Tips and tricks to uninstall and upgrade NextLabs’ Entitlement Manager for SharePoint

After we deployed the NextLabs SharePoint components Policy Controller and Enforcer, we have seen many issues listed in previous blog that are impacting to normal SharePoint usage. We will have to uninstall the software and wait for the new patch to fix those issues. During the uninstallation process, we identified many issues that will prevent the software to uninstall cleanly and it might cause potential issues after uninstallation and risk for future new version installation. In this blog, we will list the tips and tricks to uninstall and upgrade NextLabs’ Entitlement Manager for SharePoint. Since the only NextLabs component that will impact SharePoint functions is Enforcer, in the blog, I’ll focus on the Enforcer uninstall and upgrade.

Here is the procedure to uninstall Enforcer provided by NextLabs. I added #3 to have clean uninstall and will add more tips and tricks later.

1. Remove SharePoint Enforcer components on each WFE, one at a time - you should use the installer account that has full access to ALL site collections and all web.config need to be editable.

• Run cmd as admin
• Navigate to original installer on local drive
• Run the .msi like SharePointEnforcer-2010-64-6.0.1.0-102.msi and select remove
• IISReset is required after uninstallation

2.  Remove SharePoint Enforcer event receivers on ALL site collections - only one WFE

• Run event receiver uninstall tool ce_spadmin.exe
• Copy the executable to any folder and run it from console as “ce_spadmin.exe -o  spe –clearspeevents” to remove from farm
• You could run against webapp as "ce_spadmin.exe –o spe –clearspeevents –url url-of-site-collection"
• Verify removal using logs generated

 3. Remove NextLabs two features on each web - only run on one WFS to remove two web features using the ce_spadmin.exe utility tool

• CE_SPAdmin.exe -o spe -deactivatefeature -web "SharePoint - Harry"  -featureid "36a298d8-413b-4dee-83cd-6082924e3df8"
• CE_SPAdmin.exe -o spe -deactivatefeature -web "SharePoint - Harry"  -featureid "1AE19FFB-20F1-43b8-B935-D669F72EC147"

 The -web is to execute across webapp and it's the webapp name you could get through IIS admin. The two features are features listed below.

• Web hidden feature “NextLabs Security Enforcer Feature Event” w/ ID 1AE19FFB-20F1-43b8-B935-D669F72EC147
• Web hidden feature “NextLabs SharePoint Enforcer” w/ ID 36a298d8-413b-4dee-83cd-6082924e3df8

 4. Clean up timer job cache to remove reference to Enforcer dlls

• Clean up cache
• Restart timer job

Here is the procedure to verify whether you have a clean uninstall.

1. Verify four features removed on the farm as in the screen shots

• Farm feature “Nextlabs Diagnostics Manager” w/ ID DAF3439C-65AA-443b-8973-B87B003C0254
• Farm feature “SharePoint Security Trimming” 2/ ID 11AC4ED6-4863-449b-88D8-4F9BDC3912D4
• Web hidden feature “NextLabs Security Enforcer Feature Event” w/ ID 1AE19FFB-20F1-43b8-B935-D669F72EC147
• Web hidden feature “NextLabs SharePoint Enforcer” w/ ID 36a298d8-413b-4dee-83cd-6082924e3df8

2. Verify assembly seven dlls removed on the each WFE

3. Verify NextLabs registry entries removed on WFE server "Software\NextLabs\Compliant Enterprise\Sharepoint Enforcer". Please note the Enforcer entry should be removed if you only uninstall Enforcer. The policy control entry will still be three until it has been uninstalled.

4. Verify enforcer one safe control and another httpProtocol modules entries removed on each webapp web.config

<SafeControlAssembly="Nextlabs.SPSecurityTrimming,Version=3.0.0.0,Culture=neutral, PublicKeyToken=7030e9011c5eb860" Namespace="Nextlabs.SPSecurityTrimming" TypeName="*" Safe="True" />

<add name="NextLabs.HttpEnforcer.HttpEnforcerModule" type="NextLabs.HttpEnforcer.HttpEnforcerModule, NextLabs.SPEnforcer, Version=3.0.0.0, Culture=neutral, PublicKeyToken=5ef8e9c15bdfa43e" />

 

5. Verify all twenty two event receivers removed on ALL lists and document libraries on ALL site collection. You could use SharePoint manager or powershell to verify.

• NextLabs.ItemAddingReceiver
• NextLabs.ItemUpdatingReceiver
• NextLabs.ItemDeletingReceiver
• NextLabs.ItemCheckingInReceiver
• NextLabs.ItemCheckingOutReceiver
• NextLabs.ItemUncheckingOutReceiver
• NextLabs.ItemAttachmentAddingReceiver
• NextLabs.ItemAttachmentDeletingReceiver
• NextLabs.ItemFileMovingReceiver
• NextLabs.FieldAddingReceiver
• NextLabs.FieldUpdatingReceiver
• NextLabs.FieldDeletingReceiver
• NextLabs.ItemAddedReceiver
• NextLabs.ItemUpdatedReceiver
• NextLabs.ItemDeletedReceiver
• NextLabs.ItemCheckedInReceiver
• NextLabs.ItemCheckedOutReceiver
• NextLabs.ItemUncheckedOutReceiver
• NextLabs.ItemAttachmentAddedReceiver
• NextLabs.ItemAttachmentDeletedReceiver
• NextLabs.ItemFileMovedReceiver
• NextLabs.ItemFileConvertedReceiver

The powershell you could use like this.
$web = get-spweb http://sbx18:13247/sites/R1
$sg = $web.lists[“DocLib”]
$sg.eventReceivers

6.  Verify NextLabs two web features removed form each web (SharePoint sub-site). We will use the tool to remove these features. If features are not removed, the new installation will NOT active any evenet receivers on the web.

7. Verify the following five NextLabs related site property bag removed on each site collection. Based on NextLabs, these entries will not be removed and will NOT have any impact to the system.

• sppagetrimming
• spwebpartttrimming
• sptabtrimming
• splisttrimming
• spsecuritytrimming

8. Verify DOCICON.xml file Nextlabs entry removed. This is not critical and I'll provide details in the future.

The most difficult part on the uninstall is to remove the event receivers and NextLabs features. We have identified the uninstall will NOT successfully clean up either of those. There are some potential issues if events and features not cleaned up.

1. The first issue is you might see errors when access list or library.
2. The second issue is none of the event receivers will be registered when you install new version of Enforcer unless you have removed all the NextLabs features on ALL web. 
3. The third potential issue is the event receiver not removed might refer to old version assembly if new version change the version or public token

As a result, in order to have a clean and successful installation of the new version of Enforcer, you would need to have a clean uninstallation. The complete removal of NextLabs event receivers on each list/library and two NextLabs features in step #3 on each web will be the key. The property bag on each site collection will not be removed and it should not introduce any issues.