The lockdown feature is useful if you have a site collection that is configured for Anonymous access on a Publishing site and you want to lock it down so Anonymous users don’t have access to the Forms page (e.g. http://ServerName/Pages/Forms/AllItems.aspx). You might also be able to take advantage of this feature in another way. For example, if you ever run into an issue on a Publishing Portal configured for Anonymous access where users are unable to post comments (which are stored in a List) on a blog site then the lockdown feature can be disabled, which will result in allowing Anonymous users to post comments. Normally, people won’t have problem posting comments on a blog site unless it is a Publishing site, in which case they will get a prompt to enter user credentials. In such a scenario you can disable the lockdown feature.

NOTE: By default, all publishing sites have the ViewFormPagesLockdown feature enabled.

You can either use stsadm.exe or PowerShell to enable this feature. I prefer to use PowerShell. If you want more detailed information on how to use stsadm.exe, Microsoft’s Tyler Butler has documented it here for MOSS 2007.

With PowerShell, you can easily enable to disable this feature. Here are the instructions.

1. If you are unsure whether the lockdown is enabled, use the following PowerShell command to find out the answer.
   get-spfeature -site SiteCollectionURL
   e.g. get-spfeature -site http://www.winnetusergroup.com

   

2. Look at all the features listed and see if ViewFormPagesLockdown is enabled. If you see it listed then it is enabled, otherwise ViewFormPagesLockdown is disabled.
3. The lockdown feature can be enabled or disabled. To enable it first run the following command.
   $lockdown = get-spfeature viewformpageslockdown
4. Now execute the following command to enable it.
   enable-spfeature $lockdown -url SiteCollectionURL
   e.g. enable-spfeature $lockdown -url http://www.winnetusergroup.com

   
   
   NOTE: To disable the lockdown feature replace the word enable with disable. For example:
   disable-spfeature $lockdown -url SiteCollectionURL

5. At this point you can verify that the feature is enabled by running the following command. Look for the ViewFormPagesLockdown entry in the list. If it exists, the lockdown feature is enabled.

   
   
   

6. According to Microsoft, if Anonymous Access is configured for the site then you need to first disable it and then re-enable it. To enable/disable Anonymous Access in SharePoint Server 2010 go to Site Actions, Site Permissions and click Anonymous Access icon on the ribbon.

The main problem that people run into is the fact that, unlike WSS 3.0, SharePoint Foundation 2010 does not have an interface to add file extensions for additional file types and iFilters. So how can you crawl additional file types, such as PDFs, in SharePoint Foundation 2010? One easy solution is to use the following VB script. The VB script is available in the KB article 2518465. Here’s the step-by-step procedure.

1. Copy the following content to notepad and save the file with a .vbs extension. For example, AddExtension.vbs.Sub UsageSub Usage
   
   WScript.Echo “Usage:    AddExtension.vbs extension”
   WScript.Echo

   end Sub

   Sub Main

   if WScript.Arguments.Count < 1 then
   Usage
   wscript.Quit(1)
   end if

   dim extension
   extension = wscript.arguments(0)

   Set gadmin = WScript.CreateObject(“SPSearch4.GatherMgr.1″, “”)

   For Each application in gadmin.GatherApplications
   For Each project in application.GatherProjects
   project.Gather.Extensions.Add(extension)
   Next
   Next

   End Sub

   call Main

2. Copy the script to SharePoint Foundation Server and run it at the command prompt. This will add the PDF extension.
   > WScript AddExtension.vbs pdf
3. Register the PDF iFilter by going to the following registry key.
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\Search\Setup\ContentIndexCommon\Filters\Extension\.
4. Right-click the Extensions folder and select New, key.
5. Enter .pdf for the key name.
6. In the right-hand pane dobule-click the Default value and enter the following for the Value data:
   {E8978DA6-047F-4E3D-9C78-CDBE46041603}.
7. Restart SPSearch4 by typing the following at the command prompt:
   net stop spsearch4
   net start spsearch4
8. Run crawl by typing the following at the command prompt:
   >stsadm –o spsearch –action fullcrawlstart
   The stsadm.exe utility is located in the “14 Hive” folder at C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN.
9. You should now be able to crawl PDF files in SharePoint Foundation 2010.

Note that this method adds the PDF extension. You can use the same technique to add additional filters as necessary.

To address this issue, I figured it would be great to write a batch file that will look for these services to see if they are running, if not, it will start these services and log the activity in a log file. If the service is running on multiple computers. this script will even take care of all the remote servers and start the service, assuming you have the proper administrative rights. I want to thank Jerry, a Microsoft MVP – Windows Expert – Consumer, for writing this script on forums.techguy.org. I modified his original script to fit my need.

NOTE: To benefit from the script in this article you must have at least a fundamental knowledge of batch files and scripting. You should also understand what environmental variables are and how to modify the system path.

What Does the Script Do?

I wrote this batch file that will check to see if the two FIM services have started. If not, it will start them automatically. Here’s exactly what the script does. It sets a log file, called log.txt. If the file exists, it will delete it so you only have the information from the last time you ran the script. Instead of using the “net start” command, which will work on the local computer, it uses psservice.exe which is part of Sysinternals Suite and can be downloaded from Microsoft’s Web site here. I wrote the batch file with SharePoint in mind but you can use this script for any service on any Windows computer. In a typical SharePoint environment, SharePoint is installed on more than one server. If you want to make sure that the service is running on multiple computers, simply add the names of the computers in the computers.txt file.

Best Practice: Add the folder where you have copied the Sysinternals tools, such as psservice.exe, to the system’s path. That way you can run the psservice.exe from any folder.

I like to keep the batch file (FIM.bat), the log file (log.txt) and the server name file (computers.txt) in a folder called BATCH. I also like to add the BATCH folder to the path.

You should save the script as a .bat file. Make sure that it does not have a .txt extension. If you want, you can schedule this batch file to run every so often. That way you can ensure that your services are always running. If a service has already started it will only take a second for it to check and log the information. There is no overhead that you need to worry about. You can check out my blog post on how to accomplish that. The link is posted at the end of this article.

Determine the Name of the Service

In the script you should replace the name of the service with your service name. To find out what service name you should use go to Services Console (services.msc) and double-click the service. On the General name look for Service name. For example, the name of the Forefront Identity Manager Service is FIMService, as shown below.

The script will check to see if the service is running, stopped, or paused and will document the result accordingly in the log file. I have set the script to check the status 10 times. You can adjust this setting if necessary.

Running Same Script for Multiple Services

To make things simple, I start both the services in the same script. There are other ways to handle this situation but I wanted my script to be pretty flexible and decided to implement what I wanted to accomplish using this method.

In the first section, I check for the FIMService and in the second section I essentially run the same script for FIMSynchronizationService with slight modification. For example, I don’t want the log file to be deleted after the FIMService is started because I also want to see the results for the second service so I commented out the line that deletes the log file in FIMSynchronizationService section.

Dealing With Multiple Computers

You can use this script to remotely start a service on remote computers. Simply add the name of the computers in the computers.txt file on separate files. If you have only one computer, just add its name to the computers.txt file. For example, if you have 3 servers named server1, server2, and server3, your computers.txt file will look like this.

Once the batch file is complete you can verify the status of the services in the Services Console and also check the log file for the activity that took place.

The Log File

The script also utilizes a log.txt file. Each time the batch file is executed it first deletes the old log file and then creates a new log.txt file and enters the necessary information in the file for you. If both the FIM services were stopped, your log file will display the following information.

Sample Script

I named my script FIM.bat because I am using it to start two FIM services. Obviously, you can name it whatever you want but keep the name short.

Best Practice: Use the 8.3 file naming convention for your batch file. In other words, do not use more than 8 characters (excluding the extension) for the file name. For example, instead of naming it something like startsrvcs.bat, name it strtsrvc.bat to follow the 8.3 file naming convention.

You can copy the following text to the clipboard and then paste it into notepad. Modify the script as mentioned above and then save it as a batch file using 8.3 naming convention. Make sure you test the script in a test environment first to make sure it does what you expect it to do.

@echo off

cls

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: Check the status for FIMService

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Set LogFile=log.txt

If Exist %LogFile% Del %LogFile%

Set Errors=

For /f “tokens=1″ %%i In (computers.txt) Do (

Call :process %%i

If %ErrFlag%==1 Set Errors=1

)

If Defined Errors Echo FIMService on some machines could not be started. Please check the log in %LogFile%.

Goto :STOP

Set LogFile=log.txt

If Exist %LogFile% Del %LogFile%

Set Errors=

For /f “tokens=1″ %%i In (computers.txt) Do (

Call :process %%i

If %ErrFlag%==1 Set Errors=1

)

If Defined Errors Echo FIMService on some machines could not be started. Please check the log in %LogFile%.

Goto :STOP

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: Subroutines

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:process

:: %1 is the Remote Machine Name

Set ErrFlag=0

Set SERVICE1=FIMService

:FIMService

Call :CheckState %1

If “%STATE%”==”RUNNING” (

Echo FIMService on %1 has already started.>> %LogFile%

Goto :EOF

)

If “%STATE%”==”STOPPED” (

Echo FIMService on %1 is in Stop mode. Attempting to start the service….>> %LogFile%

psservice \\%1 Start %SERVICE1% 2>Nul

Call :Wait %1

Goto :EOF

)

If “%STATE%”==”PAUSED” (

Echo FIMService on %1 is in Paused mode. Attempting to start the service…>> %LogFile%

psservice \\%1 cont %SERVICE1% 2>Nul

Call :Wait %1 Re-

Goto :EOF

)

Echo FIMService on %1 is in an Unknown state. Please check the %1 system.>> %LogFile%

Set Errflag=1

Goto :EOF

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:CheckState

Set STATE=

For /F “Tokens=3 Delims=: ” %%a In (‘psservice 2^>Nul \\%1 query %SERVICE1%^|Find /I “STATE”‘) Do Set STATE=%%a

Goto :EOF

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:Wait

:: %1 is the Remote Machine Name

:: %2 is null if attempting to start, is Re- if restarting

Set loop=0

:Check

:: Will check state 10 times, adjust as needed.

If %loop%==10 Goto NoStart

:: Wait 1 second for service to (Re-)start (can also use sleep utility)

:: adjust -w as needed units are milliseconds

Ping 1.0.0.0 -n 1 -w 1000 >Nul

Call :CheckState %1

If NOT “%STATE%”==”RUNNING” (set /a loop+=1) & Goto Check

Echo FIMService on %1 has %2started successfully.>> %LogFile%

GOTO :EOF

:NoStart

Echo Unable to %2start FIMService on %1>> %LogFile%

Set ErrFlag=1

Goto :EOF

)

:STOP

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: Check the status for FIMSynchronizationService

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

@echo off

Set LogFile=log.txt

:: If Exist %LogFile% Del %LogFile% (Log file should not be deleted after the FIMService is started)

Set Errors=

For /f “tokens=1″ %%i In (computers.txt) Do (

Call :process %%i

If %ErrFlag%==1 Set Errors=1

)

If Defined Errors Echo FIMSynchronizationService on some machines could not be started. Please check the log in %LogFile%.

Goto :STOP

Set LogFile=log.txt

If Exist %LogFile% Del %LogFile%

Set Errors=

For /f “tokens=1″ %%i In (computers.txt) Do (

Call :process %%i

If %ErrFlag%==1 Set Errors=1

)

If Defined Errors Echo FIMSynchronizationService on some machines could not be started. Please check the log in %LogFile%.

Goto :STOP

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: Subroutines

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:process

:: %1 is the Remote Machine Name

Set ErrFlag=0

Set SERVICE1=FIMSynchronizationService

:FIMSynchronizationService

Call :CheckState %1

If “%STATE%”==”RUNNING” (

Echo FIMSynchronizationService on %1 has already started.>> %LogFile%

Goto :EOF

)

If “%STATE%”==”STOPPED” (

Echo FIMSynchronizationService on %1 is in Stop mode. Attempting to start the service….>> %LogFile%

psservice \\%1 Start %SERVICE1% 2>Nul

Call :Wait %1

Goto :EOF

)

If “%STATE%”==”PAUSED” (

Echo FIMSynchronizationService on %1 is in Paused mode. Attempting to start the service…>> %LogFile%

psservice \\%1 cont %SERVICE1% 2>Nul

Call :Wait %1 Re-

Goto :EOF

)

Echo FIMSynchronizationService on %1 is in an Unknown state. Please check the %1 system.>> %LogFile%

Set Errflag=1

Goto :EOF

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:CheckState

Set STATE=

For /F “Tokens=3 Delims=: ” %%a In (‘psservice 2^>Nul \\%1 query %SERVICE1%^|Find /I “STATE”‘) Do Set STATE=%%a

Goto :EOF

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:Wait

:: %1 is the Remote Machine Name

:: %2 is null if attempting to start, is Re- if restarting

Set loop=0

:Check

:: Will check state 10 times, adjust as needed.

If %loop%==10 Goto NoStart

:: Wait 1 second for service to (Re-)start (can also use sleep utility)

:: adjust -w as needed units are milliseconds

Ping 1.0.0.0 -n 1 -w 1000 >Nul

Call :CheckState %1

If NOT “%STATE%”==”RUNNING” (set /a loop+=1) & Goto Check

Echo FIMSynchronizationService on %1 has %2started successfully.>> %LogFile%

GOTO :EOF

:NoStart

Echo Unable to %2start FIMSynchronizationService on %1>> %LogFile%

Set ErrFlag=1

Goto :EOF

)

:STOP

By the way, I have tested this batch file numerous times and it worked perfectly every single time. If you decide to schedule this batch file, check out my article How to run a batch file as a task in Windows Server 2008.

Add-ADComputerServiceAccount

Adds one or more service accounts to an Active Directory computer.

Add-ADDomainControllerPasswordReplicationPolicy

Adds users, computers, and groups to the Allowed List or the Denied List of the read-only domain controller (RODC) Password Replication Policy (PRP).

Add-ADFineGrainedPasswordPolicySubject

Applies a fine-grained password policy to one more users and groups.

Add-ADGroupMember

Adds one or more members to an Active Directory group.

Add-ADPrincipalGroupMembership

Adds a member to one or more Active Directory groups.

Clear-ADAccountExpiration

Clears the expiration date for an Active Directory account.

Disable-ADAccount

Disables an Active Directory account.

Disable-ADOptionalFeature

Disables an Active Directory optional feature.

Enable-ADAccount

Enables an Active Directory account.

Enable-ADOptionalFeature

Enables an Active Directory optional feature.

Get-ADAccountAuthorizationGroup

Gets the Active Directory security groups that contain an account.

Get-ADAccountResultantPasswordReplicationPolicy

Gets the resultant password replication policy for an Active Directory account.

Get-ADComputer

Gets one or more Active Directory computers.

Get-ADComputerServiceAccount

Gets the service accounts that are hosted by an Active Directory computer.

Get-ADDefaultDomainPasswordPolicy

Gets the default password policy for an Active Directory domain.

Get-ADDomain

Gets an Active Directory domain.

Get-ADDomainController

Gets one or more Active Directory domain controllers, based on discoverable services criteria, search parameters, or by providing a domain controller identifier, such as the NetBIOS name.

Get-ADDomainControllerPasswordReplicationPolicy

Gets the members of the Allowed List or the Denied List of the RODC PRP.

Get-ADDomainControllerPasswordReplicationPolicyUsage

Gets the resultant password policy of the specified ADAccount on the specified RODC.

Get-ADFineGrainedPasswordPolicy

Gets one or more Active Directory fine-grained password policies.

Get-ADFineGrainedPasswordPolicySubject

Gets the users and groups to which a fine-grained password policy is applied.

Get-ADForest

Gets an Active Directory forest.

Get-ADGroup

Gets one or more Active Directory groups.

Get-ADGroupMember

Gets the members of an Active Directory group.

Get-ADObject

Gets one or more Active Directory objects.

Get-ADOptionalFeature

Gets one or more Active Directory optional features.

Get-ADOrganizationalUnit

Gets one or more Active Directory OUs.

Get-ADPrincipalGroupMembership

Gets the Active Directory groups that have a specified user, computer, or group.

Get-ADRootDSE

Gets the root of a domain controller information tree.

Get-ADServiceAccount

Gets one or more Active Directory service accounts.

Get-ADUser

Gets one or more Active Directory users.

Get-ADUserResultantPasswordPolicy

Gets the resultant password policy for a user.

Install-ADServiceAccount

Installs an Active Directory service account on a computer.

Move-ADDirectoryServer

Moves a domain controller in AD DS to a new site.

Move-ADDirectoryServerOperationasterRole

Moves operation master (also known as flexible single master operations or FSMO) roles to an Active Directory domain controller.

Move-ADObject

Moves an Active Directory object or a container of objects to a different container or domain.

New-ADComputer

Creates a new Active Director computer.

New-ADFineGrainedPasswordPolicy

Creates a new Active Directory fine-grained password policy.

New-ADGroup

Creates an Active Directory group.

New-ADObject

Creates an Active Directory objet.

New-ADOrganizationalUnit

Creates a new Active Directory OU.

New-ADServiceAccount

Creates a new Active Directory service account.

New-ADUser

Creates a new Active Directory user.

Remove-ADComputer

Removes an Active Directory computer.

Remove-ADComputerServiceAccount

Removes one or more service accounts from a computer.

Remove-ADDomainControllerPasswordReplicationPolicy

Removes users, computers, and groups from the Allowed List or the Denied List of the RODC PRP.

Remove-ADFineGrainedPasswordPolicy

Removes an Active Directory fine-grained password policy.

Remove-ADFineGrainedPasswordPolicySubject

Removes one or more users from a fine-grained password policy.

Remove-ADGroup

Removes an Active Directory group.

Remove-ADGroupMember

Removes one or more members from an Active Directory group.

Remove-ADObject

Removes an Active Directory object.

Remove-ADOrganizationalUnit

Removes an Active Directory OU.

Remove-ADPrincipalGroupMembership

Removes a member from one or more Active Directory groups.

Remove-ADServiceAccount

Removes an Active Directory service account.

Remove-ADUser

Removes an Active Directory user.

Rename-ADObject

Changes the name of an Active Directory object.

Reset-ADServiceAccountPassword

Resets the service account password for a computer.

Restore-ADObject

Restores an Active Directory object.

Search-ADAccount

Gets Active Directory user, computer, and service accounts.

Set-ADAccountControl

Modifies user account control (UAC) values for an Active Directory account.

Set-ADAccountExpiration

Sets the expiration date for an Active Directory account.

Set-ADAccountPassword

Modifies the password of an Active Directory account.

Set-ADComputer

Modifies an Active Directory computer.

Set-ADDefaultDomainPasswordPolicy

Modifies the default password policy for an Active Directory domain.

Set-ADDomain

Modifies an Active Directory domain.

Set-ADDomainMode

Sets the domain functional level for an Active Directory domain.

Set-ADFineGrainedPasswordPolicy

Modifies an Active Directory fine-grained password policy.

Set-ADForest

Modifies an Active Directory forest.

Set-ADForestMode

Sets the forest mode for an Active Directory forest.

Set-ADGroup

Modifies an Active Directory group.

Set-ADObject

Modifies an Active Directory object.

Set-ADOrganizationalUnit

Modifies an Active Directory OU.

Set-ADServiceAccount

Modifies an Active Directory service account.

Set-ADUser

Modifies an Active Directory user.

Uninstall-ADServiceAccount

Uninstalls an Active Directory service account from a computer.

Unlock-ADAccount

Unlocks an Active Directory account.

• Access Services cmdlets (SharePoint Server 2010)
• Backup and recovery cmdlets (SharePoint Server 2010)
• Business Connectivity Services cmdlets (SharePoint Server 2010)
• Database cmdlets (SharePoint Server 2010)
• Enterprise content management cmdlets (SharePoint Server 2010)
• Excel Services cmdlets (SharePoint Server 2010)
• Farm cmdlets (SharePoint Server 2010)
• Features and solutions cmdlets (SharePoint Server 2010)
• General cmdlets (SharePoint Server 2010)
• Import and export cmdlets (SharePoint Server 2010)
• InfoPath Services cmdlets (SharePoint Server 2010)
• Logging and events cmdlets (SharePoint Server 2010)
• Performance cmdlets (SharePoint Server 2010)
• PerformancePoint Services cmdlets (SharePoint Server 2010)
• Search cmdlets (SharePoint Server 2010)
• Secure Store service cmdlets (SharePoint Server 2010)
• Security cmdlets (SharePoint Server 2010)
• Service application cmdlets (SharePoint Server 2010)
• SharePoint Foundation 2010 Search cmdlets (SharePoint Server 2010)
• Site collection cmdlets (SharePoint Server 2010)
• Site management cmdlets (SharePoint Server 2010)
• State service and session state cmdlets (SharePoint Server 2010)
• Timer jobs cmdlets (SharePoint Server 2010)
• Upgrade and migration cmdlets (SharePoint Server 2010)
• User Profile service cmdlets (SharePoint Server 2010)
• Visio Graphics Services cmdlets (SharePoint Server 2010)
• Web Analytics cmdlets (SharePoint Server 2010)
• Web application cmdlets (SharePoint Server 2010)
• Word Services cmdlets (SharePoint Server 2010)
• Workflow management cmdlets (SharePoint Server 2010)