In truth this error can be caused by a number of factors and there is not just one answer. The best way to approach this error is by working through all the possible reasons this could be happening and eliminating each step. This way you will get to the root cause and (ultimately fix) any underlying issues you have with your UPA/ContentDB synchronisation process.
To trouble shoot this issue properly we need to understand what is actually going on and what may be causing the issue – so here goes:
The Theory bit…
When dealing with user profiles it's very easy to get mislead with all the terminology and the path of what actually happens during the site logon process. So this next bit is intended to help clarify the process and hopefully lead us closer to a permanent fix.
When a user authenticates against a site it uses the information in the content database for that Site Collection. This information is kept in the userInfo table and is synchronised with the central User Profile Store by two Sync Jobs:
- User Profile to SharePoint Full Synchronisation (hourly by default)
- User Profile to SharePoint Quick Synchronisation (every 5 minutes by default)
The key to these jobs are in the names – which is also why they are routinely misunderstood. Most people think these are the normal full and incremental Active Directory jobs for the user profile application and with the dubious titles it is easy to understand why!
In reality these jobs take information FROM the User Profile Store to the SHAREPOINT content databases throughout the day and they are responsible for refreshing the information in those content databases with the information stored in the User Profile Store.
The incremental job is designed to run every five minutes and only synchronises users that have been set to active since the last synchronisation, whereas the full synchronisation job synchronises all the users' details in the content DB. The idea behind these jobs is to ensure that when a user logs on for the first time that they have to wait for the least amount of time possible before there details are updated (if the incremental job doesn't get you within five minutes the hourly quick job will J )
So when a site collection is setup for the first time in its shiny new DB the userInfo table lists who has, and hasn't got access to the site but until that person hits the site for the first time, the isActive flag for the user is set to zero.
The isActive flag is used by these two jobs to define whether or not the information for a user should be synchronised. So when a user hits the site for the first time, it sets this flag to 1 and the next quick or incremental job will pick this up and synchronise the information accordingly.
This means that when a user logs on for the first time the isActive flag is set to 1, but the information about the user will not be present – hence the display name is not set in this content database – and therefore the user account display name will be set to their user account name which is Domain\UserName.
Once the Full or Incremental jobs pick up the change (i.e. it sees that the user now has a 1 value for isActive) they sync the user's data from the User Profile Store (including the ever important display name) and et viola! On refresh the users display name is changed from Domain\UserName to Display Name (as well as making all the other profile information available like phone number etc.)
So from reviewing this process above and confirming the symptoms we can start to rectify any errors.
Defining the Symptoms – (Potential causes for User Showing as Domain Username)
The way to do this is to ask two simple questions which can go a long way to tracing down the exact source of the error:
If the user logs on to a different site collection (in a different ContentDB) does this still happen?
This will help you define if the error is localised to the current site collection DB or is spanned across multiple Site Collection DBs. This will help us ascertain whether or not the full and incremental synchronisation jobs are working/running and if the issue is localised to one DB or is farm wide
Is the user set as active in the current site?
This will tell us if the current site collection is expecting to have the information for the user. If the user has never logged onto the site or has been set to inactive (i.e. they haven't logged on for 30 days – which by default sets isActive back to zero) then they want have their Display Name set until the next Full or incremental job is ran, and then further to this if the jobs have been ran but the user has not been synced we can start to look elsewhere.
The following scripts lists the details of the userInfo Table sorted with the isActive Flag and login and title listed first to help you quickly determine if the user is active or not.
USE [NAME_OF_YOUR_CONTENT_DB_GOES_HERE]
GO
SELECT TOP 10 [tp_SiteID]
,[tp_ID]
,[tp_IsActive]
,[tp_Login]
,[tp_Title]
,[tp_Email]
,[tp_DomainGroup]
,[tp_SystemID]
,[tp_Deleted]
,[tp_SiteAdmin]
,[tp_Notes]
,[tp_Token]
,[tp_ExternalToken]
,[tp_ExternalTokenLastUpdated]
,[tp_Locale]
,[tp_CalendarType]
,[tp_AdjustHijriDays]
,[tp_TimeZone]
,[tp_Time24]
,[tp_AltCalendarType]
,[tp_CalendarViewOptions]
,[tp_WorkDays]
,[tp_WorkDayStartHour]
,[tp_WorkDayEndHour]
,[tp_Mobile]
,[tp_Flags]
FROM [NAME_OF_YOUR_CONTENT_DB_GOES_HERE].[dbo].[UserInfo]
The result should look like this:
How to resolve the issue
The information you have gained from applying the above logic should be pointing you in the right direction by now so here is a list of fix's that can be applied to help rectify the issue
Confirm the users AD account is legitimate and not locked
First and foremost make sure the user is active in AD. It may seem a little obvious but checking it may save you a lot of time – needless to say a user being disabled in AD will not be able to log on to the site.
Confirm the user is an active user of the site
As mentioned above, look at the userInfo table for the site collection DB for the site in questions and see if the user's isActive flag is set. From here you can also see all the other profile information that is available and this will be a good indication of whether or not the account is being synchronised.
Remove and Re-add the user in the site collection
Sometime the user's details may become stale. If you check the contentdb and they are set to active and the jobs are running fine and this issue is related to just one user then deleting and re-adding the user in quick succession will refresh the user data as it does another full import from ad for that user. Once the Full or Incremental jobs pick up the users change status they will synchronise the information again. Don't forget to make a note of the user's security group membership beforehand and add them back in once the operation is complete.
Checking the last time ContentDBs were synchronised
You can check the last time the content DBs were synchronised by using the following STSADM commands. The –listolddatabases command lists all databases that have not been synchronised longer then the day value that you provide. So in this example it lists all DBs that have not been synchronised in the last day:
stsadm -o sync -listolddatabases 0
If you subsequently use the –deleteolddatabases command this will delete the records in the userInfo table in the ContentDBs older than the day value given which means that on the next Full or Incremental sync the table will be totally repopulated. In this case any records not synchronised within the last day will be deleted and repopulated – THE DATABASES WILL NOT BE DELETED! Only the corresponding records in the table:
stsadm -o sync -deleteolddatabases 0
The language used in this command can come across as quite destructive but in all fairness it's essentially triggering a re-sync.
Sync the individual user from AD
You may come across occasions where individual accounts have not been synchronised and removing them and re-adding them from the site collection may not be acceptable.
n.b. This could be for a number of reasons but is most likely to involve the membership of lots of permission groups- so re-adding them to each might be a more labour intensive task than you are willing to undertake
In this scenario you can use the Set-SPUser –syncfromad command which essentially synchronises the user's information table record with the contents of Active Directory. The script below does this for a specific user in one site collection:
add-pssnapin microsoft.sharepoint.powershell
Set-SPUser -identity http://Siteyouwantsync/my -SyncFromAD
This may be the less destructive option for your scenario but please be warned that when the next full or incremental profile sync with AD should trigger an overwrite of this information. This shouldn't be a problem as you've synchronised the user with AD using this command anyway J
Sync All Users from AD
Like the above scenario you may have to re-sync all users in one particular site collection rather than just one user. In this scenario removing each user from the site collection would not be practical and you may have good reasons for not running the Full or Incremental sync jobs. This script iterates through the site collection in question and synchronises each user in turn with AD.
add-pssnapin microsoft.sharepoint.powershell
Get-SPUser -Web http://SiteToSync/my
Get-SPUser -Web http://SiteToSync/my | ForEach-Object {Set-SPUser -identity $_.name -web http://SiteToSync/my -SyncFromAD}
Once again these commands will be overwritten by the profile store information when the next full AD synchronisation takes place.
If in doubt - check FIM!
If by this stage you are still struggling with this issue then you may be having trouble with UPA/FIM and you may need to investigate your full user profile synchronisation and setup. In this scenario I'd refer you to rather brilliant set of blogs by Spencer Harbar at:
http://harbar.net/
Paying particular attention to:
http://www.harbar.net/articles/sp2010ups.aspx
The main point from here will be to check the FIM interface and do a MetaVerse search for your problem user – this will help determine the state of the user and indeed the last time the user's attributes were synchronised with AD.
The FIM client can be found here:
Systemdrive:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe
One Final Word of Caution…
In this post I've covered two highly contentious and volatile areas, namely:
- Connecting to SharePoint contentDBs
- Connecting to the FIM interface
Whilst connecting to these clients and viewing information will not harm your installation you must be aware that ANY changes to ANY SharePoint information contained within SharePoint databases is unsupported and any changes made in the FIM interface are also unsupported – so please, ensure you only use these methods to view information to aid troubleshooting and not as an actual troubleshoot tool! Sermon over… J
Hope someone finds this useful – feel free to send feedback via the comments form on the right hand side.