Tips and tricks for Site Recycle Bin (Previous Site Deletion Capture) on SharePoint 2010

The Microsoft IT SharePoint 2010 Site Recycle Bin previous named Site Delete Capture tool has been released from CodePlex. It  that has been has been heavily used on SharePoint 2007 and a recommended tool for SharePoint Administrators by the IT Pro community. Most of the functions are identical to previous version and here are some tips and tricks to help you maximize the tool and avoid the pitfalls.

1. How to backup sites created form customized site definition using Recycle Bin tool?
By default this tool will only backup sites created form default Microsoft site templates. If you have sites created from customized site definitions, you need to staple both web and site scope features to ALL site definitions. If you add the following two line, ALL sites created from site definition will be captured.

•  Goto 14 hive 14\TEMPLATE\FEATURES\SiteRecycleBinDeleteFeatureStapling open FeatureStapling.xml file and add the below entry

   <FeatureSiteTemplateAssociation Id="78B263D4-FF62-415e-B609-F01B06FA54E0" TemplateName="GLOBAL" />

• Goto 14 hive 14\TEMPLATE\FEATURES\SiteRecycleBinSiteFeatureStapling\FeatureStapling and open FeatureStapling.xml file and add the below entry

   <FeatureSiteTemplateAssociation Id="78B94E15-23CE-43f9-8036-BABD847497D1" TemplateName="GLOBAL" />

2. How can we backup the sites already existing on SharePoint 2010 before the Recycle Bin tool installed?

You do not need to do anything. By default the deployment of this solution will activate the site feature and site collection on ALL existing sites on the farm. Here are the powershell command.

Install-SPSolution -Identity "SharePoint Site Recycle Bin.wsp" -GACDeployment
install-SPFeature -path "SiteRecycleBinSiteFeatureStapling\feature.xml" -force -confirm: $false  
install-SPFeature -path "SiteRecycleBinDeleteFeatureStapling\feature.xml" -force -confirm: $false 

As a result, you do not need to manually enable the features to make it affective. Cool!

3. Will Recycle Bin tool backup sites created form Fab 40 templates?
Yes. 2007 version described previously will not backup Fab 40 sites. However, new version will backup fab 40 sites as long as you add GLOBAL template in the feature stapling as described in #1. We have tested it with 12 different templates that were deployed as wsp on 2010.

4. Will Recycle Bin tool backup sub sites created form sandbox solution templates?
Unfortunately, this tool will NOT backup any sub sites created form templates user saved to templates and then uploaded to the solution gallery. When you check the site created from the saved template, features are activated and the site could be backed up using backup stsadm or powershell. It seems like this is the limitation for this tool. You could refer other blog on the ways to create sites using saved templates.

5.  Will Recycle Bin tool backup sub sites created form farm site templates?
As we described before, you could save the site to a template and deploy it to different farm as global farm based site template. So far so good. However, we found that the sites crated from this type of template could NOT be backed up by Site Recycle Bin. As a result, there is a risk those sites will not be easily recovered.

This is same as item #4, when you check the site created from the saved template, features are activated and the site could be backed up using backup stsadm or powershell.

6. Can we restore the site into the same content DB?
One of my college tested this and confirmed you could not backup the original site into the same content DB where site got deleted. You should be aware this when you backup the site.


7. What is Recycle Bin Backup Share size you should prepare
The answer depends on the governance policy and the SharePoint usage. You should answer the following questions before making the decision.

• Size of active used sites and growth rate
• Frequency of users will delete the site collection or sites based on previous experience
• Size of the each site collections you setup that is depends on your quota setup
• How long will backup the deleted sites

By answering these questions based on company's policy if there is any, you could calculate the necessary size needed. In normal case, we setup small size and monitor the deleted site.

8. How to resolve "The security validation for this page is invalid Microsoft.SharePoint.SPException" when activating feature 'SiteRecycleBinSiteFeature'?
Please see solution published in http://sharepointconnoisseur.blogspot.com/2011/05/security-validation-for-this-page-is.html for details.

Since Site Recycle Bin tool is using SharePoint stsadm backup command as internal mechanism to backup the sites, you will restore the site same as stsadm restore. You will noticed everything will keep same except the site collection GUID is different. You could refer to other blogs on the difference between backup/restore and export/import of the sites.

“Save Conflict" error when creating list or document library with "List Added Event Handler"

After adding "List Added Event Handler" to our SharePoint 2010 feature to update the list properties after listed created, we run into major issue during any list or document library creation by choosing below templates. The issue is we are getting "Save conflict" unexpected error. It is not consistent but happens much more frequently on “Calendar list”. The following list template will have such issue.

• Document library
• Form library
• Wiki page library
• Picture Library
• Reports library
• Calendar list

Users will get the error as indicated int he screen shot.

The error log is identical to the error people reported.

Microsoft.SharePoint.SPException: Save Conflict
Your changes conflict with those made concurrently by another user. If you want your changes to be applied, click Back in your Web browser, refresh the page, and resubmit your changes.


This is a very typical error occurs in SharePoint 2007 for asynchronous event handler. Due to SharePoint and the event receiver code trying to update the item at the same time. After debugging this issue and working with Microsoft, we have finally resolved it on SharePoint 2010. Here are the three changes you should try.

1.  Disable Event Firing when update the list. Please note this.EnableEventFiring() has been deprecated and the code for SharePoint 2010 is:
     EventFiringEnabled = false; 
     // Business logic here  
     EventFiringEnabled = true;

2. Use new SPWeb object for each list modification. The code should look like this if you apply #1 and #2 roles.

try
{
       // Use new SPWeb object for each list modification.
       SPWeb web = null;
       base.ListAdded(properties);

       //Disable Event Firing when update the list
       EventFiringEnabled = false;  
       properties.List.ParentWeb.AllowUnsafeUpdates = true;
       web = properties.Web.Site.OpenWeb(properties.Web.ID);
       SPList list = properties.List;
       list.Title = "Correlation Id- Save Conflict error";
       // Other actions to add policy to the list
       // Action to add tagging to the content
       list.Update();
       properties.List.ParentWeb.AllowUnsafeUpdates = false;
       EventFiringEnabled = true;
}

3. If you still have save conflict issues like we did, in SharePoint 2010, we have the option to make these kind of events Synchronous by adding this in the Element.xml file of the event receiver while we are registering it.

<?xml version="1.0" encoding="utf-8"?>
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
  <Receivers >
      <Receiver>
        <Name>MyCompanyListReceiverListAdded</Name>
        <Type>ListAdded</Type>
        <Assembly>$SharePoint.Project.AssemblyFullName$</Assembly>
        <Class>mycompany.com.sp.features.mycompanyListReceiver.mycompanyListReceiver</Class>
        <SequenceNumber>10000</SequenceNumber>
        <Synchronization>Synchronous</Synchronization>
      </Receiver>
  </Receivers>
</Elements>

After doing adding these changes, we are able to resolve the issue and enjoy the list event.

How to resolve (401) Unauthorized error for SharePoint web service call from Infopath Webbased form?

We run into an exception when calling OoB list web services from Infopath Webbased form on SharePoint 2010. The exception is "The remote server returned an error: (401) Unauthorized. The remote server returned an error: (401) Unauthorized."

We have NetScaler as load balance in front of multiple IIS servers and we have VIP setup for the Webapps. Users http://SharePointWebApp. However, if the web service is invoked from each individual server such as from the Infopath Webbased form, it generates exception described above. We had this issue before on SharePoint  2007 over two years ago, I though it would be beneficial to record the solution so we will not forget in the future.

There are many possibilities that could cause (401) Unauthorized error. The two major issues if you are using load balancer with multiple IIS servers and setup the alias or VIP for the webapp are authentication loop back issue and load balancer did not return the local host IP issue. You need to fix both of them in order to make web service calls successfully. Here are the procedure to fix them.


1. Authentication loop back issue
The cause was .net 3.5 sp1 - the fix for me was to add a key to the registry to disable authentication double look up. The way to do it is to set the DisableLoopbackCheck registry entry in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry subkey to 1.

To set the DisableLoopbackCheck registry entry to 1, follow these steps on the client computer:

• Click Start, click Run, type regedit, and then click OK.
• Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
• Right-click Lsa, point to New, and then click DWORD Value.
• Type DisableLoopbackCheck, and then press ENTER.
• Right-click DisableLoopbackCheck, and then click Modify.
• In the Value data box, type 1, and then click OK.
• Exit Registry Editor.
• Restart the computer

You could refer to Microsoft link for details and some other links for such solution. There is another KB article on the loop back issue.


2. Load balancer web service call does not return back to the local server. It seems like the web service call fails if the call initialized from one of the servers behind the Load balancer but pointing to web service using VIP alias.

Here are the steps to find the IPs and fix this.

First, you would need to identify the IP for Webapp VIP alias. If your site URL for the is http://SharePointWebApp, you could identify the IP for it from the IIS server using the command and the IP is 22.44.555.66.

C:\ >ping SharePointWebApp
Pinging sharepoinwebapp.compony.com [22.44.555.66] with 32 bytes of data:
Reply from 22.44.555.66: bytes=32 time=1ms TTL=255

Second, find the IP for the IIS server behind the load balancer using the command ipconfig like below and the IP is 77.33.99.44.


C:\Users\osstst1>ipconfig /all
Windows IP Configuration
   Host Name . . . . . . . . . . . . : xxxxxxxxx
   Primary Dns Suffix  . . . . . . . : na.compony.com
   Node Type . . . . . . . . . . . . : Peer-Peer
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : compony.com
   ......
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 77.33.99.44(Preferred)

Third, you added one line entry into host file that is located at C:\Windows\System32\drivers\etc\host. Add one additional line like:

77.33.99.44       SharePointWebApp

Forth, you flush the DNS Resolver Cache using command and verify the WebApp VIP IP original value 22.44.555.66 returned by ping that will changed to local IIS server IP that is 77.33.99.44.
C:\>ipconfig /flushdns 
C:\ >ping SharePointWebApp
Pinging sharepoinwebapp.compony.com [77.33.99.44] with 32 bytes of data:
Reply from 22.44.555.66: bytes=32 time=1ms TTL=255

Now, the web service called by Infopath Webbased form on SharePointIIS server will not go back to the load balancer. It will call web service hosted by the same host server.

By changing these two settings, you should be able to resolve (401) Unauthorized error.

Good luck.

Why SharePoint 2010 search does not show some results?

SharePoint 2010 search is better than ever before. Enterprise search for SharePoint 2010 contains all the features and functionality of MOSS 2007 Search, like people search, but goes further with richer navigation, refinement and related search capabilities. After Microsoft acquired FAST 2 years ago and applied this to SharePoint, it now offers as a separate add-on to SharePoint for those willing to invest in high end enterprise search.

Since search is very comportment in SharePoint adoption, there are many cases users reported they could not find the expected items in the search result. I would like to share the tips we found since August 2010 so you could explain and resolve those "issues" quickly.

Before we dig into some specific search "issues", first you should take a look of the different SharePoint Versions Search Comparison before implement it in your company. Searches like People Search, Social, Taxonomy integration not included in Search Server 2010 Express. Second, verify search services have been setup and associated with webapp and crawling process has been completed without errors. Incremental  crawling process has also been scheduled. You could verify from central admin and refer some instructions. Now let's dig into some specific search "issues" users reported frequently.

1. Why documents or items did not displayed in my search result while is for some other people? This is very common questions people complain and most of the cases, it's the permission issue. Specific users may not have permission to read those documents and as a result, it will not be displayed in the search result.

2. Why documents on one site do not show in the search result but others shown?
Besides the permission checking, this is typical site search disabled setting issue. Go to "Site Actions"->"Site Settings"->Site Administration"->"Search and offline availability" to verify "Allow this site to appear in search results" is set to yes as shown in the screen shot. This is site setting and site owners could hide the items on the site intentionally not to display in the search result.

3. Why search not showing any results for anonymous users?
This is similar site search disabled setting issue described above and you could change site setting and set "Always index all Web Parts on this site" to true.

4. Why some of my documents did not show in the search result?
Yes, this happens to several users and this may be related to Draft documents that are in document library that requires approval. You could check whether your document library enabled the approval process by going to "Document Library Settings"->"Version Settings" and whether "Require content approval for submitted items?" is set to yes as in the screen shots.

There is another interesting setting on the Document Library setting "Draft Item Security" that will impacting your search result.

Here is the case if you have file 1 has version 1.0 that is in published status and version 1.1 checked-in but not approved.

If  "Draft Item Security"is set to "Only users who can edit items", file 1 will NOT in any search result as designed since the crawling process will only index the latest version. In this case, the latest version has not been published and as a result, this file will not be indexed and will not in search result.

However, people reported if "Draft Item Security" is set to "Any user who can read items", file 1 with version 1.0 is still in the index and will be displayed in the search result. However, my testing does NOT display this file in the search result that is consistent with the golden rule - only latest published version will be indexed and if latest version is in draft version, none of the versions will be indexed as designed.

4. Why PDF files not show in the search result?
This is easy answer. You need to install PDF iFilter to index PDF files. You could follow Microsoft instruction to install it.

5.  Why social tagging and discussion not show in the result?
You may check whether jobs to index the social tagging are running correctly. The job for this is scheduled hourly and you could change it from central admin as administrator. The job is named as "User Profile Service - Social Data Maintenance Job" that is to Aggregates social tags and ratings and cleans the social data change log.

6. Why people search not show any result?
Besides you need to have check whether you are NOT running Search Server 2010 Express, this may be the mysite search index issue. You should included the MySite in the index content as in the screen shot. You may refer the instruction listed in some bog and verify it.

7. Why no result show in the default simple search but show in advanced search?
If you can see your items in advanced search but not in default simple search, this might be the webapp zone setting bug described in MSDN discussion board we identified during testing. If you have multiple zones setup for the same webapp. Please mask sure the default zone is Intranet NOT other settings. This seems to be a bug you could not get search result if the default zone is NOT Intranet. We may need to submit this bug to Microsoft.

8. Why my external line of business data not show in the result even we have BCS setup already?
If you have setup BCS to bring external data to SharePoint through external content type and did not find those in search result, this might be the search setting issue. You could configure this in SharePoint Central Administration as described in previous blog.

9. Why documents or items did not displayed in my search result even I have the permission through SharePoint?
If you have implemeted some security policy like NextLabs and enabled Search Result Trimming, it will allows SharePoint to limit the display of search results to only those web parts or documents (i.e., list items) which the search user is authorized to view based on NextLabs entitlement policy. On the worlds, even users have been granted permission through SharePoint to have access those contents, they will not be able to see in search result if thay are restricted from NextLabs policy entitlement. This is one of the requirement from our security team to block groups to access the sesitive content. See my new blog for details.


There are some other search issues we may share later.

Risk to install Microsoft Office Web Apps for SharePoint 2010

Microsoft Office Web Apps is the online companion to Office Word, Excel, PowerPoint and OneNote applications that enables users to access documents from anywhere. Users can view, share, and work on documents with other users online across personal computers, mobile telephones, and the Web. Office Web Apps is available to users through Windows Live and to business customers with Microsoft Office 2010 volume licensing and document management solutions that are based on Microsoft SharePoint 2010 Products. You could find the installation with architecture design.

This feature is very helpful if you have SharePoint users accessing Microsoft office documents from UNIX and Linus systems without Microsoft Office client installed.
There is a big risk if you plan to install this to SharePoint 2010.  Our experience was that if an installation of Office Web Apps had to be uninstalled, the result would be that the server would be removed from the farm.  We experienced this with several environments in November 2010 and notified Microsoft.  Microsoft Product team confirmed on April 14, 2011 that the results we experienced are, by design, the correct behavior.  The explanation is that the Office Web Application service must be installed on all web servers and must stay in synch across those servers.  Therefore, to avoid a situation where the servers are not synched, the uninstall process removes the server from the farm.  

Microsoft mentioned this will not be resolved in the near term and may not in next SharePoint version (2015?). Microsoft offered a couple of work-arounds. Microsoft will send us a white-paper detailing those work-arounds. One of the work around is to disable Office Web Apps if installation failed. However,  the high risk is three is no clear procedure Office Web Apps could be upgraded to future version whence this issue been fixed.

The bottom line is that we consider the uninstall process and the work-arounds to be unacceptable risks to our environments and does not plan to use Office Web Apps in our SharePoint environments until an alternative low-risk uninstall process is provided by Microsoft.

SharePoint 2010 users missing pictures in SharePoint groups

We have found many SharePoint 2010 users do not have their pictures when they are added to local groups. Here is the common symptom with detailed description.

1.    Issue - User missing pictures in SharePoint
Picture  not  displayed when  user is added to a any SharePoint group (Members, Owners, Visitors etc. ) of a  SharePoint 2010 site.

2.    Description
When a user is added to any SharePoint group,  the picture does not show.
However,  Mysite has all 3 sizes of pictures (L,M,S) stored in  /User Photos/Profile Pictures/ . Attached are the organizational view of users. Each user has 3 sizes of pictures. My Organization also shows the correct pictures for those people.

The following screen shot shows properties of working picture where url is picked from mysite medium size picture(http://mysite/User%20Photos/Profile%20Pictures/na_harryc_MThumb.jpg).

The second screen shot shows properties of missing picture where url is pointing to person.gif picture(http://projects/_layouts/images/person.jpg). Please note projects is the webapp alias VIP where the site is located.

 
If you explicitly pasted the medium size mysite picture url of missing picture user in browser(http://mysite/User%20Photos/Profile%20Pictures/domain_userid_MThumb.jpg) , picture is displayed correctly. We could display users' organization with all pictures also. However, the SharePoint group seems not able to associate the users pictures with users.




3.    Procedure to Reproduce

• Open any SharePoint site in browser
• Navigate to site actions > site settings> people and groups
• Add new user to any SharePoint group
• Picture of a  user is not displayed

4.    Similar issues reported
You could find some people also reported this issue.

• http://social.msdn.microsoft.com/Forums/en-US/sharepoint2010general/thread/450a2c3e-9c82-4a85-839f-9f5d4834b59d
• http://social.technet.microsoft.com/Forums/en-US/sharepoint2010setup/thread/19c98bbb-eefa-4575-a6de-925f1f4fae37

We have some other reasons that could cause picture missing issues. Here is the partial list.

• Users do not have picture in AD
• Pictures not synced to AD
• Picture not slitted into three sizes.

Today (4/19/2011) I just found two jobs that might related to this issue. We may have to take a look of the job status.

•  User Profile to SharePoint Full Synchronization (Hourly) - Synchronizes user information from the user profile application to SharePoint users and synchronizes site memberships from SharePoint to the user profile application.

• User Profile to SharePoint Quick Synchronization (5 minutes) - Synchronizes user information from the user profile application to SharePoint users who were recently added to a site.

One update from Microsoft on May 6, 2011 is that this issue also reported by other customer and it may be fixed by Dec. CU. I may try to apply 2011 April CU and test it again.

Please let me know if you know how to debug or fix this issue.

SharePoint 2010 RSS Viewer Web Part Issues and Tips to display SharePoint list

After upgraded all SharePoint 2007 to 2010 in August 201, our users are excited to explore some new features and enhanced web parts. One of the enhanced web part listed in 2010 is RSS feed web part. It's quite simple when you display external public RSS feed. You just need to provide the URL to config the web part. However, there are several tricks you should be aware of before you could configure it if you need to feed SharePoint list into the web part. We are facing several issues and many people also reported some strange behaviors.

The first trick for RSS feed web part is you should change authentication provider settings from NTLM to Kerberos with AD SPN setup if you need to display any SharePoint list as RSS feed. You do NOT need to setup Kerberos if you just need to display external public RSS feed such as http://www.microsite.reuters.com/rss/businessNews. The way to setup is straight forward and have not changed since SharePoint 2007. You could check from central admin on each webapp as described here. I noticed if you do not setup AD SPN, the webpart is still not working. Here are the procedures to check whether Kerberosis in deed working for the webapp.

Check SPN setup using command setspn -l domain\installaccount. Here is the example output from the command. You should see three entries on the server and fully qualified name.

C:\>setspn -l na\installaccount
Registered ServicePrincipalNames for CN=,OU=CORP,OU=Service Accounts,DC=domian,DC=company,DC=com:
        http/servername
        http/servername.company.com
        http/servername.domian.company.com

In order to confirm the user is indeed login using Kerberos, you could open the Security logs and filter for “Event ID: 4624”. You will see Kerberos as Authentication Package. More details in the future if you are interested in this topic.

The second trick is you only need to setup Kerberos on the site that is using RSS feed webpart. The displayed site does not need to be Kerberos enabled. I have the screen shot below that has three RSS feed web parts. As long as the web part site is Kerberos enabled, it can display both Kerberos enabled or NTLM enabled site lists.

The third trick or issue is I'm not able to setup to auto refresh the web part with the latest feeds. It is still same as 2007 that it only refresh after IISRESET! I'm able to find the AJAX options and setup to enable Asynchronous Automatic Refresh and Update as in the below screen shot. However, the web part displayed error "An unexpected error occured while rendering the webpart.". There is even an typo in the error message!

As of today August 30, Microsoft has provided a workaround to refresh this webpart. Pleas refer to here for details on the workaround.

The fourth issue is I'm not able to display the feed across the farms. See previous third RSS feed web part. I'm getting error "The RSS webpart does not support authenticated feeds." that is same as you have not setup Kerberos.

There are some other issues you may encounter fro external RSS feeds with SSL and different sources. We have noticed people mentioned they could display feed across farm we will continue to debug.
 
Finally Microsoft confirmed this is not support to auto feed refresh to display SharePoint lists. However, we have identified a workaround that could refresh the webpart even it's not using Ajax. Please refer the workaround and let me know how it works.

If you have error "The RSS webpart does not support authenticated feeds." on SharePoint 2013 on-premises, you might need to sett the aspnet:AllowAnonymousImpersonation to false in web.config as Brandon mentioned. I would be cautious to change it before complete testing for other webparts especially Access apps, any BCS webparts, and custom webparts using security token.

If you try to display SharePoint online O365 RSS feed from on-premises even after you configure the trust, you will still get error like 'ProtocolError occurred trying to complete the request. The server returned a status code of : Forbidden and the status description is : "Forbidden"'. I will do more research how we can configure this.