0

Running SharePoint Server 2016 with MinRole.

  • I looked on Manage services on server and Secure Store Service was Started and Compliant=Yes,

  • also under Manage Service Applications, Secure Store Service
    Application Proxy Status=Started,

  • so only the SSS Application is showing Status=Error

and I don't know why. I was unable to find any error related to this in Event Viewer in the Server neither.No failed jobs in Jobs History. Any ideas about why is this happening and how to change the status from Error to Started?

SSS Error Status

  • 1
    Have your tired to re-provisioned it again? – Mohamed El-Qassas MVP Nov 9 '18 at 16:20
  • can you share the screen print (where it shows error)? – Waqas Sarwar MVP Nov 9 '18 at 16:24
  • 1
    I also tried to run on the application server with the farm account get-spsecurestoreapplication -name "Secure Store Service" -servicecontext https://myurl and I got the error "unable to obtain master key". This is a production environment and I don't know for how long this has been with that error status. – MLC Nov 9 '18 at 21:56
  • Added a screenshot, but it is giving me an error when I click on it – MLC Nov 9 '18 at 22:04
0

There are several reasons why this may have happened.

Cause: One or more of the following might be the cause:

1.The master encryption key was not generated after the Secure Store Service application was created.

  1. The master encryption key was deleted.

  2. The secure store database is corrupted.

You need to recreate master encryption key:

To create the master encryption key:

  1. Verify that the user account that is performing this procedure is a Service Application Administrator for the instance of the Secure Store Service.

  2. Click the instance of the Secure Store Service application.

  3. On the ribbon, click Generate New Key.

  4. On the Generate New Key page, type a passphrase string in the Pass Phrase box, and type the same string in the Confirm Pass Phrase box.

REF: https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server-2010/ee924660(v=office.14)

https://social.msdn.microsoft.com/Forums/SECURITY/en-US/835ab326-85db-41c1-9c2a-26371d1c905e/secure-store-service-unable-to-obtain-master-key?forum=appsforsharepoint

  • In my test farm, logged in as the Admin account, made it an Admin in the SSS application with Full Control and I keep getting error described here: link – MLC Jan 28 at 18:59
  • I don't have operational experience with SP2016 so my advise was based on my SP2013 experiences. But it seems someone else on this forum hit your problem and manged to resolve it. Please check: sharepoint.stackexchange.com/questions/228821/… – Marek Sarad Jan 29 at 9:47
  • In the test farm I was able to Generate New Key when running Central Admin as System Account (Farm account) In production I keep getting the same error posted in my link above even with the Farm account. – MLC Jan 29 at 14:08
  • Compare the permissions for the farm account (ie member of local admin group, different access to the config and service DBs) maybe there is a difference. – Marek Sarad Jan 30 at 8:53
  • In production I found in the logs: ChangeMasterSecretKey failed with exception: Microsoft.Office.SecureStoreService.Server.SecureStoreServiceException: SecureStoreServiceApplication has not been provisioned and cannot be used then with the farm account (not server admin) I ran Mngmt Shell and called $sts.Provision() Got error Access denied. Only Machine administrators are allowed to create administration service job definition of type: Microsoft.SharePoint..... – MLC Jan 30 at 13:15
0

SOLUTION: re-provision SSS (as Mohamed El-Qassas MVP suggested), but I discovered the following 2 prerequisites had to be met (which I was missing before):

  1. Farm account has to be in the Admin group on both MinRole Servers.
  2. Connect to App Server as the Farm account and run SharePoint Management Shell as Admin

    Run the cmdlets

    #As Status was stuck in Starting in Central Admin
    Get-SPServiceApplication | ?{$_ -match "Secure"}| select status #this returns Provisioning
    $sts = Get-SPServiceApplication | ?{$_ -match "Secure"}
    $sts.UnProvision() #this made Status=Stopped in Central Admin
    $sts.Provision() #this made Status=Started in Central Admin.
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.