I've moved my blog to!. Please update your links. This blog is no longer in use--you can find all posts and comments at my new blog; I will no longer be posting to this site and comments have been disabled.

Thursday, August 9, 2007

User Profile Default Access Account

This ended up being one of those simple commands to create that took way to long to figure out how to create. Fortunately though there is an API available for setting this property (unlike most of the profile import related tasks such as the timer jobs). You can set this manually by going here: Shared Services Administration: SSPName > User Profile and Properties > Configure Profile Import. Or you can do the same thing programmatically using UserProfileConfigManager object - you need to get a DataSource object from an instance of the UserProfileConfigManager and then set the value using the SetDefaultImportAccount() method of the DataSource object:

   1: public static void UpdateAccount(string sspname, string username, string password)
   2: {
   3:     ServerContext context;
   4:     if (string.IsNullOrEmpty(sspname))
   5:         context = ServerContext.Default;
   6:     else
   7:         context = ServerContext.GetContext(sspname);
   9:     UserProfileConfigManager prof = new UserProfileConfigManager(context);
  11:     DataSource dataSource = prof.GetDataSource();
  13:     dataSource.SetDefaultImportAccount(username, password);
  14: }

The syntax of the command I created to do this can be seen below.

C:\>stsadm -help gl-setuserprofiledefaultaccessaccount

stsadm -o gl-setuserprofiledefaultaccessaccount

Sets default access account for user profiles.

        -username <DOMAIN\name>
        -password <password>
        [-sspname <name of the SSP>]

The following table summarizes the command and its various parameters:

Command Name Availability Build Date
gl-setuserprofiledefaultaccessaccount MOSS 2007 Released: 8/9/2007
Updated: 8/14/2008

Parameter Name Short Form Required Description Example Usage
username u Yes The user account name. -username "domain\name"

-u "domain\name"
password p Yes The account password. -password "pa$$w0rd"

-p "pa$$w0rd"
sspname ssp No The name of the SSP for which to set the user profile account.  If not specified then the default SSP is used. -sspname SSP1

-ssp SSP1

Here’s an example of how to set the default access account:

stsadm –o gl-setuserprofiledefaultaccessaccount –sspname SSP1 –username "domain\login" -password "password"

Note that if you intend to use this in a script make sure you are real careful about where you store that script as the password is obviously going to be stored in clear text which isn't a good thing. Also, you'll notice that I use the SSP name instead of the url - you can change the code to use the url but I found that working with the SSP name was more convenient.

Update 8/14/2008: I've made it so that the SSP is now an optional parameter.


Oh2Be16! said...

Hi Gary,
First off I want to say thanks for the hard work you have put into these STSADM extensions. I truly appreciate them.
I was wondering if you could create a new STSADM command to add a Custom Source under Configure Profile Import. Back in the day we had to use a different NETBIOS name on AD creation because we were collapsing an NT domain that already had the prefix of the DNS namespace.
For example:
On AD creation we typed: and the wizard wanted to pick NTDOM for the NETBIOS backward compatible name but NTDOM was already as a NT domain namespace. So we picked let’s say NEWNTDOM as the NETBIOS name and kept the FQDN as A bug in SharePoint gets introduced when it assumes the NETBIOS name is the DNS prefix word1(NTDOM) of So under Import Profile data reads: Current domain (NTDOM) which is wrong. Bug Bug bug.

So we have to do a Custom source as:
NAME: NEWNTDOM, Type: Active Directory, Source: Auto Discover, Search Base/DN: dc=ntdom,dc=com.

I want to automate this step so we do not have to do the GUI dance. Is it possible to knock off this new STSADM command? How about gl-setimportconnection ?

Gary Lapointe said...

Thanks for feedback! Unfortunately I don't have time to create commands unless I need them for an issue I'm facing. If you really need me to help you with creating this it would have to be done as billable work - I'll be happy to write you up a quote if you're interested.