ISSUE: KB2844286 RESOLVED with Update KB2872441

Microsoft has finally released an update to the KB2844286 issue with SharePoint. That update is linked below.

http://support.microsoft.com/kb/2872441

We have installed it in our DEV environment and have verified the issue is fixed within our farm. I have also confirmed that you must still have KB2844286 installed and then install KB2872441 as you will still need the other security related patches from KB2844286 (or KB2844285, or KB2844287 depending on OS)

My original post can be found below as I am still updating that post as I get updates.

ISSUE: KB2844286 Security Update on SharePoint 2010

Advertisement

ISSUE: KB2844286 Security Update on SharePoint 2010

Came in today to find the following error message showing up on seemingly random web parts and lists throughout our SharePoint 2010 Foundation farm. ULS Logs on the servers weren’t very helpful.

[This issue has been RESOLVED see updates below]

For the sake of search indexing, here is the text version of the error we are getting.

Unable to display this Web Part. To troubleshoot the problem, open this Web page in a Microsoft SharePoint Foundation-compatible HTML editor such as Microsoft SharePoint Designer. If the problem persists, contact your Web server administrator.

We quickly tracked it down to a Security Update that was applied to our web front end servers last night. Check the OS below to find the KB update associated with your server.

Windows XP and Windows Server 2003

• KB2844285

Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1

• KB2844286

Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2

• KB2844287

This is in regard to the following Microsoft Security Bulletin for July 2013

Microsoft Security Bulletin MS13-052

As a temporary workaround, we found uninstalling the update (KB2844286) from your servers (all WFE’s and App servers) then performing an IISReset on the servers will resolve the issue. Several others have experienced this issue as noted in just one of many forums such as the one below

http://social.technet.microsoft.com/Forums/sharepoint/en-US/cc9a557b-93cd-40d5-965c-e0a2f107624d/unable-to-display-this-web-part-error-message-after-patch-kb2844286

If I find there is a solution better than uninstalling I will update this post to reflect that. As of right now, uninstalling this update is the best option.

[Update 7/16/2013 3:40pm]

It appears the error typically appears when a list or web part view has had the XSLT customized. At least in our Farm, that has been the common behavior.

[Update 7/17/2013 10:03am]

Not much of an update, but I’m awaiting contact from our Microsoft TAM to see about this issue. If we don’t hear from them soon, then we’ll be opening a ticket with Microsoft. Luckily we were able to work around the issue by uninstalling.

[Update 7/17/2013 12:50pm]

I just received confirmation from our TAM that Microsoft is aware of 2 issues regarding the patch noted in this article above. One of which appears to be the SharePoint issue we’re having.

[Update 7/17/2013 2:43pm]

Just spoke with our Microsoft Sr. Support Escalation Engineer assigned to our premier support ticket and here is their response (summarized).

“Our product group is currently working on the updated patch. We have no ETA for the new release at the moment.”

Looks like we wait then for a resolution.

[Update 7/17/2013 2:59pm]

One more confirmation from Microsoft Support and a link to the forum MS is using to track the issue publicly. No public information just yet beyond that, however.

“Both the SharePoint and .NET product groups are aware of the issue and they are in the process of fixing the patch.”

Follow the issue at this TechNet Forum

[Update 7/18/2013 9:24am]

So far I have heard of no updated patch being released yet by Microsoft. There were two MS Security Bulletin updates but it doesn’t appear they were related to this issue as they were for Bulletin MS12-006 and MS12-052.

[Update 7/21/2013 12:36pm]

Still no updated patch. Received an e-mail from our MS Support representative and they indicated they too have no ETA on any updates to the security patch. I guess I’d rather they take their time then rush an update out all to break something else. It would be a good idea if Microsoft were to either add a note to the update download page indicating the issue, or just pull the update altogether.

[Update 7/24/2013 8:28am]

I just got a message from our Microsoft Support representative and she informed me there is no update as of yet on a new download for the patch. No surprise there.

[Update 7/25/2013 7:50am]

As you can see from the comments that have arrived thus far, it appears Microsoft has provided a fix to the KB2844286 issue. We are in the process of testing it out in our DEV environment now. Let’s hope it fixes it and doesn’t cause more issues.

[Update 7/25/2013 8:22am]

I am at this point, comfortable with counting this issue RESOLVED. We’ve tested it in DEV and the solution resolves the problem and doesn’t seem to break anything else. We won’t be able to complete the resolution in our Production environment until after hours as we will have to re-install KB2844286 which will require a reboot and the patch requires at the very least an IISRESET.

Go to http://support.microsoft.com/kb/2872441 to download the update. Note: You will need to run an IISRESET for the update to take effect after installing.

Configure Kerberos for SharePoint 2010

Cerberus or Kerberos, in Greek and Roman mythology, is a multi-headed hound (usually three-headed)which guards the gates of the Underworld, to prevent those who have crossed the river Styx from ever escaping. more

Configuring Kerberos Authentication in SharePoint 2010 has gotten a bad reputation for being too hard to do so many, if not most, stick with the standard NTLM authentication. Even Microsoft recommends this. For many instances, this may be fine, but if you require Kerberos, I recommend using the below document from Microsoft to guide you through the configuration of Kerberos.

Configuring Kerberos Authentication for Microsoft SharePoint 2010 Products (Download)

How do I know if I should use Kerberos or NTLM?

This is a good article that lays out why you would use Kerberos. Click Here

Some keys to remember when setting up Kerberos is the people or technologies you will need to work with.

In a typical enterprise, you will need to speak with the following folks.

• Active Directory Administrators (Create SPN’s & KDC configuration)
• Load Balancing Administrators
• SSL Encryption (external or internal)

If you are the administrator of all of this, then your job gets easier and harder, because now you have to know how to do all of this. The above document, however, walks you through the process step by step and then shows you how to effectively test to ensure the configuration is working.

Basically there are 5 steps to configuring Kerberos (not including SharePoint Installation)

1. Create SPN’s – Info
2. Configure account delegation
3. Configure SSL
4. Configure Load Balancing
5. Configure Web Application

The process is more complex than just 5 steps, but those are the basic aspects of the configuration. Ensure you follow the above document and don’t get bored by all of the content within. They get a little too much into their scenario for configuration which is can be confusing. The naming scheme for service accounts and Service Applications are so similar it’s easy to get lost in the document.

I recommend you read through the document once or twice before starting, create an action plan that shows your step-by-step process before you begin then execute. More importantly, research and truly analyze whether your implementation really requires Kerberos or you can get by with just NTLM.

Once you’ve made it through, you’ll find it’s much easier than even the document makes it out to be. Sometimes these documents are much too wordy.

Leave your comments about your experiences with configuring Kerberos authentication for SharePoint 2010.

Error: SharePoint 2010 Configuration Wizard

I ran into the below error today while installing the April 2012 Cumulative Update (KB 2598321) for SharePoint 2010 Foundation.

I figured I would post the resolution for anyone who happens upon this issue as well and for my own sake, since I’m constantly forgetting the parameter to run. The resolution isn’t specifically just for the April 2012 Cumulative Update. It can be used anytime you see this error.

WARNING: Backup your farm prior to installing Cumulative Updates and running the Configuration Wizard.

What Happened?

Architecture: 2 WFE/APP (load balanced), 1 SQL

Scenario: Installed CU on both WFE’s and ran Configuration Wizard on the primary server first. Attempted to run on the 2nd server and received the error above.

Impact: When the configuration wizard fails, it may then take your WFE offline until you can get this resolved.

Resolution: Run the following PowerShell command on the affected server

psconfig.exe -cmd installcheck –noinstallcheck

 WARNING: Ensure you understand what this command is doing before you perform it on your production servers. Click Here for more information on PSCONFIG.

 

You may need to re-run the configuration wizard to ensure all is functioning but this should bypass the installation check which will disregard the error you saw above.

 

Hopefully this helps you if you have this error.

 

Thank you to @AviSuj for reminding me of these parameters.

Clean Deploy of Central Admin

SharePoint 2010 is a really fun platform to administer, but configuring it can be a challenge, both technically and socially. If your organization is like mine and has a team of DBA’s administering your SQL instance/s for SharePoint, you’ll want to know how to deploy SharePoint 2010 as clean as possible.

What is a Clean install of SharePoint?

SharePoint 2010 can be installed and configured in a very short amount of time using the configuration wizards which basically will do almost all of the work for you. If you value your relationship with your DBA’s… DON”T DO THIS!!

Using the configuration wizard will inevitably create a slew of SQL databases with horrible names that include a long GUID at the end. This can be a real nightmare for maintenance and just plain ugly. (see below)

This is default SharePoint 2010 Foundation Database configuration. Standard/Enterprise are much worse by default.

This article will just address that of deploying and configuring the SharePoint Farm and Central Administration web application so as to keep that aspect of the installation clean.

This is what SharePoint 2010 Foundation could look like with some extra effort. Standard/Enterprise can be cleaned up as well.

If I can’t use the wizard, what do I use?

In order to do this, you will need to use the SharePoint 2010 Management Shell to do this as there is no clean way of doing it via a GUI interface that I know of.

But don’t get too nervous just yet, because even though it’s powershell, it’s pretty easy, and if you follow my steps, you can do it with little to no powershell experience. Leave a comment if you’re interested in downloading a script that makes these steps even easier.

NOTE: I highly recommend you familiarize yourself with PowerShell if you plan on administering SharePoint.

SQL Steps

• Install SharePoint on your server
• Skip to SharePoint Steps Section if not using Pre-Created Databases (i.e. are you or DBA’s creating empty databases, if so continue to next step)
• Run SQL Server Management Studio 
• Connect to SQL Instance SharePoint will reside
• Click New Query
• Enter the following commands

CREATE DATABASE “SharePoint_Config” COLLATE LATIN1_General_CI_AS_KS_WS
CREATE DATABASE “SharePoint_AdminContent” COLLATE LATIN1_General_CI_AS_KS_WS

• Press F5 key when ready to execute
• Verify the new Databases “SharePoint_Config” and “SharePoint_AdminContent” were created successfully

SharePoint Steps

• Navigate to Start > All Programs > Microsoft SharePoint 2010 Products > SharePoint 2010 Management Shell
• Enter the following command (Replace < > entries with specified info)

psconfig.exe -cmd configdb -create -server <“SQLServerName/Instance”> -database “SharePoint_Config” -user <“domain\username”> -password <“password”> -admincontentdatabase “SharePoint_AdminContent” -passphrase <“PassPhrase”>

• Ensure the command completed successfully (see image above)
• Now enter the following command to configure the Central Administration Port (You could proceed using the Configuration Wizard if preferred)

psconfig.exe -cmd adminvs -provision -port <“Port”> -windowsauthprovider onlyusentlm

• Click Start > All Programs > Microsoft SharePoint 2010 Products > SharePoint 2010 Central Administration
• Ensure the site comes up

You’re now on your way to a happy and clean SharePoint 2010 installation and a happy team of DBA’s

Again, if you’re interested in getting a script from me that performs this for you so all you need to do is enter your specific information please leave a comment and I’ll ensure I get it to you.