You should never try to start those Forefront-Services via Services-Console. This will never fix anything related to UserProfileService.
First try to get rid of the "Starting" state via PowerShell:
Add-PSSnapin Microsoft.SharePoint.Powershell
$TypeName = “User Profile Synchronization Service”
$ServerName = “SERVERNAME” #Replace with your server name where the service is stuck on Starting
$Serviceinstance = Get-SPServiceInstance | where-object {$_.TypeName -eq $TypeName -and $_.Server.Address -eq $ServerName}
$Serviceinstance.Unprovision()
Before you continue to troubleshoot: Do you REALLY need UserProfileSyncService? This is only required if you want to import some special attributes (e.g. UserPictures from AD) or if you want to export attributes from SharePoint to AD. If not, you should consider using AD Import instead of UPS-Sync.
Update to the answer after your two comments:
- You want to synchronize attributes from ActiveDirectory to SharePoint. You want them to be displayed on Users MySite or ProfilePage. This can be achieved with AD-Import, except some attributes like Picture. No need for SyncService.
- Synchronizing attributes from SharePoint to AD requires SyncService. BUT: There is one huge huge drawback in this function. If you enable AD-Export for an attribute, it blindly pushes from SharePoint to AD. Especially it won't check which side was edited recently. So the selected attributes to export must exclusively be edited in SharePoint MySite or UserProfileService. If you edit the attribute in AD directly, the change will get lost at the next Sync-Schedule. This makes it unusable in most customer-scenarios.
Do you still want SyncService? If yes, let us know. Then we will continue troubleshooting.
Update 2 after more comments:
can you please provide more details?
I was not able to find a good blog-post about the blind push. I will try to explain on an example:
- You configure the property "Job title" to be exported from SharePoint to AD.
- With the next sync, all AD-Users will get updated with the "Job title" from SharePoint. SharePoint does not check anything. It just writes the values from UPS to AD. I had one extreme example: SharePoint UPS was never filled with values from AD. So all "Job titles" where empty in SharePoint, but they where really well maintained in AD. Now the Write-Sync for the attribute was configured on SharePoint. SharePoint blindly deleted all Job titles in AD because SharePoint didn't have any values when enabling the feature.
- The answer for this problem: First do an initial import for a property, then enable AD-Export.
- After you got behind this, the blind sync from SharePoint to AD will hit you in another situation: If an AD-Administrator updates the "Job title" via AD-Console, the old value in SharePoint will be written to AD. So you need to update the value in SharePoint and not in AD. This will disappoint lots of Domain-Admins.
if we do not grant the SP farm user any additional permission on the AD server (such as Create all child object or write all properties) then data will not/can not be pushed from SP to AD
- Yes, the account will not be able to write to AD without granting "write properties". Just enabling "Replicating Directory changes" will not make it able to write to AD. You should also check that the farm-account was not accidentally added to Domain-Administrator group.
- UserProfileSyncService will also not write attributes to AD unless you configure a property from direction "import" to "export".
