Master Key Encryption
If the scope of the profile covers a content database and uses RBS, Master Key will be required for SQL server. The master key is used for building secure RBS SQL infrastructure (provides necessary certifications for secure RBS communication in content database and for adding digital signatures for RBS components). If a password is not provided during profile creation, a temporary default password will be used. For this reason, using the interface to create the password in StoragePoint allows the admin to set their own password. If the password is forgotten, please contact Quest Support for procedures on altering the password.
|
|
NOTE: The Master Key is used for protecting certificates or encrypted columns in a table - this is not encrypting externalized data. An administrator may need to enter the Master Key if the database is added to availability groups in SQL. |
Enter a password, and click Create Key.
Click Close. Note the name of the content database that is covered by this encryption key.
The page will be locked until the operation is complete. This operation can take several minutes.
If this page appears when saving an existing profile, note whether the profile has a librarian configuration. If so, the master key encryption is completed on the first save of the profile, rather than when the librarian configuration is saved.
Verify File Share and Content Database Permissions (OPTIONAL)
When using the File Share adapter, an additional check may be seen when saving the profile:
This screen displays when editing an existing profile if:
·the Externalize Content BLOBs setting is Yes;
·there is at least one FileSystem endpoint;
·and the Web Application in the scope of the profile has at least one connected SharePoint (IIS Web) Service Application account that cannot access one of the FileSystem endpoints.
·The Web Application is connected (through proxy) to at least one service application, i.e. User Profile Service.
This screen displays when creating a NEW profile or copying a profile if:
·there is at least one FileSystem endpoint;
·The Web Application is connected (through proxy) to at least one service application, i.e. User Profile Service;
·All service accounts associated with profile web application do not have file system access permissions (Read, Write, Modify, Delete, DeleteSubdirectoriesAndFiles, CreateDirectories, CreateFiles) on all FileSystem endpoints AND db_owner role on all content databases associated with the profile.
|
|
NOTE: If the role "db_owner" for the web application pool is missing, it will result in the following error: "The URL <> is invalid. It may refer to a nonexistent file or folder, or refer to valid file or folder that is not in the current web". If the role "db_owner" is missing, the user assigned the role cannot retrieve all of the required metadata from Microsoft RBS API. |
When a new Content Database Profile is created, the associated web application pool account registered on SQL server will get two additional Database Role memberships: Public and SPDataAccess.
This check can be run manually by clicking the Check File share and Content Database Rights button beneath the list of endpoints on the profile.
Correct any permission issues before externalizing data. Use the Copy to Clipboard button to note which accounts need permission.
The Storage Profiles page will be displayed with the newly-created storage profile showing up in the list.
Editing an Existing Storage Profile
Once a profile is saved, archiving, records and holds management can be added to the profile. Endpoint filters can also be modified for asynchronous operations.
Click the name of the storage profile to edit.
Make note of any notifications at the top of the page:
Do not change the Endpoint Selection mode on the profile that have a File Share Librarian configuration, which will be indicated in the Filter column.
To temporarily prevent externalization to an endpoint, switch the Online selection to No. This only affects this endpoint for this profile. It does not affect the endpoint's use on other profiles.
Make the necessary changes, including endpoint filters, noting that the profiles scope and name cannot be changed, nor can endpoints that are associated with a File Share Librarian configuration be removed.
When complete, click Save to apply the changes.
The Storage Profiles page will display.
It is recommended that an IISRESET and a SharePoint Timer Job reset be performed on each web front end if changes were made to the storage profile.
Archiving
Archiving can be setup to move BLOBs to different storage tiers, as content is aged or when changes in metadata are detected. The rules can be configured on different scopes of content, but there can only be one rule per scope. The most granular rule is the only rule that will ever get evaluated.
The levels of granularity are as follows, from the least to the most granular:
1.Web Application
2.Content Database
3.Site
4.Site Content Type
5.List
6.List Content Type
So, for example, if the metadata change rule is more granular than the aging rule, then the aging rule will never get evaluated for an item within the scope of the metadata change rule.
1.Aging rule on site
2.Metadata change rule on list
3.Aging rule will never be evaluated for an item within the list in 2.
If large file support is enabled, only the aspx file is moved to the archive endpoint.
Profiles with File Share Librarian Configurations should not add Archiving to the profile. The archiving option won't be available for new profiles.
To configure archiving, open the profile and click the arrow of the Archiving bar.
|
Enable Archiving |
Yes Archiving will be enabled for this scope. No Archiving will NOT be enabled for this scope. (default) |
|---|---|
|
Archiving Rules |
Click New Rule to open the New Archiving Rule window. See Configuring Archiving Rules for more information. |
|
Archive Aging |
The Archiving Aging section is used to schedule when the Archive Aging job will run, and to run it immediately if necessary. |
