Choosing Server for SharePoint, Exchange, Active Directory, SQL

Hello
We want to migrate from work-group type network and setup an interoffice mail server and , ... with SharePoint, Exchange, outlook. There are less than 40 clients. I prefer to minimize the number of servers. Is it possible to use one system for some
of this servers:
1. SharePoint
2. Exchange Server
3. SQL Server
4. Active Directory DC
Thank you

You could combine #1 and #3, but none of the other services. Or you could look at just getting a Domain Controller and using Office 365.
I'd recommend you have more than one Domain Controller for redundancy.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Similar Messages

Sharepoint 2013 Active Directory Import- Manager field not updating

Hi,
SharePoint 2013 Active directory import -Manager field not updating
Concern/Issue-
We are using SharePoint and configured the Active Directory Import .First import it seems everything is working fine and OOB Organization chart built using User profile data is coming out right.
Now the user is moved from one Organization Unit to Another.
Now our Manager field is not Updating .There is change in AD manager attribute but not reflecting in the SharePoint User profile.
Manger field is mapped to "manager" attribute in SharePoint.
We tried removing the user and Re-Import using Incremental import but no luck.
Thanks for help in advance
Sachin

Moving a user from one OU to another in AD won't normally change the Manager attribute in AD. You would need to edit the user's organization settings to change the manager value in AD. I've also seen these changes not be picked up unless something
other than just the manager field in AD changing. Try changing something like Office location and see if the manager change is picked up by AD Import.
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

SQL Server for SharePoint farm

Hi All,
As per the best practice to setup the farm, SQL Server shouldn't be a physical machine instead of Virtual. I am wondering what is the reason behind it?
If we do setup the farm in Azure then will it be ok to use the VM for SQL Server since SharePoint doesn't support Azure SQL Server?
Regards Restless Spirit

Generally, for On-Premise, many organizations do not support or allow IT departments to virtualize database servers. This policy is typical in organizations that have dedicated database teams that tightly manage and maintain SQL Server. In these controlled
deployments, the database team has to create all databases. Virtualizing SQL Server is not an option
In Azure IASS, SQL VMs are supported
http://download.microsoft.com/download/8/7/6/876E7EBF-47ED-488D-A861-13A020EB40BD/SharePoint%202013%20on%20Windows%20Azure%20Infrastructure_v1.pdf
Please mark the replies as answers if they help or unmark if not.

SharePoint - Automated Active Directory User Management

We are currently using a custom list to capture data from our HR team related to Employee Changes such as New Hires, Change of Information, and Exits. The next step after the form is filled out is to make the AD/Exchange change for that request. I'm
looking for a way to take the data from that list and automate the Active Directory change. Curious if anyone else is doing that or if you know of any products that allow that sort of integration.
I've seen a number of products that manage the AD accounts outside of SharePoint, and I've seen a number of products that will manage accounts in AD using SharePoint as the front end. I've yet to find anything that automates the process.
Thanks in advance.
Environment is SharePoint 2010 Enterprise, Server 2008 R2, and Exchange 2010

The other option is I do have a .net/C# developer on staff. I could have her write the code behind the scenes to pull this out of the list and automate if that is the best route. I'd just rather used an out of the box product if there is one.

SharePoint 2013 Active Directory Groups represented as c:0+.w| SID in UserInformation list instead of c:0+.w|Domain\Groupname

Hi
We are running on SharePoint Server 2013.When we add AD groups as permissions, we see that the group name is being displayed properly in the permissions. Whereas when I click on the groupname I see the SID with the Sharepoint specific claims characters,
instead of domain\groupname. I understand that the claims characters are because of claims mode. But I expected domain\groupname instead of SID. Is this the right behaviour.
When I call SiteData.GetContent web service, I get the SID of the group name instead of the domain\groupname.
Can someone please clarify?
Thanks
Naga

Hi,
Yes, the identity claim for an AD group is based on the SID of the group. The claim encoding for an Active Directory group consists of the following sections:
c:0+.w|<SID>
•"c" for a claim other than identity
•"+" for a group SID
•"." for a string
•"w" for a Windows claim
More information:
http://www.sharepointfire.com/MyBlog/2013/11/get-ad-group-identity-claim-in-sharepoint-2013/
Thanks,
Dennis Guo
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Dennis Guo
TechNet Community Support

SharePoint Foundation Active Directory Problem

Hey,
I have a problem with the Active Directory connection to SharePoint Foundation.
My Situation looks like this:
I'm working on a kind of project controlling plattform. Each of our customers has its own site. Also each customer has an account in our Active Directory. For the administrative part, we have a list which contains some infos of the customer, the url to its
site and the contact person.
I wrote an import-script which creates a site and a new item in the list. To put the contact person in the list-item, I use a code-snippet like this:
try
user = web.EnsureUser(loginName);
catch (Exception ex)
throw new Exception("LoginName " + loginName + " not found");
Now the problem is, that the try/catch block fails too often which means: SharePoint doesn't know the loginNames of some of our customers.
Why does SharePoint not know maybe 1/5 of all our customers? All of them have an account in our active directory, none of them ever logged in the SharePoint (at the time they even doesn't know, that they have a SharePoint site for this project).
I searched the internet for the problem but all I found where questions related to the synchronization of ad-properties to SharePoint Foundation. But I don't want to sync the phone-number or something like that - I want SharePoint only to know all the loginNames
of our customers, not only 1/5 of them.
How do I achive this, what am I doing wrong?
Thank you!

web.EnsureUser has nothing to do with the UPS at all. This has nothing to do with synchronisation (it does have a role but it's a maintenance one and nothing to do with authentication.
The simplest answer is that the login names are being entered wrongly. Having said that there are a few areas you can look at to try to identify the problem:
Does it fail repeatedly for the same username? Can you add that user to the site manually using a people picker control and if so will the script work afterwards? Are there any trends in the user accounts that SharePoint cannot find?

Using Groups in SharePoint from Active Directory

Hello,
Is it possible to use groups in SharePoint from AD?
I have several groups in AD that I would like to use in SP. Of course SP has its own set up groups in permission (Owner, Member and Visitor). I do not want to use these groups. What I would like to do is use groups that are in my AD and assign those the
designer, contributor, read-only..etc permission.
For example, SP people picker finds my AD group called "Finance_Project" and assign this group with permission rights as a contributor.
Is this doable in SharePoint. I would think since SharePoint can be authenticated with AD, you should be able to use your own AD groups.
Any suggestions, articles and answers are greatly appreciated.
artisticweb

You can do this in SharePoint. are you importing the AD groups via UPA?
Creating a SharePoint group and adding an Active Directory group to its members…this allows anyone in the Active Directory group to participate in the SharePoint group
Mapping roles directly to Active Directory groups and not using SharePoint groups at all.
here is couple of article which will explain your choices one over to other
Assign permission levels in SharePoint 2013
Using Active Directory Vs. SharePoint Groups
http://sergeluca.wordpress.com/2013/07/06/sharepoint-2013-use-ag-groups-yes-butdont-forget-the-security-token-caching-logontokencacheexpirationwindow-and-windowstokenlifetime/
Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

Sharepoint 2013 - Active Directory Import User Profile Property manager fields

Hi there,
I juste encountered actually a little issue regarding the Active Directory Import User Profil.
Importation seems to work well but I have a little problem regarding the Manager field.
When I verify a user profil through the sharepoint admin page ("Manage user profil") , I can see the manager field is correctly populated, but if I want to check my profil as a user (personal information), the manager field is not visible.
With Sharepoint Admin and Manage Profil Properties, I haven't the possibility to modify some settings for the manager.
For example, Policy parameters is greyed.
The only way I found to show this field in a user profil is to give the permission "allow users to Edit values ...".... setting I don't want to set.
Have you already this sort of issue ?
Thanks for your help/idea.

Hi Michael,
I don't remember well what I did exactly regarding this issue because I played a lot with user profil.
I know I used this powershell script from Sheyia which in fact help me a lot to clean and create a good profil setting.
http://blogs.technet.com/b/sheyia/archive/2013/10/09/sharepoint-2013-another-way-to-change-order-for-user-profile-properties-via-powershell.aspx
For example, this script help me to resolve some double entries.
Let-me know if it help you (or not of course)

Integrating Final Cut Server 1.5 with Active Directory

Following the directions in the Final Cut Server Setup Guide and I am running into errors. Fun with Final Cut Server. Fun with Kerberos.
Final Cut Server v.1.5 is running on an Intel Xserve running 10.5.6 Server, joined to AD. Active Directory is running on a Windows Server 2008 setup.
I dropped the ini files on the domain controllers, as directed by Apple KB (http://support.apple.com/kb/HT3688) and I ran the commands directed in the setup guide.
The adprincadd command should be run literally, of course, but there's a mistake straight-away when it should read "./adprincadd.pl", the ".pl" is missing. Also it says "fcsvr/fqdn of fcsvr", so naturally I replaced the fqdn, but the "fcsvr" prefixed threw me off. It gave me errors until I opened Kerberos.app and notcied that the kerb ticket was in ldap/, then the command worked for me. At least no errors, until I checked the ticket and it said I had no permissions and that the keytab entry was invalid. Wheeee.
1. First I tried:
(some info redacted)
node09:sbin root# ./adprincadd.pl -dc dc01.example.com. fcs.example.com.
Getting kerberos principal for computer account
Kerberos principal is ---
Getting computer id...---
Getting AD Domain...---
Base DN is dc=example,dc=com
getting kerb ticket using [email protected] got ticket
SASL-bind to dc01.example.com. successful
Computer record is at CN=---,CN=Computers,DC=example,DC=com
Checking to see if ---.--.---. exists...000020B5: AtrErr: DSID-031529F7, #1:
0: 000020B5: DSID-031529F7, problem 1005 (CONSTRAINTATTTYPE), data 0, Att 90303 (servicePrincipalName)
at ./adprincadd.pl line 165
2. Then I noticed the /ldap in Kerberos.app and changed the adprinadd command:
Everything ran well, with no errors...
Finding kvno...2
Reading /etc/krb5.keytab...done.
Creating new keytab file...done.
Writing out temporary keytab...done.
Making backup of old keytab and moving new keytab into place...done.
Operation Completed. You can verify with "kinit <ad user>; kvno -k /etc/krb5.keytab ldap/---.example.com"
3. Verifying with kinit gave me the keytab errors:
kinit matx; kvno -k /etc/krb5.keytab ldap/fcs.example.com
Please enter the password for [email protected]:
ldap/[email protected]: kvno = 2, keytab entry invalid
kvno: Permission denied while decrypting ticket for 'ldap/[email protected]'
Thoughts?

Hello, I'm having issues with the client login after AD integration. I followed the steps from http://support.apple.com/kb/HT3818 and the Terminal output reported a success.
I'm able to add AD groups in Final Cut Server Group Permissions. However, when I try logging in on the FCServer client using credentials associated with AD group I've added, I'm getting an error message from the client stating:
"Please re-enter the username and password or contact the server administrator. Please note that the username and password are case-sensitive."
The FQDN is correct in the Server field of the client.
I'm able to log into the client using locally created user accounts that I've created on the server so I know the client is communicating correctly.
The only thing I can find in the Console for the client machine is this:
11/25/09 10:50:12 AM /Users/*/Desktop/Final Cut Server.app/Contents/MacOS/Final Cut Server[1773] Warning: accessing obsolete X509Anchors.
In the server Console, this is a suspect message: /Library/Application Support/Final Cut Server/Final Cut Server.bundle/Contents/MacOS/fcsvr_stored[77891] pps proxy error: dsDoDirNodeAuth = -14091
Not finding much info out there regarding this. Any guidance is appreciated.

Active Directory Error 0x51 occurred when trying to check the suitability of server ' servername '. Error: 'Active directory response: The LDAP server is unavailable'. It was running the command 'Get-OwaVirtualDirectory'.

This issue is driving us nuts - there are no issues with Domain Controllers or AD in this environment. The server it is citing in the error has been retired - it was gracefully dcpromo'ed down and removed from the environment. DNS has no record of it, nor is it located anywhere else. We are not able to log into Outlook Web App either with authentication failed errors - and I can't help but expect these 2 issues are related? I tried hard coding the Configuration Domain Controller at the org level, as well as using the -staticdomaincontrollers and -staticglobalcatalogservers with the "Set-ExchangeServer" powershell command - no luck.... System settings of the exchange 2010 servers show they are pointing to the correct DCs - but I still get this error accompanied with long delays in rendering windows in EMC. Extremely frustrating..... I have an issue logged with MS now, but they aren't looking at them until Nov 9. Has anyone seen this issue at all? More info on the OWA config - using Form based auth, and I'm not able to perform a simple test-owaconnectivity -mailboxcredential (get-credential\username) -allowuntrustedcertificate -allowinsecurelogon - please help

Create a "global catalog" on the 2nd domain contoller, will fix this problem.
To create a new global catalog:
On the domain controller where you want the new global catalog, start the Active Directory Sites and Services snap-in. To start the snap-in, click Start , point to Programs , point to Administrative Tools , and then click Active Directory Sites and Services .
In the console tree, double-click Sites , and then double-click <var>sitename</var> .
Double-click Servers , click your domain controller, right-click NTDS Settings , and then click Properties .
On the General tab, click to select the Global catalog check box to assign the role of global catalog to this server.
Restart the domain controller.

Server 2008 R2 DNS Server can not open active directory erro 4000

The DNS server was unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly
and reload the zone. The event data is the error code. Error 4000
This just started happening yesterday. Also File service and print server is unable to contact because of this error. I have no lookup zones. When I try and go to the DNS server I get a message The server VETSALDC could be contacted The error was Access
Denied. Would you like to add it anyway?
PLEASE HELP

Hi,
According to your description, my understanding is that DNS unable to open Active Directory with error 4000.
This happens when that particular DC/DNS server has lost its Secure channel with itself or PDC. This can also happen in a single DC environment where that DC/DNS server holds all the FSMO roles and is pointing to itself as Primary DNS server.
You may check AD DS using command line “DCdiag” (run as administrator). besides, you may try to stop and restart AD DS service(detailed steps reference the link:
http://technet.microsoft.com/en-us/library/cc732714(WS.10).aspx ), make sure that the AD DS is running correctly.
Then restart the DNS service, detailed steps reference the link:
http://technet.microsoft.com/en-us/library/cc735673(v=ws.10).aspx .
If the problem still exits, is there any other DC or DNS on your network? Post the TCP/IP parameters (ipconfig /all) of DC and DNS here.
Best Regards,
Eve Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

After rebooting ML server, unable to open active directory. Error msg is Unable to open requested node error -14006.

This active directory is a replica of master on 2nd Mac Mini server which still thinks replica is there (perhaps it is) and will not let us delete in order to recreate. Both servers are running 10.8.4. Nothing changed on either server, simply did a reboot. When we logged in, Active Directory was turned off and when trying to turn on or access received message "Unable to open the requested node. The node LDAPV3/127.0.0.1 could not be opened because of an unexpected error -14006".
Does any one have experience with this and how can we recover? Thanks in advance for your help.

Hi again,
I've been able to run Reports by changing the "Reports_Tmp" key in the Registry under:
Hkey_local_machine\software\oracle\home0\
to the D:\ drive

Wild Card for strGroup in Active Directory

I am using the following vb script. Several of our Active Directory groups start with SPS_ I have tried SPS_* and SPS_% and can not get it to pull the group information. Could someone please assist?
Thank you in advance!
Option Explicit
Dim strFile, strGroupDN, objGroup, objExcel, intRow, objMember, objSheet
Dim objRootDSE, strDNSDomain, objTrans, strNetBIOSDomain, strGroup
Dim strLogonTime 'Formatted Last Logon Time output string
' Constants for NameTranslate
Const ADS_NAME_INITTYPE_GC = 3
Const ADS_NAME_TYPE_NT4 = 3
Const ADS_NAME_TYPE_1779 = 1
const ADS_UF_SMARTCARD_REQUIRED = &h40000
'Specify (or prompt for) the spreadsheet file.
strFile = "H:\Desktop\AD SPSA\SPS_Users.xls"
' Determine DNS domain name from RootDSE object.
Set objRootDSE = GetObject("LDAP://RootDSE")
strDNSDomain = objRootDSE.Get("defaultNamingContext")
' Use the NameTranslate object to find the NetBIOS domain name
' from the DNS domain name.
Set objTrans = CreateObject("NameTranslate")
objTrans.Init ADS_NAME_INITTYPE_GC, ""
objTrans.Set ADS_NAME_TYPE_1779, strDNSDomain
strNetBIOSDomain = objTrans.Get(ADS_NAME_TYPE_NT4)
' Remove trailing backslash.
strNetBIOSDomain = Left(strNetBIOSDomain, _
Len(strNetBIOSDomain) - 1)
strGroup = "SPS_*"
strGroup LIKE '_PS'
' Use NameTranslate to convert NT name to DN.
On Error Resume Next
objTrans.Set ADS_NAME_TYPE_NT4, strNetBIOSDomain & "\" & strGroup
If (Err.Number <> 0) Then
On Error GoTo 0
' NT name not found.
Wscript.Echo "Group " & strGroup & " not found"
Wscript.Quit
End If
strGroupDN = objTrans.Get(ADS_NAME_TYPE_1779)
' Bind to group object.
Set objGroup = GetObject("LDAP://" & strGroupDN)
' Create new workbook.
Set objExcel = CreateObject("Excel.Application")
objExcel.Workbooks.Add
' Bind to worksheet.
Set objSheet = objExcel.ActiveWorkbook.Worksheets(1)
' Add header row.
objSheet.Cells(1, 1).Value = "SAMAccountName"
objSheet.Cells(1, 2).Value = "Last Name"
objSheet.Cells(1, 3).Value = "First Name"
objSheet.Cells(1, 4).Value = "e-mail Address"
objSheet.Cells(1, 5).Value = "Phone Number"
objSheet.Cells(1, 6).Value = "SPS AD Description"
objSheet.Cells(1, 7).Value = "Date Created"
objSheet.Cells(1, 8).Value = "EDIPI"
objSheet.Cells(1, 9).Value = "LastLogon"
objSheet.Cells(1, 10).Value = "TSAllowLogon"
objSheet.Cells(1, 11).Value = "LDAP Path"
intRow = 2
For Each objMember In objGroup.Members
objSheet.Cells(intRow, 1).Value = objMember.sAMAccountName
objSheet.Cells(intRow, 2).Value = objMember.sn
objSheet.Cells(intRow, 3).Value = objMember.givenName
objSheet.Cells(intRow, 4).Value = objMember.mail
objSheet.Cells(intRow, 5).Value = objMember.telephoneNumber
objSheet.Cells(intRow, 6).Value = objMember.description
objSheet.Cells(intRow, 7).Value = objMember.WhenCreated
objSheet.Cells(intRow, 8).Value = objMember.UserPrincipalName
objSheet.Cells(intRow, 9).Value = objMember.LastLogin
objSheet.Cells(intRow, 10).Value = objMember.AllowLogon
objSheet.Cells(intRow, 11).Value = objMember.ADsPath
intRow = intRow + 1
Next
' Save the spreadsheet and close the workbook.
objExcel.ActiveWorkbook.SaveAs strFile
objExcel.ActiveWorkbook.Close
' Quit Excel.
objExcel.Application.Quit
Lee Mossolle

Bill,
We have over 100 AD Groups that all start with SPS so I need to search all of the groups and see what users have the Deny this user permissions to log on to Terminal Server which the flag for this is AllowLogon. If AllowLogon is equal to 0 then the user
needs the AD Profile updated so that then can access a program in the CITRIX Environment. So if I could use a wildcard in the strGroup, I could query for several groups and not one at a time. I am sorry for not explaining that better!
Thanks,
Lee
Lee Mossolle

I want to setup a Disaster Recovery Server for Sharepoint Server 2010

There are four production server running sharepoint server 2010 and one SQL server for
ContentDB management.

DR depends upon your backup stratgies, i.e
1) if you taking full backup of sharepoint using SharePoint tool
2) If you taking just SQL backup( Content DB and Services DB).
3) using the 3rd party tool for backup and recovery.
apart from above, you also have make a decision what point of time you want recovery.
from your questions, what i think for you.
Setup new farm with same SharePoint level.same customization, same services configuration, and same number of web apps.
then backup from Prod server( SQL content DBs) and then restore into new farm and mount them.
this is one time thing, Now you have to make decision, how data move from Prod to QA( i mean frequency i.e daily, monthly etc).
Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

Unable to access server files shares with Active Directory Users

Quick breakdown of my issue.
I have setup a Yosemite file server running the latest version of Yosemite and Server.
File sharing in Server.app is enabled and shares have been created
The server is bound to my company's Active Directory and you can directly login to the computer via AD credentials.
The big issue is this, unless the user has directly walked up to my server and logged into it at least once, they cannot authenticate to the file shares via their AD credentials.
For example: Administrator (me) I can login and access all file shares without issue.
Jane Smith (SMITH) who has actually walked up to my server and logged in via her AD credentials, can also access all file shares. (That she has access to)
John Doe (JDOE) who has not logged into the server in anyway, cannot authenticate to the server file shares at all (even though I have granted him permission) He just gets an "Access Denied" message.
I have gone into Directory Utility and changed the search order to give AD priority and this still doesn't resolve the problem.
We have unbound the server from AD and added in back again and still not able to resolve.
If you open Server.app and go to add someone from AD to a file share, it finds the AD user quickly and everything looks right. but still unable to authenticate to the server if they haven't directly logged into it before?
All of the documentation and google articles I have found say my server is setup correctly, any help would be greatly appreciate it!
Thanks in advance!

I figured this out. In Mountain Lion Server, it doesn't matter if you give the user rights to a shared file or folder, if the user doesn't have access the File Sharing service, they can't get it. I had to find the specific users in the Server app under the AD in the Users tab, and give them rights to the File Sharing service. I think you can do this for a whole AD group as well, but I haven't tried.

Choosing Server for SharePoint, Exchange, Active Directory, SQL

Similar Messages

Maybe you are looking for