway.

There are so many issues with the app. It’s extremely unstable, it will just bail out and quit often while using it. It can’t handle notifications from other apps, when you dismiss a notification, the app has to reconnect to the NP30 and you lose your position in the browse hierarchy, so you have to start all over again. Often times the app will incorrectly render the menu items as it struggles to keep up with the data being returned from the server. You can go into top level items and it’s children will be displayed in different orders at different times. It really struggles with a large library. It cannot display artwork at any level other than album regardless of how the server is configured. Yuk!

[UPDATE 09/05/2012] The March update also brings a new version of the remote control application, which is now named Stream Magic. It’s very similar but much improved. Indeed the complaints above are almost completely resolved. The app is also now available for Android, which I have no device on which to test.

Once you are playing, life is good, but the app is very poor. It is perhaps unsurprising that CA being audio heads are weak software developers. They should either commit seriously to fixing the app, and providing it on alternative platforms (bit silly having to buy a iPad just to control the player) or open it up to the community so we can build a decent one. Compared to the excellent community SqueezePad app, UuVol is an embarrassment. Of course Squeezebox has many more customers than CA.

The thing is it’s almost there, it just needs the same love and care that CA provide to their hardware. Simple things like the lack of track remaining time shows the developers are not serious listeners.

Now you may be thinking, but hang on it’s a UPnP device, so you must be able to use regular UPnP software. You’d be right. Sort Of! Control Point is the API used to build UPnP control apps, and this can be used, but with varying results, and it cannot control all of the NP30 functions. Sadly the superb Linn app, Kinsky will not control the NP30. Everything looks good until you try and start playback at which point nothing happens. The best I’ve found so far is SongBook Lite, which works but of course only for the basic UPnP abilities.

Ugh, sounds like hassle, why not just use an Amp?

Lots of amps have built in DNLA or UPnP clients these days, why not use one of those? Surely that would be neater? Yup well my 5600ES has a client (and a server!) but it’s not very good. Most important to me is sound quality. The Sony doesn't support streams over 48/16! And furthermore it’s only UI is via the TV and it’s not great. The iThing app for that is, wait for it, US only!!!! Of course there are other options, like the excellent top of the line Denon receiver, but I don’t want to be tied into an amp. And I want a standalone streamer. If I had bags o money, I’d buy the Linn Magic DS, but alas.

Platform Hygiene

Once again, to get the most out of the NP30 you must sort out the network configuration and the setup of your UPnP server. I use Asset UPnP, which is excellent and dedicated to tunes. Perfect in combination with the NP30.

Network is critical and the NP30 isn’t forgiving. Aside from the jumbo frames example I gave earlier, I had a strange problem when the NP30 was on the LAN and the iPad was on the WLAN. In this configuration often the iPad couldn’t connect to the NP30 or would frequently disconnect. This turned out to be nothing to do with the NP30 but rather was an issue with the piece of crap Netgear router Virgin calls a “super hub” which was provided when they upped my bandwidth.

It’s these sorts of things that mean you may well need to tinker to get the most out of the NP30 especially if you wish to enjoy FLAC.

Conclusion

The NP30 is a great piece of kit at a very reasonable price. You need to consider what are the most important aspects for you. Sound Quality is excellent, usability is weak. If you have a large library that compounds the usability concerns. Here’s a recap of the pros and cons.

Pros

exceptional sound quality and musical performance
great FLAC handling
96/24 support
great value for money
zero server side lock in

Cons

no gapless FLAC playback
no option to turn off display
poor quality display

~~extremely poor UuVol app~~ - addressed with the new Stream Magic remote app

no open app development

unforgiving, cheapo NIC

If CA were to fix the above (plus track remaining display) it would be a killer device. For a first stab at a network music player they’ve done a great job and at £400 it’s a steal. This top notch player is let down by primarily the UuVol app, which is a terrible “almost, but no cigar”, especially considering you need an iThing on top of the £400.

Interestingly CA has announced a new unit, the £700 Stream Magic, due in April. This seems to be a combination of the NP30 and the recent Dac Magic Plus (it will include digital inputs, filters and USB sound card) in a full width chassis. Also muted is a much better front panel browse experience.

However it also appears as if the display is the same, still no support for higher than 96/24 streamed, and the same crappy UuVol app. I hope these suspicions don’t become reality, but I fear that I will be looking at alternatives once again. CA really do have a great opportunity to own this space, one wonders if they can grab it.

Of course, sadly, I am not the target audience – adding USB input and not increasing streaming support are evidence enough of that – perhaps one day I will get my ultimate streamer. By which time of course, format re-invention will happen all over again.

Bottom line: love the sound, but the usability is ~~very~~ weak.

[UPDATE 09/05/2012] The update and new app improve things significantly on the usability side.

The iPad Invasion: Leveraging SharePoint for Mobile Enterprise Security

Spence — Fri, 10 Feb 2012 11:17:14 GMT

iThings – they are everywhere, you know it and I know it! There’s not been a enterprise SharePoint deployment I’ve been involved with over the last 18 months where the topic hasn’t reared it’s head. Finally someone has a decent toolset that actually considers business requirements rather than just hype.

Check out this upcoming webcast around the area for more details:

The iPad invasion is here, ready or not. Used for an increasingly wide range of business applications, iPads can be found at every level, from executives to assistants, board members to sales teams.
With workplace use skyrocketing, these devices – whether corporate-sanctioned or personally-owned – present security, compliance, and legal challenges that cannot be ignored. Is your organization prepared?
Join Ernst & Young’s mobile data security expert, Matthias Bandemer, as he explores the security challenges presented by mobile devices in the workplace, with a focus on leveraging your existing SharePoint infrastructure to secure corporate data on the iPad.
Joining Matthias is Colligo’s CEO, Barry Jinks, and Director of Product Management, Trevor Dyck, who will provide valuable insight on integrating iPads into your enterprise SharePoint environment.
In this webinar, you’ll learn:

Strategies and techniques for securing enterprise data on mobile devices

Balancing the mobile user experience with IT and security requirements

Replacing consumer-grade file sharing services such as Dropbox with mobile SharePoint access

Increasing security and simplifying administration using tools such as MDMs and Colligo Administrator

Securely accessing and storing SharePoint content on an iPad using Colligo Briefcase

Enterprises that embrace the iPad and other mobile devices report significant productivity gains. This webinar will give you the strategy, tools, and techniques to capitalize on this trend and securely integrate iPads into your SharePoint environment.

Register here: https://www.vconferenceonline.com/event/regeventweb.aspx?id=493&cid=colligoMSFT_STB

You should also check out this great article which gives you a few more important things to consider:

The Dark Side of BYOD: Privacy, Personal Data Loss and Device Seizure
Many employees don’t understand the implications of using their personal devices for work. Many companies don’t understand that they are in fact liable for the consequences. This post covers the things you always wanted to know about BYOD but were to afraid to ask.

Mirroring the Profile and Social databases IS 100% supported

Spence — Wed, 02 Nov 2011 12:29:47 GMT

As a small but significant follow up to my UPA session at the SharePoint Conference in Anaheim last month, is that yesterday we pushed out an update to the Database types and descriptions article on TechNet to finally detail that synchronous mirroring of the Social database IS 100% supported.

As already detailed in this document, the Profile database already supported synchronous mirroring. That leaves the Sync database, which if you were paying attention in the session we really don’t care about in terms of “HA” or “DR”.

Not perfect by a long shot but you can now officially do what many customers have already done successfully in production for very large deployments, and implement a mirroring solution for HA of the UPA. A very small change, but today (well yesterday) is a very good day indeed.

Scripts from my SharePoint Conference Sessions

Spence — Sun, 16 Oct 2011 19:55:10 GMT

As promised during my sessions at the SharePoint Conference in Anaheim last week, here are the Windows PowerShell scripts demonstrated.

Please note that these scripts are direct copies of those on my Virtual Machines. You *will* need to tweak them for use on your environments, and remember they are authored for the purposes of demonstration! If you wish to take pieces of them to use in a real deployment, they will need some work. The scripts are provided as is, without any warranties! You know the score.

SPC407: Enterprise Deployment Considerations for the User Profile Service Application.
These scripts create the UPA avoiding the Default Schema Issue even in UAC environments, and provision the UPS service instance. I will be posting a follow up to detail these in more depth in the next week or so.

UPADemos.zip

SPC370: Multi Tenancy with SharePoint 2010.
These scripts setup a multi-tenant environment from scratch. Before running them, you need a farm created, and the State Service and Usage and Health Data Collection Service Applications provisioned. The seventh part of my Multi Tenancy article series will be published soon.

MTDemos.zip

Simply must have IT Pro Resources for SharePoint Server 2010

Spence — Mon, 03 Oct 2011 23:00:28 GMT

SharePoint Conference 2011 is in full effect here in sunny Anaheim, CA. Following this morning’s keynote it is worth pointing you in the direction of a couple absolute must haves which were released today as part of the overall festivities.

First up is the Scale Test Report for Very Large Scale Document Repositories white paper which describes the design and implementation of a 120 million (count em) item, 30Tb farm – the same farm that was used in the keynote HA demo. The number of times I’ve had to discuss “scalability limits” of SharePoint with customers is frightening, and this is a first class resource. You must check this out. Also props to Paul Andrew for leading up this effort.

Next, and you are going to love this, is the SharePoint Network Topology Diagram Add-In, which is cooler than a cool thing, and will provide you with a fancy Visio Services representation of your SharePoint farm, think Services on Server, but with groovy 3D server icons. You know you want some! Just don’t be labelling anything a “WFE” or I'll be over quick sharp to correct that! :)

Announcing the Microsoft Certified Architect: SharePoint Server 2010

Spence — Mon, 03 Oct 2011 18:37:52 GMT

This morning at the sold out SharePoint Conference 2011 we officially announced the new premier certification for SharePoint practitioners, the Microsoft Certified Architect (MCA) for SharePoint Server 2010.

During his keynote address, Jeff Teper, Corporate Vice President of the SharePoint Product Group discussed the key role the SharePoint eco system has and will continue to play in the run away success of Microsoft’s platform without peers in the marketplace. The MCA program helps the highest-achieving IT architecture professionals distinguish their expertise with Microsoft server technologies, including SharePoint solutions for enterprise customers. MCA will recognise the best of the best in the architecture field and engaging an MCA will help guarantee success with your SharePoint initiatives, on premise, in the cloud or a combination of both.

This new certification is intended to recognize and validate the expertise of the highest-achieving SharePoint architects. The MCA Program administers a unique, rigorous review board and case exam process to help enable the most experienced IT professionals in IT architecture to distinguish their expertise in architecting complex solutions using Microsoft server technologies. Designed specifically for seasoned, practicing SharePoint architects, this new MCA certification validates both the technical and leadership skills of those who deliver SharePoint solutions for enterprise customers.

Dovetailing with today’s announcement, Microsoft have also introduced the revised and restructured review board process, which applies across all of the MCA certifications. The goal of this redesign was to reinforce the distinction between the value delivered by technology-specific architect certifications and technology-agnostic certifications.

It is a great honour to be along with my good friend for many years, Kimmo Forss one of the “inaugural” SharePoint MCAs and we look forward to many more over the coming months.

I’ve already received a bunch of questions on the new certification, and will be posting a summary Q&A after the conference later this week. I will however mention here and now that yes, the Microsoft Certified Master (MCM) is a pre-requisite for MCA. MCM is our top tier *technical* certification for SharePoint. In our view you cannot be a real architect if you don’t have the technical chops. You can find out more details over on the MCA site.

During the conference I will be loitering around the SharePoint Readiness booth in the Microsoft Product Pavilion after my breakout sessions to take any questions you may have on either MCM or MCA.

Have a great conference, and don’t forget Every Vote Counts – Please help decide how to divide our $50,000 donation between NetHope’s member humanitarian organizations by voting using the SharePoint Conference web site.

SharePoint Pod Show: MCM, Top 3 mistakes, and User Profile Sync discussion

Spence — Mon, 29 Aug 2011 23:04:00 GMT

Was chatting to my buddy Rob Foster recently and he was slagging me off for not pointing to the SharePoint Pod Show we recently recorded. So here for you listening pleasure (ahem!) is a discussion about the MCM program, some classic mistakes for SharePoint deployments and even a little bit of cricket!

SharePoint MCM, Top 3 mistakes, and User Profile Sync discussion with Spencer Harbar-Episode 63

SharePoint 2010 Advanced Infrastructure Administrator - 29th August–2nd September, Auckland, NZ

Spence — Thu, 11 Aug 2011 11:13:55 GMT

After Tech Ed New Zealand, I’ll be hanging back in Auckland with my good buddy Steve Smith to deliver the Combined Knowledge SharePoint 2010 Advanced Infrastructure Administrator course.

This is by no means your regular SharePoint admin training. According to the blurb, “This is a once in a lifetime opportunity to learn from two of the most experienced SharePoint experts in the World today and take your SharePoint knowledge to the next level!”

It’s always great fun to work with Steve, and I’m looking forward to delivering this material, which steps away from the usual SharePoint featurisms and delves into the real deal of the surrounding infrastructure you absolutely must have down for a successful SharePoint deployment in the real world.

You can find out more details over here, where you can also register, but hurry places are running out fast! I look forward to seeing you in Auckland!

Cambridge Audio Sonata NP30

Spence — Wed, 20 Jul 2011 01:04:23 GMT

I finally got around to getting myself a new network tune box. Those of you who know me will be aware I am somewhat of a muso and I have a distinctly uncompromising stance when it comes to “better sound”. For a while I was using a Squeezebox Duet, which is OK but leaves a lot to be desired. So the hunt for a proper network tune box commenced about this time last year. I’m not interested in a all in one media player, I want a dedicated device for tunes and that doesn’t need a television to control. Seriously, who listens properly to tunes with the television on? that’s just not right.

My tunes are all in FLAC stored on a Windows Home Server, which is also running the Asset UPnP Server from Illustrate. Asset UPnP is a dedicated music server and beats the usual suspects hands down in every key regard. Unfortunately WHS 2011 still doesn’t support streaming FLAC, but even if it did, I’d probably still use Asset. So I needed a box that could play that stuff, and met my other requirements.

Why not stick with the Squeezebox? Well it’s a nifty little device for sure but it has some key limitations. Unfortunately it only supports up to 48kHz and I am increasingly using higher bitrate source material. The new Touch can do better, but that’s no good - I wasn’t going to wait for them to refresh the Duet. Then there’s the DAC – it’s pretty lame when you hook it up to a system where you can hear the difference. So with the Duet I had the SPDIF hooked up to my amp to use it’s DAC, which is very good indeed, but of course that ties it to the amp. Then there’s the software, it needs it’s own server. It’s kinda OK, but when you have a large library it’s slooooow. Then there’s the controller software for it’s remote and iPad, PC etc. That’s actually kinda neat and one of the better ones, but I don’t want to compromise on sound just for this. So in the bin the Squeezebox goes. I coulda stepped up to the Transporter, but at over £2000 it’s just not worth it.

I lusted over the Linn Akurate and Klimax for a while and briefly considered the Sneaky Music, but the price is hard to justify, and frankly the controller software is very lame. Linn make great gear, but it just wasn’t up to scratch within a reasonable budget and a lot of hassle.

So in the end I plumped for the very affordable and excellently spec’d Cambridge Audio Sonata NP30. Here it is sat comfortably in the rack:

Looks wise it’s kinda nice, and as you’d expect follows the Cambridge Audio design, this one intended to be matched with their Sonata line. I have it hooked up to the amp (a Sony TRVA555ES, a kick ass piece of kit the like of which aren’t made any more) using analog outs – the NP30 doesn’t have “balanced” connectors which I’m not into anyway. I also have the SPDIF hooked up for comparisons when using crappy formats and also for the small number of surround sound recordings I have. It is also hooked up to the LAN and it has wireless as well.

It really doesn’t do much. It just plays tunes. But it plays them very well indeed. It can also stream internet services (radio and such) which I’m not that interested in, but useful for things like SomaFM. Those of course are all in MP3. For the real deal it will work with any UPnP server. It’s plays everything I can throw at it. The DAC is a nice one, the Wolfson WM8728 which can go up to 24-bit/96kHz. It sounds pretty warm, it’s very nice output especially at reasonable levels. Time will tell if it warms up more and beats the amp (unlikely), but there may come a time when the amp is replaced.

Overall sound quality is excellent, very good dynamic range. Sweet and rock solid, it’s what you could call an “in the pocket” player.

It’s basically silent, which is just the ticket. Streaming over the WLAN works great, but I’ll stick with the LAN I think! It has a mode where it will try LAN first then WLAN etc. Load times are extremely quick. There’s no lag waiting for anything thus far with a very large library of tunes! It of course grabs a bunch of data, pull the LAN out and it will continue to play for a few minutes before failing.

The NP30 comes with the standard Sonata remote, which is OK, but you are not really going to be using this to control the device as browsing the collection from the display is as awkward as it was on the very first network music players years ago. The front panel has a jog wheel which is much better. The display can be dimmed as well, but unfortunately it cannot be turned off.

Cambridge Audio ship a thing called uuVol, an iPhone/iPad remote. It’s not fantastic and it’s obviously early doors in terms of it’s development, but it’s perfectly adequate. Now an interesting bugette here is that if the NP30 is on the LAN, uuVol will struggle to connect. This doesn’t happen if both the NP30 and iPad are on the WLAN. Cambridge Audio are aware of the problem and working on a fix.

The only other gripe I have is it can’t do gapless playback. For concerts that is just crap. Cambridge Audio say they are working on it, but it’s “hard to do”. That’s kinda annoying as a £100 Squeezebox can do that no problem. But of course the squeezebox jitters like crazy and has a fetish for rebuffering so it’s not that easy!

So overall I'm very happy with it so far. It is a simple device, but that’s just how real audio gear should be. The three things I want fixed are the remote app LAN issue, gapless playback and the ability to turn off the display. But it’s a very nice tune box even with those issues, and so if you are into these sorts of things, I’d encourage you to take a listen to one.

Summer and Autumn Speaking Engagements

Spence — Tue, 19 Jul 2011 23:58:32 GMT

It’s that time again folks, Conference craziness season is back with a vengeance after the summer. When is it *not* conference season I hear you chuckle! Anyways, I have the privilege of speaking at a number of events between now and the end of the year. It’s always a great deal of fun to meet folks at conferences and hear about their SharePoint experiences. I look forward to seeing you one of the following events.

TechReady 13
25-29 July - Seattle, WA
http://www.mytechready.com/

This event is for Microsoft employees only. I’ll be in Redmond for some other work and will be presenting a developer focused session.

SharePoint 2010 Site Provisioning Smack Down: Site Definitions vs. Web Templates, the What, When, How and Why.
Debate still rages around the “right way” to approach provisioning of SharePoint sites especially in relation to large scale deployments. This session will cover the various approaches to site provisioning available, looking at their pros and cons and associated considerations. Guidance around what approach to use when, and why will also be provided.

SharePoint User Group UK (SUGUK)
4th Annual Golf Day
11th August - Ullesthorpe, Leicestershire, UK
http://suguk.org/forums/thread/26940.aspx

The golf day is great fun, a round of golf and some user group sessions. My partner in crime Steve Smith will also be presenting.

The rational guide to Kerberos with SharePoint 2010
In this session Spence will drill into the cloudy often ignored world that is Kerberos and will show that Kerberos is not something to be scared off, but something to embrace providing you approach it right. Full scenario walkthroughs of Farm traffic, End User sign in and Service Application delegation to external services will be demonstrated live!

Tech Ed New Zealand
24-26 August - Auckland, New Zealand
http://newzealand.msteched.com/

I’ve always wanted to visit New Zealand but it’s been about four years before I’ve been able to make it happen. I’ll also be staying on for a week after the event to deliver Combined Knowledge’s Advanced Admin Boot Camp.

Real World Service Application federation with SharePoint 2010
SharePoint 2010 provides architects with a compelling new model for service publishing and federation, opening up exciting new approaches to farm design. This session will cover how Service Application Federation plays out in the real world, based upon early enterprise adopters. Learn how to approach the design of a enterprise services farms, provide true scalability and discover the constraints for each service application which can be published, including global deployment considerations. Related aspects such as Security, High Availability and performance will also be covered. This session will be split 70/30 between lecture and demonstrations.

Rational Guide to SharePoint 2010 User Profile Synchronization
The incredibly popular session with new content updated for SP1 and the latest CUs. Get the real deal on configuring User Profile Synchronization in SharePoint 2010 in this demo and best practices heavy session. This session will cover the architecture of the new User Profile Synchronization capability in SharePoint Server 2010 and provide a walkthrough of the configuration requirements and setup eccentricities. This session will be split 70/30 between demonstrations and lecture.

SharePoint Conference
3-6 October - Anaheim, CA
http://www.mssharepointconference.com/

The big daddy. It’s gonna be an awesome show. Be there!

Enterprise Deployment Considerations for the User Profile Service Application
Deploying the User Profile Service application presents unique design considerations for architects. Learn best practices from real enterprise deployments and understand the key architectural considerations in terms of high availability, scalability and geographic deployments. Also covered will be general UPA related best practices in terms of synchronization, policy and privacy and leveraging social features inside the enterprise.

Best Practices for Multi Tenancy
SharePoint 2010 delivers compelling new infrastructure features for those wishing to host multiple customers on a shared platform whilst retaining confidentiality, integrity and availability. This session will cover how multi-tenancy can benefit all sizes of deployment from a basic farm to the largest such as SharePoint Online. Learn how to approach the design of a multi-tenant deployment and to configure and operate multi-tenant infrastructure, create Member Sites, Subscriptions, Feature Packs, and Service Application Partitions. Understand the key design choices and development required. This session will be split 50/50 between lecture and demonstrations.

Capacity Planning your SharePoint 2010 deployment
One of the biggest challenges for architects is how to approach capacity planning and management for a SharePoint 2010 deployment. In this session we will cover approaches to the problem space and devise the appropriate capacity management strategy for SharePoint 2010 implementations. Learn how to manage capacity throughout the deployment lifecycle and adopt best practices from field experiences.

European SharePoint Conference
17-20 October - Berlin, Germany
http://sharepointeurope.com/

I’ll be co presenting one of the keynotes with Mirjam van Olst, and generally loitering around the rest of the conference.

Keynote 3: Successful Deployment: Lessons Learned From the Field
with Mirjam van Olst
Take a whirlwind tour of lessons from the field since the release of SharePoint Server 2010 to understand the key factors of a successful roll out in the enterprise across planning, architecture, implementation, deployment and operations. Based upon some of the most common pitfalls and worst practices of early adopters and the key challenges they have faced, the keynote will detail the lessons learnt alongside best practices to help ensure a successful deployment. Ideal for all disciplines, including Information Workers, Business Decision Makers, Developers and IT Professionals.

SharePoint & Exchange Forum 2011
14-15 November 2011 - Stockholm, Sweden
http://www.seforum.se/

My first visit to Sweden which I am very much looking forward to.
Sessions TBD but likely to include Kerberos, Sandbox for O365, UPA, Multi Tenancy. I may also co present with my buddy Steve Smith once again.

That’s my lot for the rest of the year! I look forward to seeing you at one of the above events.

Managing Sync Connections with *-SPProfileSyncConnection cmdlets in Service Pack 1

Spence — Tue, 12 Jul 2011 20:20:09 GMT

One of the most common conversations I have with customers, partners and random SharePoint consultants is around the creation of SharePoint Server 2010 User Profile Synchronization Connections. These guys are the key link, or connection string if you will between the User Profile Service Application (UPA) and the connected directory services. A very common complaint is the inability to automate their creation using Windows PowerShell. The good news is that Service Pack 1 (SP1) introduces a couple of new cmdlets which help in this regard. This post looks at these cmdlets and also details why they might not be all you had hoped for…

[UPDATE 25/08/2011]

Please note that these cmdlets are only intended for use within SharePoint Online environments by SharePoint Online engineers. Their use in on premises deployments is NOT supported. You have been warned!

What is a Synchronization Connection?

A Sync Connection is the link between the User Profile Synchronization service instance (UPS) and the connected directory services. When they are created a Forefront Identity Manager (FIM) Management Agent is created behind the scenes and it’s these bad boys which do the work of getting data to and from the connected sources to SharePoint. Sync Connections can be created easily using the UPA’s Configure Synchronization Connections page. However this page suffers from numerous flaws, especially when working with enterprise directory services implementations.

Why do people want to automate them?

There are a number of reasons, but there are usually one of two key drivers. Firstly a lot of people promise customers a 100% automated SharePoint deployment. This of course is a nirvana that cannot be achieved with SharePoint 2010. Of course automation is a good thing, but it’s just a silly promise that cannot be met. It’s a bad driver on it’s own. Any SharePoint practitioner with any credibility would never make such a promise.

Secondly, and more importantly one of the key limitations of the Configure Synchronization Connections page is that it can’t really handle the directory services design of many large enterprise AD implementations. There are some timeouts that can be configured, but often these will not suffice and it becomes impossible using this page to create the connections in the manner desired. The page doesn’t scale basically. This leaves us with but one other approach, to use the Synchronization Services Manager (miisclient.exe) after creating the connection in UPA management to change the selected containers. Unfortunately such an approach is NOT supported.

Thus being able to create the connections using Windows PowerShell would avoid this problem.

The new Windows PowerShell cmdlets.

Service Pack 1 therefore introduces two new cmdlets for working with Sync Connections, Add-SPProfileSyncConnection and Remove-SPProfileSyncConnection. Luckily for us they decided not to spell out Synchronization in full :). These cmdlets do make it easier to manage Sync Connections, however there are some considerable limitations. Furthermore note that there is no Get-SPProfileSyncConnection or Update-SPProfileSyncConnection. Also rather annoyingly, like all of the new cmdlets in SP1 whilst of course get-help is implemented there are no examples.

Without further ado here is how to use Add-SPProfileSyncConnection:

$upa = Get-SPServiceApplication 972fe314-7eb9-47b7-a265-20ffbc94680b
$syncAccountPassword = convertto-securestring "Password1" -asplaintext -force

Add-SPProfileSyncConnection -ProfileServiceApplication $upa `
			-ConnectionForestName "contoso.com" `
			-ConnectionDomain "Contoso" `
			-ConnectionUserName "spups" `
			-ConnectionPassword $syncAccountPassword `
			-ConnectionSynchronizationOU "OU=SharePoint Users,DC=contoso,DC=com"

Looks pretty straightforward right? Almost! But not quite!

There are some additional optional parameters. For reference the full params are:

Parameter name	Required	Description
ProfileServiceApplication	True	Service Application pipebind to the User Profile Service Application
ConnectionForestName	True	The FQDN of the forest you are connecting to
ConnectionDomain	True	The NETBIOS name of the domain you are connecting to
ConnectionUserName	True	Username used for the synchronization connection
ConnectionPassword	True	Secure string format of the password of the account used for directory connection
ConnectionSynchronizationOU	True	The top level OU that you would like to synchronize, this must be a DN and you can only include one container per command
ConnectionPort	False	The port used to connect to the directory service. Default port is 389.
ConnectionUseSSL	False	Boolean value if the connection to the directory service must be over SSL
ConnectionNamingContext	False	Naming Context of the Directory Information Tree to connect to
ConnectionServerName	False	Name of the Domain Controller to connect to
ConnectionClaimProviderTypeValue	False
ConnectionClaimProviderIdValue	False
ConnectionClaimIDMapAttribute	False

Now that’s all very nice. However there are some key limitations with the cmdlet which will impact how much you can use it in a real deployment.

The account running the PowerShell host must be added as an administrator for the UPA
This isn’t really a limitation but it upsets purists. Instead of using the Proxy, we need the UPA itself, and this means we must have at least the Manage User Profiles administration rights on the UPA. If you don’t have this and attempt to run the cmdlet, you will receive the generic error from FIM, “MOSS MA Not Found”.
There is no DisplayName parameter
The name of the connection will be the NETBIOS name of the domain, i.e. the ConnectionDomain parameter. This will also be used for the Description. This also means that you can add only one connection per domain. Now this is strong recommended practice, but it prevents some scenarios from being possible with this cmdlet and is a major oversight.
There's no option to create more than one connection per forest
Since you have to specify the ConnectionDomain parameter. Again more than one connection per forest is strongly discouraged but there are numerous scenarios where this is needed. Again this cmdlet is no use to you if you are in that boat.
If you specify the same ConnectionDomain parameter, the system will overwrite the ConnectionSynchronizationOU, ConnectionUserName and ConnectionPassword parameters.
If the connection cannot be created due to a FIM error, the command completes
No errors are reported at all! We still need to use miisclient.exe to verify things have worked!
Remove-SPProfileSyncConnection does not delete sync connections!
The Remove-SPProfileSyncConnection cmdlet only removes the ConnectionSynchronizationOU specified, will not delete the connection itself. There is no way to use these cmdlets to delete sync connections.
These cmdlets only work for Active Directory Sync Connections

A couple of other things to understand about the cmdlets:

When creating the connection you may receive permission related errors, if so you need to use user@domain as the format for the ConnectionUserName parameter.

If you have an existing Sync Connection for the domain and omit the ConnectionSynchronizationOU parameter, it will update the credentials for the connection.

Conclusion

We have a couple of new cmdlets which do help the automation of sync connections. However they have significant limitations which restrict their value, and they could have been so much better. Ensure you are familiar with the limitations before diving in and attempting scripted UPA nirvana! :) We still have no cmdlets for working with connection filters.

[UPDATE 25/08/2011]

User Profile Synchronization Service changes in the June 2011 Cumulative Updates

Spence — Fri, 08 Jul 2011 10:51:30 GMT

One of the most common complaints about the User Profile Synchronization service in SharePoint Server 2010 is the time it takes to perform synchronization runs or “sync” for short. This is due to a number of factors not least of which is that by leveraging Forefront Identity Manager (FIM) SharePoint now effectively includes a metadirectory. This is a good thing. However if you are just doing import then there is a huge increase in the time it takes over previous versions which were simply performing an ADSI query and inserting the results into a database.

It’s very important to note that there are many other factors which influence the time it takes to perform a sync, many of which are under your control as the farm administrator. I may do another post about these in the future.

Microsoft have heard this common complaint loud and clear and have been working hard to reduce the time taken to sync since RTM.

The December 2010 Cumulative Updates (CU) first introduced a significantly reduced sync time, due to the re-implementation of the SharePoint Management Agent that is created when you provision the UPS service instance. Depending upon environmental factors the December 2010 CU would decrease sync time by around 30-38%.

The really good news is that the June 2011 CU (*not* Service Pack 1) introduces some more changes that also help significantly reduce the sync time. This post takes a quick look at these.

A new build of Forefront Identity Manager (FIM)

The release of SharePoint Server 2010 includes a bundled version of FIM. However it wasn’t the RTM of FIM, but rather a stable build chosen to meet the release schedule of SharePoint. This by no means is the reason for all of the problems with UPS, but it is a factor.

The August 2010 CU included a minor build revision of the FIM bits, but since then the version has remained the same.

With the June 2011 CU, another build revision of the FIM bits has been included. This is one of the reasons why the UPS service instance must be re-provisioned after the installation of the June 2011 CU. This new build improves numerous aspects of the capability, including the sync time.

It’s important to note however that the bundled FIM is still not FIM RTM. Don’t get bogged down by this thou. Remember that UPS in SharePoint 2010 is not supposed to be full FIM, it’s FIM “Light”. The new build of FIM in the June 2011 CU is 4.0.2450.34. You can also see that the ‘Release Candidate 1’ text box on the about screen has been removed!

Here for your reference are the various build numbers:

Product	Version	FIM Build
FIM 2010	RC1	4.0.2560.0
FIM 2010	RC1 Update 1	4.0.2570.0
FIM 2010	RC1 Update 2	4.0.2574.0
FIM 2010	RTM	4.0.2592.0
SharePoint Server	RTM	4.0.2450.5
SharePoint Server	August 2010 CU +	4.0.2450.11
SharePoint Server	Service Pack 1	4.0.2450.11
SharePoint Server	June 2011 CU	4.0.2450.34

Changes to Synchronization Runs

Because FIM is a metadirectory, it works like one. :) One of the fundamental characteristics of a metadirectory is the requirement to perform delivery receipt and confirmation. This ensures the metadirectory is up to date and it also allows one to support a myriad of directory services, including those that may have intermittent network connectivity issues. All of this has been true since the very first true enterprise metadirectory (Zoomit Via in 1997).

This is the main driving force behind how directory synchronization works in SharePoint Server 2010. Even though the product can only do import or export it uses the synchronization engine provided by the metadirectory (FIM).

But if you are just doing an import from say Active Directory to SharePoint, that’s overkill. Take a look at the following screenshot of Synchronization Service Manager (miisclient.exe) which shows the sync runs for an incremental sync performed using SharePoint Server 2010 Service Pack 1, which is doing import only using the default property mappings:

Note that there are eight runs, and that the time taken is roughly six minutes. We of course here are only importing a couple of users, but it would still take six minutes if there were 50 adds. The number of users does influence sync time, but it is not a linear user/time relationship.

Now, take a look at the same thing this time with the June 2011 CU:

This time there are only five runs and the time is roughly 1.7 minutes. Nice! That’s another 33% time improvement (roughly) and you will experience the same improvements with more realistic numbers of users.

This improvement is due to the new version of FIM, and new versions of the AD, SharePoint and Metaverse management agents included in the June 2011 CU. I could bore you with the technical minutiae, but it’s not relevant. The thing you need to know is that sync is a lot quicker with the June 2011 CU!

Other Changes

With the June 2011 CU Profile synchronization now supports domain migration.

Synchronization Connections for SunOne (or later Oracle versions) LDAP are now possible regardless of the state of the nsslapd-return-exact-case base attribute. In previous builds creating the sync connection would fail.

The Profile Synchronization Status view now includes all stages and a better view of progress. (but miisclient.exe is still the way to go if you know what you are doing).

ULS reporting is vastly improved. Instead of just reporting a stage was started, we get the following detail:

This might seem pointless on face value, but it means that if there are errors during a run they are now bubbled up back to SharePoint, and can be recorded etc via ULS. It also avoids the need to use Synchronization Service Manager (miisclient.exe) to know there were problems. In the past even with errors, there would be nothing in the ULS.

Take this example:

The highlighted row is a problem with the export to AD. Of course to see the root cause of the problem we still need to dive into miisclient.exe. In this case, it’s the old chestnut – lack of permissions on the attribute in AD we are trying to write:

But the point is, in the past SharePoint would report success even if there were failures. Now it will report failures and that makes it much easier to manage the operational service of the farm with standard SharePoint tooling.

Synchronization Connections now run in parallel

If you have multiple Synchronization Connections their associated runs will now execute in parallel. Before the June 2011 CU, each run would run serially, thus increasing the overall time for sync to complete. Now, this is NOT a reason to have multiple connections. That remains as bad an idea as it always was, but there are some cases where it is the only way to achieve the end results desired. You should always try and avoid multiple connections, especially more than one for the same AD forest. However if you are using more than one, the sync will now be significantly quicker.

Check out the following, two Synchronization Connections:

And here are the sync runs, note that they run in parallel:

The IsSynchronizationRunning property

There is also now a property on the UPA (service application) that allows us to check if a profile sync is running before doing other operations such as adjusting timeouts or creating connections etc:

$upa = Get-SPServiceApplication 972fe314-7eb9-47b7-a265-20ffbc94680b
$upa.IsSynchronizationRunning 
True

This is really important when developing custom code or Windows PowerShell automation solutions for UPA.