10 Things you can do to make SharePoint Secure

1 - Run the Microsoft Security Assessment Tool & Best Practice Security Analyzer Tool from Microsoft

Too often, we assume we “know” everything already and skip some very basic changes that can help immensely. Check out these two security tools to get you started:

Microsoft Security Assessment Tool

The Microsoft Security Assessment Tool (MSAT) is a risk-assessment application designed to provide information and recommendations about best practices for security within an information technology (IT) infrastructure.

http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=12273

Best Practice Security Analyzer Tool from Microsoft

The Microsoft Baseline Security Analyzer provides a streamlined method to identify missing security updates and common security misconfigurations.

http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=7558

2 - Only enable the required Windows Services where you need them

The fewer Windows Services there are to attack or use to attack your server there are, the better. Disable those that are not required to run your server, remembering that different SharePoint servers may have different needs. Identify those you do not need and stopped them from being used for a security attack.

3 - Only enable the required SharePoint Services where you want them to run

Like the previous mention about Windows Services, the same applies to SharePoint Services. If you do not need to use one of them, then stop it to not only reduce the surface for attacks but also improving SharePoint’s performance.

4 - Create multiple Service Accounts, that do not have Domain or Server Administration Permission

Both SharePoint and Windows Services use accounts to do what they need to do. Some services require more access than others to do what they need. For example, a search account needs at least Read on everything in your SharePoint to successfully crawl. However, it isn’t ideal to grant this kind of power to one specific account. Like this service, along with others like it, create multiple service accounts and grant them just the rights needed to do what they need to do. This way, if one of them is compromised, it is not your entire SharePoint farm at risk. And while we’re on the matter, make sure passwords are not the same for all of them and complex enough not to be guessed.

5 - Use DNS URLs, not Server name for access

Make sure there is no reference to your servers in the url people will use to access SharePoint. Make use of Alternate Access Mapping and ensure everyone and everything is always using DNS names. Giving away the name of your server allows them to better target their attacks.

6 - Only use known ports for access, such as 80 or 443, then control access via Firewalls

Though you may think configuring SharePoint on ports different than the common HTTP and HTTPS defaults will help you, you’re better off letting the firewall do the job.

7 - Do not disable the Windows Server Firewall

Just because it makes it easier does not mean it is “better”. Windows Server Firewall is that built-in software in Windows to protect the server from within; it is an added level of security and works exactly as it’s intended to.  The Windows Firewall allows you to set different rules depending on the network profile currently active. Since this is a SharePoint Server and not a laptop, you will always be running on that one, making its configuration relatively easy. You should only allow connections required for SharePoint to work and connect to things like AD and Office Web Apps.

8 - Utilize the “ViewFormPagesLockdown” feature

Let’s look at not turning on this feature first, open your web search engine and look for “View All Site Content”. If your SharePoint sites are made available anonymously, you’re opening up the door for attacks. Bare in mind that it’s a lot easier to attack things we know exist, not locking down your SharePoint admin pages like View All Site Content for anonymous users allows them to know what exists. The ViewFormPagesLockdown feature, active with Publishing Sites by default allows you to do just that, lockdown the view form pages.

9 - Protect external entry points via firewall rules

Because of how vast SharePoint is, it’s important to protect it from any possible and unwanted external connections. Only open the ports necessary for your visitors or SharePoint services if connected with the cloud in a hybrid scenario.

10 - Allow Permissions only at the levels where needed, Farm, Service, Web, Site Collection, Site and Content.

SharePoint is secure by default; it’s what we do to it that turns it unsecure in most situations. There are different Permission Levels and you can create your own as well, these define what kind of access exists. Then, you grant groups these Permission Levels on SharePoint objects that can use them by breaking their permissions inheritance and set their own. In SharePoint, you don’t see what you don’t have access to, but on the flip side you can use Search to see everything you have access to quite easily. It’s important to understand how this works and plan accordingly. 

SharePoint 2010 database migration to SharePoint 2013

There’s been a lot of discussion about how to prepare and plan for a migration, what it involves, what are the best practices. In this article, let’s get our hands dirty a little bit. Recently I had to do another complete upgrade to SharePoint 2013, and I took the opportunity to capture a few notes and screenshots.

So. Your SharePoint 2013 farm is installed and ready. Today is the day: You migrate your content. What do you do?

Prepare your upgrade to SharePoint 2013

There are excellent TechNet articles about the SharePoint migration process. Very much recommended reading, not to say mandatory:

Reference: Overview of the upgrade process to SharePoint 2013

Reference: Upgrade and migrate to SharePoint 2013 (Resource Center)

Survey your existing farm

To be fair, you should have done this a while back. For the sake of having a complete picture, I’ll just go over the major points you should look at when you take stock of what content needs to be part of the journey.

Farm Solutions

Before the actual migration, you will want to have clear idea of all farm solutions installed on your SharePoint 2010 servers.  Do you have a plan for every custom or 3^rdparty package? Do they exist in 2013 versions or do they work as is? Any missing feature will be reported as such during the upgrade, and can potentially cause issues.

Don’t forget to check Sandbox solutions, if you have them on your farm.

For each of those added solutions, you will want an inventory of which site collection and web site uses what. This can potentially be time consuming to compile but might save you headaches later.

Web Apps

By now you should know which web applications will be migrated. Take particular note of their authentication methods:

Any web app still in Classic mode will need to be upgraded to Claims on SharePoint 2013

Alternatively, you can change it while it is still running on your 2010 farm, if you feel safe doing so. We will come back to that later.

Copy your content database from 2010 to 2013

Here you have two main options: Pause your 2010 farm to take a cold copy of the content databases, or perform a live copy. Since we want to test with minimal downtime, we take the second choice with the help of SQL Server’s Copy-only backup feature:

That will allow you to take a live backup of your DB without interfering with your normal backup schedule, which would do pesky things like clearing your change logs and compromising your disaster recovery plans.

After that you simply restore that backup to your SharePoint 2013 SQL Server, optionally under a new name. No sweat.

Create a target web application

When migrating a SharePoint 2010 content database to upgrade to SharePoint 2013, you need to hook it to an existing web application, obviously. However, most of the time your DB to migrate will include a root site (situated at the path “/” on that web application).

If you have several site collections at the same path, or in fact any web site in your web application with identical paths, conflicts will arise and some of your sites will be inaccessible. But you want to keep the same paths as before, otherwise any paths specified in your content (Links lists, for example) will be broken.

You also want to create your new web application with the same authentication mode as in 2010. If you didn’t upgrade from Claims to Classic in SharePoint 2010, you now need PowerShell to create a Classic mode web application in SharePoint 2013, as they are considered obsolete.

Reference: Migrate from classic-mode to claims-based authentication in SharePoint 2013

So then, the trick is to make a brand new web application, and just remove its content database (all this through Central Administration). It can live without any DB for now.

Test and Upgrade your migrated database

Let’s recap:

• You have attached your SharePoint 2010 content database in your SharePoint 2013’s SQL server
• You have a new web application with no associated content database

You can now test and upgrade (as required) your migrated database. To do so, again we look to PowerShell. The following command will inspect your database and produce a detailed report of upgrade issues found:

Reference: Test-SPContentDatabase PowerShell cmdlet

This is the point where you want to install all third party and in-house customizations. Then re-test your database. Repeat until there are no errors reported, or at least none that you will not be able to live with.

Mount your new database

Next, you can upgrade your database. You can run the upgrade by itself, or as you attach it to your web app. The latter is the preferred process.

But you can’t just add a SP2010 content database to SP2013 through the UI. You will need your tech guy’s favorite swiss-army tool: PowerShell. The command to use is Mount-SPContentDatabase.

Reference: Mount-SPContentDatabase PowerShell cmdlet

Browse your upgraded sites

We’re almost done!

You should now be able to browse your new, migrated site. At the beginning it will still present the SharePoint 2010 look and feel, with a small difference:

You will see this nice colored banner at the top. The first link will take you to the first step of the site collection upgrade process (TechNet).

Index your new content

All right! Your content is all migrated and upgraded, and ready to use! Let’s throw the search crawler at it now

Not bad, one hour for about 24,000 documents, many of them PDFs. And no errors! I can now take advantage of the much improved SharePoint 2013 Search Center on all my content.

All in all, this upgrade to SharePoint 2013 migration went pretty well. There are some third party web parts that I will discuss with the farm’s admin, and a complete Site Template solution which I don’t think will be functional in 2013, given the huge changes in the UI. But even that site’s content is fully browsable and usable as it is now, so likely it will remain in 2010 mode

Publishing Save/Close not working

Error

An unexpected error has occurred.

Troubleshoot issues with Microsoft SharePoint Foundation.

Correlation ID: e3c9c2a2-87b4-40d2-b283-a9ad0eb50541

Date and Time: 10/22/2014 8:44:07 PM

Go back to site

Solution Steps:

$web = get-spweb "http://servername/sites/sitename"

$correctId = $web.Lists["Pages"].ID

$web.AllProperties["__PagesListId"] = $correctId.ToString()

$web.Update()

$web.AllProperties["__PublishingFeatureActivated"] = "True"

$web.Update()

SharePoint 2010 Error – You must specify a value for this required field

One issue that come up when using custom master pages is this error when editing a Team site page and then trying to save the it.

All that causes this is simply a Place holder missing from the Main area of your master page. Even if you’ve moved it to a asp:Panel and declared it as false at the bottom of your master page you’ll still get the error. All is needed is to move content place holder <asp:ContentPlaceHolder id=“PlaceHolderPageTitleInTitleArea”runat=”server”></asp:ContentPlaceHolder> within the s4-bodyContainer div , within the s4-ca div seems to work best. Save the master page and that’s that no more irritating message.

You’ll notice this adds the page title to your master page you will either need to style it, place it in the area you want to display this or hide it if you don’t want to display it

SharePoint User Profile Service Migration from SharePoint 2010 to SharePoint 2013

SharePoint User Profile Service Migration SP 2010 - SP 2013

Identify User Profile Service Databases -

• User Profile Service Application_ProfileDB_ID
• User Profile Service Application_SocialDB_ID
• User Profile Service Application_SyncDB_ID

Note : Managed Metadata Service must be migrated before mingrating user profile service

• Taking Back Ups of the Identified Databases 
• Log in to you SQL Management Studio and take backups of the above mentioned Databases (good practice is to make them read only before taking backlups -> right click->properties->option->set read only)

• Right click on the DB and select Back up - add the path you want the back ups to be stored 

                                                                             01

02

• Exporting the Encryption Key
• In the Server where User profile Service is currently running opem CMD and go to "%Program Files%\Microsoft Office Servers\14.0\Synchronization Service\Bin\"
• Enter “miiskmu.exe"
• Select export key and click next
• Enter your farm admin account details and domain and next.
• Set the path where the key should be exported
• Click Export

• Restoring Databases in the new SQL server

• Copy the backups to the new SQL server ( Its good to have in the same machine while restoring)
• Open SQL management studio in the new SQL server
• Check Device, Select the Paths of the Databases and click OK

                                                                                                       03

• Creating User Profile Service and Mounting The Databases
• Before Creating the Service Application, User Profile Service in stance should be started
• Central Administration -> Manage Services on server -> Start User Profile Service

   

•     Create new Application Pool for user profile service 

                         New-SPServiceApplicationPool -Name  UserProfileServiceAppPool 

           - Account Domain\Username

             $applicationPool = Get-SPServiceApplicationPool 

           -Identity 'UserProfileServiceAppPool'
                                                                         

•    Create User Profile Service, using the above application pool and the migrated Databases

                      $UserProfServ = New-SPProfileServiceApplication 

          -Name "User Profile Service Application" 

            -ApplicationPool $applicationPool 

            -ProfileDBName "Profile DB Name" 

            -SocialDBName "Social DB Name" -ProfileSyncDBName "Sync DB Name"

• Import Encryption Key
• Save the Exported encryption key in the following location in the application server "c:\\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\"
• Open CMD and go to "%Program Files%\Microsoft Office Servers\15.0\Synchronization Service\Bin\"
• Run the following command

• miiskmu.exe /i c:\\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\keyname {0E19E162-827E-4077-82D4-E6ABD531636E}

                          Note : GUID is always the same 

Adding Delimiter between Reapting Table Fields (aka Double Eval)

I have been working on a problem where Im attempting to capture a merged field from a Repeating Table (infopath form) and add a delimiter between each entry.  This is a Webform.

The purpose of adding the delimiter is so that later on from sharepoint I can export to Excel for reporting purposes.

Anyway the function I know Im supposed to use is the Eval function (actually it is supposed to be a double Eval function). 

The structure looks like this

eval(eval(group5, 'concat(../../my:MainTable/my:group5/my:Unit, ";")'), "..")

This actually does work, but the problem its not cycling through the data, its just taking the first field and each time you add a new row it just adds the first entry again.

for example

If the first field is dog

the second field is cat

and the third field is bird

it comes out dog;dog;dog;

It basically ignores the second and thrid entry as if its ignoring the double eval.

Can anyone see what Im doing wrong with this double eval?

Help URL Video: https://www.youtube.com/watch?v=ij2KqMH8FCU 

Common Error: The site is not valid. The 'Pages' document library is missing.

The site is not valid. The 'Pages' document library is missing.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: Microsoft.SharePoint.Publishing.InvalidPublishingWebException: The site is not valid. The 'Pages' document library is missing.

The interesting piece here is that the Pages library indeed existed but could not be found.
Background Information
To understand this we need to look into how the Publishing feature find the Pages library in a Publishing site. As the Pages library does not need to have the name "Pages" - e.g. in German version it has the name "Seiten" SharePoint does not search for the Pages library by name.
Instead the Publishing feature stores the unique ID of the Pages library in the __PagesListId property which resides in the property bag of the publishing site.
The above listed error will occur if the value stored in the __PagesListId does not match the ID of the actual Pages library.
What can cause this problem?
Honestly: I don't know. I have not managed to forcefully cause such an inconsistency - if one of you has repro steps, please post a comment here!
How to fix the problem?
To fix the issue it is required to update the value of the __PagesListId property value to match the ID of the Pages library.
This can be done (e.g.) through the following Powershell script:

$web = get-spweb http://site-collection/path-to-affected-site $correctId = $web.Lists["Pages"].ID $web.AllProperties["__PagesListId"] = $correctId.ToString() $web.Update()