I have had some time this week to try out some tools that I have been meaning to try out. This week I am trying out
the SP 2010 Diagnostic Studio. I installed it successfully and tried it on my development evironment. I was able to build a report and a snapshot of
the environment. I decided to turn my attention to my Employer's intranet environment. This would allow me to analyze it and measure it against benchmarks. I didn't want to install
the Diagnostic studio on
the Production Envorinment, lucky for me,
the Diagnostic studio can be run remotely, well...kind of.
Issue
My development environment is a stand alone, full installation of SharePoint 2010 Server. It has Office 2010, SQL 2008 Enterprise, a DC...well you get
the point, it's jammed packed! But more importantly it's a stand alone, self contained VM environment. Well Microsoft has instructions as to how to connect remotely with Diagnostic Studio here.
The deciving part of this is that
the SP2010DS prompts you for credentails. So I thought I was getting
the right account to run
the reports.
I tried all
the Power Shell commands in
the link
above but I still ended up getting
the following errors:
06/28/2011 12:50:18 Connecting to remote server failed with
the following error message :
The WinRM client cannot process
the request...If
the SPN exists, but CredSSP cannot use Kerberos to validate
the identity of
the target computer and you still want to allow
the delegation of
the user credentials to
the target computer, use gpedit.msc and look at
the following policy: Computer Configuration -> Administrative Templates -> System -> Credentials Delegation -> Allow Fresh Credentials with NTLM-only Server Authentication. Verify that it is enabled and configured with an SPN appropriate for
the target computer. For example, for a target computer name "myserver.domain.com",
the SPN can be one of
the following: WSMAN/myserver.domain.com or WSMAN/*.domain.com. Try
the request again after these changes. For more information, see
the about_Remote_Troubleshooting Help topic.
06/28/2011 12:54:47 Access to
the path '\\<targetserver>\C$\Users\<account logging in>\AppData\Local\Temp' is denied.
You might also get an error message like this:
The WinRM client cannot process
the request. A computer policy does not allow
the delegation of
the user credentials to
the target computer.
Explanation
After looking at
the event logs on
the target environment, I noticed that there were a several Security Exceptions. After looking at
the specifics around who was denied access, I was able to see
the account that was being denied access, it was
the client machine administrator account. Well of course that was never going to work!!!
After some quick Googling,
the last error message
above will lead you to edit
the Local Group Policy on
the client server. And although there are instructions from microsoft around doing this, it really will not work in this scenario. Notice
the Description and how it only applices to authentication mentioned?
Resolution
I can tell you what I did, but I wish there was a better way but I simply don't know if it's duable any other way. Because my development environment had it's own DC, I didn't really want to mess with Kerberos authentication. I would also not be smart to connect that server to
the domain, considering it has it's own DC.
I ended up installing SharePoint 2010 Diagnostic Studio on another Windows 7 Dev environment I have, and connected
the machien to
the domain. I ran all
the necesary remote credentials commands mentioned here. Those commands add
the group policy for you! Once I did this I was able to authenticate properly and I was able to get
the reports.
Conclusion
You can run SharePoint 2010 Diagnostic Studio Remotely but it will require some specific scenarions. A couple of things I should mention is that as far as I understand, SP2010 DS, will install agents on your target environment to run tests and retrieve
the data. I was a Farm Administrator, and also a Server Admin on SharePoint Server. I am not 100% sure if you need all those permissions but I that's just what I have to my internal intranet.
I deally I would like to have a machine that I can have SharePoint 2010 DIagnostic Studio installed and I can run that against client environments. It appears that I will not be able to do that, unless I enable Kerberos on my Windows 7 Machine now. If you have it installed in
the same way I would like to have it, please let me know, I'll keep trying to get what I'm after. Hope this helps someone out there doing
the same.
