JHC Technology's Best Practices for Amazon Web Services

JHC Technology has utilizing Amazon Web Services (AWS) since its beginning in 2010, and is now an Authorized Government Partner, an Advanced Consulting Partner and a Channel Reseller for AWS. 

Not only do we recommend AWS as the Infrastructure as a Service (IaaS) platform for our clients but I am happy to say that JHC has never purchased any datacenter equipment/infrastructure for our internal systems or operations.  

All JHC infrastructure has been deployed in the AWS cloud platform since we started to include:  

• Blackberry Enterprise Server, 
• Exchange
• SharePoint
• Active Directory
• Citrix
• Test/Development environments

Through the course of the last three years, I have been mentally drawing up a list of JHC best practices for deploying solutions/datacenter operations on the Amazon Web Services platform.   Below are a few examples:

• Fail quickly, often, and cheaply.
• Architect a Zero Trust Model for your AWS Solution.
• Own your AWS accounts and use consolidated billing with a trusted AWS reseller.
• Design for Disaster Recovery and High Availability for both AWS infrastructure and applications deployed on AWS infrastructure.
• Utilize AWS Storage Gate, S3, and Glacier for full lifecycle backup and restores.
• Put in place least privilege administration security policies for AWS Identity and Access Management.
• Do not take a cloud and/or Infrastructure as a Service only posture.  Consider hybrid Cloud solutions that utilize on premise infrastructure, Platform as a service, and/or Software as a Service that integrate with your AWS solution.
• Architect for least viable solution and use business rules to auto scale up and down.
• Deploy your Development and User Acceptance Testing environments on AWS.  Design solution to turn on environments only when needed and automate shut down of environments.
• Deploy your infrastructure inside Virtual Private Cloud that crosses multiple availability zones within an AWS region.
• Decouple compute and storage when possible but realize that most clients’ applications can’t be deployed in this manner.  Consider deploying legacy applications inside AWS and provide roadmap for refactoring to make application more AWS cloud friendly/efficient.

James Hirmas is the CEO for JHC Technology.  He can be reached at jhirmas(at)jhctechnology.com,@JHC_JamesHirmas, or connect with him on LinkedIn.

Excel Calculation Services Won’t Start? Here's a How-To on Making it Work

Recently I was working with a client and they had an issue with Excel Calculation Services. The user had an Excel Web Access web part to display an Excel spreadsheet chart on their site. The web part was throwing a ‘Unable to process the request … Please try again …’ error. 

First, I performed the following tasks to ensure that I wasn’t missing anything:

1. Open SharePoint Central Admin
2. Open “Services on server”
3. Make sure everything looked good there
4. Attempted to stop/restart “Excel Calculation Services” – but to no avail – Same error was still showing on the web part
5. I then decided to look through the MOSS ULS logs as my last and final resort and some interesting errors stood out to me. 

1. ExcelServerApp.ClearTempPath: Failed to create the Ecs temp path.
2. EngineInterop::LoadDll: Failed to load our engine (xlsrvol.dll)

To find these, I looked for “Excel Services Application service is starting” and the errors would directly follow.  

I ended up fixing this issue by performing the following steps:

1. Go to IIS Manager (Start, Administrative Tools, Internet Information Services (IIS) Manager) on the server running Excel Calculation Services
2. Expand the server and Sites nodes
3. Select the site running ECS (SharePoint Web Services in my case)
4. Choose the Authentication icon in the IIS area
5. Choose ASP.NET Impersonation in the list and disable it

Gary Arrington is the Cloud Consultant & SharePoint SME for JHC Technology.  He can be reached at garrington(at)jhctechnology.com or connect with him on LinkedIn.

Migrating Legacy Content into SharePoint 2013

In my most recent client engagement I was tasked with architecting, designing and implementing a SharePoint 2013 build, but the only caveat was that my client wanted to migrate their old legacy file server.

I should feel like my name should be “Migration Dude” as I have been tasked with nothing but SharePoint –related migration work. I am referring to the task of migrating millions of documents from legacy systems into SharePoint 2010/2013. These documents can exist in Wiki’s (which have been hard-coded) to file servers that exist as Linux based to Windows Server 2000/2003/2008. You get the idea.

These days, I am finding that organizations are realizing that there is significant cost savings in leveraging SharePoint as their content management solution as well as ensuring that it is Cloud-based.

I’d like to share some of the Migration Best Practices steps that I have taken over the last couple of years that have helped me along the path to MIGRATION SUCCESS!

End User Impact – SharePoint Migration Servers

Having dedicated hardware that the migration software can exist/live on will help significantly if you have a 24/7/365 customer.  Migration software uses lots of server memory

SQL Server Impact
Heavy performance impacts are noticeable especially when VERBOSE logging is turned on turning a migration. I mean you do want to know what fails and why it failed, right? Ensure that your SQL servers are beefy enough to handle the full amount of throttle you are giving it. Time is money, and migrations are expensive

Resource Metrics - Keep an eye on Performance
Setup counters such as RAM, available disk space, Queue Length ( for the location in which the content databases will reside in). Slowness here is also called Bottle-Necking, which can ultimately affect search and your end-users’ happiness.

Happy Migrating!!!

Gary Arrington is the Cloud Consultant & SharePoint SME for JHC Technology.  He can be reached at garrington(at)jhctechnology.com or connect with him on LinkedIn.

Database Encryption & Application Level Protection

Often times during a SharePoint implementation the topic of data protection comes up, and mostly, we end up leveraging Application Level Protection. In addition to Application level protection there are some database encryption methods that can be applied at the database level to protect the content.

Database Encryption

Below is description about different types of encryption methods that can be applied to protect the database.  With the implementation of SQL Server 2008 or above the best approach to encrypt the data is to use the Full Database level encryption. One of the major benefits of using full database encryption is that applications do not have to rely on built it functions to encrypt /decrypt the data and therefore prevents query slowness. 

 

		Advantages	Disadvantages
Windows BitLocker	This service is available at the Windows Server 2008 and up. This type of encryption protects the data at volume level	·   Minimum impact on disk read/write ·   Volume level encryption protects system data	·   Backups and Logs are not encrypted ·   Logs are not encrypted
File Level Encryption	This service is available at the Windows Server platform. This type of encryption protects the database files. It specifically uses NTFS.	·   Easier to implement since it leverages NFTS platform. ·   Leverages Windows  key management store	·   Backups and Logs are not encrypted ·   Logs are not encrypted. ·   Need OS level administrative access on the server ·   Async  I/O can experience slowness
Cell Level Encryption	This is the legacy encryption method from SQL Server 2005. This type of encryption protects at the field level for the database. SharePoint databases cannot benefit from this type of encryption due to schema restrictions.	·   N/A	·   Cannot use with SharePoint
Full Database Level Encryption	This is new service called TDE (Transparent Data Encryption) that is introduced in SQL Server 2008. All the data get encrypted in the database mdf and ldf files. Only time the data is decrypted is when the information is read and display at the application level.	·   Full database backup ·   Backups are encrypted ·   Transaction Logs are encrypted ·   TempDB is encrypted	·   Encryption puts extra load on the system ·   Application independent. The application is not affected by encryption ·   Data in transit is not encrypted.  SSL can leverage to mitigate data in transit

Application Level Protection

Another level of security can be added to the SharePoint application by leverages Kerberos and SSL authentication. Kerberos and SSL help create a secure communication channel between the server and client. Kerberos authentication is a protocol in establishing trust and provides authentication. Both provide secure communication between the server and client.  Kerberos is available under the Windows platform and is mostly installed on a domain controller. Once the SharePoint architecture is associated to the domain, Kerberos authentication can be activated to provide centralized authentication and ticket granting service.  Kerberos authentication adds another layer for protection to the SharePoint environment. Some of the benefits of implementing Kerberos are following:

• Double hop authentication using delegation.
• Tickets are renewed after a certain time which reduces roundtrips to domain controller. Improves performance
• Authentication at the Server Level

In order to implement Application level protection, SharePoint has to configure at a domain level with Active Directory authentication.

Hemant Datta is the COO  for JHC Technology.  He can be reached at hdatta(at)jhctechnology.com, @hdatta, or connect with him on LinkedIn.

Building Your Own SharePoint 2013 Lab

Recently my wife decided that she had expressed an interest in learning SharePoint, so I said “Hey, there’s no better way to learn than to learning using the latest/greatest technology.” She would have to learn Windows Server 2012, SQL Server 2012 and the SharePoint 2013 Preview.  With that in mind, the goal was to build out a SharePoint 2013 Preview farm in a lab environment that would emulate a small/development environment.

The Prelude

This is not an exact step by step. Some of your own individual research will be needed to perform a lot of the “in-betweens”

The Hardware

The farm was built on my Macbook PRO utilizing Virtual Box. I truly recommend a desktop/laptop with a quad core processor and a minimum of 16GB of ram.

Software Needed

•        Virtual Box

•        Windows Server 2012 Trial

•        SQL Server 2012 Trial

•        SharePoint Server 2013 Preview

The Pre-Reqs

PreReqs can be downloaded via batch script. If you just want to let the SharePoint installer download everything, you can skip this section. If you want to perform an offline setup/install, see below:

• .NET Framework 4.5
• Windows Management Framework 3.0 (CTP2) – PowerShell 3.0
• Microsoft SQL Server 2008 r2 Native Client
• Windows Identity Foundation (KB974405)
• Microsoft Sync Framework Runtime v1.0 SP1 (x64)
• Windows Server AppFabric
• Windows Identity Extensions
• Microsoft Information Protection and Control Client
• Microsoft WCF Data Services 5.0
• CU Package 1 for Microsoft AppFabric 1.1 for Windows Server (KB2671763)

1.     Create a new folder and copy PrerequisiteInstaller.exe and msvcr100.dll from the root folder of the SharePoint 2013 Preview ISO into it. 

2.      Create a subfolder named “PrerequisiteInstallerFiles” and copy all the prerequisites that you downloaded into there. 

3.     Create a subfolder under PrerequisiteInstallerFiles named “NET35″ and copy the contents of the Windows Server 2012 ISO \sources\sxs there.

4.       Create a batch file to install the prerequisites:

@ECHO OFF

set PF=”PrerequisiteInstallerFiles”

REM INSTALL NETFX3

dism /online /enable-feature /featurename:NetFX3 /All /Source:%PF%\NET35 /LimitAccess

REM INSTALL PREREQUISISTES

PrerequisiteInstaller.exe /SQLNCli:%PF%\sqlncli.msi ^

/PowerShell:%PF%\Windows6.1-KB2506143-x64.msu ^

/NETFX:%PF%\dotNetFx45_Full_x86_x64.exe ^

/IDFX:%PF%\Windows6.1-KB974405-x64.msu ^

/Sync:%PF%\Synchronization.msi ^

/AppFabric:%PF%\WindowsServerAppFabricSetup_x64.exe ^

/IDFX11:%PF%\MicrosoftIdentityExtensions-64.msi ^

/MSIPCClient:%PF%\setup_msipc_x64.msi ^

/WCFDataServices:%PF%\WcfDataServices.exe ^

/KB2671763:%PF%\AppFabric1.1-RTM-KB2671763-x64-ENU.exe

5.       Save the batch file to wherever you placed the PrerequisiteInstaller.exe and msvcr100.dll files. 

Create Your Virtual Machines

Create Windows Server 2012 three times.

1. DC1        Active Directory Domain Services and DNS roles
2. SP_CAS_13         SharePoint 2013 running Central Administration Server
3. SPSQL   SQL Server 2012 hosting the SharePoint 2013 databases

Prepare the Domain

1.       Log onto your domain controller VM and add Active Directory Domain Services. 

2.       I used dev.internal for my domain name. 

3.       Configure DNS forward & reverse DNS

4.       Create the following domain accounts

o   SharePoint setup account

o   SharePoint Service Applications service Account

o   SharePoint Web Application Service Account

Install the SQL Server

1. Log onto your SQL Server 2012 VM.
2. Connect the SQL Server 2012 ISO image to the VM and run the setup.exe file located in the root folder.  I did not change any of the defaults.  For “Feature Selection” I enabled/installed ”Database Engine Services” and “Management Tools – Complete”.
3. Create a login for your SharePoint setup account and grant the account db creator and db owner rights.

 Install SharePoint Pre-Reqs

Now it’s time to install the SharePoint Server 2013 prerequisites.  Perform the following steps for the Central Administration VM:

1. Attach the SharePoint Server 2013 ISO to the VM
2. If performing an online (download everything from the internet) setup, launch the PrerequisiteInstaller.exe from the root of the SharePoint installation media/ISO

Install SharePoint Server

 Now it’s time to install SharePoint!  Perform the following on the CA Virtual Machine:

1. Log onto the CA VM using the SharePoint Setup Account
2. Attach the SharePoint ISO
3. Run splash.hta from the root of the SharePoint ISO and select the “Install SharePoint” option
4. “Create a new farm”
5. For the database settings, enter the name of the SharePoint SQL VM
6. When installation completes, launch Central Administration

The configuration wizard will step through setting up shared services, the initial web application and site collection.

Now you have a fully functional version of SharePoint 2013 preview

End the End

It took me longer to write this blog than it did to actually help my wife build out her first development farm. In our next segment we will talk about installing development tools and the such. Stay tuned.

Gary Arrington is the Cloud Consultant & SharePoint SME for JHC Technology.  He can be reached at garrington@jhctechnology.com or connect with him on LinkedIn.

How to Add and Remove Entries From Web.Config Using SPWebConfigModification

Often times during SharePoint Development, we need to store configuration related entries in the web.config file. We can use Property Bag tool from CodePlex, but in case you would like to use a Feature, I have outlined below the steps to create a Feature that will add entries to the web.config for the SharePoint Web Application:

1.       Open Visual Studio 2010
2.       Select New Project  Empty SharePoint Project
3.       Provide a local site and Select "Deploy as a farm solution" option.

4.       Right Click on the "Features" and Select "Add Feature"

5.       On the following screen, provide the Unique Title Name and Description. (Refer to screen below).

(Mostly, developers don't put anything in Description but this information really comes in handy when you are trying to figure out what a specific Feature is supposed to do in terms of functionality)

6.       Right Click on Feature1.Feature and Click on "Add Event Receiver"
7.       Uncomment the "Feature Activated" part of the code

8.       Add the following Code in FeatureActivated Method

This code is added to the following entries in web.config

1. Connection Strings
2. Key Value pair in AppSettings section

For each child node entry provide a specific owner name (like "Smartrider" in my case).We will need this as a reference later on in case you want to remove the entries (we are going to do this during Deactivation)

string value = @"Test"
SPWebApplication webApp = SPWebApplication.Lookup(new
Uri("<URL>"));
SPWebService service = SPWebService.ContentService;
SPWebConfigModification connMod = new
SPWebConfigModification();

connMod.Path = "configuration";

connMod.Name = "connectionStrings";

connMod.Value = " <connectionStrings> </connectionStrings>";

connMod.Owner = Assembly.GetExecutingAssembly().FullName;

connMod.Type = SPWebConfigModification.SPWebConfigModificationType.EnsureSection;

webApp.WebConfigModifications.Clear();

webApp.WebConfigModifications.Add(connMod);
//SQL Connetion String
SPWebConfigModification webConfigMod = new
SPWebConfigModification();

webConfigMod.Owner = "Smartrider";

webConfigMod.Type = SPWebConfigModification.SPWebConfigModificationType.EnsureChildNode;

webConfigMod.Value = String.Format("<add name=\"{0}\" connectionString=\"{1}\" providerName=\"{2}\"></add>", "conn", "Data Source=<datasource>;Initial Catalog=<databasename>;Integrated Security=True", "System.Data.SQLClient");

webConfigMod.Path = "configuration/connectionStrings";

webConfigMod.Name = "sqlConn";

webApp.WebConfigModifications.Add(webConfigMod);
//Add NetworkShare URL
SPWebConfigModification appConfigMod = new
SPWebConfigModification();

appConfigMod.Owner = "Smartrider"

appConfigMod.Path = "configuration/appSettings";

appConfigMod.Name = String.Format("add [@key='NetworkURL'] [@value='{0}']", value);

appConfigMod.Value = String.Format("<add key='NetworkURL' value='{0}' />", value);

appConfigMod.Type = SPWebConfigModification.SPWebConfigModificationType.EnsureChildNode;

webApp.WebConfigModifications.Add(appConfigMod);

webApp.Update();

service.ApplyWebConfigModifications();

• You also want to add code to remove the entry when the Feature is Deactivated. One way to do this is to find all the entries that are inserted by Owner name "Smartrider".

public
override
void FeatureDeactivating(SPFeatureReceiverProperties properties)

{
SPWebApplication webApp = SPWebApplication.Lookup(new
Uri("URL"));

try

{

RemoveEntries(webApp);

webApp.Update();

webApp.Farm.Services.GetValue<SPWebService>().ApplyWebConfigModifications();

webApp.WebConfigModifications.Clear();

}

catch (Exception ex)

{

throw ex;

}

}
//Remove Entries made to web.config by Owner name "Smartrider"
private
void RemoveEntries(SPWebApplication webApp)

{
try

{

List<SPWebConfigModification> entriesToRemove = new
List<SPWebConfigModification>();

foreach(SPWebConfigModification configMod in webApp.WebConfigModifications)

{

if(configMod.Owner == "Smartrider")

{

entriesToRemove.Add(configMod);

}

}

if(entriesToRemove.Count > 0)

{

for (int i = entriesToRemove.Count - 1; i >= 0; i--)

{

webApp.WebConfigModifications.Remove(entriesToRemove[i]);

}

}

}

catch

{

throw;

}

}

9.     Deploy the code and check the web.config file to verify your entries.
10.   Done

Hemant Datta is the COO  for JHC Technology.  He can be reached at hdatta(at)jhctechnology.com, @hdatta, or connect with him on LinkedIn.