Monday, February 25, 2013

Passwords Need Changing

Dear spiteful Jesus was this a long one to sort out.

There are basic accounts that are needed to run Sharepoint on the backend. Usually, they involve Farm Accounts and Content Accounts and it gets weird, there are passwords.

Here is a pro tip:

  • Active Directory does not, itself, force you to change passwords.
  • Microsoftware, however, does.
  • Therefore, it is very possible as a new, slightly terrible summer temp stand-in, to introduce a situation where a Content Retrieval Account's passwords are different on the front end from the back end...
  • .... and unchangeable. 
  • And untraceable. Why did I even have to mention this, of course they are.
To fix this, you need to go into your hive folder and do a search for every last thing called Web.Config.

Don't do this next bit if your site faces outwards, because you will get the h4xx0r3d

Add the following to each of the ... fifteen? Twenty-seven? I don't know. All the config files you find.
<configuration>
<system.web>
<customErrors mode="Off" />
</system.web>
</configuration>

Nest appropriately, of course. Save them. Back them up if you're feeling like you may die today.

Okay, now you can see some of your many mysterious errors. Having discovered the error - lo! The passwords do not match!

Go to the Central Admin page, go to the Security tab, find the offensive account, and change the password to something you can remember.

Send that password to your AD manager.

Never change anything ever again.

You deserve a whisky. Thank god you fixed this on Friday at 4:30, eh? SUCKER.

Edit: I see that Angry Me glossed over exactly what was going on up there! Well done, Angry Me, you are second in diplomacy only to Drunk Me.

The Web Config edits turn on explicit error messages from your server. Without them, you get a deeply broken screen with the "processing your request" GIF (the load screens in sharepoint are animated gifs of a load image, which does not relate in the slightest to the running job) and a thing which comments that there's been a runtime error, but even though your account has The Tallest admin permissions, you cannot see what that error might be.

There is no way to set error messages to turn up for some accounts but not for others, although you can turn on making error messages only show up for people in the building. (set customErrors to mode="RemoteOnly" then watch them break anyway).  The error messages themselves are charmingly explicit and will tell you more or less what's wrong: a password is broken somewhere. They will suggest you can fix the problem via PowerShell, which in my machine is apparently referred to as Sharepoint 2010 Management Shell, which is not the same name at all, thank you.

When you go to the management shell and enter the magic words they say will work, what will happen in this instance is that the shell will spit about ten lines of red text at you telling you the password you entered is wrong and cannot be changed that way.

The way it can be fixed is the above: Create a new password you can remember in Central Admin's security panel. Send it to the Active Directory admin. Carve a note about it into your cave wall in the hopes that the next island strandee will not have to do this again.

No comments:

Post a Comment