André Krijnen

Not alot of people had these issues regarding the Claims to Windows Token Service, but I had some problems with it. For some reason on Windows Server 2008 with Service Pack 2 and all prerequisites installed except voor KB971831-x64 HotFix voor WCF c2wts couldn’t be started. In the event viewer and in the ULS logs I had alot of messages that it takes too long to start te service.

Also when I browsed to the http:///SecurityTokenServiceApplication/SecurityToken.svc I had an internal server error. So I knew that were some problems. I did also knew that I couldn’t install the KB article voor WCF. So I knew that this could cause the issues regarding the c2wts service.

For some reason or another it tries to make a connection to the outside world(internet) from the Service Application in order to get the ssl certificate, but this isn’t possible when you are at a production network of a cliënt. So I checked the config file of the SecurityToken.svc and I found out that there is a .NET framework 4.0 mentioned in it. So I downloaded the .NET Framework 4.0 and installed it on the production servers hosting SharePoint.

After installation it worked without any problems. I don’t know what fixes it, but it okay, because know we can use Excel Services as it should be.

The last couple of days I was working at a customer where Kerberos was needed for SharePoint 2010. Of course I started to set the different Service Principal Names for my App Pool accounts, farm accounts, machines, etc. Not to hard to do it, but I ran everytime in a 401 error: The requsted resources requires user authentication.
Strange I thought, but yet I sended the Domain Administrator more commando’s and it didn’t help. So I checked everything, checked for duplicates, etc. Still I ran into these errors.

After some search I found out that there are some problems with IIS 7.0 regarding Kerberos, and I needed to configure the applicationHost.config to solve these issues with Kerberos. enabled the kernel activation mode, etc. But, it didn’t make any difference, rebooted several times, removed the Kernel Activation Mode and removed again the changed on the applicationHost.config.

I knew that we’ve made C-Name records and it gave me a wonderfull idea to change the C-Name records to A records. These changes where applied, and wow, in less time as expected I opened IE and opened the different web apps. In less then a second the page was displayed from my web app. When you run in these problems, change your C-Name record to A-record and it will fix all your problems with SPN’s, Kerberos and IIS 7.0

I didn’t know that standard Windows 7 has Powershell installed. When I started powershell I noticed the V1 version in the menu bar, but this is not the real version. I didn’t know that until I did:

Get-Host

It shows the following information:

Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\Users\> get-host

Name : ConsoleHost
Version : 2.0
InstanceId : 880b266d-2931-4ff5-9ba8-181e3ecc5ab3
UI : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture : nl-NL
CurrentUICulture : en-US
PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
IsRunspacePushed : False
Runspace : System.Management.Automation.Runspaces.LocalRunspace