Recreate SharePoint 2010 User Profile Service


I recently had to recreate the User Profile Service in my SharePoint 2010 test farm due to a bad PowerShell script to add permissions to the USP.   The USP was hosed.  I was getting an invalid claim error when calling Get-SPServiceApplicationSecurity or when clicking on the Permission button in Central Admin.  So I decided to recreate the USP to retain the existing profile data (90,000 users), synchronization filters and the managed metadata hookups.  I was successful in doing so.  Here are the steps I took:

  1. Log in to the server that is hosting the User Profile Synchronization Service. Launch command prompt as administrator. Change directory to \Program Files\Microsoft Office Server\14.0\Synchronization Service\Bin.  Backup the MIIS encryption key by running miiskmu.exe /e <Key file name and path>.  Please note that you may have to log in as the farm account when doing this (you will need to add the farm account back in the Local Administrator group anyway to reproision the synchronization service).
  2. Backup the Profile, Social and Sync databases.
  3. Stop the User Profile Service.
  4. Delete the user profile service application by either PowerShell or via Central Admin.  Do not choose the option to delete data.
  5. Delete the Sync database.
  6. Create the user profile service application with the same database names.
  7. Restore the Sync database backup over the one that was just automatically created.
  8. Log in to the server that was running the User Profile Synchronization Service.  Launch command prompt as admin.  Navigate to the same place as above.  Run miiskmu.exe /i <Key file name> {0E19E162-827E-4077-82D4-E6ABD531636E}.  Again, you may have to login as the farm account.
  9. Start the User Profile and User Profile Synchronization services. Again, the User Profile Synchronization Service may take some time to start up.  Note: I had to restart the server one time after waiting 30 min+ on the first.
  10. Check Central Admin to see whether the profiles are still there and whether the synchronization connections are still there.  If the synchronization connections disappear, try restarting the FIM Connection Manager service.   
  11. Test the synchronization service by running an incremental import.
  12. Reassign the administrators and permissions (content access account, web application pools in remote farms, etc.) 

 

Comments (2)

  1. import issue says:

    Hi Charlie,

      i have some issue with the powershell cmdlet like 'miiskmu.exe /i <Key file name> {0E19E162-827E-4077-82D4-E6ABD531636E}' when i want to upgrade my sharepoint environment from 2010 to 2013,i used the cmdlet ' miiskmu.exe /e <Key file name and path>' and export the user profile key  to my local machine,and the path is "C:Program FilesMicrosoft Office Serversmiiskeys-1.bin" ,but when i use the cmdlet "miiskmu.exe /i 'C:Program FilesMicrosoft Office Serversmiiskeys-1.bin' {0E19E162-827E-4077-82D4-E6ABD531636E}" ,it went wrong ,the information is :—————————

    Microsoft Identity Integration Server Key Management Utility


    Microsoft Identity Integration Server Key Management Utility v4.0.2450.47

    © 2010 Microsoft Corporation. All rights reserved

    MIIS database: <Failed to get server configuration>

    Key set:     <Failed to get server configuration>

    Usage: MIISKMU /e filename [/u:username {password | *}] [/q]

    /e       Export key set to file

    filename Filename

    /u:     Service account credentials

    username [domain]username

            [domain.com]username

            username@domain.com

    password Password (specify '*' to prompt for password)

    /q       Quiet mode (no pop up dialog boxes)

    NOTE: If calling this application from a batch file, prefix the command with "cmd /c "

    to have the ERRORLEVEL set to the success/error code of the operation.

    Press CTRL+C to copy message box text.


    OK  


    and my comand in the cmd window is like the follows:

    C:Program FilesMicrosoft Office Servers15.0Synchronization ServiceBin>miiskmu.exe /i 'C:Program FilesMicrosoft Office Serversmiiskeys-1.bin' {0E19E162-827E-4077-82D4-E6ABD531636E}

    could you please help me and give me some suggestions?

    beg you reply!

  2. Jordan says:

    Hello,

    Thank you for this article !

    I have run it on dev platform without problem, but on prod (not a joke !) I cannot re create the UPA and have the following message :

    "A SharePoint database named [DB name] already exists.."

    Do you know how can I recreate this UPA without losing all data ?

    Thank for your reply…

    Regards,

    Jordan

Skip to main content