1

I'm getting crazy trying to activate UPSS in my environment. First I tried to use SharePoint Active Directory Import in order to synchronize my AD users to SP. After reading some articles concerning problems with user images I tried to switch to SharePoint Profile Synchronization.

I managed to get UPS and UPSS running, but immediately after starting UPSS my Profile Synchronization Status gets into "synchronizing" mode (even if there is no connection yet).

I stopped the timer job to be able to create a connection and restarted it. However nothing happens. State is "synchronizing" again but it's just stuck. MIIS doesn't show any updates as well. When trying to click on "stop" it will try stopping forever and I have to kill UPSS again.

What I already tried:

  • IIS reset
  • Restart UPS and UPSS
  • Start UPSS on another SharePoint Server
  • Restart timer job

As soon as I switch back to SharePoint Active Directory Import everything works fine again. However I want to import users profile images so I have to use SharePoint Profile Synchronization.

Environment:

  • Windows Server 2008 R2
  • SharePoint 2013 Enterprise (all Updates installed)
    • 1 Application Server
    • 1 WebFrontEnd Server
    • 1 SQL Server (2012)
    • 1 OWA Server

Here you can see how it looks. The users already listed are from the first connection (SharePoint Active Directory Import)

ProfileSync

UserProfileService

Improve this question
5
  • Is there anything to be seen in the ULS, Event Viewer or MIIS?
    – TempaC
    Dec 9, 2015 at 15:28
  • 1
    Thank you for your hint. Didn't take a look at Event Viewer so far. There is an entry "Access to the requested resource(s) is denied". I don't know how to solve this, since I used the "spfarmadmin-account" and administrative rights on the profile synchronization server are granted.
    – Morris K.
    Dec 9, 2015 at 15:59
  • Does it specify what resource? Make sure to check whether the used accounts for the User Profile Synchronisation Service have the correct permissions. Most of the time this is a permission problem. Check if the NetBIOS name of the domain differs from the fully qualified domain name.
    – TempaC
    Dec 9, 2015 at 16:02
  • 1
    Hm, in the details pane there is a String which obviously referes to an serviceinstance. I tried to find out which one it is but the object seems not to exist (Get-SPserviceinstance -identity 12345)? However I'll double check my securitysettings tomorrow morning and keep you up to date.
    – Morris K.
    Dec 9, 2015 at 16:17
  • I would also recommend using procmon to identify possible permission related issue. Also it doesn't hurt to run psconfig.exe -cmd secureresources to reassure all permissions are set correctly.
    – Andreas
    Dec 9, 2015 at 17:18

2 Answers 2

Reset to default
1

Does [spfarmadmin-account] have Replicate Directory Changes permission on the domain?

https://technet.microsoft.com/en-us/library/hh296982.aspx#RDCdomain

enter image description here

Improve this answer
1
  • Thanks for your response too! Yes, I've given the Replicate Directory Changes permission yesterday. What however seems strange to me is when I click trough the "Delegate Control-Menu" in AD the checkbox is emtpy again?
    – Morris K.
    Dec 10, 2015 at 7:33
1

I was finally able to find a solution. I completely deleted the User Profile Service (Manage Service Application) and recreated it. The new configuration was exactly the same. The only difference was that I have opened incoming connections for Distributed Transaction Coordinator (TCP Incomeing) on the server running UPS/FIM services. According to an article i found this is required for named SQL Server instances.

I'm not sure if this was the reason or if there was another miss configuration in the original User Service Application or the firewall port. However it works fine right now!

Thanks guys for your hints!

Improve this answer
1
  • Could you please cite the important part of the article you mentioned and add a hyperlink as reference to that article. And don't forget to mark this answer as accepted (after 48 hours), so that it doesn't pop up as "unanswered question" anymore. Help Center > Can I answer my own question?. Thanks.
    – jcp
    Dec 11, 2015 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.