Alexander’s Blog

I wrote the blog The Challenging Task of Managing SharePoint Permissions about one of the weaknesses in SharePoint that has to do with managing secure access and permissions. I decided to look for some third-party answers and found several products that offer the type of solutions that enterprises running SharePoint really need. Although there are sevearl vendors that offer SharePoint administration and security tools, there are some that seem to stand out: AvePoint, Barracuda, and Quest to name a few. I will obtain a copy of these products to find out how they’ve addressed the gap created by the lack of better management of permissions in MOSS 2007.

My first article in this series of reviews is about a product from Barracuda called DeliverPoint.

DeliverPoint

When I went to the DeliverPoint Web site I noticed that the product is referred to as DeliverPoint: Permissions. When I installed the product it added a console that says DeliverPoint. On the Site Actions menu it is referred to as DeliverPoint 2007. I will refer to it as DeliverPoint in this article.

Before you consider installing the product, you should check out the hardware and software requirements. I would also advise you to read the DeliverPoint Reference Guidein the installation folder because it mentions several DOs andDON’Ts that are worth reading.

Notice that Windows Server 2008 is not listed as a supported operating system. However, I was able to install and operate it on my Windows Server 2008 just fine.

Product Highlights

With DeliverPoint, Barracuda addresses several of the permission management issues that SharePoint did not address out-of-the-box. According to Barracuda, here are some of the highlights of their product.

- Built for administrators of all levels: central administrators, site collection administrators, and end-user administrators
- Central Administrators maintain control
- Discover, copy, transfer, and delete account and object permissions quickly and easily
- Keep the farm clean when employees leave the company or transfer divisions
- Empower non-IT administrators to manage permissions within their respective site collections, sites and workspaces
- Seamless integration with Microsoft Office SharePoint Server 2007 and Windows SharePoint Server 3.0.

Installation

DeliverPoint is offered only as a 32-bit product. Officially it is supported on Windows Server 2003 and not on Windows Server 2008. However, I installed it on my Windows Server 2008 server running MOSS 2007. The installation is simple. At the end of the installation you are prompted to run the Configuration Wizard.

Make sure you check for any critical updates for .NET Framework after you have finished installing the product. To run the Configuration Wizard you must have administrative privileges to the local computer. When I installed the product, I was logged on as a domain account that was a member of the local administrative group. I went to Start, All Programs, DeliverPoint, DeliverPoint Configuration Wizard but it crashed with the following error on my Windows Server 2008.

Now here’s the confusing part. Once you’ve installed the product the Configuration Wizard cannot be possibly run again. What’s confusing is that in the Start menu the wizard is available even though it has absolutely no use. It would be nice if the wizard would tell you that you have already installed and configured the product and that there is no need to run this wizard again. Instead, it gives you the impression that it crashed (well, it does crash) and you may be wasting time trying to troubleshoot a problem that is not really a problem.

I contact Barracuda’s tech support. I was able to get to them right away and the person who assisted me was very helpful. He suggested that on my Windows Server 2008 server I start the wizard from a command prompt (make sure you use Run As Administrator to open the command prompt). I went to the folder where DeliverPoint was installed and issued the following command to start the wizard.

C:\Apps (x86)\DeliverPoint>barracuda.deliverpoint.configuration.exe “c:\Apps (x86)\DeliverPoint”

Remember to use the quotes if you have spaces in the path.

Using the Product

Once the product is installed successfully you manage it from SharePoint. There is no console in Windows to use the program. Everything is managed from within SharePoint. You will notice two menu items on Site Actions menu in SharePoint: DeliverPoint 2007 and Discover Site Permissions.

DeliverPoint 2007 is the primary areato manage permissions. Using the View Menu allows you to search for account permissions (Account Centric View) and view your SharePoint site hierarchy (Farm Centric View). The Farm Centric View is the default view. You will appreciate the intuitiveness of the Account Centric View. You can copy, move, delete permissions or you can view the unique permissions for an individual. Here’s what a screen looks like when you view unique permissions for a user.

The Treeview Legend uses clean icons that clearly identify the sites that inherit permissions, sites that have unique permissions or sites that have no access. These little things make DeliverPoint design very intuitive.

DeliverPoint also adds another item on the context menu for individual items. For example, you can right-click a document in a Document Library and select Discover item Permissions using DeliverPoint to view all the permissions for that item. This capability is sorely missing in SharePoint.

In addition to the Site Actions and context menu items, DeliverPoint also appears as a third tab in the Central Administration site next to the Operations and Application Management tab. Here you will find two sections: DeliverPoint Configuration and Module Management, as shown below.

A lot of businesses have a top-level site collection that is controlled by IT. All the departments have their own sites under the top-level site. The Site Owners are responsible for managing their own sites. They need a better solution to manage security and permissions than what’s available out-of-the-box. DeliverPoint is great for these Site Owners. They can easily discover which users have access to a specific site, list, folder, or list item.

One of my favorite features in DeliverPoint is the ability to copy permissions. You can copy an account’s permissions to one or more accounts so when you hire a new employee you can copy the permissions from another employee in the department who performs similar tasks. If that’s not enough, you can even “cut & paste” to move or transfer permissions from one account to one or more accounts.

This product is even designed to conform to Microsoft’s licensing requirements. Of course, every level in DeliverPoint is security trimmed, which means you can only view, copy, delete, transfer or manage permissions where you have authorized access in SharePoint.

Conclusion

If you work with SharePoint, you desperately need a third-party product to get a better grip on your security. SharePoint administrators, network administrators, and especially the Site Owners will appreciate the simplicity, flexibility and intuitiveness of DeliverPoint. DeliverPoint is not a comprehensive solution to administer SharePoint. It’s purpose is to only manage permissions. My Internet Explorer crashed a few times while I was using the Discover Site Permissions feature but I am not ready to blame DeliverPoint for the crashes at this time because I have used this product for a very short time. If you are interested in trying out this product, you can download a free 15-day trial version here.

Next time I will review another SharePoint product that offers similar solutions to administer SharePoint permissions so stay tuned.

If you are a SharePoint administrator then you know that there are some features in SharePoint that are awesome, while others definitely need improvement. One area that needs improvement is permissions. There are round about ways of managing permissions in SharePoint that most of us try to live with. If you are a SharePoint administrator then you may be more knowledgeable than, let’s say, a Site Owner who is responsible for managing and securing a site. Even for simple tasks like enabling Anonymous access for a site, there are lots of things you need to understand and go through various hoops to get all the permissions working properly.

Let’s be honest……Microsoft developers have not done a very good job of making the management of permissions in Microsoft Office SharePoint Server (MOSS) 2007 and Windows SharePoint Services (WSS) easier. Permissions can be assigned using SharePoint Groups or Active Directory, which gives you the flexibility to assign permissions whether you have an Active Directory environment or not…..this is a good thing. However, for those of us who are very familiar with Active Directory and SharePoint, this is not a problem but for people who are not very familiar with Active Directory it could be challenging to understand why there are two levels of permissions and when to use one or the other. It’s not the fact that permissions can be assigned at the two levels I mentioned above, it’s the lack of better management of permissions that is the issue. Some people don’t understand why they can’t open an Active Directory group from within SharePoint and why they can’t see in a consolidated area where their users have permissions in the site collection, lists or libraries.

Permissions are scattered in SharePoint all over the product and their is no easy way to centrally manage and view permissions or to get a better picture of how inheritance is applied at various level. For example, if you want to assign unique permissions to a bunch of documents in a library at one time, you can’t. You need to select one document at a time and assign permissions. This is unacceptable to most organizations. Microsoft markets SharePoint as a collaborative solution for large enterprises with hundreds of thousands of users, yet there is less than acceptable focus on security in SharePoint in the sense that there is no central location that you can use to get a good view of your overall security, permission levels and access control of SharePoint farms or individual sites.

Microsoft’s typical answer to these weaknesses in the product is that this is by design and then they give you all kinds of excuses why this is unnecessary. That would have been okay except that when the next version rolls around, Microsoft touts how this couldn’t be done in the previous version and now it is so easy to accomplish the same task. I could give you lots of examples of how Microsoft blasts previous versions of their own product just to sell the new version (we butchered Windows Vista but what a great job we’ve done with Windows 7)…..but let’s leave that for another time. [By the way, in my opinion Microsoft has done a much better job with Windows 7.]

This major weakness in SharePoint is a great opportunity for third-party vendors. Codeplex, an open source project community has filled some gaps by providing an Access Checker Web Part. The Web Part does a decent job but lacks certain functionality, for example it doesn’t support SharePoint groups and you can use Active Directory users but not Active Directory groups.

I will be evaluating several SharePoint products that are specifically meant to address access management down to the individual items in SharePoint Lists and Libraries. Look for my product reviews under blog category Reviews.

My (funny) Prediction

I predict that when a future version of SharePoint (it may not be called SharePoint by that time) comes out, Microsoft will ridicule MOSS 2007 for its primitive way of handling permissions. The lack of comprehensive permission and security management will be laughed at and the new version will be touted for its enhanced capabilities and ease of management……I guarantee. Anyone willing to bet? Same will be said about the gazillion accounts with umpteen rights needed to install and properly configure MOSS 2007 in an enterprise with no clear documentation from Microsoft.

Having said that, we have to realize that for all practical purposes MOSS 2007 is really version 1 of SharePoint. Because it is so different than it’s predecessors, it’s not even fair to compare it to SharePoint Portal Server 2001/2003 or WSS. I consider MOSS 2007 version 1 of SharePoint and I have to admit that for a version 1 it is an impressive product with enormous potential. It is revolutionizing online collaboration and I expect it to only get better as the new versions roll in.

Here is an example that shows in detail how you can import an Excel spreadsheet into a Microsoft Office SharePoint Server (MOSS) 2007 List. I used my Windows Networking User Group Web site as an example because I have easy access to it. I am using Excel 2007 in my example.

First create an Excel document with column headings and data that needs to be imported, if one doesn’t exist already. If you are a trainer and would like to use the file I’ve created for demo to your students, you can download this Excel Sample File. The file is in Excel 2007 format.

To import an Excel file into SharePoint, you don’t have to first create a List and all the columns because when you import an Excel spreadsheet, SharePoint will create all the columns and will also create the list based on the name you provide. If you use column names that already exist (e.g. Name), SharePoint will create a column with a number appended to it, e.g. Name1. Here are all the steps.

1. Go to Site Actions, View All Site Content.

2. Click Create.

3. In the Custom Lists section click Import Spreadsheet.

4. Enter the Name, Description and File location, where:

Name: This will be the name of the new SharePoint List
Description: An appropriate description of the SharePoint List
File location: The path to your Excel file

Click the Import button.

5. You will see the Excel spreadsheet open up. In the Range Type section, click the drop-down button and select Range of Cells. Click anywhere in the Select Range box. This will allow you to select the text that you want to import into SharePoint List.

6. Highlight the headers and all the cells with your mouse (click and drag) and then click on the icon on the right-hand side in the minimized Import to Windows SharePoint Services list. This will allow you to get back to the mode where you will be able to click the Import button.

7. Go ahead and click the Import button to start the import process.

NOTE: Whether you are using Excel 2003  or Excel 2007 there is a chance that you may see the following error:

Method ‘Post’ of object ‘IOWSPostData’ failed

If you get this error, don’t panic. Just read my blog post Error: “Method ‘Post’ of object ‘IOWSPostData’ failed” in SharePoint on how to work around this error.

8. If you are prompted for logon credentials, provide the account name a password that has permissions to add to the SharePoint List.

9. You will see your Excel spreadsheet imported into SharePoint with the name of the list that you provided in step 4.

NOTE:

If you used a name for the column that already exists in SharePoint, e.g. Name. SharePoint will append a number 1 to the column title, e.g. Name1. Next time it will use Name2, and so on.

Conclusion

As you can see, adding data from Excel spreadsheet into SharePoint is relatively straight forward. You should check out this blog post from my colleague Sharee English Excel and SharePoint: Part 2 because she prefers the Named Range as the Range Type and shows a slightly different method to import data from Excel into SharePoint. With Excel 2003, or even Excel 2007, you may run into the Method ‘Post’ error that I mentioned earlier. The solution I posted in another blog post seem to work for just about everyone. I’ve run into this error on several computes both Windows XP computers running Office 2003 and Windows Vista running Office 2007 and was able to fix the problem with this solution.

When importing an Excel spreadsheet into a SharePoint List I ran into this error on a computer running Windows XP SP2 and Office 2003. Then I tried importing on a Windows Vista computer running Office 2007. After doing some research I found a solution on Microsoft MVP Kathy Hughes’ blog.

I am documenting the solution for Office 2007 here but the solution for Office 2003 should be similar. Just replace the references accordingly. For example, in step 2 you will replace the reference to Office 12 with Office 11.

Error

I experienced the error when I tried to import the spreadsheet. The error states:

Method ‘Post’ of object ‘IOWSPostData’ failed

Cause

This error is apparently due to a failed Application.SharePointVersion(URL) call in the Excel add-in which causes Excel to try and use the IOWSPostData.Post() to publish the range. This method is used by SharePoint Team Services 1.0. If you can force it to use version lookup result variable (lVER) to a later version (e.g. 2 or later), Excel will use SOAP to communicate with WSS 3.0 and you should be able to import the data successfully.

Solution

1. Open Excel 2007.

2. Open EXPTOOWS.XLA add-in which is located by default in C:\Program Files\Microsoft Office\Office12\1033 folder. If prompted, Enable the macros.

3. Press ALT+F11. You should see the Microsoft Visual Basic code editor window as shown below.

If you do not see the code editor window open. Go to ExptoOWS (EXPTOOWS.XLA, Forms folder and double-click publishForm. Press F7 (or View, Code from menu) to open the code editor.

4. You need to locate the lVer = Application.SharePointVersion(URL) code. Use CTRL+F to locate the code, as shown above. The letter before “Ver” is a lowercase L, not the number 1.

5. Comment out the line that says lVer = Application.SharePointVersion(URL) as follows:

‘lVer = Application.SharePointVersion(URL)

6. Add a line lVer =2. Your two lines should now read:

‘lVer = Application.SharePointVersion(URL)

lVer = 2

Notice the apostrophe ‘ before line one.

7. Save the file and exit Excel.

8. You should now be able to import Excel files into SharePoint Lists without any problems.

Unlike Office icons (Word, Excel, etc.), by default, PDF icons are not displayed on the Microsoft Office SharePoint Server (MOSS) 2007 or SharePoint Server 2010 sites when you add a PDF document. Also, you cannot search the contents of a PDF file and the search results do not display PDF icons. For Windows Server 2003 (32- and 64-bit) there are some KB articles and other documentation that shows you exactly how to display a PDF icon. I couldn’t find any documentation for 64-bit Windows Server 2008 and wasn’t able to get the icon to display using the Windows Server 2003 (x64) instructions from Microsoft. I tried Microsoft blogs, KB articles, and other Web sites but the instructions for Windows Server 2003 didn’t work for my Windows Server 2008. If you are able to get them to work that’s great. If not, read on.

Recently I discovered that Adobe finally came out with a new Adobe iFilter 9 for 64-bit platforms which allows searching PDF files on 64-bit Windows platforms for MOSS 2007, Exchange 2007, and SQL Server 2005. I tried this new iFilter and was able to get it to work. I also tried the iFilter on SharePoint Server 2010 and it worked flawlessly. I decided to document these instructions for people who may be running SharePoint on Windows Server 2008.

By the way, Adobe has tested their iFilter 9 on the following systems:

Desktop environment
• Microsoft Windows XP x64 with Service Pack 2: Windows Desktop Search 3 and 4, Windows Indexing Service
• Microsoft Windows Vista x64 with Service Pack 1: Windows Search 4

Server environment
• Microsoft Windows Server 2003 x64 Edition R2 with Service Pack 2: SharePoint Server 2007, Exchange Server 2007, Windows Desktop Search 3
• Microsoft Windows Server 2008 x64 with Service Pack 1: SharePoint Server 2007, SQL Server 2005, Windows Search 4

Installation

Adobe has not tested the iFilter on MOSS 2007 running on Windows Server 2008. I am not sure why they didn’t bother testing on MOSS 2007 but I did and it works. Here are the step-by-step instructions on how to install the iFilter 9. You can use the following instructions for both MOSS 2007 and SharePoint Server 2010. Just replace the references to 12 hive with 14 hive in steps 5-9.

1. Download the Adobe iFilter 9 for 64-bit platforms. I found a few errors in the Adobe’s document that tells you how to configure the iFilter. Therefore, I suggest that you use the following instructions instead to avoid confusion.

2. Unzip the PDFiFilter64installer.zip file.

3. Logon with an administrator account and double-click the PDFFilter64installer.msi to start the installation.

4. After the installation is complete, add the location of the Adobe’s Reader to your path in the environment variables (Control Panel\System\Advanced\Environment Variables). For example, C:\Program Files\Adobe\Reader 8.0\Reader. It should point to the folder where the Adobe Reader executable file is located.

5. Now you need to verify that the PDF information has been added to the registry.

a. Start, Run, Regedit.
b. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\12.0\Search\Applications\{site GUID}\Gather\Portal_Content\Extensions\ExtensionList. You need to do this for all your sites so go to each GUID that represents the site and make the change.
c. If you see a PDF extension then just skip to Step 6 . If PDF extension is missing then continue with the next step d.
d. Right-click on right-side Extension List pane and select New > String Value.
e. Add a name for the new Registry Key (e.g. if you have 37 entries already then add a new entry and name it 38).
f. Double-click the new Registry Key and for  the Value data enter “pdf”.

Note: This step can also be accomplished in the SharePoint Server Search Administration page by adding ‘pdf’ to the list of File Types in Search Administration->File Types. This will automatically add an entry for ‘pdf’ filetype.

6. Verify that PDF has the correct settings in another registry location.

a. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\12.0\Search\Setup\Filters\.pdf.
b. Verify that the following values are present. If they are not, you need to add a .pdf key and create the following entries.
NOTE: The instructions in italics work for SharePoint Server 2010.
- <REG_SZ> Default = <value not set>
(you do this by adding a new key under Filters)
- <REG_SZ> Extension = pdf
(you do this by adding a new String value, then modify it to add Value data pdf)
- <REG_DWORD> FileTypeBucket = 1
( you do this by adding a new DWORD (32-bit) Value and setting it to 1)
- <REG_SZ> MimeTypes = application/pdf
(you do this by adding a new String value, then modify it to add application/pdf)
Your screen should look like this.

7. Next you need to verify that PDF has the correct settings in a couple of additional registry locations.

a. In the registry editor go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\12.0\Search\Setup\ContentIndexCommon\Filters\Extension\.pdf.
b. Modify or create the key and replace the values with the following. If you create a new .pdf key there will be a (Default) REG_SZ (value not set) entry created automatically which cannot be deleted. Just leave that value alone. That value has parenthesis around it, while the new value that you will create does not.
Name = Default
Type = <REG_MULTI_SZ> (In SharePoint 2010 this is created by adding a Multi-String Value)
Data = {E8978DA6-047F-4E3D-9C78-CDBE46041603}

a. In the registry editor go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0\Search\Setup\ContentIndexCommon\Filters\Extension\.pdf.
b. Modify or create the entry and replace the values with the following.
Name = Default
Type = <REG_MULTI_SZ> (In SharePoint 2010 this is created by adding a Multi-String Value)
Data = {E8978DA6-047F-4E3D-9C78-CDBE46041603}

Please note that although the two registry entries listed above look similar, they are not. One is in the Office Server section while the other is in Shared Tools\Web Server Extensions. The value of the data in both cases must be the same, i.e. {E8978DA6-047F-4E3D-9C78-CDBE46041603}.

8. Download the PDF logo from Adobe and copy the logo to the following location:
C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\TEMPLATE\IMAGES.

9. Add an entry in DOCICON.XML for the pdf icon in the following location:
C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\XML. The following entry needs to be added to the  <ByExtension> section of the DOCICON.XML file.

<Mapping Key=”pdf” Value=”pdf.gif”/>

If you are using a different file name for the GIF file, make sure that you replace “pdf.gif” with the name of your file.

10. Restart SharePoint search services. At the command prompt type:

net stop osearch
net start osearch

For SharePoint Server 2010 type:
net stop osearch14
net start osearch14

11. At the command prompt, restart IIS by typing:
IISRESET

12. At this point you should be able to see the PDF icon next to Adobe PDF files and the search results should display content from PDF documents along with a PDF icon.

Troubleshooting Tips

1. Make sure that you restart the search service and run IISRESET when you are done making the changes.

2. Depending on the order of changes you made, you may have to start a full crawl to index all the files.

3. Look for any typos in the entry you made in the DOCICON.XML file. Also, make sure that the entry was added to the <ByExtension> section of the DOCICON.XML file. This is one of the most common reason for failures.

4. Make sure that the name of the icon file matches with the entry in the DOCICON.XML file. For example, if your icon file is called PDF16, make sure you use the same name (PDF16.GIF) in the DOCICON.XML file.

5. If you used spaces at the beginning of the line, your PDF iFilter may not display the information as expected. There needs to be a tab at the beginning of the line, not spaces. Therefore, I recommend that you copy an existing entry in the DOCICON.XML file and then modify it for your PDF iFilter.

6. The icon that can be downloaded from Adobe’s Web site is 17×17 pixels. I read somewhere that the icon must be 8-bit and 16×16 pixels. I haven’t spent time to verify this (although I know others have used it on Windows Server 2003 32-bit and it worked for them) but when I couldn’t get mine to work I replaced my 17×17 icon with a 16×16 PDF icon. In my case there could be other reasons for the lack of icon display but if you can’t get your PDF icon to display you might want to try using this 16×16 pixel icon.

7. Make sure you make the changes in both places in step 7 of the instructions.

8. Whenever you make changes to the DOCICON.XML file, you need to run IISRESET at the command prompt. Refresh your browser to see the effect of the changes.

9. If you get an error when you try to save the DOCICON.XML file that it is used by another process, simply stop the Web service, save the file and then restart the service.

10. Gotcha! Be careful when you copy any code. For example, if you have copied the code from a Web site (e.g. step 9 in the previous step) you might want to paste it into notepad and them copy it from Notepad before pasting it into DOCICON.XML file to ensure that your text is pure ASCII text. When you copy the code from this page the double quotes are replaced with curly quotes. Watch out for this one because it is very easy to overlook.

11. You might find the following links helpful:

http://support.microsoft.com/?id=555209

http://blogs.msdn.com/ifilter/archive/2007/03/29/indexing-pdf-documents-with-adobe-reader-v-8-and-moss-2007.aspx

NOTE:

I wrote this article originally in January 2009 for MOSS 2007 and have updated it a few times to cover SharePoint 2010. As I mentioned earlier, you can also use these instructions for SharePoint Server 2010. Just replace the references to 12 hive with 14 hive in steps 5-9.

Original publication: 1/18/2009

Updated: 5/2/2010

Updated: 4/26/11

Updated: 5/12/11

Updated: 10/29/11

Last Update: 10/26/12