User Profile Service Application - Access denied

Dec 8, 2010 at 8:37 AM

Hey!

I have been trying include the User Profile Service in our install (didn't install before), but the scripts errors with the following:

- Creating User Profile Service Application...
Access denied.  Only machine administrators are allowed to create administratio
n service job definitions of type: Microsoft.SharePoint.Administration.SPServic
eApplicationInstanceProvisioningJobDefinition, Microsoft.SharePoint, Version=14
.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c.
    + CategoryInfo          : InvalidData: (Microsoft.Offic...viceApplication: 
   SPCmdletNewProfileServiceApplication) [New-SPProfileServiceApplication], S  
  ecurityException
    + FullyQualifiedErrorId : Microsoft.Office.Server.UserProfiles.PowerShell. 
   SPCmdletNewProfileServiceApplication
 
Receive-Job :  - Failed to create User Profile Service Application
At E:\SP2010\AutoSPInstaller\AutoSPInstaller.ps1:1095 char:15
+             Receive-Job <<<<  -Name CreateProfileServiceAppJob -Verbose
    + CategoryInfo          : OperationStopped: ( - Failed to cr...ice Applica 
   tion:String) [Receive-Job], RuntimeException
    + FullyQualifiedErrorId :  - Failed to create User Profile Service Applica 
   tion
 
 - Creating User Profile Service Application Proxy...
New-SPProfileServiceApplicationProxy : Cannot validate argument on parameter 'S
erviceApplication'. The argument is null. Supply a non-null argument and try th
e command again.
At E:\SP2010\AutoSPInstaller\AutoSPInstaller.ps1:1104 char:134
+             $ProfileServiceAppProxy  = New-SPProfileServiceApplicationProxy -
Name "$UserProfileServiceName Proxy" -ServiceApplication <<<<  $ProfileServiceA
pp -DefaultProxyGroup
    + CategoryInfo          : InvalidData: (:) [New-SPProfileServiceApplicatio 
   nProxy], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.Offic 
   e.Server.UserProfiles.PowerShell.SPCmdletNewProfileServiceApplicationProxy
 
- Creating State Service Application...
 - Creating State Service Application Proxy...

 I have checked and dobbelt checked, but both the user used for installing and the FARM admin account are local admins (with the farm account being added to the administrators group in the script)

Everything else runs fine...

Any clues where to look?

Thanks!
Jesper


Coordinator
Dec 8, 2010 at 3:26 PM

Did you remember to right-click Launch.bat and select "Run as Administrator"? Alternately you could disable UAC on your server.

HTH,

Brian

Dec 9, 2010 at 9:29 AM

Yep - did the "Run as Administrator"

UAC disabling is a no-go (I work at Danish Defence - they are kinda picky about security :-)

Will investigate further :-)
If anything pops into mind - please tell :-D

Regards
Jesper

Dec 23, 2010 at 6:20 AM

I got the same error. I get the feeling this may be a race condition as it ended up working later. I did find this post.

http://blog.schauweb.dk/post/2010/12/01/User-Profile-Service.aspx

Dec 29, 2010 at 6:59 PM

Did anyone seem to find out what is happening wih this?  I never had this error before and if I switch back to the last version, it does not throw this error.

Coordinator
Dec 29, 2010 at 7:40 PM

I have a feeling it may be related to UAC - I've never experienced the 'Access Denied' but then again, the first thing I do is disable UAC on any new VMs I test on. Might need to incorporate some 'self-elevating' code to circumvent environments with UAC...

Brian

Dec 29, 2010 at 8:22 PM
timiun wrote:

Yep - did the "Run as Administrator"

UAC disabling is a no-go (I work at Danish Defence - they are kinda picky about security :-)

Will investigate further :-)
If anything pops into mind - please tell :-D

Regards
Jesper

 

Hi Jesper,

I did disable UAC and now the profile service did install correctly.  I would recommend that until Brian can adjust the script just disable UAC while doing this step and enable it after the script completes.  Of course you will have to restart your server a few times for this to take effect.

Hey Brian,

That did the trick!  Like always, this script ROCKS!

Coordinator
Dec 29, 2010 at 9:14 PM

Thanks for all the input guys & sorry for the often late/missing replies... I'm working on a way to have the script elevate itself so you don't have to disable UAC (and maybe don't even have to right-click Run As Administrator).

Cheers

Brian

Coordinator
Jan 14, 2011 at 10:23 PM

Update: the upcoming v2 should take care of the UAC issues and will self-elevate...

Cheers
Brian