2

I have a SharePoint 2010 farm with a User Profile Service (UPS) configured. It reaches into my AD Forest and pulls out exactly 24 users. There are about 150 users in my company's Active Directory. I have determined that all of the users it has retrieved are ones that have personally logged into the SharePoint farm at some point. Why is it not pulling everyone? I am not an AD guru and my AD gurus do not know anything about SharePoint so it is hard to find enough common ground to say to them "this needs to happen" in order to get the stuff imported.

Does anybody have any experience or wisdom they can share with this issue?

Thanks,

  • Matt

Update - 3/16/2012 We went to the trouble of creating a new AD user and made sure it had the permissions for replicating AD, and then recreated the Synchronization Connection for our UPS.

The permission-related error messages went away and now we have new error messages:

in Forefront Identity Manager (DS_FULLSYNC) - stopped-extension-dll-no-implementation

in Event Viewer: The management agent "MOSSAD-Midland Active Directory" failed on run profile "DS_FULLSYNC" because the extension "Microsoft.Office.Server.UserProfiles.ManagementAgent.dll" does not contain a class implementing the required (IMVSynchronization or IMASynchronization) interface in the assembly.

This is even more baffling because the resources I've seen online relate this to a customization, and we have not customized our UPS at all.

Update - 3/21/2012

Working on rebuilding UPS from scratch

Improve this question
1
  • We have about 4 domain controllers, which apparently the service randomly selects between. Could it be that specifying one in particular could help?
    – Matt
    Mar 16, 2012 at 18:22

5 Answers 5

Reset to default
5

What that usually means is that your Active Directory isn't configured or managed the way that SharePoint expects. Grab your AD guy and have him sit next to you while you go to Central Admin -> Applications -> Service Applications -> User Profile Service. On the dropdown next to your default AD connection, there will be an option called "Edit Connection Filters" - select that.

You will then be taken to a page that lets you define inclusion\exclusion filters and from there your AD guy should be able to tell you what properties to select in order to include just users.

Improve this answer
3
  • I did not actually see any special "inclusion" filters, and I definitely do not need to exclude anyone at this stage of the game! This page only seemed to have "exclusion" filters for users or groups.
    – Matt
    Mar 13, 2012 at 19:44
  • 1
    You might want to edit the Connection itself and make sure that it auto-detected the right forest and that it is accessing AD with an account that has the proper permissions
    – Dave Wise
    Mar 13, 2012 at 20:04
  • Thanks, I sent in to my AD people to ask them just that, about the permissions. We only have the one forest.
    – Matt
    Mar 13, 2012 at 21:28
3

Thanks for the helpful suggestions!

I ended up following the Rational Guide to Implementing SharePoint 2010 User Profile Synchronization and that eventually solved my problems. At the end of the day it was the fact the user set up to do the actual AD synchronization did not have all the right permissions to do its job.

It turns out the user doing the actual synchronization needs to have replicate directory access to both the AD OUs being copied AND to the Configuration Partition. It was the configuration partition aspect of the permissions that was missing for the longest time.

Improve this answer
1
  • This is only required if the FQDN of the domain is different from its NetBIOS name. For example, users login using Domain\username while their FQDN for the domain suffix is DomainXX.yyy. In this case permission on Configuration Container is a must. Also "NetBiosDomainNamesEnabled" should be then set to "1"
    – Joseph Saad
    Jul 12, 2016 at 22:28
3

I struggled with this for about a week and did all the configuration steps I could find (Delegate Authority in AD, Enable NETBios names, create and configure a new UPS, make a new UPS connection, do the sync, etc.).

After doing all that my AD users were still not synching to SP 2010. Finally, I installed SP Server 2010 SP1 and simply tried doing the sync again (no new configurations) and voilla! All users were imported.

Improve this answer
2

Have you set up the User Profile Service Application to sync?

http://blogs.msdn.com/b/russmax/archive/2010/03/20/sharepoint-2010-provisioning-user-profile-synchronization.aspx

Improve this answer
1
  • Yes, it is supposed to automatically sync at 1am every day, and I have manually run full synchronizations on it about 50 times.
    – Matt
    Mar 13, 2012 at 19:45
2

User Profile Service Importing User Profiles from AD This is what is required of the service account:

  • Domain User Account Additional permissions are automatically granted for the server farm account on web servers and application servers that are joined to the farm
  • This account is automatically added as a SQL Server Login on the computer that runs SQL Server, and following SQL Server security roles are assigned:
    • dbcreator fixed server role
    • securityadmin fixed server role
    • db_owner fixed database role for all SharePoint databases in the server farm
    • Membership in WSS_CONTENT_APPLICATION_POOLS role for the SharePoint Server 2010 Server farm configuration database
    • Membership in WSS_CONTENT_APPLICATION_POOLS role for the SharePoint Server 2010 SharePoint Admin content database
    • Must be given replicate directory services permission at the Forest level
Improve this answer
1
  • Thank you for the late answer and the detailed account requirements but I don't think this is the full picture of what it takes to configure the User Profile Service.
    – Matt
    Jul 3, 2014 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.