Change Active Directory of SharePoint 2013 (Domain Change)

It's Good to be back after long time. Thought to come out from the shell after long time.

Resent past,  I had a requirement to move existing  Domain Controller (DC) of SharePoint environment to a new DC
My company came up with a policy, that all the UAT environments should be under UAT domain controller and Production DC should not contain any of the UAT environments. Which was a good decision from the Security Point of view.

My Next challenge was how to do the domain change to an existing SharePoint environment which is having few hundreds GB Data.

As I heard Even Microsoft Does Not support this particular activity I had no choice other than moving DC or build a new environment under our Testing DC.

I moved two environments SharePoint 2013 and SharePoint 2010 here I'm explaining the steps I followed for SharePoint 2013 environment.

Only resource I could find regarding the same topic is Sushant's Blog which was helpful to start.

Warning

• This process can have multiple drawbacks, its always good to have proper rollback plan before you move. 
• If your Servers are build on Virtual Machines It's better to have snapshots of the servers.
• Because there is no guaranty  to succeed this approach till you find out doing it :) 

I created a Check List for my self during the migration, which kept me on track about all the changes I did.

1. Documentation
2. Implementation
3. Verification

Documentation

I document all the details which I could collect about the existing environment. I do this as a practice before any major modification for my environment. SharePoint used to keep it's values all over the server in various formats. 

It's always good to start from the bottom and easiest way :) 

NOTE: Make sure you have the SA Password ready with you or with your DBA, you will need it once you change the domain for the SQL Server.

1. User Account Details

• Local Group Details (Note down all users details in each group)
• Administrators
• WSS_ADMIN_WPG
• WSS_RESTRICTED_WPG_V4 
• WSS_WPG 
• Distributed Com Users 
• IIS_IUSRS 
• Performance Monitor Users 
• Users
• Help Library Updaters
• SQL Server 2005 Browser Users
• Windows Fabric Administrators 
• Windows Fabric Allowed Users

        2. SQL Server Details

• Document all the databases exists in the SQL Server
• SQL Server Accounts

• Account Roles and Permissions
  
• Each Database I have created a chart with it's own permissions against each Account

OldDC\AccountName1 DB Permissions

Database	dbOwner	Public	SharePoint_Shell_Access	SPDataAccess	Wss_Content_ Application_Pools	DB_Accss Admin
AppMng_Service_DB
Bdc_Service_DB	Y	Y
Managed Metadata Service	Y	Y
PerformancePoint Service Application	Y	Y
Search Service All Databases	Y	Y
Secure_Store_Service_DB	Y	Y
SharePoint_AdminContent	Y	Y	Y	Y	Y
SharePoint_Config		Y	Y	Y	Y	Y
SP2013_TestWebApp_Content	Y	Y
StateService	Y	Y
TranslationService	Y	Y
User Profile All Databases	Y	Y
WordAutomationServices	Y	Y
WSS_Content	Y	Y
WSS_Logging	Y	Y

3. IIS Application Pools 

Navigate to IIS and identify each application pool Account for each web application and App pool 

4. Web Applications

• Identify all the web applications in the farm and note down each and everything

5. Managed Accounts

• Document all the managed accounts 

6. Service Accounts

Service Name	Account Name
Farm Account	OldDomain\SPFarmAdmin
Windows Service - Claims to Windows Token Service	Local System
Windows Service - Distributed Cache	OldDomain\SPServiceAcc
Windows Service - Document Conversions Launcher Service	Local System
Windows Service - Document Conversions Load Balancer Service	Local Service
Windows Service - Microsoft SharePoint Foundation Sandboxed Code Service	OldDomain\SPServiceAcc
Windows Service - Search Host Controller Service	OldDomain\SPServiceAcc
Windows Service - SharePoint Server Search	OldDomain\SPServiceAcc
Windows Service - User Profile Synchronization Service	OldDomain\SPServiceAcc
Web Application Pool - SharePoint – 17722	OldDomain\SPServiceAcc
Web Application Pool - SharePoint – 80	OldDomain\SPServiceAcc
Security Token Service Application (Security Token Service Application)	OldDomain\SPServiceAcc
Service Application Pool  - SharePoint Web Services Default	OldDomain\SPServiceAcc
Service Application Pool – SharePoint Web Services System	OldDomain\SPServiceAcc

7. Servers In the Farm

• I kept a Screen shot of Central Administration -> System Settings -> Servers in the Farm Page

8. Services on Server

• Kept a Screen Shot of Central Admin -> System Settings -> Manages Services On the Farm Page

9. Alternate Access Mappings

• Details of each access mappings

10. SharePoint Service Applications

• At least names of each service applications on existing environment

11. Content Databases 

• All content databases for each and every web application

12. Windows Services (Must)

• All windows services which is currently running on server 
• Service Account for each Service
• current State (running or stopped)
• Start mode of the service (Automatic or Manual) 

Up to this point we were doing documentation now let's see how do we do the migration

Implementation

1. Back up all the SharePoint Related databases before you start.

• All Content Databases
• All SharePoint Service and Config Related Databases.

2. Prepare all the Service and Setup Accounts (New Domain Accounts) which require for you to configure in SharePoint Environment.

3. Domain Change

• Do the domain Change for the Server
• Right Click My Computer
• Change Settings
• Click "Change" button near to "To Rename this computer or change it's domain or workgroup.."
• Select the Domain Section and type the DC name you need to move your SharePoint environment.
• To Change the DC, you need to provide valid domain Account Credentials for new domain.
• Changes will get effect once you restart the server.

4. Add New Domain user as Local Administrator

• Add SharePoint Administrator Account in to Local Administrators group

5. Delete Often Accounts 

• Once you open the Local Administrators Group, all accounts having crazy GUID, that is because accounts which were using previously under OldDomain became ofen

6.  Delete Old Accounts from Windows Groups 

• Now you can delete those accounts with GUID and add new SharePoint Setup admin accounts as Local Administrators of the Server

7. Add the your new domain accounts in to following Groups through computer management

Windows Group	Account(s)
WSS_WPG
WSS_ADMIN_WPG
IIS_IUSRS
WSS_RESTRICTED_WPG_V4
Windows Fabric Administrators
Windows Fabric Allowed Users

8. Change SQL Server Credentials

• If your SQL Server is running on Same Server, by this time SQL Server is stopped due to the Domain change of the server.
• Navigate to Services Section change the SQL Services Account and Start the SQL Server Service 

9. SQL Server Permissions 

• Now you may need your DBA help or if you have SA credentials for your SQL Server, log in to the Server as SA and provide add New Domain Accounts for SQL Server, such as SQL Administrator and SQL Service Accounts.
• Provide SysAdmin Permission for following Accounts 
• SQL Administrator 
• SharePoint Administrator
• Provide all the required permission for each database and each server role. 
• Your can refer the document you have created during documentation stage.

10. Set New Farm Account for SharePoint

Open SharePoint Management Shell And execute following STSADM commands in the window

Stsadm –o updatefarmcredentials – userlogin “NewDC\SPFarmAccount” –password “password”

Execute following command to change the credentials of the SharePoint Accounts 

Stsadm –o updateaccountpassword –userlogin “NewDC\SPFarmAccount” –password “password” – noadmin

If Everything went perfectly, by this time, you will be able to open the Central Administration. 

11. Add New Domain Account as SP Shell Admin

Execute following command against each and every content database of the SharePoint Farm.

Add-SPShellAdmin –UserName “NewDC\SPSetupAdmin” –database (Get-SPContentDatabase “WSS_Content”)

12. Remove Existing Shell Admin as follows 

Remove-SPShellAdmin “OldDc\OldSPSetupAdmin”

13. To Get all existing Shell Addmin Accounts execute following commad in PowerShell

Get-SPShellAdmin

14. Managed Accounts 

• Navigate to Managed Accounts Section and find out what are the old managed accounts in the system.
• When you go to the edit of each managed account you can see currently configured services with that particular account.
• You have to change the service account of each service one by one to delete the old managed account.
• First change them in to a one account and later once all services are up, you can change it to multiple accounts if you need

NOTE: 

• Till you remove all associate services from the each Managed Account, you cannot delete old Managed Accounts from the SharePoint Farm
• It will direct to Error Page when you have one or more services running on old domain accounts, from Manage Service Account section or from Central Administration, You cannot change the Service Application Accounts at this stage. 
• You Have to take the hard root to the success. only way I could find is PowerShell
• Before Your Proceed make sure you add your new Managed Accounts through the Central Administration.

From the Managed Accounts Page you can see how many services running under particular account, (Farm Components Using This Account) then you can follow each step to change the account ID of that particular Service 

15. Change Service Application Pool Identities

•  To Change the Application Pool Identities execute following Commands for Each and Every Application Pool

Set-SPServiceApplicationPool "SecurityTokenServiceApplicationPool" -Account "NewDC\SPAppPoolAccount"

16. Change Web Application Pool Identity

Execute Following PowerShell Commands to Change the Web Application Pool Identity

$WebApplicaiton = Get-SPWebApplication http://WebAppURL/

$WebAppPool = $WebApplication.ApplicationPool

$WebAppPool.Username = "NewDC\SPNewWebAppPoolAcc"

$WebApplicaiton.ApplicationPool.Update();

17. Change Distributed Cache Service Accounts

Execute Following PowerShell Commands 

$farm = Get-SPFarm

$cacheService = $farm.Services | where {$_.Name -eq "AppFabricCachingService"}

$accnt = Get-SPManagedAccount -Identity NewDC\user_name

$cacheService.ProcessIdentity.CurrentIdentityType = "SpecificUser"

$cacheService.ProcessIdentity.ManagedAccount = $accnt

$cacheService.ProcessIdentity.Update()

$cacheService.ProcessIdentity.Deploy()

For More Details you can refer this Technet Article 

18. Change SharePoint Service Accounts

Your can  change the Service Accounts as follows 

$svc = Get-SPServiceInstance -Server "ServerName" | Where {$_.TypeName -eq "Microsoft SharePoint Foundation Sandboxed Code Service"}

$mgdAcc = Get-SPManagedAccount -Identity "NewDC\AccountName"

$svc.Service.ProcessIdentity.ManagedAccount = $mgdAcc

$svc.Service.ProcessIdentity.Update()

$svc.Service.ProcessIdentity.Deploy()

$svc = Get-SPServiceInstance -Server "ServerName" | Where {$_.TypeName -eq "User Profile Synchronization Service"}

$mgdAcc = Get-SPManagedAccount -Identity "NewDC\AccountName"

$svc.Service.ProcessIdentity.ManagedAccount = $mgdAcc

$svc.Service.ProcessIdentity.Update()

$svc.Service.ProcessIdentity.Deploy()

Above Details I could find from this blog

19 Search Service Account Change

First You have to stop the Search Service in the windows Services 

then you can execute following commands in PowerShell

$MgtAccount = Get-SpManagedAccount -Identity "NewDC\AccountName"

$procId = (Get-SPEnterpriseSearchService).get_ProcessIdentity()

$procId.CurrentIdentityType = "SpecificUser"

$procId.ManagedAccount = $MgtAccount

$procId.Update()

 20. Change Search Host Controller Service

$inst = Get-SPServiceInstance | ? {$_.TypeName -eq "Search Host Controller Service" }

$inst.Service

$inst.Service.ProcessIdentity

$inst.Service.ProcessIdentity.UserName = "NewDC\AccountName"

$inst.Service.ProcessIdentity.Update()

21. Remove Old DC Accounts from Farm Administrators Group

Through the Central Administration, you can change the Farm Administrators 

22. Error "Cannot drop the event session 'SharePoint_Diagnostics_, because it does not exist or you do not have permission."

To Solve above issue, I could find the solution from following blog

Resolution was 

Delete the SP Usage Application through central administration and recreate through PowerShell

New-SPUsageApplication -name “Usage and Health Data Collection Service Application”

23. Change Site Permissions in to new accounts 

• navigate to each site collection and change the site collection administrators in to NewDC Accounts 

NOTE: Start with Root Site Collection

24. Delete All Managed Accounts 

Once you detach all the services from the old account you will be able to delete the account through PowerShell

$MgtAcc = Get-SPManagedAccount "OldDC\SPManagedAcc"

$MgtAcc.Delete() 

25. State Service Application

I have Created New State Service Application As follows 

Verification

• you can double check all configuration you have documented previously with the current environment
• Same time you have to check the all SharePoint Features 

NOTE

I had to Remove totally SharePoint 2013 Workflow Management Service  and configure it again with the new AD details. because it is containing FQDN of the server in few places in registry. which is having old domain name.

Change Language in SharePoint 2013

Prerequisites : 

You have to install SharePoint Language Pack before you use this feature (ex: French, Arabic)

we have two option to change language in SharePoint

1. Via Browser Preferences
2. My Site - Language Selection

Browser Preferences

• First of all navigate to the site collection settings
• Site Collection Administration - > Language Settings.

• Select the language you want to enable in site

•  Navigate to Internet Explorer Options
•  Select language button

•   Select language Preferences
• 
•   Add language you want to enable (Arabic)

• Move up preferred language in the list.
•  Now SharePoint will open automatically in selected language 

     My Site Language Preference

•       To enable this feature you need to enable user profile service. And my site host
•        Then log in to the SharePoint site and click on My settings 

• 1     Select edit profile and select Language and Region Option

•        In the language selection in Display Language Section you can select the language you want to display your pages

There is nice article in following MSDN BLOG

How to Fix InfoPath Form Publishing Error – SharePoint 2013

InfoPath Cannot Save the Following Form

Error: InfoPath cannot save the following form: http://... this document library was either renamed or deleted, or network problems are preventing the file from being saved. If the problem persists, contact your network administrator.

This may be a known fact which all of you guys heard. But I thought it's worth to share.

This is happening when you are trying to develop and publish InfoPath forms on your SharePoint Server.

According to the Microsoft KB Article  you have two Options to overcome this Issue  

1. Enable Desktop experience on your SharePoint Server if you want to develop and publish InfoPath Forms on your SharePoint Server.
2. Second option is do not develop your InfoPath forms in your SharePoint Server. Develop them in your client machine and publish them in to the server.

Following Section will guide you to enable Desktop Experience on your development Server.

How to Enable Desktop Experience on Windows 2012 Server

1.       Go to Server Manager and start Add Roles and Features wizard.

Install System Center Service Manager 2012 Self-Service Portal

Here I would like to explain how to install both web content server and the SharePoint Web Parts on same server.  As Last topic of the post I have described how to configure the web content server to the Self- Service Portal remember to follow those step after you installation completed. Otherwise it will load you a blank Self Service Portal without any web parts. I faced same issue and I had to waste my time for overcome that situation. Happy installing J

1. Install Prerequisites
2. Prepare a Secure Socket Layer Certificate in the IIS
3. Give Proper name to the Certificate.

SCSM 2012 Self Service Portal Prerequisites 

• .NET Framework 4.0
• IIS
• Microsoft Analysis Management Objects.
• Silver Light 4.0

Install Both Web Content Server and SharePoint Web Parts on Same server

1.  Login to the Server you are going to install the Self Service Portal.
2.  Execute the Setup EXE to install the Self Service portal.
3.  Select or click on the “Service Manager Web Portal”
4.               
5.  Check both  web content Server and SharePoint Web Parts
6.              
7. Keep the default locations for installation.
8.  After the prerequisites check.
9. Configure the Service Manager Self-Service Portal name and port
10.  Accept the Default Name for the Content server.
11. It’s good to give port 444 as port number since user is not login to the Content Server.
12. Check on Enable SSL encryption
13. Select the SSL Certificate previously created.
14.  Click on Next.
15. In Select Service Manager Data Base Page, give the Server name of the SCSM Server Installed.
16.                
17. Select the server instance and database Name.
18. Click on Next.
19. In the Configure the account for the Service Manager Self-Service Portal page select the domain account.
20.  Specify the user name and password for the Service Manager Server.
21. Test the credentials
22. After the “The credentials were accepted” click on next.
23.  In the Configure the Service Manager SharePoint Web site page.             
24.  Accept the default name for the Portal.
25. It’s good to give the port as 443 event screen shots says 444. Because default port for SSL is 443. When port 443 is using you no need to type the port with the url.
26. Select the database server name of the SharePoint server
27. Select the SQL server instance.
28.  Keep the default database name.
29. Click on Next.
30. On the Configure the account for Service Manager SharePoint application pool page, give the domain username and password and click on test.
31. After the verification click on next.
32. In the installation summery.
33. Click on install to install.

SSL Issued to Name with the web site URL

      Check the "Issued To” name of the SSL certificate. Same name should be used to access the SMPortal.

1.         Go to the IIS.
2.         Select the Service Manager Portal from the Web sites.
3.         Go to the Application Settings.
4.         Double click on SMPortal_WebContentServer_URL
5. 
6.       Change the url server name as in the Issued To Name in the SSL
7.       This server name can be FDQN of the server. It will depend on the SSL certificate you are using for the Self Service portal. In my scenario I use Self signed certificate.
8.       If you gave port number 444 for the content server it should be 444 not 443 as in the screen shot. 

Convert Virtual Box in to VHD and boot from the VHD File

It’s after long time since my last post. Finally I thought to share some experience I had with the VHD files and Oracle virtual boxes.  I was trying to install and configure SharePoint 2010 Server in my home PC.  

After several attempts I configured a Oracle Virtual Box by installing Windows Server 2008 R2,Active Directory, Visual Studio 2010, SQL Server 2008 and finally Share Point with all prerequisites. Finally I found out my resources I have in my PC is not enough to run the SharePoint ( I have only 4GB RAM and my instructor worn me about it already but I didn’t care about it :D )

Finally I had to go for some other options

Boot VHD is a good option and for implement it, I had to created new VHD and install all the software again in to the new VHD that was a hard task then I found there is a possibility to convert vdi (virtual Box File) in to VHD format. Then I had to try it

VboxManage utility comes with inbuilt to the Oracle virtual box

Steps to convert VDI file to VHD

1.     .  First of all if there is any snap shots related to your virtual box vdi file, delete them (delete them through virtual box console it will merge snap shot and current state of the virtual box) and bring the vhd in to one stable point .
2.        Uninstall virtual box guest additions if you already installed them in to your virtual box.
3.    . Release and remove the vhd file form the virtual media manager in the oracle virtual box. Otherwise it will generate an error saying “cannot register the hard disk …etc .”
4.    .DO NOT REMOVE THE PHYSICALE FILE of the virtual hard disk.
5.      Go to Command prompt and navigate in to your virtual box program folder     “C:\Program Files\Oracle\VirtualBox\”
6.  Type  vboxmanage clonehd “Path to your Virtual box vdi file” “path to newly creating VHD File” - - format VHD    C:\Program Files\Oracle\VirtualBox> vboxmanage clonehd “F:\myVirtualBox.vdi” “F:\myVHD.vhd
7. Then above command will create a .vhd file which is located in the F drive in above example.

8.       Depending on resources of your host machine, it will take some time. Mine it took several hours so be patient.

Next step is attach vhd file and boot from vhd.

Steps to attach vhd file and boot

There were several articles on the web explained how to create new vhd file and install os in to that file. But only few which explains how to attach existing vhd and boot from it.

http://gregorybeamer.wordpress.com/2009/12/30/vhd-booting-windows-server-2008-r2-in-windows-7/ was a good article for me

If you already attached your vhd  from disk management you have to remove it using diskpart utility

How to remove the vhd (detach vdisk)

1.        1. Go to command prompt and type diskpart

a.       C:> DISKPART

2.       2. Then type select vdisk file =”file path”

DISKPART:> SELECT VDISK FILE =”F:\ myVHD.vhd”

DISKPART> detach vdisk

DISKPART> exit

3.       3. Then you have to use the bcdedit utility to copy the boot load entry for new boot option in the start up. 

     NOTE: your computer will give error saying access denied or you do not have permission then you have to go to Startmenu -> All programs -> Accessories -> write click on command prompt and click on “Run As Administrator”

4.     4.   Then type following command in the command prompt

a.       bcdedit  /copy {current} /d “name you like to use in boot menu”

5.      5.   It will create a new boot menu entry with the name you gave. (Long string {GUID} will display after the message copy it and save it you will need it in next steps ) You will be able to check it by type bcdedit and press enter that will display all the boot loader entries

6.      6.  Then type the following commands with previously saved GUID

bcdedit  /set  {GUID} device VHD=”path to vhd file”  ( example for path F:\ myVHD.vhd) 

bcdedit  / set {GUID} osdevice VHD=”path to vhd file”

bcdedit  /set  {GUID} detecthal on

NOTE : sometimes there will be an error saying about the path then try it with “[locate] “ instead of your drive letter it will find the drive and do the execution that option worked for me

I found that solution from here http://www.techexams.net/forums/windows-7-exams/51301-bcdedit-set-error.html

bcdedit  /set  {GUID} device VHD=[locate]\myVHD.vhd

System.Security.SecurityException: Request for the permission of type 'System.Net.WebPermission,

Upload files to the FTP server via C#.NET code is a simple task when you use System.Net and System.IO namespaces. But when I was trying to do that I get an opportunity to know few more things that I didn’t know before.
NOTE: if you are going to use this FTP upload in commercial hosting server like GoDaddy then please make sure weather you can have the access to do so.
In my experience I could not run my web application in GoDaddy Server. That gave me exception “ System.Security.SecurityException: Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=……“
Even it is working FTP upload in your local machine, when you upload it to the GoDaddy that will not work. It is occurring because of the permission gave by GoDadday to your web application. We talk to the Godaddy and they inform us, they can not allow us to do our operation, because we are using shared hosting server.
When I search an answer for that most of the blogs and forums said they used some other Hosting plan to overcome that.
If you are interesting to know the FTP upload via C# .NET
File Upload in to FTP Server via C#.NET Code
File Download From FTP Server via C#.NET Code