The final day of the conference - today I focussed on the IT PRO track – all 5 sessions. So that’s Steve Smith, Spencer Harbar, Daniel Wessels, Spencer again, Bob Fox and Brian Wilson, covering Intranets, Extranets, internet sites, search, Kerberos and Virtualising SharePoint.
Steve Smith started the day with a redefinition of WWW, as the wild wild west. It’s an open world out there and as soon as you attach your servers to the internet they’re insecure, you really don’t know who will be accessing your content or trying to do things they shouldn’t. You have layers of security at the edge, (that may be ISA), IIS and then again at the SharePoint level, with your content in the database and that’s what you’re delivering or protecting. I suppose it’s obvious really, but the more complex you make things in these layers, the less likely they are to be secure because of mistakes.
They continued with best practices for your Web applications and SSL scenarios – where Spencer Harbar put in the one liner – “host headers are evil” – but it transpires that this is only in the context of SSL, where life really is a lot easier if you use fixed IPs and stick to standard port numbers.
Daniel Wessels took us through Search Infrastructure, Architecture, Setup and Management. It seems there are varying rules of thumb for the size of your search DB, depending on which whitepaper or documentation you read, going from 2x to 6x the size of your index, but you won’t really know what that figure will be for you until you run some tests on the mix of data your farm is indexing. Looking at the servers in the farm, the maximum ratios for Query, index and DB server are 7:1:1, above that the performance actually tails off... time for an extra index server and thus another SSP to scale the capacity and performance.
For your default search content access account this really should not be a farm administrator, in this scenario both minor versions and unpublished documents will be indexed and potentially visible to end users. So although if they have not got permissions to see these versions of the documents they won’t be able to see them when clicking on the search result link, they will see the words around the keyword matched in the search results page. Another interesting point was around the content access account used for external websites, here you need to be using an account that has no permissions on your network, because if challenged the indexer will give up the account’s username and password to the external site and you really don’t want that being used to access your network do you?
During the lunch session Andrew Woodward and Alex Pearce gave us a view on some of what is happening in the education space in the UK with SharePoint and showed us a great looking interface for a VLE built with Silverlight sitting on top of the SharePoint Learning Kit for a UK Learning Gateway.
After lunch, Spencer Harbar and Bob Fox took us through setting up Shared Services and Excel Calculation Services to use Kerberos and it went well, apart from the demo on shared services causing some problems, but hey nothing like a live demo to go wrong... but there was good discussion and questions while Spence battled with IIS & SP to get it to work.
Some key pointers from the session – case matters when you are setting your SPNs, and all the SSPs in your farm must be either all NTM or all Kerberos, you can’t mix them.
Brian Wilson finished off the speaker sessions for the day covering virtualisation of SharePoint in a production farm. He addressed the issues of resource usage and how you need to look at this from both a physical and virtual perspective. A key point is that restoring snapshots of a server in the farm is not supported – you are likely to get all sorts of mess and probably database corruption as timer jobs are likely to go out of sync.
The conference was finished off with open mike sessions in all the tracks, it’s great to have the opportunity to ask the experts those questions you find really hard to get answers to. In the IT Pro track we had discussion around admin accounts, should you use a shared account among a team or assign the permissions to users directly? Generally using a shared account is likely to end up being less secure as those details get shared around, and you would be better assigning the farm admin permissions to the users’ own accounts. This also gives you an audit trail as to who has made the changes. Large databases came up again and some of the issues around that, sometimes you have to remind people to ask the question whether data should really be in SharePoint in the first place.
A good question was how should you structure a support team? Well it depends... :) but a minimum would be one and a half people dedicated to it, so that when that one person is on holiday the half can still pick things up and know how to fix things if problems arise!
And so from SharePoint by day to SharePint by night, the guys at Syntergy gave us a pot for the beer, thanks guys! It was a good chance to chat to some more people and enjoy a beer or two or three... sadly I needed to be on the train home this evening so had to leave early.
And finally, thanks to Steve and co at Combined Knowledge, you have done a great job of this conference and we look forward to the next one...