Common Issues with Share. Point Server 2. 01. Exchange20128.png' alt='Microsoft Exchange Edge Sync Service Could Not' title='Microsoft Exchange Edge Sync Service Could Not' />User Profile Synchronization. Print posted on Monday, September 2. PMIntroduction. Back about a week after RTM of Share. Point 2. 01. 0 I published my Rational Guide to implementing Share. Point Server 2. 01. User Profile Synchronization. This was actually written up long before RTM and was doing the rounds among a circle of Share. Hi, we have a handful of Windows 7 desktops. Some of them sync time with the domain without requiring any configuration. Others seem to be stuck and will. Learn how to set up your Windows Phone 7, update it Windows Phone 7. How to export favouritesbookmarks from Microsoft Edge Or does it not have this function Thanks. At Microsoft our mission and values are to help people and businesses throughout the world realize their full potential. Find IT pro training and documentation for Exchange Server. Point insiders. I then tweaked it for RTM and pushed it out immediately after the Share. Point Evolutions Conference, where I had demonstrated the steps. Amazingly, this article has already been viewed over 2. Apple says it is working closely with Microsoft to fix an issue that prevents Outlook. Office 365, and Exchange 2016 account holders from sending. An incredible response. Of course the Microsoft documentation in this area is weak at present, and UPS is what you could call a rough edge of Share. Point 2. 01. 0. But even so this is an amazing number. Furthermore the amount of time I spend helping others with UPS related problems as a result has inspired this follow up article which will cover the most common issues people experience. UPDATE 0. Tech. Net has recently updated its Configure profile synchronization Share. Point Server 2. 01. Microsoft Exchange Edge Sync Service Could Not' title='Microsoft Exchange Edge Sync Service Could Not' />I urge you to check this out. Before I dive in, I must stress that the number one reason people have problems is that they do not follow the procedure No really, I cant count the number of times steps have been missed or I get a response like oh, I didnt think I needed to do that. If you follow the procedure you will be successful unless you are hitting an environmental or other known issue. I wont detail all of the known issues in this article, but rather cover the most common ones. The general idea is to have a reference for common queries and so on. I will update this article over time as new things are discovered. Once again I cannot stress how important it is to follow the procedure in the Rational Guide. If you havent, go there firstThis article will use the following definitions for the various components involved UPA The User Profile Service Application in Manage Service ApplicationsUPS The User Profile Synchronization Service Instance in Services on ServerWhy does UPS get stuck on starting Why does it get stuckWell, 1. When we hit Start in Services in Server a series of tasks are run, which are akin to running the second stage of the Forefront Identity Manager setup. Those include things like setting up certificates, windows services, installing database schemas so on. If something is incorrect, it will try all 1. Thats why it appears to be stuck when in fact its attempting each of the runs. Of course this can take a while, hence the appearance of being stuck. After around 2. 0 to 4. Stopped, and you can attempt to start it again. In some cases, the status will remain as Starting even after reboots. In this case something very bad has happened and you are best off throwing away the UPA service application and starting over. Hacking out a solution is not a good idea, and will almost certainly cause you further problems in the future. You can however, manually kick things back to the state before the starting of the UPS service instance. This can be necessary in some cases, but again, I strongly recommend you start clean by deleting and recreating the UPA. Steps to reset the state can be found here. Incorrect Permissions. Incorrect Permissions are the number one cause of the infamous Stuck on Starting behaviour. There are no ways around the account requirements. If you dont set the permissions correctly things wont work, its that simple. There are two accounts we need to configure. The UPS Service Instance Service Identity, i. FIM services run as which is the Farm Account. And the Synchronization Connection account, this is the account which actually performs the sync. The UPS Service Instance Service Identity. Firstly, you must run the UPS Service Instance as the Farm Account. Just because its possible to change the service identity in Manage Service Accounts, doesnt mean it will work, and more importantly it is unsupported. So dont change it. Next, the Farm Account must be a local administrator of the machine running the UPS Service Instance during provisioning only. When we hit Start in Services in Server a series of tasks are run, which are akin to running the second stage of the Forefront Identity Manager setup. Many of these tasks require local machine administrator rights. You must grant this right before hitting start, and more importantly they must be applied. As the Farm Account is running services on your box SPTimer. V4 and the Central Admin app pool we must simulate a log off and log on for the change in rights to be applied. You can do this by restarting SPTimer. V4, or better yet, rebooting the machine. Once UPS is provisioned you can remove the Farm Account from the local administrators group. UpdatePlease note that any event in your farm that requires the UPS service instance to be provisioned will require the Farm Account be a local admin. Such events include the re provisioning of the service instance following the deployment of a Share. Point Cumulative Update and performing a Farm Backup from Central Administration which stops and starts the UPS service instance. Dont forget to ensure that the correct rights are assigned and actually taking effect when planning and scheduling your farm operational maintenance tasks. Also, the Farm Account must have Log on Locally rights on the machine running the UPS Service Instance. Now be careful, you may think the account has these rights, and it will do if you made it a local administrator. However once you remove the admin rights, you may not have Log On Locally. If you dont various operations will fail. The Synchronization Connection Account. The Synchronization Connection Account must have Replicating Directory Changes on the Domain you are syncing with. It is the only way sync will work. Its a hard requirement. Despite the scary name the Replicating Directory Changes permission makes zero changes to AD. It provides a change log capability, which improves the speed of operations such as Sync. If you are syncing with a Windows Server 2. Synchronization Connection Account must be a member of the Pre Windows 2. Compatible Accessgroup. If you wish to do an Export, the Synchronization Connection account must have Create Child Objects and Write permissions on the OUs you are syncing with. Watch out for a common gotcha, that these rights are set on the container level only, you must ensure that This object and all descendants is selected. So there you have it, a summary of the rights required. 50 Stylish Themes For Windows Xp here. What if you are not the domain administrator Well before you start, ask for proof in the form of a screenshot that they are set correctly. Make sure you verify these permissions before you start working in Share. Point. Over and over again Ive seen people waste hours or days on this because they werent. Its also very common to mix up these accounts. Remember the Farm Account runs the service, and the Sync Connection account does the sync. Its not very sensible to use the same account for both. No accounts ever need Domain Administrator privileges to get UPS working. You dont need to log on as the Farm Account ever to get UPS or anything else working. Logging on as the Farm Account is a very, very bad idea and you shouldnt be doing it. You of course require Farm Administrator rights to perform the actions related to the farm, service application administrator rights to perform actions related to the service application, and local machine administrator to perform actions related to the machine configuration detailed below. Health Analyzer Warning Please note, that the Health Analyzer will report an error The server farm account should not be used for other services. This will pop up every week by default. Unfortunately, this Health Analyzer Rule is not smart enough to understand that you have to run UPS as the Farm Account. Therefore this error with respect to UPS only should be ignored.