But how to disable RBS on your sharepoint 2010 content DB? I found all the steps just as difficult to figure out as for installing. Below are my findings on how I managed to disable R?BS and remove it completely of my sharepoint (I had 1 content db using it).

Backup 1st: Backup site collection with stsadm, backup SQL db, backup RBS blob storage (NTFS – copy when SQL server service is stopped).

Migrate all content off RBS to SQL and disable RBS for content db:

$cdb=Get-SPContentDatabase <ContentDbName>

$rbs=$cdb.RemoteBlobStorageSettings

$rbs.GetProviderNames()

$rbs.SetActiveProviderName("")

$rbs.Migrate() –note: this might take some time depending on amount of data in your RBS store

$rbs.Disable()

Change the default RBS garbage collection window to 0 on your content db:

exec mssqlrbs.rbs_sp_set_config_value ‘garbage_collection_time_window’,'time 00:00:00′

exec mssqlrbs.rbs_sp_set_config_value ‘delete_scan_period’,'time 00:00:00′

Run RBS Maintainer (and disable the task if you scheduled it):

"C:\Program Files\Microsoft SQL Remote Blob Storage 10.50\Maintainer\Microsoft.Data.SqlRemoteBlobs.Maintainer.exe" -connectionstringname RBSMaintainerConnection -operation GarbageCollection ConsistencyCheck ConsistencyCheckForStores -GarbageCollectionPhases rdo -ConsistencyCheckMode r -TimeLimit 120

Uninstall RBS:

On your content DB run: exec mssqlrbs.rbs_sp_uninstall_rbs 0

Uninstall from add/remove SQL Remote Blob Storage.

I found that there were still filestream references in my DB, so run this on your content DB:

ALTER TABLE [mssqlrbs_filestream_data_1].[rbs_filestream_configuration] DROP column [filestream_value]

ALTER TABLE [mssqlrbs_filestream_data_1].[rbs_filestream_configuration] SET (FILESTREAM_ON = "NULL")

Now you can remove the file and filegroup for filestream:

ALTER DATABASE yourdbname Remove file RBSFilestreamFile;

ALTER DATABASE yourdbname REMOVE FILEGROUP RBSFilestreamProvider;

Last step: Disable filestream in SQL Configuration Manager for your instance (if you do not use it anywhere aside this single content db with sharepoint), run SQL reset and iis reset and test.

You will find those links useful:

http://sqlrbs.codeplex.com/Thread/View.aspx?ThreadId=204627

http://technet.microsoft.com/en-us/library/ff628255.aspx

http://technet.microsoft.com/en-us/library/ff628259.aspx

http://beyondrelational.com/blogs/jacob/archive/2010/03/11/completely-removing-filestream-features-from-a-sql-server-2008-database.aspx

1. Garbage collection. Its not done out of the box, you need to configure the RBS maintainer. See: http://blogs.msdn.com/b/sqlrbs/archive/2010/03/19/running-rbs-maintainer.aspx, http://blogs.msdn.com/b/sqlrbs/archive/2008/08/08/rbs-garbage-collection-settings-and-rationale.aspx and the RBS chm help file. You should set that up in the task scheduler. And as far as I found out there is a 30day period where files are still not deleted – kind of retention period which for backup strategy makes sense. Its hard to check – documentation on details is scarce and the rbs_ sql tables are not that obvious to read.

2. Files larger than ~1.2MB will fail to upload IF you did not allow client access to FILESTREAM. You will see “access is denied” SqlRemoteBlobs.RemoteBlobStoreException. So go in and enable client access (I tried setting Share permissions on this but that did not work out). This is what you should have in SQL Configuration Manager for that instance:

This is because by default 1.2MB is the limit from which SQL starts out of band access to the blobs (ref: http://blogs.msdn.com/b/sqlrbs/archive/2010/03/31/rbs-filestream-provider-small-blob-optimization-settings.aspx).

It seems not many people use this feature, but if you start having 100’s GB content your SQL will quickly die without RBS…  On the other hand RBS+Sharepoint integration is weak (close to none): its hard to setup, hard to maintain and backup/restore gets even more complex – so I suggest do it only on your largest content DBs and set a limit from which you move the files out to RBS, by powershell (example for 512kB):

$cbd = Get-SPContentDatabase “WSS_Content”

$cbd.RemoteBlobStorageSettings.MinimumBlobStorageSize=524288

$cdb.Update()

I have tons of other internal small KB articles like that one developed during my works, so ping me a mail if you have some strange issue and google is unable to answer.

I do have 1 unanswered problem though:

When I upload an Office 2k7 document with custom server properties from another sharepoint library (e.g. 2007) to my new moss2010 farm, I see an issue that an event handler we have is not fired. All other docs (non Office 2k7) work fine, and as soon as I remove server properties from that doc the event handler is fired… I have no idea if there is a switch somewhere in SharePoint 2010 that would resolve this – seems MOSS2010 is trying to read those server properties and this is causing some issues in our custom developed code:( debugging also doesn’t help as the event is simply not fired. ULS logs are silent on this. If you hit this or saw a similar issue let me know!

• “The given key was not present in the dictionary” error when attempting to run the Configure Farm Wizard
• Moreover it seemed as though the same user had different permissions in central admin when browsing it locally on server or remotely!
• The error  “The given key was not present in the dictionary” repeated itself while attempting to configure Sharepoint SQL reporting integration/

The Sharepoint logs (in “14” hive) showed that it seemed this method failed:

GetUserPropertyFromAD(SPWebApplication webApplicaiton, String loginName, String propertyName)

So I thought its an AD permission issue, and it was! I had to grant AUTHENTICATED USERS READ permission (probably read ‘some’ information would be enough) to the MOSS accounts (I granted to the DB access account and managed services account). After that an IISRESET and it worked.

Again Microsoft could improve its error messages – nothing new ;D

However there are 2 issues I met that were undocumented on the web:

1. You cannot perform a BARE METAL backup of a WS08R2 machine running on VHD. I needed to do this to transfer a VHD from 1 hardware to a different one. Ooops – no option to do that:( And since this is a full fledged VM (SQL, Sharepoint etc) Sysprep is no option.
2. If you want to move a native boot VHD to Hyper-V you need to:
   1. Mount the VHD, open the HKLM hive from that VHD in regedit (LOAD HIVE)
   2. go to CCS\Services\Intelide and change Startup to 0 (start on boot)
   3. Only then you will be able to boot a VM running on hyper-v with the VHD you used for native boot.

One more interesting thing my friend, Jakub, pointed me to: if you want to move the vhd from 1 hardware to another remember this:

bcdedit /set {guid} detecthal on (Refer to: http://technet.microsoft.com/en-us/library/dd799299(WS.10).aspx)

For most other issues you will find useful links on the web, e.g:

http://blogs.msdn.com/bramveen/archive/2009/10/27/swapping-between-native-vhd-boot-and-hyper-v.aspx

http://www.markwilson.co.uk/blog/2009/10/native-vhd-boot-windows-7-or-server-2008-r2-from-an-external-usb-drive.htm

Nice link about doing vhd boot without any OS (note you can use normal windows 7/R2 installation dvd instead of WinPE): http://blogs.msdn.com/mikeormond/archive/2009/10/09/boot-windows-7-from-vhd-without-installing-a-native-os.aspx

And a step-by-step video: http://www.ditii.com/2009/10/19/native-boot-windows-7-windows-server-2008-r2-from-vhd-on-a-windows-xp-pc/2/

Any my friends step by step for booting vhd off usb (in PL though): http://app-v.spaces.live.com/Blog/cns!12E9A21E4AEEFADB!275.entry

SEARCH TAGS: bare metal backup native vhd boot, native vhd boot does not start in hyper-v

In our team I’m also the ‘infrastructure guy’, which means that I forgot how to write code and now have to do the boring, dirty stuff;) Anyway if you are configuring a platform that uses IIS, Sharepoint, SQL DB, Reporting, Analysis and want to expose that to Internet you will be faced with many challenges – regardless if you are a programmer or an “ITpro/admin”. This Microsoft platform is powerful in its potential but still developing on those aspects like ease of programming or installation/configuration/maintenance/operations.

Anyway, let’s get to the point: you will find lots of useful information on the internet about how to configure Kerberos and Sharepoint. However most of them focus on INTRANET scenarios. Here I want to give some short tips/pointers on the most often “hicups” when exposing a solution built of varying technologies (Sharepoint Excel Services and Reporting Services, SQL Analysis Services/OLAP) over Internet. My whole list of various issues I met along the way is huge, but let me give you the top 3, which caused my biggest headaches (least or not documented anywhere in www.google.com

1. If you expose Sharepoint web apps to internet you cannot use Kerberos on those sites – why? because you can either use forms based authentication or windows, but NTLM (your user out there in the Internet won’t find your internal DC and even if he would, he would not get through all the firewalls with his Kerberos ticket). But if you will want (or need, as shows point 2) to delegate user credentials to the backend, you will need to configure CONSTRAINED DELEGATION, where first hop is NTLM (or any other auth) and subsequent are KERBEROS. Here is the must read:http://www.adopenstatic.com/cs/blogs/ken/archive/2007/07/19/8460.aspx.
2. If you want to expose OLAP cubes over internet, there is a way with the magical msmdpump.dll. Two things to watch out for:
1. you need to use this scheme of authentication: basic auth to IIS website with msmdpump.dll, then Kerberos to the backend OLAP (which is point 1)
2. If you configure the above read http://blogs.msdn.com/psssql/archive/2009/04/03/errors-may-occur-after-configuring-analysis-services-to-use-kerberos-authentication-on-advanced-encryption-standard-aware-operating-systems.aspx, and install the hotfix mentioned there on ALL your farm and backend servers. Otherwise you will notice strange “message altered in transit” errors and OLAP will not work correctly. This applies to both OLAP over internet (msmdpump.dll) as well as OLAP over Excel Services
3. There is a problem if you use the same EXCEL to connect to OLAP cube over internet (pointing to the msmdpump.dll) and still want to VIEW it in browser by using Excel Services: that will fail because of how excel services security model is currently implemented. Don’t want to go into details on that, but MSFT is aware of this and is “discussing on whether to fix it or not” (the usual;)) The only workround it to dynamically in code substitute the EXTERNAL .odc connecting to msmdpump.dll to an INTERNAL .odc that connects directly to Analysis Services when querying the Excel via Excel Services. Not nice, but otherwise you cannot view the same Excel with PivotTable in ECS and use it on the internet.

To get all this right its important to understand Kerberos, and Internet is where you will find more then enough info on this. For troubleshooting I found these tools useful:

• Netmon (of course)
• Fiddler  (‘lightweight http netmon’;))
• Sharepoint logs
• IIS failed request logging
• and of course www,google.com

If you have any questions, or some feedback (other big issues you met in such setups) ping me by mail or using this blog (comments/contact).

First off, I had this error, even though setup reported no errors. I could not administer the TFS (e.g. administer security). I received 500 Internal server error. Also when trying to browse the /TFS website. I spent some time trying to figure it out, and then went for the ‘easy’ solution. Set it up on a brand new server (in my case a VM): WS2008SP2 x64. I did NOT add web service role to the server, I just let the TFS install do it. I needed the basic installation only (no sharepoint or reporting, just source control and build). This time it worked:)

I figure that this could have been due to some settings on my IIS7 on the previous server, since it was also hosting other services (WSUS and Visual SourceSafe).BTW: if you are co-hosting VSS and WSUS on a 64 bit II7 you will need to turn off dynamic compression in IIS (see: http://forums.iis.net/t/1149768.aspx) – I spent a whole day troubleshooting this!

TFS2010 for now seems to work great for us. Its way better than VSS for internet-based source control, and easier to set up then TFS2008. Some of the things to note: you will still need Team Explorer 2010 to create team projects, but you will be good to go using Team Explorer 2008 for most tasks, just remember to apply Visual Studio 2008 SP1 and this GDR update http://go.microsoft.com/fwlink/?LinkId=166481 on it. And be careful: by default TFS2010 (that was true for 2008 too) allows shared checkouts – this can lead to some problems during merges, so the way to disable it is in team explorer (on a collection or project level) by choosing collection settings and source file types (this is a per filetype setting).

• DELL Equallogic iSCSI SAN
• 1 node a physical machine
• 2nd node a virtual machine on VMWare vSphere4
• Windows Server 2008 R2 Failover Cluster
• SQL Server 2008 SP1 installation in cluster

As expected such a bundle of new products worked less than great together. You can make it work but, there are many tweaks needed. I ended up with the same configuration but running on WS2008SP2 instead R2. Here are a couple of tips:

• If you want to use VMWare in a P2V cluster, VMWare does not support MPIO in such a configuration when using VMWare’s Raw Device Mapping. So we decided just to expose iSCSI directly to the VM by using Windows iSCSI initiator inside the VM (maybe less performing, but a more robust approach)
• Secondly, if you want an “aggregation” rather then HA-only iSCSI MPIO setup, then you need to install DELL’s Equallogic Host Integration Toolkit available from https://www.equallogic.com/support. Note: to run on WS2008R2 you need v3.3 which is an early production version (but worked for us OK).
• Next, if you want to install SQL Server 2008 on Windows 2008 Failver cluster you should slipstream the SQL installation with SP1  (on R2 it won’t install at all, on Standard WS08 cluster I had and error and had to reinstall with a slipstreamed version)
• On vSphere4 Windows 2008 R2 is incompatible with VMWare Tools (you can omit installing them or install them but WITHOUT the video driver – it will freeze your VM).

So my recommendation is to go for fully physical clusters, or fully virtual and stay away from P2V configurations. Additionally wait for full SQL2008 on WS2008R2 and WS2008R2 on VMWare (supposed to be some patch available soon) support.

However my favorite is this one-liner with the help of Joe’s admod tool:

admod -csv -add -import -unsafe -cont < .\UserImport.csv

(unsafe to import a lot of objects, cont to continue importing if an entry fails)

It will create disabled users, with blank password, and change password at first logon attribute set. It seems the fastest and easiest method (thanks to Tomek for pointing this out to me).

Your CSV just needs to have DN as the first value. If you are wondering what attributes to add to the file, there’s a ton…

My sample is:

dn,objectClass,sAMAccountName,sn,givenName,userPrincipalName,name,displayName,initials,Description,company,telephoneNumber,mobile,physicalDeliveryOfficeName,department,title,facsimileTelephoneNumber,EmployeeID,EmployeeNumber,Manager,c,co

Oh, and if you are adding manager attribute, of course you need to make sure the manager account is on the list before the “managed” person.

If you are wondering what else to add, whole list of attributes for your reference is attached here.

If you want to modify your users after that use Tomek’s tip with adfind, admod combination.

Since I work in DELL, and to have access to mail (except OWA) I need a domain joined laptop I had figured out such configuration: I will install physical machine from corporate DELL image, P2V this to a VM, and run my corporate VM on  Win7 x64 workgroup computer (I don’t like all these agents, scripts and policies;))

I had to install on physical first, because DELL does not allow joining to domain non-corporate images, and moreover has a strict policy on hardware – to user binding via the service tag. Its not possible to install the image directly in a VM – it will attempt to read a service tag. All this is performed by SCCM Task sequences (looking at it from end-user perspective it must be huuge..).

Anyway the process looked easier then it was in fact, but I finally managed. This is how it went – in case you ever stumble upon such issues it may be handy:

1. Install Win7 on physical machine. Lengthy but easy process, Dell IT automated.
2. Disconnect the machine as soon as possible from the network so that the safeboot agent does not have enough time to get pushed and encrypt the drive.
3. P2V using a great sysinternals tool disk2vhd:Disk2vhd. I love their tools for their simplicity.
4. The VHD created is a dynamically expanding VHD with max size that of original physical disk.
5. Attempting to start the VM in Windows Virtual PC failed. The IDE bus implemented there supports disks only up to 127 GB (mine was 136). That limitation is not present in Hyper-V.
6. I tried using VHDResizer. No luck. Again this seemed not to support such large files.
7. So I mounted the VHD under Win7 – YES, you can do that now out of the box in Win7. And shrunk the LOGICAL partition below 127GB.
8. I still could not start the VM in Windows Virtual PC, but I managed to use VHDResizer to resize the VHD to the amount I specified when shrinking the logical partition.
9. Now I could start the VM, but… “OS boot could not be found”.
10. A Windows repair (insert Win7 DVD iso, boot VM, do a repair) finally helped (I think shrinking the logical volume caused deletion of some boot information – which is fixed with bcdedit by the repair action automatically).
11. Finally clean up physical devices from devmgmt.msc so that the VM boots faster: VMware KB Article.
12. Ta..da.. in the end I can have my desired setup: separated VM for corporate stuff, boots much faster, encrypt all with BitLocker.

I am longing to see a day when IT will really be easier than THAT. However I sense that soon we will have bare metal hyper-visors on desktops, so that your WORK, HOME vms do not interfere and you can use one HW for many purposes. That is a solid security boundary, however I am in doubt when I see that I can save a report in IE to PDF on my HOST, without having Acrobat Reader installed there (by using the instance in my VM). This is a fascinating approach, but gives me some security shivers (imagine a virus – how easy can it then spread from your VMs to host…)

Back to some news: first off I started my company with a couple of friends – working “after hours” (big challenge). You can see our website: www.predica.pl. We focus on IT systems and applications developed in hosted scenarios: we cover business analysis, software development, hosting, maintenance etc. taking the headache of IT away from you:)

I also did a presentation on virtualization (Microsoft+DELL add-ons) during Microsoft Technology Summit 2009 in Warsaw. You can grab PPT from it here: MTSDemoAlipka. You want see much since 50% of it were demos. But at least you can get the gist of it..

I will be at TechEd 2009 in Berlin (next month), but as attendee not presenter, so if you’ll be there – ping me and we can meet for a beer for sure:)

Besides, I started climbing again, and its been great. Finding back old friends still doing it, visiting some new places (Indian Creek, US is a must! and Labak in Czech Republic – all you will ever want in crag climbing), and finding out that I still have lots of fun climbing. Ran two marathons – originally supposed to be one, but I needed to improve my time:)

I will try to improve my “post rate”. My blogging guru Tomek (http://www.w2k.pl/, http://blogs.dirteam.com/blogs/tomek/) is not letting his guard down, even though having a lot on his shoulders lately:)