Installing Microsoft Forefront Identity Manager 2016 SP1 on Server 2016 with SQL 2016
Total Page:16
File Type:pdf, Size:1020Kb
Installing Microsoft Forefront Identity Manager 2016 SP1 on Server 2016 with SQL 2016 In this post, I will walk you through the process of installing MIM 2016 SP1 on Windows Server 2016 running SQL 2016. MIM 2016 SP1 will be evaluation version. My home lab consist of: Domain – RAMLAN.CA DC1 & DC2 - Domain Controllers Server 2016 MIM – Forefront Identity Manager Server 2016 SP1 on Server 2016 Create proper OU structure for MIM install. I have created the following to keep everything clean. I will be creating following users and groups within above OU. These accounts will be used during the installation/testing/deployment stages. I have shared PowerShell script to create these users/groups. import-module activedirectory $sp = ConvertTo-SecureString "01Jan2009" –asplaintext –force New-ADUser –SamAccountName MIMMA –name MIMMA -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName MIMSync –name MIMSync -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName MIMService –name MIMService -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName MIMSSPR –name MIMSSPR -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName MIMSSPR –name MIMSSPWR -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName SharePoint –name SharePoint -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName SqlEngine –name SqlEngine -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName SQLAgent –name SQLAgent -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp - PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName "[email protected]" New-ADUser –SamAccountName BackupAdmin –name BackupAdmin -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp -PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName [email protected] New-ADUser –SamAccountName BackupAdmin –name MIMADSync -path "OU=ServiceAccounts,OU=Services,OU=MIM,DC=ramlan,DC=ca" -AccountPassword $sp -PasswordNeverExpires 1 -Enabled 1 -UserPrincipalName [email protected] and add this user to Domain Admin group as well New-ADGroup –name MIMSyncAdmins –GroupCategory Security –GroupScope Global –SamAccountName MIMSyncAdmins -path "OU=Groups,OU=Services,OU=MIM,DC=ramlan,DC=ca" New-ADGroup –name MIMSyncOperators –GroupCategory Security –GroupScope Global –SamAccountName MIMSyncOperators -path "OU=Groups,OU=Services,OU=MIM,DC=ramlan,DC=ca" New-ADGroup –name MIMSyncJoiners –GroupCategory Security –GroupScope Global –SamAccountName MIMSyncJoiners -path "OU=Groups,OU=Services,OU=MIM,DC=ramlan,DC=ca" New-ADGroup –name MIMSyncBrowse –GroupCategory Security –GroupScope Global –SamAccountName MIMSyncBrowse -path "OU=Groups,OU=Services,OU=MIM,DC=ramlan,DC=ca" New-ADGroup –name MIMSyncPasswordReset –GroupCategory Security –GroupScope Global –SamAccountName MIMSyncPasswordReset -path "OU=Groups,OU=Services,OU=MIM,DC=ramlan,DC=ca" Run below command to add these groups as well. Create SPNs: Run below command as Domain Admin setspn -S http/MIM.RAMLAN.CA RAMLAN\SharePoint setspn -S http/MIM RAMLAN\SharePoint setspn -S FIMService/MIM.RAMLAN.CA RAMLAN\MIMService setspn -S FIMSynchronizationService/MIM.RAMLAN.CA RAMLAN\MIMSync Install pre req using PowerShell: Add-WindowsFeature NET-HTTP-Activation,NET-Non-HTTP-Activ,NET-WCF-Pipe-Activation45,NET-WCF- HTTP-Activation45,Web-Server,Web-WebServer,Web-Common-Http,Web-Static-Content,Web-Default- Doc,Web-Dir-Browsing,Web-Http-Errors,Web-App-Dev,Web-Asp-Net,Web-Asp-Net45,Web-Net- Ext,Web-Net-Ext45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Health,Web-Http-Logging,Web-Log- Libraries,Web-Request-Monitor,Web-Http-Tracing,Web-Security,Web-Basic-Auth,Web-Windows- Auth,Web-Filtering,Web-Digest-Auth,Web-Performance,Web-Stat-Compression,Web-Dyn- Compression,Web-Mgmt-Tools,Web-Mgmt-Console,Web-Mgmt-Compat,Web-Metabase,WAS,WAS- Process-Model,WAS-NET-Environment,WAS-Config-APIs,Web-Lgcy-Scripting,Windows-Identity- Foundation,Xps-Viewer –verbose Install-WindowsFeature Web-WebServer, Net-Framework-Features,rsat-ad-powershell,Web-Mgmt- Tools,Windows-Identity-Foundation,Server-Media-Foundation,Xps-Viewer –includeallsubfeature Set local security policies: Open properties for Log on as a service and add these accounts. RAMLAN\MIMSync; RAMLAN\MIMMA; RAMLAN\MIMService; RAMLAN\Sharepoint; RAMLAN\SQLEngine; RAMLAN\SQLAgent; RAMLAN\MIMSSPR; RAMLAN\MIMSSPWR Add these 2 accounts as well – MIMADSYNC & MIMSSPWR Open properties for Deny access to this computer from the network and add these accounts. RAMLAN\MIMSYNC; RAMLAN\MIMSERVICE Open properties for Deny log on locally and add these accounts. RAMLAN\MIMSYNC; RAMLAN\MIMSERVICE Change the IIS Authentication mode: iisreset /STOP C:\Windows\System32\inetsrv\appcmd.exe unlock config /section:windowsAuthentication - commit:apphost iisreset /START Install SQL Server 2016 SP1: After mounting SQL 2016 ISO – You can run this command to install SQL silently. setup.exe /Q /IACCEPTSQLSERVERLICENSETERMS /ACTION=install /FEATURES=SQL /INSTANCENAME=MSSQLSERVER /SQLSVCACCOUNT="RAMLAN\SQLEngine" /SQLSVCPASSWORD="01Jan2009" /AGTSVCACCOUNT="RAMLAN\SQLAgent" /AGTSVCPASSWORD=”01Jan2009” /AGTSVCSTARTUPTYPE=Automatic /SQLSYSADMINACCOUNTS="RAMLAN\Administrator" I am going to perform manual install of SQL 2016 SP1 - Include Full-Text & Semantic Extractions for Search. This is required. Install SQL Server 2016 SP2: I am going to perform manual install of SQL 2016 SP2 - Install SQL Server 2016 SP2 CU2: I am going to perform manual install of SQL 2016 SP2 CU2- Install Management Studio: I am going to perform manual install of SQL Management Studio - Install SharePoint Foundation 2013 with SP1: https://www.microsoft.com/en-ca/download/confirmation.aspx?id=42039 Download SharePoint Foundation 2013 from above link. Extract to the folder using this command "sharepoint.exe" /extract:c:\download\sharepoint Start the prerequisite installer wizard from an administrative command shell. If you do not use an administrative shell, you will get download errors and the wizard will fail. Restart the Server Feature installation: Fix .net framework 4.5 hardcoding (solution courtesy of https://support.microsoft.com/en- ca/help/3087184/sharepoint-2013-or-project-server-2013-setup-error-if-the–net-framewo) First you have to download https://download.microsoft.com/download/3/6/2/362c4a9c-4afe-425e- 825f-369d34d64f4e/wsssetup_15-0-4709-1000_x64.zip Open the .zip file and extract the wsssetup.dll into the updates folder under your extracted Sharepoint installation. (C:\download\Sharepoint\updates) if you have replicated my folder structure) Start the Sharepoint installer from an administrative command shell and run setup Configuration Wizards: 01Jan2009 I was getting above error when, I open Central SharePoint site. Try one of the solutions listed below: 1. Copy MOMAgent.msi from OM Server (C:\Program Files\Microsoft System Center\Operations Manager\Server\AgentManagement\amd64) Run this command - msiexec.exe /fvomus "MOMagent.msi" NOAPM=1 Restart the server 2. You can try this solution - Locate HKLM\SOFTWARE\Microsoft\.NETFramework - Add a new DWORD value called LoaderOptimization. Open SharePoint Central Administration site – It should work now Configure SharePoint for MIM: A) Create new web application Start SharePoint Management Shell with run as admin and run below command $dbManagedAccount = Get-SPManagedAccount -Identity RAMLAN\SharePoint New-SpWebApplication -Name "MIM Portal" -ApplicationPool "MIMAppPool" -ApplicationPoolAccount $dbManagedAccount -AuthenticationMethod "Kerberos" -Port 82 -URL http://portal.ramlan.ca B) Create new Site collection connected to the new web application $t = Get-SPWebTemplate -compatibilityLevel 14 -Identity "STS#1" $w = Get-SPWebApplication http://portal.ramlan.ca:82 New-SPSite -Url $w.Url -Template $t -OwnerAlias RAMLAN\administrator -CompatibilityLevel 14 -Name "MIM Portal" -SecondaryOwnerAlias RAMLAN\BackupAdmin $s = SpSite($w.Url) $s.AllowSelfServiceUpgrade = $false $s.CompatibilityLevel C) Disable SharePoint Server side view state and SharePoint task health analysis $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService; $contentService.ViewStateOnServer = $false; $contentService.Update(); Get-SPTimerJob hourly-all-sptimerservice-health-analysis-job | disable-SPTimerJob Make sure you can login to the new site (http://localhost:82/default.aspx) Installation: Synchronization Service Mount the ISO and run setup.exe from Synchronization Service folder Since we were unable to export the key due to above error. I clicked No to complete the process. Below you will find how to back up the keys. Since we were not able to export the keys – I will show you how it can be done. Open Synchronization