Dec 31 2008
Solution Preview:
Do not use the Network Service account in a farm that has been installed using Least Privilege access – you will receive strange errors when approval workflows are executed. To change the identity of a SharePoint application pool to a specific account, use Central Admin, Operations tab, Service Accounts. Don’t try to do it by hand.
Background:
I had configured a SharePoint farm for a customer about 30 days ago. This customer had a developer who was going to be dropping a custom application in place on the farm in the coming weeks so he didn’t want me to create the Application Pool or Site collection for the solution, so I did everything else that was required for the install. One other bit of information is that when I do my installations, I follow best practices and use least privilege access. The install went fine and I handed the farm off t the customer and the customer’s developer.
The Situation
Last night I received a call from a support tech that that customer called and was very angry that we had used “SharePoint Trial Access Keys” when installing SharePoint for them 30 days ago. The tech was told that when the customer attempted to create a new page they received the error “The Trial period has expired for this product.” I did the installation, I know the keys I used were not trial keys. I logged on to the server (from home at 8:30 in the evening) and navigated to the site. I created a new sub-site in their production environment (template: Team Site) as I didn’t want to mess with their custom application they were trying to get deployed in the root. I was able to create the site and numerous pages within the site.
After relaying this to the customer they gave me permission to create a page within their production site (template: Publishing Portal). I was able to create the site, but when I clicked Publish I did in fact receive the error: The trial period has expired for this product!
After some searching around it became apparent that when the developer created the application pool for the new site, he used the Network Service account as it’s identity. This was the cause of the error. Apparently when you mix authentication methodologies in a SharePoint install it gets upset.
Now this error is NOT associated with creating new pages. I was able to do that in the Team Site I had created and I was able to create the site in the Publishing Portal. The problem occurs when the content publishing workflow fired in the publishing portal. So something in the specific workflow was hitting an authentication error which, naturally, spewed the error: The trial period has expired.
The Solution
Change the identity of the Application Pool to be a specific SharePoint service account. To do this by hand is very tedious (and not recommended)
- Change the identity of the Application Pool Identity
- Add the new user to the IIS_WPG and WSS_WPG
- Assign the user: Adjust memory quotas for process and Replace a process level token
- Give the IIS_WPG group Read & Execute, List Folder Contents, and Read permissions to the Web site directories
- Create a new SQL login and grant appropriate rights
- A bunch of other stuff
The SHAREPOINT WAY (and the right way) is to:
- Create the new service account
- Open Central Admin
- Go to the Operations Tab
- Under Security Configuration click Service Accounts
- Click the radio button for web application pool and select the appropriate application pool
- Click the Configurable radio button
- Enter in the correct Username and Password
- Click OK
- Open a command prompt and enter: iisreset
- Test the site
That’s it. Enjoy.