Jack of all that is Microsoft, Master of None

July 24, 2008

Got Long MOSS Service Account Names?

Are you planning on creating and using some long-named MOSS service accounts?  Maybe something like TestMOSSMySiteAdmin01 or TestMOSSSSPAppPool01?  Well if you do, then take note – I’ve had two separate occasions where I have an AD account with more than 20 characters as the username, and MOSS isn’t happy about it.  I ran across this a while ago at a client site and thought it was something wrong with their environment, and let it slide… but my buddy and fellow B&R colleague Mr. Bob Fox ran into this yesterday, and was quite surprised that this happens.

So here’s the deal…

You’ve got your account, ‘TestMOSSMySiteAdmin01’ – you go and create it in Active Directory, typically by just specifying the Full Name & User Logon Name, and your screen looks something like this:














Notice a couple of things here:

§  The user logon name is exactly what I want – the full account name.

§  But the ‘User Logon Name (per-Windows 2000) has been truncated by one character (character #21)

So now we hop over to our MOSS environment, as we want to bring up a new Web Application for our MySites, and use this account.  We run through the typical web app setup, and specify the full username:






But when we submit this information, we get a username/password combination error:



Event thought I’ve entered everything correctly. 

So after ripping my hair out, this is where the Active Directory account’s User logon name (pre-Windows 2000) comes into play.  From what I can tell, this is what MOSS is using when you input a username – so in this case, I have to truncate the name of my service account in the web application setup form:


Notice that I had to cut off the last number – to match what AD was showing.  Now, when I submit this, my web application gets created properly.  And to verify that it took the shortened name, I open up IIS, and voila – using the truncated account logon name:




And while I’m running Server 2008 with IIS7, I have confirmed this is the same on Server 2003 with IIS6. 

So in the end, the moral of the blog post is that whenever you can, keep your service account names to under 20 characters.  If you can’t beware of this issue.


Technorati Tags:
, , , ,


June 8, 2008

Some Happenings, New CodePlex Project and More

I’ve been swamped with a few big projects lately, but I wanted to alert everyone to a couple of happenings:

  • I’m down at TechEd 2008 IT Pro this week in Orlando until Thursday afternoon with a few other members of the B&R Team – Jason Medero, Michael Lotter, Bob Fox & Josh Carlisle.  If you’d like to get together with any of us and talk SharePoint, feel free to ping me on the blog or via email – chrisr (at) bandrsolutions (dot) com.
  • Monday night is the famous ‘SharePoint by day, SharePint by Night’ event… more information on it can be found here on Bob’s blog and here on AC’s.  I’ll be there with the guys mentioned above.
  • Jay will be running the SharePoint 2003 -> 2007 Migrations Birds of a Feather session on Wednesday, June 11 at 6:30PM… it will run about an hour, and Jay will be more than happy to stay after and answer all of your questions (as long as you take him out for a drink).  Jay has done more migrations then I can count at this point, and all of different sizes.  He is a great resource to talk to (or bring it to your shop) if you need some assistance. I highly recommend this BOAF session if you are thinking of making the jump to 2007 from 2003, or you are in the middle of it.
  • My BOAF session – ‘Microsoft Office SharePoint Server 2007 and Windows Server 2008: What a Match’ is on Thursday, June 12 at 10:30AM.  Some more information on this session:  “With the launch of Windows Server 2008, there have been many discussions in the SharePoint community around whether or not SharePoint farms should be upgraded to the latest and greatest server operating system, or if administrators should take the “wait and see” approach. Based on experience so far, the answer is pretty clear—by upgrading, your life as an administrator is going to be made easier, and you will see performance gains with SharePoint. This Birds-of-a-Feather session focuses on both the technical and business drivers for upgrading sooner instead of later, and how you can go back to your manager and make a convincing argument… one that will not only save you time, but will end up helping your organization as well.”  I hope to see you there!

And then on another note, I’ve been working with Josh Carlisle on the AMD Developer Cental site, http://developer.amd.com, and Josh just released a really cool feature – ‘SharePoint Smart 404’ on CodePlex, which got its roots from the work we’ve done for AMD.  Essentially, instead of giving your users the same old boring 404 page when they type the wrong URL, the ‘smart 404 page’ will provide them with search results based on the url they were trying to hit.  To see an example of this in action, try hitting the site http://developer.amd.com/processors – this Processors site doesn’t exist – but note that you now have relevant search results around the word ‘processors’ (note the ‘Best Bets’ area).  I look forward to contributing to this project.

Until the next post,

Technorati Tags:
, , , , , , ,

April 16, 2008

Web Content Management – Allow reviewers to see drafts and nothing else


You have a public-facing site with WCM/Publishing enabled.  Active Directory authentication is used for your content creators, editors & approvers.  Your anonymous users can browse most portions of the site without logging in, however, there are some areas where they login using forms-based authentication.

Your pages are constantly undegoing changes, and you need to create an account that has access to review the draft version of pages, however, you do not want them to see the Site Actions button or the Page Editing Toolbar, or have the ability to create any new content.  Essentially, they are the most basic of content reviewers – the only ‘elevated permissions’ they have over an FBA user is that when they browse the site, they see the latest draft of every page, instead of the latest published version.

The Typical Solution

So in most situations, you would turn content approval on within your page libraries, and then add this user to the <SITE> Members SharePoint group, where they would be granted contributor rights, and could review the page drafts.  They would be able to edit the drafts, but since content approval is turned on, anything they modify won’t go anywhere without approval.  But they are contributors, and can create new content (that they cannot publish), and they still have access to the Site Actions menu, even if the functionality available to them is significantly limited.  In the majority of cases though, this setup works exactly as needed for most organizations.

Our Scenario’s Solution

In our case, we need to create a new Permission Level:

1.  Browse to Site Actions -> Site Settings -> Modify all Site Settings -> Advanced Permissions.

2.  Click Settings -> Permission Levels.

3.  Click on the actual ‘Contribute’ link.

4.  You will now be presented with a page listing all of the permissions for contributors.  We want to make a copy of this permissions set, and then modify the new permission level.  Scroll down to the bottom of the page and click on Copy Permission Level.

5.  A new page will appear where we can now customize our new permission level.  Give this level the name of Draft Reviewers, or whatever you see fit.

6.  Then, make sure only the boxes checked in the images below are checked on your page.  This will ensure that any users granted this Draft Reviewers permissions level will be able to see drafts but not do anything else ‘elevated’ within the site.  Once you have checked (and double checked) your settings, click Okay.

7.   Once the permission levels has been created, go back to Permissions in your breadcrumb.

8.   Now we need to create the SharePoint group that will hold these Draft Reviewers and also assign them the permissions set we just created.  Click on New -> SharePoint Group.

9.  Give your group a name (such as Draft Reviewers) and then make sure you check the box next to the new permission level we just created:

10.  Click Okay – and congratulations, your new group is created with the proper permission based on the scenario above.  Now, add your users to the group, and when they log into the site, they will see all of the pages in draft form, but perform any other type of content management process or administrator function.

 Technorati Tags:
, , , , , , ,

Blog at WordPress.com.