As you might know by now, Office SharePoint Server 2007 includes a collection of components designed to serve specific functions, such as search, collaboration, business intelligence, business forms, content management, enterprise search, and so on. A web site that is built in SharePoint will use a combination of these components. For example, an intranet site will use the collaboration, search, business forms, and business intelligence components, whereas a site built for web content publishing will use the content management and search capabilities. Each of these different components has its own configuration requirements and other settings. Therefore, depending upon the different features being used in the site, the administrative tasks will vary.
The objective of this chapter is to discuss some of the most common administrative tasks performed at the different levels within the SharePoint 2007 environment. These tasks include the administration of server-level configurations, web applications, site collections, and site settings. A detailed review of every administrative option is beyond the scope of this chapter.
Tip
Please see Chapter 3 and Chapter 4 for in-depth coverage on administrative tasks related to server installation and server configuration.
SharePoint 2007 provides different utilities to perform the post installation configuration. These utilities can be divided into three main categories:
Certain administrative tasks can be performed using different tools. For example, tasks such as creating a site collection, backup, and restore can be performed using either the Central Administration options or the STSADM command-line utility.
Any web site built on SharePoint 2007 (intranet portal, publishing web site, etc.) will have a hierarchy of sites to organize the content. Building a web site in SharePoint starts with creating a web application. Then, one or more site collections, applied with a specific template, will be added to the web application. Each site collection will have one or more sites, and each site will have a collection of Web Parts and pages.
Tip
For a detailed discussion on site hierarchy and designing sites, refer to Chapter 5.
Administration tasks at each level of the hierarchy vary. Tasks at the lower level of the hierarchy (site level) might include creating lists or configuring a user; these are the responsibility of the site owner. Tasks at the upper level of the hierarchy (site-collection or web-application level) might include activating or deactivating WSS features or configuring search; these would be the responsibility of SharePoint administrators. From a hierarchy perspective, the administration tasks can be broken down into the following different levels:
Central Administration tasks, which mainly include options for administering the server farm. These tasks can be further subdivided into three main sections:
—Operations
—Application Management
—Shared Services Administration
Web application administration
Top-level site administration
Site administration
Office SharePoint 2007 presents a list of administrative tasks to be completed after the installation. Each of these tasks is a one-time configuration activity and is part of the configuration required to prepare an Office SharePoint Server 2007 farm for use. Not all the tasks in the administrative list need to be performed; the tasks required depend on the type of installation. Figure 23-1 depicts the list of administrative activities.
As mentioned earlier, Central Administration is divided into three main subdivisions based on functionality. The first one, operations, focuses on the configuration of servers and services, including server topology, overall SharePoint security, upgrade and migration, backup and restore, and content deployment. Content deployment is related to web content management and is required only if the portal requires automated content deployment. The second section, application management, deals with the tasks specific to application creation, site collection management, shared services, InfoPath forms services, application-specific security, workflow, and data connections. The final section, Shared Services Provider (SSP), is used to configure the search, business data catalog settings, Excel services settings, SharePoint My Sites, and audiences.
This section explores some of the important and most common administrative tasks performed using the operations section.
One of the first tasks in a server farm is to configure each server in the farm with appropriate services. This task is performed with the “Services on server” option under the “Topology and Services” section in the Operations page. SharePoint 2007 has five different roles that can be used to configure a server within the farm. Selecting a role enables the different services to perform that role’s activities. Some of these services require further configuration. SharePoint Server 2007 provides a services indicator that displays the status of the service. Figure 23-2 depicts the different roles available to a given SharePoint server.
In order to enable alerts and notifications, Office SharePoint server requires an outgoing email server. To configure an outgoing email server, select the Outgoing Email Settings option under the topology and services section of the operations page.
SharePoint 2007 contains a new feature that allows email messages to be stored directly in SharePoint lists. To make this feature work correctly, there are several components that need to be configured. If SMTP service is running on one of the farm servers, SharePoint configures the settings for incoming email automatically. Using the Operations → “Incoming email” settings, the server should be configured to accept incoming emails. The Advanced option can be used to explicitly specify the options, in case SMTP service is not running on the server. The directory management service in SharePoint 2007 can be used to integrate the list’s email settings with the organization’s active directory. When enabled, the directory management service creates an account for the list in the active directory, thereby allowing users to search for email-enabled SharePoint lists using the address book. The SPTimer service polls the mail drop folder and routes the emails to the appropriate lists. Figure 23-3 depicts the email configuration settings under the topology and services section in the operations page.
Once the email settings have been configured, the SharePoint list needs to be mail-enabled to accept incoming emails. The list settings page provides an option for configuring incoming emails for the list. This option is available only if the server has been configured to accept incoming emails. To set the list to receive emails, set the “Allow this document library to receive emails” option to Yes and provide an email address that users will use to send emails to this list. The configuration page also provides options for saving attachments, saving the original email files (.eml), saving meeting invitations, and specifying security (i.e., who can send emails to this list). Figure 23-4 depicts this page.
The Operations → Antivirus option under the Security Configuration section allows administrators to apply antivirus settings, such as scanning documents on upload and download. Antivirus software is not included in Office SharePoint Server 2007, and so antivirus software specially built to support SharePoint must be installed on all front end web servers. For example, Microsoft provides Fore Front Security for SharePoint, a separate antivirus software specially designed to integrate tightly with SharePoint Server 2007. More information can be found at http://www.microsoft.com/forefront/serversecurity/sharepoint/download.mspx.
The Operations → Blocked File Types option under the Security Configuration section allows administrators to configure which file types need to be blocked from being uploaded into a SharePoint library. The list of blocked file types is maintained on a per–web application basis. To add new file types to the list, scroll to the bottom of the list and add each file type in a separate line.
SharePoint 2007 introduces a new policy-based system to manage documents. The idea is to create a policy based on certain features—such as barcodes, auditing, and labeling—and then associate a content type or library to a policy, thereby forcing the documents to follow the guidelines defined in the policy. The Operations → Information Management Policy Configuration page under the Security Configuration section allows the administrator to manage the features that could be used in a policy.
Office SharePoint Server 2007 comes with four different policy features:
- Expiration
The expiration feature is used to set the content expiration in a manner that can be tracked and managed.
- Auditing
The auditing policy feature can be used to log events such as viewing, editing, checking in, and deleting documents or list items.
- Labeling
The labeling feature allows users to attach document-specific notes that can be formatted, searched, and printed.
- Barcode
The barcode policy feature enables users to attach a barcode image to a document, thereby creating a unique identifier for the document.
There are three steps to implementing an information management policy:
- Configure the policy features
Select Operations → Information Management Policy to activate or deactivate the policy features.
- Create a new Information Management Policy
Use the site collection’s Site Collection Policies page to create a new policy.
- Apply the policy to the content type
You can also apply it to the document library.
Information management policies are created at a site collection level. To create one, navigate to the Site Settings page of a site and choose the Site Collection Policies link under Site Collection Administration. Once a policy is created, it can be associated with a library or a list by navigating to the settings option of the library or list and then selecting the Information Management Policy Settings link under “Permissions and Management.” Click New to create a new policy. Figure 23-5 shows a policy creation page.
The Operations → Information Management Policy Usage Reports option under the “Logging and Reporting” section in the operations page can be used to configure reporting on a site’s information management policies. The reports are configured on a per–web application basis and can be scheduled. Figure 23-6 shows the Information Policy Usage Reports configuration page.
The Operations → "Usage analysis processing” option allows the administrator to configure the SharePoint usage reporting service. Once configured, the service provides different categories of reports, such as summary, users, destination pages, search results and queries, and requests. This service allows administrators and users to monitor and query site usage statistics such as:
Average number of requests per day
Top pages used in the site
Top users visiting the site
Frequent search queries and results
Overall usage of the site collection usage metrics
In order to configure the usage analysis reporting service, three different components need to be configured:
- Windows SharePoint Services usage logging
Using the Central Administration → Operations → “Usage analysis reporting” option, check the Enable Logging option and specify a time for processing the log. This will enable the logging at the WSS level.
- Office SharePoint Server 2007 usage logging
Navigate to the shared services provider home page and choose Usage Reporting under the Office SharePoint Usage Reporting section. Choose “Enable advanced usage analysis processing” and “Enable search query logging” and click OK. This configuration step needs to be performed on a per–shared services provider level. Figure 23-7 depicts the Office Server 2007 usage configuration page.
- Activate the reporting feature for a portal
Navigate to the Site Settings → Site Collection feature and activate the Reporting feature. This configuration step needs to be performed at a per-application level.
Once configured and processed, the Site Settings → Site collection usage reports option can be used to view the reports. Figure 23-8 depicts the reporting page.
Using the Operations → Alternate access mappings option under the Global Configuration section, an administrator can configure multiple URLs for a given web application. Each web application can be configured with different URLs for the default, intranet, Internet, custom, and extranet public zones. To configure public URLs, choose the Edit Public URLs option from the Alternate Access Mapping page, and then select the web application to configure. Figure 23-9 depicts the Alternate Access Mapping page.
Office SharePoint 2007 provides different options and utilities for performing backup and restore. A backup and restore strategy should be planned, taking into consideration the different options, the strategy’s pros and cons, and other environment settings. A new feature in SharePoint 2007 is a two-phase Recycle Bin, which users and administrators can use to restore deleted content from the Recycle Bin.
This section focuses on the different backup and restore options available in SharePoint 2007. To perform a successful backup and restore, Office SharePoint Server 2007 requires that the SQL server account have read and write privileges on the backup folders.
The Central Administration →
Operations page
provides a GUI-based mechanism to perform backup and restores at a web
application or farm level. One drawback in using this interface is that the
backup operation cannot be scheduled. To perform a scheduled backup
operation, a command-line utility called STSADM (located in the “12 hive,”
which is <install
location>Program FilesCommon
FilesMicrosoft SharedWeb Server Extensions12in) can be
used in a script, which can then be scheduled. In addition these two options
(Central Administration and
STSADM), third-party utilities also can be used to perform the backup and restore.
Backup and restore can be performed at different levels:
- Farm-level backup
This can be performed using the Central Administration → Operations → Perform a backup or with the
–obackup operation with the-directoryand–backup method fulloptions with the stsadm utility. For example:stsadm–o backup–directory <location to store backup> -backupmethod full
- Web application backup
Use Central Administration or the
–obackup operation with the–item“Farm Windows SharePoint Web Applicationwebappname” option with the stsadm utility. For example, to back up:stsadm–obackup–directory <location to store backup>–item "FarmWindows SharePoint Web ApplicationWebAppName" - backupmethod full
To restore:
stsadm–o restore–directory <location of backup> -item "FarmWindows SharePoint Web ApplicationWebAppName"–restoremethod <new/overwrite>
- Site collection backup
Use the–o backup operation with the–url option in the stsadm utility. For example, to back up:
stsadm–o backup–url <http://URL of site collection> -filename <location of backup filename .bak>
To restore:
stsadm–o restore–filename <location of the back file> -url <URL to restore the site collection>
- Individual sites backup
Use the–o export operation with the–url option. For example, to back up:
stsadm–o export–url <http://URL of the site> -filename <location of the export file.bak>
To restore:
stsadm–o import–filename <location of the backup file.bak> -URL <URL to restore the exported site>
- Database backup
Configuration and content database can be backed up independently using the SQL server back utilities.
While performing backup and restores it is important to remember that custom Web Parts, custom component files, and settings are not backed up. To perform a successful restore, these components should be explicitly installed and configured.
As mentioned before, the Operations → “Perform a backup” option under the "Backup and Restore” section of Office SharePoint Server 2007 allows administrators to back up web applications, web application content databases, shared services content databases, and the configuration database. The page allows the administrator to choose either a specific web application or the entire farm for backup. To perform a backup of a web application, select the web application from the list presented; SharePoint 2007 automatically selects its content databases. In the next page, choose whether the backup performed should be full or differential, and provide a location for the backup file. Figure 23-10 shows step 1 of the backup operation.
This procedure creates a set of files in the backup folder specified. To restore the portal from this backup, use the Operations → “Restore from backup” option. Specify the location of the backup file in step 1, and then step 2 will display the components available for restoration. Figure 23-11 displays this page.
Step 3 will display the available content database(s) for the web application to be restored. Step 4 provides the information to specify whether the restore should use the settings when the backup was performed (this will overwrite the web application) or restore the backup with a new configuration. Choosing the later requires a new web application name, URL, physical file location, and content database names. Figure 23-12 shows this page.
The Operations page also has sections for configuring the upgrade and migration of sites from WSS 2.0 and MCMS sites. Another available section is for configuring content deployment settings, which are required for publishing portals and sites.
In addition to these sections, there are certain other options that have not been discussed in this chapter, such as configuring single sign-on settings, diagnostic logging, and solution management, all of which are optional configuration elements. Information rights management, although not a required configuration, can be useful in protecting content. The following section briefly discusses this option.
Microsoft Office SharePoint Server 2007 supports Information Rights Management (IRM) at a list or library level. IRM allows administrators to limit the actions that authorized users can perform on specific document types. It can be used to prevent unauthorized users from copying, modifying, and printing the documents’ content. IRM uses a file format–specific protector to manage the rights for files within a SharePoint list or library. IRM requires the following additional software:
- Microsoft Windows Rights Management Services Client
This software must be installed on every front end web server in the farm.
- Microsoft Windows Rights Management Services for Window Server 2003 (SP 1 or later)
This server software must be available in the network.
- File type protector
Office SharePoint Server 2007 includes protectors for InfoPath documents and Office documents. To use IRM on any other file type in a list or library, a separate protector must be installed on each front end web server.
To configure the server with IRM, use the Operations → Information Rights Management option under the Security Configuration section. Once the server is configured, the List/library settings → Information Rights Management link under the “Permissions and Management” section can be used to apply specific security settings. For the Information Rights Management link to appear, IRM must be first configured at the server level.
This section focuses on the common administrative tasks performed using the application management page. This page allows administrators to administer web applications, manage site collections, configure shared services for the farm, configure security, manage workflows, and administer external connections and the InfoPath Forms Services.
The Application → “Create or extend web application” option under the SharePoint Web Application Management section is used to create and configure web applications. A web application by itself is essentially an empty container and needs to be provisioned with site collections or with a shared services provider.
To create a web application, use the “Application management” → “Create or extend web application” option. This page has options for creating a new IIS web site or using an existing one, creating a new application pool for the web site or using an existing one, options for a security provider for the web application, and specifying the database server and the content database name. It is a good practice to isolate each web application into its own application pools. To create a web application, follow these steps:
Specify a web site description. This will be used as the web site name in IIS.
Provide a port number. SharePoint 2007 provides an arbitrary port number.
Enter a host header if the URL of the web application is resolved by the DNS servers.
Specify a virtual directory location. By default, this is InetpubWWWRootWSS VirtualDirectoriesPortNumber.
In the security configuration section, choose an authentication provider (Kerberos or NTLM), and specify whether the site allows anonymous access and whether the site uses SSL.
In the application pool section, specify an existing web application, or create a new application by choosing “Create a new application pool.” Provide a name for the application pool and enter the credentials for the application pool.
Choose “Restart IIS automatically.”
Specify the database server and specify the content database name.
Choose OK to create a web application.
Figure 23-13 displays the new web application page.
Web applications can also be created and mapped to other web applications. The extended web application exposes the content of the mapped web application. This way, a different authentication mechanism can be used for internal users and people from other domains or the Internet. To extend a web application, select “Create or extend a new web application” → “Extend a web application.” Choose the web application to be mapped in the “Web application” section, and choose the application pool and security configuration as before. Since the extended web application exposes the content of the mapped web application, it does not have a content database of its own. Figure 23-14 depicts the page for extending a web application.
A web application hosting site collections needs to be associated to a SSP; therefore, SSP should be created prior to creating other web applications. A Shared Services Provider (SSP) provides services such as My Site, audiences, Office SharePoint usage reporting, search, Excel services, and the business data catalog. A web application hosting site collections is associated with one SSP, whereas a given SSP can serve multiple such web applications. To host the SSP, a web application is required. One special requirement for a web application hosting the SSP is that network services cannot be used as the application pool identity. SSP also requires another web application to host the MySite.
To create a shared services provider, choose Shared Services Administration → New SSP from the Central Administration page. Follow these steps to create a new SSP:
Specify a name for the SSP.
Specify a web application for the SSP. If a web application does not exist, choose “Create a new web application.”
Choose a web application for the My Site. Again, choose “Create a new web application” if a web application does not exist.
Enter the credentials for the timer jobs run by the SSP.
Specify a database server name and content database name for SSP.
SSP uses a separate database for storing the search information. Specify a database server name and database name to be used as the search database.
Choose an index server in the farm. SharePoint Server will, by default, populate the available index servers from the farm.
Choose whether the web services for SSP will use SSL.
Click OK to create the SSP.
Figure 23-15 depicts the New Shared Services Provider page.
As mentioned before, each web application that hosts site collections requires an SSP. Each SSP can host multiple web applications. The association between the web application and the SSP can be changed using the Shared Services Administration → Change Association page. If there are multiple SSPs configured, you can choose the SSP in the drop-down list, choose the web application(s) that need to be associated with the SSP, and then click OK. Figure 23-16 depicts the change association page.
The Application Management → Define Managed Paths option under the SharePoint Web Application Management section is used to define a managed path on a per web application basis. A managed path defines any custom paths in the URL that could be used by the site collections in the web application. A managed path can be either included (wildcard inclusion) or excluded (explicit exclusion). Wildcard inclusion is useful to create custom paths for site collections. Explicit exclusion could be used for custom web site applications under the SharePoint web application; in this case, the web application path is managed by SharePoint, but the custom web site path is not. To add a managed path, follow these steps:
Navigate to the Define Managed Path page from the application management page.
Under the web application section, choose the web application to define the managed path.
Enter the path for inclusion or exclusion. Test the URL by clicking “Check URL.”
Choose whether the path should be a “wildcard inclusion” or an “explicit exclusion,” and then press OK.
Figure 23-17 shows the managed path page.
Application Management → Web Application General Settings page can used to perform general web application settings such as setting the time zone for the web application, enabling or disabling RSS feeds and alerts, setting space quotas for site collections, defining the maximum upload size, and entering the Recycle Bin settings. To configure the general web application settings, choose “Web application general settings” from the “Application Management” page, and choose the specific web application for which to configure the settings. Figure 23-18 depicts the Web Application General Settings page.
To create a site collection using the Application Management → Create Site Collection page, follow these steps:
Choose a web application for which to create a site collection.
Enter a title for the web application.
Site collections can be created at the root or in a managed path. If the managed path is a custom managed path, choose one from the drop-down list if required. The managed path should already be created for the web application. Enter the URL name for the site collection.
Pick a template from the template categories (Collaboration, Meeting, Enterprise, or Publishing).
Enter a primary site collection owner and an optional secondary owner.
Choose a quota for the site collection (discussed in the next section).
Click OK to create the site collection.
Figure 23-19 depicts the site collection creation page.
Quota templates are used to define space limitations for site collections. They are defined at the server level and are applied while creating a site collection, using the web application general settings or using the site collection quotas and locks option under the SharePoint Site Management section. To create a new quota template, follow these steps:
Figure 23-20 depicts the quota template creation page.
Authentication providers for web applications can be configured using the Application Management → Authentication Providers option under the application security section. This option can be used to configure or change the authentication type, enable/disable anonymous access, and change the IIS authentication settings to use NTLM or the Kerberos authentication protocol. Figure 23-21 shows the configuration of the authentication provider for the web application.
Using the Application Management → Workflow Settings page, configure the workflow settings, such as notifications for internal and external users and allowing user-defined workflow options for a given web application. Figure 23-22 shows the Workflow Settings page.
The application management page includes other options for configuring web applications and for site collection management. Besides these administration options, the application management page also includes configuration settings for the InfoPath Forms services, external service connection, and search service.
The top-level site administration page includes options for managing the galleries for Web Parts, master pages and layout pages, site templates, enabling and disabling features, and configuring search options for the site collection, auditing, and caching. The top-level site is the root of the site collection. Each site has its own site-level administration page (discussed later in this chapter). Discussed here are some of the options in the site collection administration:
- Site collection features
The site collection features option under the Site Collection Administration page can be used to activate and deactivate features for the entire site collection.
- Site Collection Audit Settings
These can be used to set the events that need to be audited. For a document library and list items, these events include:
- Audit log reports
This option provides different types of reports that can be created using the auditing settings. Administrators can create custom reports by using “Run a custom report” under the Custom Reports section or by using another report from one of the following categories:
Content activity reports
Information Management Policy reports
Security and Site Settings reports
- Site collection policies
This lets administrators configure the information management policies for the site collection. Information management policies can be imported or created here.
- Web Part Gallery
Using the Web Parts option under the Galleries page, administrators can configure new Web Parts for the site collection. Prior to this step, a Web Part needs to be installed in the server and marked as “safe” in the web.config file of the web application. Once the Web Part is installed, it can be made available to the sites in the site collection by populating the Web Part into the gallery. To populate a Web Part into a gallery, follow these steps:
Navigate to the Web Part Gallery (Site Settings → Web Parts)
Choose New in the Web Part Gallery page.
Choose the Web Part that needs to be populated in the gallery, and click Populate Gallery. Figure 23-23 shows the Populate Gallery page.
- Site Template Gallery
The Site Template Gallery is used to upload site template (.stp) files.
Site administration can be performed using the Site Settings link of the specific site. This section discusses some of the administrative tasks that can be performed at a site level.
- Look and Feel—Master Page
Each site can be applied with its own master pages. Using the Site Settings → Master Page option under the “Look and feel” section, an administrator can change the site master page or system master page and provide an alternate CSS file. For a child site, either the master page can be inherited from the parent or it can apply one on its own. Figure 23-24 depicts the site master page settings page.
- Look and Feel—Navigation
Using the Site Setting → Navigation option under the “Look and Feel” section, the site’s global navigation (top menu) and the current navigation (left navigation) can be changed. SharePoint Server 2007 provides options to include/exclude subsites, hide/show specific items, manually add links to customize the navigation, and sort. The options available in the navigation page are different for a top-level site and for a childsite. Figure 23-25 displays the navigation settings for a child site.
- Look and Feel—Page layouts and site templates
This section allows administrators to specify the layouts and templates that subsites can use.
- Look and Feel—Welcome Page
The administrator can set the welcome page for a specific site through this section.
- Users and Permissions—People and groups
This section can be used to configure security for the site collection and the individual sites. SharePoint implements role-based (called a “group” in SharePoint terminology) security. A role itself is a collection of privileges/permissions. Roles are applied to SharePoint content objects such as sites, libraries, or lists. Users who belong to the role will have the permissions defined in the role on the applied content objects. A user or an AD group can be added to the role. SharePoint has pre-defined roles, such as approvers, hierarchy managers, designers, and visitors.
To add users or groups to a role, follow these steps:
Navigate to Site Settings → “People and groups.”
Choose New → User.
Enter the users or AD groups by specifying the username, group name, or email. Alternatively, you can search for a user or group by clicking the browse icon below the Users/Groups text box. You can also check the user-name through clicking the check names icon.
To assign users to a predefined permission group, choose the available groups from the drop-down list. To give a user explicit permissions, choose one or more permission levels from the “Give permissions directly” section.
Choose OK to add the user to the group.
If the child sites do not inherit permissions from the parent, custom security can be implemented at the child sites. To break permission inheritance from the parent, follow these steps:
Navigate to Site Settings → People and Groups of a child site.
Select Site Permissions from the left navigation bar.
Choose Actions → Edit Permissions. This brings up a dialog box warning that security changes at the parent site will no longer be effective for this site. Click OK.
To add a custom SharePoint group, follow these steps:
Navigate to Site Settings → People and groups.
Choose New → New Group.
Specify a name for the group in the Name section.
Specify the owner of the group.
In the group setting section, specify whether members of the group will have rights to view or edit the group membership.
In the membership requests section, specify whether users should be allowed to request access to the group or request to leave the group.
Specify the permissions that the members of this group should have.
Click OK to create the group. Figure 23-26 depicts the New SharePoint Group creation page.
In addition to the administrative tasks discussed in this section, the site settings page for a site provides other options for configuring RSS feeds, creating new content objects (such as subsites, workspaces, lists, and libraries), and activating/deactivating features at the site level.
This chapter explored some of the common administrative tasks performed at the Central Administration level, site collection level, and site level. SharePoint administration varies according to the type of installation (single-server or farm), the set of features used (publishing, business data catalog, or Excel services), and other environment settings. Since administration tasks are performed at various levels, it is important from an organizational perspective to create a strategy for delegating administrative tasks among the system administrators, power users, and end users.