User Profile Synchronization Service Won't Start After Installing December 2011 CU

Question

User Profile Synchronization Service won't start fter installing December 2011 CU. It was working fine prior to installing the CU. I have seen suggestions to delete and recreate the user profile service. Will I lose any data if I try this?

Any advice?

Answer 1

  What error messages are you having in Event Viewer regarding User profile service application? FIM services are started or stopped?

Have you checked the SharePoint logs in verbose mode for errors and exceptions regarding UPA?

If we cannot fix it and you want to reinstall it you can use the following steps:

•           First thing use farm account for this service application
•           To uninstall UPA  -go to Central Administration – Manage services on server and stop both services User Profile Service and user Profile Sync Service
•           Check if both FIM services are stopped - start -> Run-> services.msc-  (startup type should be automatic for those services)
•           Delete the user profile service application with associated databases
•           To install UPA – go to Central Administration - > Manage services on server -> start user Profile Service
•           Recreate User Profile service application
•           Start user Profile Synchronization service
•           Check if both FIM services are started

---

MCITP|MCTS SharePoint| SharePoint Performance blog

Answer 2

Hi.

"Delete the user profile service application with associated databases" will delete all changes your users have made to their userprofiles.

Part from that, you should save the time of t-shooting by reinstalling and starting over.

For guidance I would refer you to the best guide there is:

http://www.harbar.net/articles/sp2010ups.aspx

Regards

---

Thomas Balkeståhl - Technical Specialist - SharePoint - http://blksthl.wordpress.com

Answer 3

So, the FIMSynchronizationService keeps stopping. I can start it. Then, as soon as I try to start the UPS Service it stops again. Event ID 6203 shows:

Verify that the service account has permissions to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Identity Manager\2010\Synchronization Service

I have confirmed that the sp_farm account (which the FIM serving is using as its logon account) has Full Control and Read access to the registry key specified above. I've been through all of the steps at harbar.net. This was working fine up until I installed the CU.

EDIT: One more odd thing that I noticed... the User Profile Sync Service shows that it is using an applicaiton pool called User Profile Sync Service. However, when I look in IIS Manager, no such application pool is listed. Is this normal?

Thoughts?

Answer 4

Hi,

You should not try to start FIM service manually, SharePoint will do that for you. What you need to do is to take a print screen of your user profile Service application settings! Make sure you have that data before deleting the service. Then you can go ahead and delete your user profile service application, WITHOUT deleting associated databases. This will remove the service application but will keep the associated databases intact. Afterward, delete ONLY the synchronization database from your SQL sever. Then create a new User Profile Service Application and write down exactly the same information that you have in your print screen.

SharePoint will only create Sync database and will use your user profile DB and your social DB. The Sync database will be upgraded to latest patch level. Then you can go ahead and start your User profile synchronization service. Your farm admin account needs to be member of local administrator account during provisioning of the service.

To find out which application pool is used you can use Powershell:

get-spwebapplication | select @{Name = "WebAppName"; Expression = {$_.Name}}, Url, @{Name = "AppPool"; Expression = {($_.applicationpool).name}}

---

Regards
Henrik A. Halmstrand
sharepointrevealed.com
getspconfig.codeplex.com
Please click Mark As Answer; if a post solves your problem or Vote As Helpful; if a post has been useful to you.

Answer 5

I had this same issue of the User Profile Synchronization (UPS) service showing up in the Stopped state after installing the December 2011 Cumulative Update (CU). I checked my windows application logs and saw the following entry:

An exception occurred when trying to issue security token: An error occurred while receiving the HTTP response to http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc/actas. This could be due to the service endpoint binding not using the HTTP protocol. This could also be due to an HTTP request context being aborted by the server (possibly due to the service shutting down). See server logs for more details.

One of the other effects of running the upgrade was it switched the port my Central Administration was bound to in IIS.  So on a hunch I checked the SharePoint Web Services IIS website bindings and discovered the https port 32844 was no longer bound to an SSL certificate.  I changed it to use our SSL certificate that was self-signed for that server.  Then I opened Central Administration and attempted to start the UPS service and it successfully started.

As a side note, there were also entries in my System event log that stated my SSL certificate settings were deleted for port 0.0.0.0:32844 and also the port on which my Central Administration IIS website was bound to as well.

I have no idea why the upgrade process resulted in having these bindings changed/removed, but it definitely wasn't expected. 

Not sure if this is the issue you ran in to, but it seems to have fixed it for us.

Answer 6

I am at my wits end. I have tried everyting. I have followed all the suggestions in this thread and every step outlined at harbar.net, including deleting and recreating the User Profile Service Application. I've now been down for a week and I don't know what else to do. \Any advice??

Answer 7

 

Have checked Your UPA services A/C have sufficient privilege on AD  , Check group Policy  also For  Your Services A/c its permission related Issue .

• Check permission of services A/c as require on AD
• Check group policy  
• Check user privilege On DB server
• Your Services A/c should be part of  AD  administrator 

After that You can  created new UPA services , Del timer Job , Old UPA Services application etc

I have tested and pretty much sure it will work

Cheers

kamal

Answer 8

Have checked Your UPA services A/C have sufficient privilege on AD  , Check group Policy  also For  Your Services A/c its permission related Issue .

• Check permission of services A/c as require on AD
• Check group policy  
• Check user privilege On DB server
• Your Services A/c should be part of  AD  administrator 

After that You can  created new UPA services , Del timer Job , Old UPA Services application etc

Hi Kamal. Can you tell me what A/C refers to? Also, can you tell me where I find the option to delete timer job?

Answer 9

Hi,

Believe A/c is service accounts.

Delete Timer Job option can be found at Central Administration screen of your farm. The sequence to reach here is:

 Monitoring > Review Job Status > Find the jobs under "Running" section > Select the relevant job and click and delete it. You have to delete the relevant job though. Let Kamal specify what exact job he is referring to. Believe it will be related to User Profile.

---

Thanks, Soumya | MCITP, SharePoint 2010

Answer 10

Hi,

Believe A/c is service accounts.

Delete Timer Job option can be found at Central Administration screen of your farm. The sequence to reach here is:

 Monitoring > Review Job Status > Find the jobs under "Running" section > Select the relevant job and click and delete it. You have to delete the relevant job though. Let Kamal specify what exact job he is referring to. Believe it will be related to User Profile.

Thanks. Kamal, can you jump in and let me know which timer job you are suggesting that I delete? Thanks.

Answer 11

Bump.

Answer 12

Hi

Sorry, digressing from the main technical subject here. Usually it is not remmended to do additional bumping. If a question is showing up as unresolved then the community knows it is still unresolved. If someone knows the answer, he will get to it.

---

Thanks, Soumya | MCITP, SharePoint 2010

Answer 13

I have been running into the same problem. I notice when I ran the CU that some of our sites were not cominging up Error 404, after some investigation found it to be a site binding issue in IIS (CU changed this?) Other sites were still failing until I took UPS out of the proxy group the Web Application was using, so I knew there was an issue with UPS. After I tried to start the UPS sync service in Services on Server page, did an IISReset, the service was still "stopped". I have tried to Recreate the User Profile Service Application using the old social and profile dbs with a new Sync DB as well as all new dbs. I have checked the service accounts running everything and they all are in line with what was assigned prior to the CU.

One thing I did notice was that when I was checking the properties for the UPS application, the Profile Synchronization Instance will not change servers and the server it keeps assigning itself to is not the server running the UPS application. We have the UPS Application running on one WFE and one App server, should this be configured differently?

Topology: 2 WFE (running CA), 2 App Servers, 1 SQL

9 languages (recently installed SP1)

Any information regarding this issue would be very helpful.

Regards,

Joe C

Answer 14

Update- While digging through my ULS logs I noticed a "Critical" level event and found this interesting event:

Database full error on SQL Server instance 'SQLSever1' in database 'SharePoint_AdminContentDB'.

To address this issue I logged onto the SQL server, ran the Management Studio, located the SharePoint_AdminContentDB and doubled the AutoGrowth restricted Size on both the DB and log (since there was less than 0.2MB left for growth).

To alter/check this db:

Right click the DB

Select Properties

Under "Select a Page" click Files

Under the AutoGrowth column click the ...

Change Settings accordingly.

Hope this helps!

Regards,

Joe C

****I do not know how well this is supported by Microsoft**** If anyone knows whether this change is or is not please respond.

Answer 15

Hi.

Have a look at these:

SharePoint 2010 User Profile Service fails to start
http://www.paulgrimley.com/2010/07/sharepoint-2010-user-profile-service.html

From the last link you can note this: 'To resolve this issue what I did was delete the User Profile Service Application  from the Service Application page and recreated it.IMPORTANT  recreating the user profile servie application  with exactly the same name  will result in these errors reappearing so I advise that when recreating you  give the service application a different name.'

I would however rebuild the whole UPS, read the entire article by Spencer Harbar(below) first, even the notes at the bottom, then give it a try. Usually following the guide gets it working.

Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization
http://www.harbar.net/articles/sp2010ups.aspx
This is THE place of info on the UPS!

Start by rescreating it by the book(Harbar) and creating new DB's and all, new names on everything. If this works, then you know it can be done. Perhaps then you can start to built it all over again and point to thew old Profile DB's? If you think that it is worth it.

Regards

---

Thomas Balkeståhl - Technical Specialist - SharePoint - http://blog.blksthl.com

Answer 16

Hi Thomas. Thank you for the reply. I tried using a different name when recreating the UPS, but it did not make a difference. Then, I tried recreating the UPS using all new DB's. This time, the service DID start.

So, here is my question now...users have data stored in document libraries at https://portal/my/personal/username/Documents. If I recreate the UPS with all new DB's, but keep all other settings the same, will this content stay in place?

Thank you!

Answer 17

Hi Edward.

Try to keep only the profiel DB. Recreate the social and synch.

Regards

---

Thomas Balkeståhl - Technical Specialist - SharePoint - http://blog.blksthl.com

Answer 18

Hi Thomas. Keeping the Profle DB but deleteing the Social and Sync DB's did the trick! I did, however, have a major moment of panic the first time I clickd the My Content link as it showed that it was creating the site. However, when it finished my document library and files were still there. Thanks!

I will editorialize for a second... this was a lot of pain caused by a CU. I sure hope the next SharePoint version sees an easier to configure and more stable user pofile service!

Answer 19

 

Looks like there was already an answered flagged in which you were directed to "start over". I used AutoSPInstaller for a new farm. The UPS was working fine until I ran the Dec 2011 CU… 15 mins after install :). Again I repeat brand new farm and UPS was working fine.

I got it going again by going to services and

1. manually starting "Forefront Identity Manager Service". It was set to disabled, so I set it to automatic.
2. Then I set "Forefront Identity Manager Synchronization Service" to automatic and reentered the password for the user on the “Log On” tab of the service properties.
3. Went to Central Admin click start for the “User Profile Synchronization Service”
   1. After the page refreshed I restarted IIS – at the same time the service was displaying “starting”… I did the reset thanks to http://www.harbar.net/articles/sp2010ups.aspx
4. After a couple minutes the service was up and running again.

Hope that helps!

---

Thank you in advance, Peter

Answer 20

Interesting Peter. I never tried that particular set of step in that particular order. Just curious, where at harbar.net did you see that particular suggestion? I thought I read that link inside out and never saw that particular suggestion. Thanks! 

Answer 21

I didn't see all the steps I suggested. I just saw the one about restarting iis under the section "Start the UPS related SharePoint Services" #11

• An IIS Reset is required if central admin is on the same box as FIM.
  An IIS reset is always a good choice here even if it isn’t :).
  
  If you are impatient, an IISReset will ensure that provisioning kicks in immediately, but once it’s complete you will need to run IISReset again before you can manage the User Profile Service Application. 

the other steps I just tried out myself.

---

Thank you in advance, Peter

Answer 22

 What is the result if we just leave this service turned off? Users won't be able to use "My Sites", or their own tagging, that kind of stuff, right?

Is there a comprehensive list of things that won't work if we just leave it broken 'cause I'm tired of fixing this piece of garbage service.

Thanks,

Jon Johnston

Answer 23

Hi Jon and the rest of you.

I Know what you mean...:-)
There is often little to gain by trying to fix this service at all, the best is always to try and remove it completely and then do it all over from the start. Perhaps you have and it still won't start, then one option is to give up :-) Or, contact Microsoft Support and see if they can help.

Regarding what you loose if the User Profile SYnchronization won't start:
You loose the synchronization of user data with your directory, read only or read/write. The SYnch service is the service that connects to your AD(or directory of choice) and update the user profiles with data imported from there.
The synch service does not provide mysites, social tagging, user profiles or any of those features. The loss is updated user data.

Mysites and the other features you mention, is part of the Service application 'User Profile Service Application', as long as that is configured and functioning ok, those features will be available.

Hope this helps?

Regards

---

Thomas Balkeståhl - Technical Specialist - SharePoint - http://blog.blksthl.com
Download the SharePoint Branding Project here

Answer 24

well i tried your method now i can't even have access to CA!

it keep showing me CLID error i hope i don't have to restore or even worse reinstall whole platform :(

---

Mights Make Rights

Answer 25

Hi Edward.

Try to keep only the profiel DB. Recreate the social and synch.

Regards

---

Thomas Balkeståhl - Technical Specialist - SharePoint - http://blog.blksthl.com

Hi Thomas, The proposed answer you gave is not recommended and potentially unsupported see http://technet.microsoft.com/en-us/library/gg985419.aspx as it states:

If you are restoring the User Profile database (by default, named User Profile Service_ProfileDB_<GUID>), you must also restore the Social database (by default, named User Profile Service_SocialDB_<GUID>). Failing to do so can cause inaccuracies in the User Profile data that might be difficult to detect and fix.

Hope that helps others and plan really carefully when restoring a user profile service app as there more than meets the eye and you may not straighaway notice any issues.

Paul

---

Paul Grimley | Senior SharePoint Consultant - Microsoft | Blog: http://www.paulgrimley.com | Twitter: @paulgrimley

Answer 26

Configure profile synchronization (SharePoint Server 2010) http://technet.microsoft.com/en-us/library/ee721049.aspx

http://sharepointgeorge.com/2010/installing-sharepoint-2010-privilege-service-accounts/

http://www.windowsclever.com/sharepoint/how-to-setup-user-profile-service-sharepoint-2010.html
http://www.sharepointboost.com/blog/configuring-the-user-profile-service-ups-in-sharepoint-2010/

http://www.harbar.net/articles/sp2010ups.aspx

http://technet.microsoft.com/en-us/library/ee721049.aspx
http://www.harbar.net/articles/sp2010ups.aspx#ups2
http://www.harbar.net/articles/sp2010ups2.aspx

---

Deepesh Yevle MCTS