Corey Roth [MVP] : User Profile Service

User Profile Service Error: Unable to process Create message

CoreyRoth — Tue, 29 Mar 2011 21:54:12 GMT

I’m adding another entry to my series of posts on User Profile Service Application errors in SharePoint 2010. This particular error occurs after you pick the Active Directory OUs you want when creating a synchronization connection. Specifically when trying to save the new connection, you might receive the following error.

Unable to process Create message

There are a variety of causes to it, but I wanted to share my specific resolution today. I received this error after I went from December 2010 CU to February 2011 CU. Although, upgrading to the latest CU resolved my error from earlier, it presented the new one I mentioned above. When I applied the February CU, surprisingly, the User Profile Service did not require reprovisioning. However, every time I tried to save my synchronization connection, I received the error. Finally, to resolve the issue, I deleted the User Profile Service application and recreated it. Once I did that, I restarted UPS and was able to create the connection.

User Profile Service Error: UpdateILMMA: Failed to update password.

CoreyRoth — Tue, 29 Mar 2011 18:21:05 GMT

We all know that @Harbars wrote the book when it comes to SharePoint 2010 User Profile Synchronization not to mention how to get it working again. You need to follow the instructions in these guides word for word when setting up UPS Many issues are caused by incorrect permissions. I thought I would share the error you receive when you happen to miss one of the required permissions. You will find this error in the ULS logs during the provisioning process. I thought this was worth posting because I couldn’t find anything out there on this error at the time.

UpdateILMMA: Failed to update password. Exception: {1}.. Available parameters: Microsoft.ResourceManagement.WebServices.Client.PermissionDeniedException: Access to the requested resource(s) is denied
at Microsoft.ResourceManagement.WebServices.Client.ResourceTemplate.GetResource(UniqueIdentifier identifier, String[] attributeNames, Nullable`1 resourceTime)
at Microsoft.ResourceManagement.WebServices.ResourceManager..ctor(UniqueIdentifier resourceIdentifier, String typeName, String[] attributeNames, CultureInfo locale, Boolean includePermissionHints, TimeZoneInfo localTimeZone)
at Microsoft.ResourceManagement.WebServices.ResourceManager..ctor(UniqueIdentifier resourceIdentifier, String typeName, String[] attributeNames, CultureInfo locale, Boolean includePermissionHints)
at Microsoft.Office.Server.UserProfiles.Synchronization.MAConfiguration..ctor(Guid resourceIdentifier)
at Microsoft.Office.Server.UserProfiles.Synchronization.ILMMAConfiguration..ctor(Guid resourceIdentifier)
at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.UpdateILMMA(String databaseServerIlm, String databaseInstanceIlm, String databaseName, String domain, String userName, SecureString password) .

Obviously from the error message some kind of permissions are required that weren’t present, but which ones? Well in this particular case, it is the result of the farm account not having log on locally permissions (clearly mentioned in Harbars article). Here are a couple of things to keep in mind. First, just because you have administrator access during provisioning does not mean you have log on locally permissions. Second, even if you add the account to the Allow Log on Locally item in Local Security Policy, does not mean you actually have the permission. In many cases, organizations have service accounts locked out using Group Policy which overrides any Local Security Policy setting.

If you suspect you might not have permissions, you can verify it in a number of ways. Although, it is never recommended to login with a farm account, if things aren’t working, you might as well break the rules and try logging in. Usually, what I do is go to the SharePoint Management Shell, hold down Shift, and right click the icon to see the Run as different user menu item. Type the credentials in for your farm account and see if it works. If you have the right permissions, the PowerShell prompt will open. If you don’t, you will get an error saying you are denied the right to login (or something to that effect). Be careful when attempting this because if you lock out your farm account, you will bring your entire SharePoint farm down.

Anyhow, I hope this helps. I feel the more information on errors I can post, the more it might help people that receive them later.

Method not found: 'Int32 Error with User Profile Service Application

CoreyRoth — Tue, 29 Mar 2011 16:37:51 GMT

Recently, when I was trying to configure a User Profile Synchronization Connection in SharePoint 2010, I received the following error message when clicking the Populate Containers button.

Method not found: 'Int32 Microsoft.Office.Server.Administration.UserProfileApplicationProxy.get_LdapConnectionTimeout()'.

I double checked my credentials and tried again, but I received the same error message. After doing a ton of searching on the Internet, the results were pretty much inconclusive. When I looked at the current patch level of the SharePoint installation, I discovered it was on December 2010 CU. Having heard enough bad feedback about this particular cumulative update from others, I proceed to update to February 2011. I installed the update on each server and ran the configuration wizard. I then proceeded to try the Populate Containers button again. Sure enough, it worked this time. If you happen to receive this cryptic error message, try updating to a newer cumulative update to see if it resolves the issue.