SharePoint 2010 Search result Not found documents for a specific library in specific SharePoint site

Hi All,

I came across a situation where user is trying to search documents selecting the option “search in same site” instead of “all sites” from  search box and getting no result where as can find documents from other library with in same site.

Why such happens ?

The first point comes to mind for search error is  content not crawled, indexing not done for this situation.

Yes , its true but we need to think why  ?

As per my investigation I found the setting of the library as below

Draft-items-are-not-crawled-in-SharePoint

By default SharePoint only crawls major versions of files and draft items are only viewable by their creators. SharePoint is behaving as expected out of box.Draft items are not crawled in SharePoint

Resolution :

This behavior can be altered in Document Library Settings -> Versioning Settings -> Draft Item Security

Select the option “Any user who can read items”.

This will allow all users to see draft items including the crawling account.

  • Else you need to select “Create major versions” option or can publish the documents as major versions if want to get those documents in search result as per client wish.

https://support.microsoft.com/en-us/help/2304855/draft-items-are-not-crawled-in-sharepoint

Access Denied Error after migrating to SharePoint 2013

Scenario:

We were working for a client, they had many groups and we had to build a collaboration portal for all the groups. Key thing was few sites of some groups were already present in SharePoint 2010 in different standalone servers. Migration was a key thing here as the existing sites has huge data, and huge user base.

The Requirement was to build a portal /web application which will have migrated sites and new set of sites as per agreed site structure. According to the agreed architecture and design we created a new web application and started building the site hierarchy.

As part of this we followed the regular approach database detach –attach method and migrated the existing SharePoint 2010 site .Migration was successful and we were able to access the site  with the system account. Later we tried with couple of site admin accounts, to our surprise we were getting “ACCESS DENIED” with any other user id.

Background:

By default when we create a web application in SharePoint 2013, it gets created with Claims authentication. When we migrate the content DB to 2013, it recognizes the user account only in this format i:0#.w|domainusername . Though it’s an AD account it no more recognizes the DomainUserName format.

SharePoint assumes all users to be claim users and renders them so. Therefore, a normal windows user – “DomainUserName” appears as “i:0#.w|DomainUserName”. Moreover, it uses the username in this same format to check for its permissions but does not find a matching entry for the user as the database has windows users – “DomainUserName”. So, the site will give you an access denied.

Note that the System Account will work since its “DomainUserName” is never used and System Account is a keyword used by SharePoint for the application pool identity. Therefore, it remains unaffected.

Solution:

In brief the share point 2010 site which needs to be migrated should be converted to claims format and then migrate it to 2013. But a word of caution , do not directly change the SP 2010 site to claims format in a production environment as it will not allow existing windows accounts to login and existing SharePoint 2010 site will be no more operational.

Below power shell script converts classic mode site to claims mode:

Power shell script

This script converts user accounts to claims format:

Script for converting user accounts to claims format

On executing the first script (to enable claims authentication) the SharePoint Content Database is made ready for claims based authentication but the already existing site users were windows users, are not “migrated” to be understood by claims authentication.

We use the second script to “migrate” the users. MigrateUser($true) will convert all user accounts to claims format. After running this script user accounts are converted in the database to claims format, therefore, user names are read correctly by SharePoint therefore, permissions for users are associated correctly by SharePoint hence the site permissions work correctly.

Note:

By any chance if you execute these scripts directly in productions, by executing $webapp.MigrateUsers($false) will not convert user accounts to windows mode, rather it will throw an exception. Make sure you have a temporary environment built where you execute the above scripts. Also note that these scripts are running on Web Applications so they will affect all site collections in that web application

Accounts used to install and configure SharePoint 2013

Account Purpose Requirements
SQL Server service account The SQL Server service account is used to run SQL Server. It is the service account for the following SQL Server services:  MSSQLSERVER  SQLSERVERAGENT   If you do not use the default SQL Server instance, in the Windows Services console, these services will be shown as the following:  MSSQL  SQLAgent Use either a Local System account or a domain user account. If you plan to back up to or restore from an external resource, permissions to the external resource must be granted to the appropriate account. If you use a domain user account for the SQL Server service account, grant permissions to that domain user account. However, if you use the Network Service or the Local System account, grant permissions to the external resource to the machine account (). The instance name is arbitrary and was created when SQL Server was installed.
Setup user account The Setup user account is used to run the following:  Setup  SharePoint Products Configuration Wizard  Domain user account.  Member of the Administrators group on each server on which Setup is run.  SQL Server login on the computer that runs SQL Server.  Member of the following SQL Server roles:  securityadmin fixed server role  dbcreator fixed server role   If you run Windows PowerShell cmdlets that affect a database, this account must be a member of the db_ownerfixed database role for the database.
Server farm account or database access account The server farm account is used to perform the following tasks:  Configure and manage the server farm.  Act as the application pool identity for the SharePoint Central Administration Web site.  Run the Microsoft SharePoint Foundation Workflow Timer Service.  Domain user account.   Additional permissions are automatically granted for the server farm account on Web servers and application servers that are joined to a server farm. The server farm account is automatically added as a SQL Server login on the computer that runs SQL Server. The account is added to the following SQL Server security roles:  dbcreator fixed server role  securityadmin fixed server role  db_owner fixed database role for all SharePoint databases in the server farm

Accounts used by application pools or service identities are in the local machine Administrators group SharePoint

Rule Name:  Accounts used by application pools or service identities are in the local machine Administrators group.

Summary:  A user account that is used by application pools or services must have permissions of a domain user account and must not be a member of the Farm Administrators group or a member of the Administrators group on the local computer. Using highly privileged accounts for application pools or services poses a security risk to the farm, and could allow malicious code to execute.

Cause:  Accounts that are used by application pools or services are members of the Administrators group on the local computer.

Resolution: Change the user account to a predefined account, or to a domain user account that is not a member of the Administrators group.

  1. Verify that the user account that is performing this procedure is a member of the Farm Administrators group.
  2. On the Central Administration home page, in the Security section, click Configure service accounts.
  3. On the Service Accounts page, in the Select the component to update list, click the application pool or service that uses the credentials of a member of the Administrators group on the local computer as its security account.
  4. In the Select an account list, click an appropriate account for this component — for example, the predefined account Network Service — or click Register new managed account, and then on the Register Managed Account page, specify the credentials and the password change settings that you want.
  5. Click OK.