SharePoint 2010 Profiles & MySites Webinar Q & A

This webinar included several live demonstrations and a discussion of:

• Creating & maintaining users in SharePoint
• Troubleshooting why changes to user information do not always work
• The relationship between User Profiles & MySites
• How SharePoint security really works for Sub-sites, Lists, Libraries & Items
• What happens to MySites & Profiles when users are deleted
• Planning and Documenting User Profile Service Customizations
• Best Practices & Avoiding Pitfalls

This webinar provided information, guidance, tips and techniques for managing User Profiles and MySites in SharePoint 2010 and was presented by ShareSquared's SharePoint MVP's & Certified Master Candidates Paul Stork and Jim Duncan.

Q & A

• Question: Will a recorded version of the webinar be made available?
  
  Answer: Yes, it is available here, and the slides here
  Note, if you experience issues with the low-res recording, please try the hi-res version for best viewing.
  
  
• Question: How can we increase the length of "Bio" more than 3600 characters?
  
  Answer: Assuming you mean the “About Me” property, the built-in property lengths are hard coded and can’t be changed. However, you could create your own custom HTML property similar to the About Me property and set the length to whatever you would prefer.
  
  
• Question: What's the best way to manage Tag/Notes entries, centrally or at the Site Collection level?
  
  Answer: Tag/Note entries can be deleted for a specific user or URL in Central Administration, but there is no option for managing them at the Site Collection level. You can read more about the Central Admin management features on the TechNet Site. Individual users can also manage their own Tags and Notes in their MySite but administrators cannot manage them at the site collection level.
  
  
• Question: Can User Profile Service be used without activating MySites?
  
  Answer: The User Profile service depends on having a MySite host as the shared interface for displaying and editing Profile information however, the User Profile service will function normally without implementing a MySite for each user. To implement a MySite Host without implementing individual MySites adjust the User Permissions in the User Profile Service under People to remove the Create Personal Site permission. By default that permission is available for NT Authority\Authenticated Users (all classic mode users) and All Authenticated Users (all claims based users).
  
  
• Question: In Central Administration, In "Manage Policies" under "Edit User Profile Property"; is there a way to setup add, update, edit of a user's properties in Active Directory from SharePoint?
  
  Answer: When editing individual User Profile Properties you can create an Import or Export mapping. The Export mapping is used to Sync changes in SharePoint back to Active Directory. You can have either an Import or Export mapping, but not both. Attributes must already exist in both Active Directory and the User Profile to be mapped. You can’t add new properties dynamically.
  
  
• Question: Is there a way to override the flag for deletion in 14 days? Or can we increase this deletion date?
  
  Answer: There is no way to change the 14 day deletion timing. It is hard coded into the MySite Cleanup Timer Job. The only way to change the timing would be to deactivate the MySite Cleanup Timer Job and replace it with your own custom Timer Job.
  
  
• Question: If a profile is deleted, does it delete from the default Created/Modified By column throughout the Portal?
  
  Answer: The Created By/Modified By entries use information in the Site’s UserInfo table, not the User Profiles. When the MySite Cleanup Job deletes the User Profile it has no effect on any People columns in lists or libraries. The one change you will see is that clicking on the user’s name in one of these columns will no longer take you to a User Profile, since it doesn’t exist. Instead you will be directed to the WSS User Display page. This displays a subset of what was in the User Profile when it was deleted.
  
  
• Question: What happens to sites where an employee is an admin? Does their supervisor have permission to those sites?
  
  Answer: The MySite Clean-up timer job has no effect on websites other than those contained in the user’s personal MySite site collection. Since entries are not removed from the Site UserInfo table the deleted/disabled employee will still be listed as the Site Collection Administrator. You can re-assign ownership of other sites to a different user before deleting or disabling the employee using the ‘STSADM –o MigrateUser’ command.
  
  
• Question: Is the UserInfoTbl a SQL table?
  
  Answer: The UserInfo table is a table stored in the Content Database for each Site Collection. That said, it is not recommended that you access this table directly since it will void your support warranty with Microsoft. Microsoft does not allow any direct access to the SQL tables used by SharePoint.
  
  
• Question: Is there any way to display the user profile database as a list? Dataview?
  
  Answer: You can create custom web parts to display information stored in User Profiles however, there is no way provided in the regular product to display this information as a list or using a DataView web part.
  
  
• Question: Can we limit end users permission to create new sites under their My Site, or to upload too many pictures?
  
  Answer: No. User’s are by definition the Site Collection administrator of their personal MySite. This is by design and can’t be changed. You can and should limit the storage space available for a user’s MySite by implementing a site collection quota on all MySites. You also need to have users make good choices themselves about what to store in MySites by establishing a good set of Governance Policies.
  
  
• Question: How do you get user profiles to display profile ID pictures. Do they need to be stored in AD or in a site? What's the best practice?
  
  Answer: The easiest way to add user profile pictures is to have user’s add their own through the Profile Edit form. When editing a user profile, a user can easily select a picture on their local workstation. SharePoint will upload it, re-size it, and store it in the appropriate location for you. If you want to bulk upload user profile pictures you can do this by either importing them from Active Directory or by uploading them using a PowerShell script. This post talks about how to import pictures to SharePoint from AD.
  
  
• Question: One of the polls indicated that 26% of respondents had implemented MySites with less than stellar adoption. Do you have experience regarding why so many implementations have sub-optimal usage?
  
  Answer: MySites don’t really have a corollary in pre-SharePoint environments. This makes it difficult for most users to envision how they should be used. Because similar functionality doesn’t exist in current networks personal network drives are often used to explain what MySites are “like”. The problem with this approach is that it highlights the use of MySites for personal storage but completely misses any “collaborative” capabilities.
  
  

  This results in users who:

  • See no advantage in using MySites for personal storage since access is often more cumbersome than a personal drive mapping
  • Completely overlook the use of MySites for “collaboration” thinking that a shared Team Site is more appropriate.
  • Are disappointed by the relative simplicity of “social networking” features available in MySites
  
  

  The final result is users who have no clear vision of what to use a MySite for. We believe this is why many MySite implementations are underutilized. Until familiarity with MySites and their uses increases this will probably continue. Without widespread use, the only way to increase this familiarity is training. Any roll out of MySites should include a carefully designed training plan that does as much to fire the imagination of users on how MySites can be used as it instructs them on the mechanics of their use.

  
  
  
• Question: I want users to be able to edit their manager field, but changing the property of the manager field puts up a warning that scares users into not wanting to edit the manager field. The warning suggests that the next sync will delete their manager field edits.
  
  Answer: By default the Manager property is mapped to the Active Directory field and any changes made locally will be overwritten by the settings in Active Directory. That’s why your users see the warning. If you remove the Manager field Import Mapping that maps it to the Manager field in Active Directory the message you are seeing will go away.
  
  
• Question: Please provide more guidance on custom code for preventing/postponing the personal site deletion via MySite Cleanup Job?
  
  Answer: As mentioned above the 14 day deletion is hard coded into the MySite Clean-up timer job. To override it you would need to create your own custom timer job as a replacement for the MySiteCleanup job. You can override just the Profile deletion by creating a custom class that inherits from IProfileEventInterface. That class can be substituted for the normal Profile deletion process using the STSADM –o PreProfileDeleted command.
  
  
• Question: How can I prevent inactive users from displaying on the org chart?
  
  Answer: Disabled users in Active Directory will continue to show in the Organization Browser. To remove them from the browser you will need to remove their manager setting in AD. Once their manager’s profile is synchronized they will be removed from the organization browser.
  
  
• Question: In a multi-domain deployment, how can you filter people search scopes to display results for one domain but not another?
  
  Answer: The default People search scope only includes a filter based on content class. This content class includes all the People objects in SharePoint. There is no simple way to limit a search scope to only include people from a specific domain.
  
  
• Question: Can the User Profile user interface be changed? Should it?
  
  Answer: The shared pages used to display a User’s MySite are all contained in a single MySite Host site collection. You can easily change them just like you would change any other SharePoint site. The branding can be modified and pages can be added or removed. Re-branding a user’s personal MySite is a little trickier but can also be accomplished through the use of custom code.
  
  
• Question: What keys things to consider when migrating MySites from 2007 to 2010? Any known issues?
  
  Answer: The best step by step write-up, located here, I’ve seen on migrating from a SharePoint 2007 SSP to SharePoint 2010 is written by Ali Mazaheri, SharePoint MCM. We’ve used it several times to perform successful upgrades from 2007 to 2010.
  
  
• Question: What happens if you delete a user from the "All People" page? We do this currently to remove alerts and reference to an individual user in any site permissions, etc., in a site collection. Is this a problem?
  
  Answer: Removing the user from the All People page will remove their entry in the UserInfo table however, you will still see them listed in lists and libraries, for things they’ve created or modified. Clicking on their name will then result in an error.
  
  
• Question: If the User Profile service is corrupted (sync no longer works correctly), can the User Profile service be deleted and recreated without losing the users' account pictures (they are not pulled from AD, only in the mysite)?
  
  Answer: The User Profile service can be deleted and recreated without deleting the MySite host or the individual MySites. Since the pictures are stored in a list in the MySite Host that will preserve the pictures. However, you may need to do some PowerShell scripting to reconnect the profiles in the new User Profile service to the mysites and pictures.
  
  
• Question: Any way to remove "What's happening?" comments after a user make them? Say a user makes an offensive comment, we would like to be able to remove it.
  
  Answer: There is currently no way to easily remove comments in the "What’s happening?" tag without writing custom code. Other Social Tags and Notes can be removed through the User Profile Service application in Central Administration.
  
  
• Question: How can I steer users in the organization to use MySites as a collaboration tool? it seems that users create MySites and then hardly visit the site.
  
  Answer: There is really no substitute for training in this case. The problem is that MySites are a new concept and their use is not fully understood by most users. The closest equivalent is a network home directory, but that is only used for storing personal content not for collaboration. So its not surprising that without training users will tend to use MySites as a personal storage space rather than as somewhere to share information from.
  
  
• Question: I want to change my Picture Attribute to a custom one we set up. When I go to change the attribute setting, the attribute I want to use is not available in the drop down. What do I need to do see all the attributes in my AD?
  
  Answer: There are a couple potential issues here. First Importing Pictures from AD wasn’t supported in the original release of SharePoint 2010. This wasn’t made available until the October 2010 Cumulative Update. You can find the documentation for the CU here. The second problem may be that the picture attribute you are trying to map isn’t the right data type. The User Profile Picture Attribute is actually a URL that points to an image, and not an image itself.
  
  
• Question: Which is better - create AD groups for use in SP or create groups in SP alone? or is it a hybrid?
  
  Answer: The answer to that depends on how your company intends to manage SharePoint security. If you plan to manage it centrally then we normally recommend creating and using AD groups. But if you plan to decentralize security to individual business units or business owners then we would recommend creating SharePoint groups, otherwise you would need to give your business users administrative authority in AD. Its not that one is better than the other, just that each fit better into a specific corporate plan.
  
  
• Question: Is there any way to prevent un-provisioning of the UPS during a farm backup?
  
  Answer: This issue is fixed by the June 2011 Cumulative Update for SharePoint server. Otherwise you will need to leave your Farm Administrator as a local admin on the server running the User Profile Synchronization service. Without the CU a Farm Backup will automatically un-provision and then re-provision the User Profile Synchronization Service.
  
  
• Question: In Manage User Profiles page, what can you set to list out all the Profiles Missing from Import?
  
  Answer: To display the Profiles missing from the last import simply select ‘Profiles Missing from Import’ in the View dropdown before you do your search. You will still need to provide some entry in the Find profiles textbox, normally the first letter of the Domain.
  
  
• Question: Do you know of a good place for info on importing user profile information from a BCS?
  
  Answer: This TechNet article contains a video that demonstrates how to use BCS to import user profile information from a SQL server database.
  
  
• Question: Is there a way to put each MySite into a separate content db?
  
  Answer: There is no way to automatically create a new content db for each user’s MySite as it is provisioned. If you pre-create the MySites using PowerShell you could control what content db the MySite is created in.
  
  
• Question: How can I centrally manage all the Social Tags, Notes, Like It, etc. so that they are all in central location and easy to manage?
  
  Answer: You can manage all the Notes and Tags from the User Profile Service in Central Admin by selecting ‘Manage Social Tags and Notes’ under the My Site Settings group. This provides an interface where you can search for Tags or Notes by User, URL, Data Range or contents. Once found the Notes/Tags can be deleted.
  
  
• Question: Please confirm/deny - the Memberships property of the profile only includes sites where the user is an "Active User"?
  
  Answer: First we should discuss what the difference is between an Active and Non-Active user. All users give direct permission to a site are Active users. Users whose membership is based on AD group membership, who have logged into a site, but not contributed are Non-Active users. Users whose membership is based on AD group membership who have NOT logged into a site are not recognized as users until they log in to the site for the first time.
  
  

  For a site to show in the Memberships property of the User Profile there are several things that need to be in place:

  • The site must contain a default “Members” group or inherit security from a site that has a default “Members” group. Having security access to the site is not enough.
  • The user must be a direct member of the default “Members” group mentioned in point 1. Being a member of an AD group that is a member of the “Members” group is NOT sufficient. All users directly added to the Members group are Active users.
  • A successful search crawl of the site where you are a member must have been run since you were added to the “Members” group.
  • An Incremental User Profile Synchronization must have been completed AFTER the search crawl finished.