Beginning SharePoint Administration

This section describes the most common tasks you will perform as a full administrator for a fresh WSS installation. You also learn the basics of how the security works for sites and content. The objective here is to give you the basic information needed to set up a fully functional WSS environment. At this moment, it does not matter whether you've chosen a SQL Server 2005 Express or MS SQL database, or whether it is a local or remote database engine.

Creating Your First Sites

The first thing you most likely want to do is to create new user sites. After all, this is where all files, lists, and other information will be stored.

If you selected the Basic installation method during the installation of WSS 3.0, you got your first top site and, therefore, the first site collection created automatically. This top site is called Team Sites, and its URL address is http://srv1/default.aspx (assuming that the name of the Windows 2003 server is SRV1). The suffix /default.aspx is simply the default content page displayed when opening this web site.

Important 

If you chose the Advanced method when installing WSS you have to create the first site collection (that is, the first top site) manually. Later in this chapter you will see how to create a site collection.

You can create a subsite to this team web site by using the following steps:

Try It Out Create a Subsite

1. Log on to any computer in the network as a SharePoint administrator, that is, the user account used when installing WSS, since this is the only user account that has access to the team web site at the moment. Later in this chapter, you will see how to add more users. Start the web browser and open the URL address to your new SharePoint site (for example, http://srv1).

2. Click Site Actions Create on the top link bar. This gives you a page that shows all types of objects you can create for this web site, including document libraries, contact lists, plus sites and workspaces in the Web Pages section.

3. Click Sites and Workspaces.

4. The next page is a web form where you define the new subsite, as you can see in Figure 3-8. Fill in the following fields:

   1. Title: Enter the title for this site. Spaces and any Unicode characters, such as Å and Ü, are okay here. You can change this text later, if necessary.

   2. Description: Enter a description of the site. It will be displayed on the web page. You can change this text later.

   3. URL name: Enter the web URL address for this site. Note that the prefix is inherited from the parent of this subsite and cannot be changed; in this example, it's http://srv1/. Although it is okay to use blank spaces and 8-bit characters here, you should avoid using them to prevent problems or strange URL addresses later on. For example, if you create an URL with the name http://srv1//räksmörgås, it will actually be listed as the URL http://srv1/r%C3%A4ksm%C3%B6rg%C3%A5s. It is also a good thing to keep the name of this URL as short as possible, while still making it descriptive. This will make it easier for you to later type in this address manually, if you want to.

   4. Select a template: In this example, select the team site. There are 10 different site templates, divided into two tabs: Collaboration, and Meetings. Later you will learn how to create new site templates.

   5. User Permissions: By default, this option allows you to inherit the user permissions from the parent web site (that is, the team web site in this case). You can also choose to use unique permission settings for this subsite. The advantage of inherited permissions is that, if you later modify the permission settings for the top site, these new settings will also be used in the subsite. Whatever you choose, you can later switch it to the other option.

   6. Navigation: Select Yes to display this subsite on the Quick Launch bar at the parent site. You can also select to display the name of this subsite on the top link bar of the parent site. These settings will make it easier for users to quickly access this site later.

   7. Navigation Inheritance: Select Yes to make this subsite inherit the same top link bar as its parent site, that is, the team site in this example.

   
   Figure 3-8

5. Click Create to start the process to create this site. This is normally complete in a matter of seconds. When it is done the new subsite is displayed.

Take a look at this new subsite. Does it not look very similar to the top site? It has the same color, the same web parts, and the same lists. In fact, it should look exactly like the other web site because it is built on the same site template! Look at the breadcrumb trail for this page: It says Team Sites > Subsite 1. From this, you can tell that the current site is a subsite and its parent is the Team Web Site. Another indication that this is a subsite is the URL address: http://srv1/subsite1 (again, we do not care about the suffix /default.aspx because this is the name of the content page you are looking at right now). When you understand how to read the URL address, you can see exactly where in the site tree a given web site is situated.

Click on the breadcrumb trail Team Sites to go back to the parent (and in this case top) site. Look carefully to understand which site you are looking at. Check the URL: http://srv1. This is the proof you need that you are at the top site again.

To open the subsite again, you can either click its name on the top menu, that is, Subsites 1, or click the site's name in the Quick Launch bar, under the headline Sites. The reason that this subsite is listed in these two locations is that you selected this option during steps 4f and 4g above.

If you chose not to display the new subsite in the top menu, or the Quick Launch bar, you could still find it using the method in the following Try It Out.

Try It Out List and Go to Any Subsite

1. On the top site's Quick Launch bar, click View All Site Content.

2. Scroll down to the bottom of the following page. Under the section Sites and Workspaces, you will see all subsites directly under this top site, regardless of whether they are listed on the parent site. In this example, you will only see one site here, "Subsite 1." If you hover the mouse cursor over it, you can see its URL address listed on the status row for your web browser: http://srv1/subsite1. Click it to go to this subsite now.

3. Check that you actually are looking at the subsite now. You have two clear indicators of this: the URL address and the breadcrumb trail.

If you need to create a subsite under the current subsite, you do it in exactly the same way you did the first time. You can have any number of levels in your site collections, and each level can have any number of sites in parallel, as long as you give sites in the same level unique URL names. Remember that the names should be meaningful - if your users cannot easily find the site they need at the moment, something is wrong with either your structure or the way these sites are accessed.

Creating a New Site Collection

Now that you know how to create subsites, the next step is to learn to create new site collections, that is, new top sites. This is also the step you need to take in case WSS was installed using the Advanced method to create the first site collection ever for this WSS installation. This is a bit trickier because there is no easy-to-use link for this anywhere on the first site collection, but this problem can also be solved. In this section, you first see how to create a site using the SharePoint 3.0 Central Administration (SCA) tool, and then learn how to display a link on the first top site that will allow anyone with the proper permission to create new top sites.

Before you create a new site collection, you should think about what web application it will use. In Chapter 2, you learned that every site collection must be created in a given web application, and that a web application is an extended virtual IIS server, for example the default web site. When you create the second site collection, you must decide if you will need a new web application or if you can use the same web application as the first site collection. In most situations, you will use the same web applications, but you may want to create a new web application if you need any of these:

• q Separate application pool settings: For every site collection, you will have separate users and administrators, but if you also need a separate Application pool identity, you should create a new web application for this site collection.

• q Separate TCP port or host header name: If you need a separate TCP port number or a separate Host Header name for the new site collection, you should create a new web application.

• q Separate security settings: When creating a new web application, you can define a specific authentication provider (NTLM or Kerberos), whether anonymous access will be activated, and whether Secure Sockets Layer (SSL) should be used.

• q Separate database server and name: If you need to create a new site collection and want it to store its content on a specific SQL server and/or database name, then create a new web application. This may be very handy if you have a distributed organization and want to create a site collection for each location in your organization, with local access to their database. Note that this also requires one SQL server at every location.

• q Separate URL: When you want the URL to be different from that of any other site collection, you must create a separate web application. If not, all new site collections created after the first will get a URL that contains the name of the first site collection. For example, if the first site collection has the URL http://srv1, a second site collection named "newSC" will get the URL http://srv1/sites/newSC.

Creating a Top Site Using the SharePoint Central Admin Tool

Initially, this is the only way of creating a new site collection in WSS. You must be a WSS farm administrator, or a member of the local Administrators group on the WSS server, to do this. Follow these steps to create a new site collection in the same web application as the first site collection:

Try It Out Create a New Site Collection Using the SCA Tool

1. Start the SCA tool (Start Administrative Tools SharePoint 3.0 Central Administration).

2. Open the Application Management page.

3. Click Create site collection in the SharePoint Site Management section; on the next page, (see Figure 3-9), enter these settings:

   1. Make sure that http://srv1 is selected as the web application; if not, use its menu and select the correct web application for the new site collection.

   2. Enter the title for this new site collection; for example "Site Collection 2." This can later be changed.

   3. Enter the Description for this site collection. This can later be changed.

   4. Define the URL for the new top site. This cannot be changed later. When you create a new site collection using the same web application as the first site collection, it will inherit the URL of the first site collection, plus the string "/sites/" as a delimiter. In this example, you will create a new site collection with the URL "top2," so the complete URL address will then be http://sites1/sites/top2. The delimiter "/sites/" is known as a wildcard inclusion URL path. In other words, if you ever find a site with the URL http://srv1/sites/sales, you know that this is a site collection with a top site named "sales," and it was created after the first site collection.

   5. Select a template: Choose the site template the top site for this new site collection will be built upon; you have 10 different site templates by default, divided into two tabs. You cannot select another site template later, but you can modify the selected site template.

   6. Primary Site Collection Administrator: This can an be changed later. Enter the user account or e-mail address for the owner of this top site. This user will also be the owner of all subsites in this site collection. You cannot prohibit a site collection administrator from accessing to any of the site's subsites, regardless of the permission settings.

   7. Secondary Site Collection Administrator: This can be changed later. This is an optional owner, who, like the first administrator, also has "divine" access to all sites in this site collection. Enter the user account or e-mail address, if any, for this secondary owner. In Chapter 6, you will see how WSS can help you clean up unused web sites by sending an e-mail to the owners and offering to remove these sites. If you have two owners, the chance is much greater that one of them will read the e-mail and can take the appropriate action.

   8. Quota Template: This can be changed later. Use this setting to configure a size limit for this complete site collection. If your WSS environment is fresh, you do not have any quota template defined yet. If you want to define one, right-click the Manage Quota Template link on the left to create what you need, and then go back to the first page and click Refresh to see the new template in the pull-down menu.

   9. Site Language: This is only visible if you have installed a WSS language template pack. This cannot be changed later. By default, you will have only the language of the installed WSS pack (for example, English), but if you install new WSS language template packs, you will be able to select between them here. Later, you learn where to find these language packs and how to install them.

   10. Click OK to save your settings.

   
   Figure 3-9

4. The next page is just a confirmation that the site has been created successfully. If it hasn't, you will see the reason why here. You can click OK to go back to the Central Administration page or click the URL link to open your new top site in a new browser window. This site collection, and its top site, are now ready to be used.

Creating a Top Site Using the WSS User Web Site

If users need an easy way to create new top sites (site collections), without asking you as an administrator to do it for them, it can be done. There is a special configuration setting in WSS called Self-Service Site Creation that regulates this. Note that you can still control which users will be able to create site collections because these users must be granted the Use Self-Service Site Creation permission.

When you activate this self-service feature, you see a new message show up in the Announcement list for the first top site in your WSS environment. This message contains a link to the ASP.NET script that creates the top sites, scsignup.aspx. You can later create your own link to run that script, as you can see in the following Try It Out, where you activate this feature.

Try It Out Activate Self-Service Site Creation

1. Log on as an administrator to the WSS server.

2. Start the SharePoint 3.0 Central Administration tool (SCA).

3. Click the Application Management tab.

4. In the Application Security section, click Self-service site management.

5. Make sure that the correct web application is selected at the top of this page; if not, use its menu and change this value. (See Figure 3-10.)

   
   Figure 3-10

6. In the Enable Self-Service Site Creation section, select On to activate this feature; the default is Off. The second configuration option on this page is the Require secondary contact box. If this box is checked, every top site will require a secondary owner (that is, another user account). This can be a very good feature if you later turn on the automatic cleanup of unused sites, because all owners of the top sites will get an e-mail from WSS asking whether the site should be deleted. This secondary owner is commonly a role-based user, such as Helpdesk, Support, or something similar. Set this option, and click OK to save and close this page.

The self-service site creation feature is now turned on. Open the first top site in your WSS environment (http://srv1) and check the Announcements list. You should see a new item here, as in Figure 3-11.

Figure 3-11

The link in this announcement takes you to the web form for creating new top sites. But this is not the best place to store such a link. Later on, there may be many new announcements, and it may be hard to find this one. One easy solution is to create a link in the Links list (see the following Try It Out).

Try It Out Create a Top Site Using the scsignup.aspx Page

1. Go to the home page of your first top site (http://srv1 in this example).

2. In the new announcement, highlight the complete link http://srv1/_layouts/scsignup.aspx; right-click it and select Copy Shortcut.

3. Under the Links list, click Add new link.

4. Right-click the URL box and select Paste. It should now show the previously copied link.

5. Enter a descriptive name for this link in the description box (for example, Create New Top Site, as in Figure 3-12).

   
   Figure 3-12

6. Click OK. You will now return to the home page for this site.

7. Test the new link by clicking Create New Top Site.

8. You will now see the web form where you create new top sites. Note that it will be slightly different from the one you can activate using the WSS administration tool. For example, the URL address for this top site will always be under the /sites/ path, since you cannot select another web application. Another difference is that you cannot set the Site Collection Administrator. It will automatically be the user who created the site collection.

   1. Title: Enter the title for this web site. This title shows up on the home page.

   2. Description: Enter a description of this top site.

   3. URL name: Enter the URL address for this top site. Note that it automatically has a prefix of http://srv1/sites if your server is named srv1.

   4. Template Selection: Select the site template to be used by this new top site.

   5. Click Create to save and close this page. The new site collection, and its top site, will now be created, and then displayed.

Configuring WSS to Use an Outgoing SMTP Mail Server

Before progressing any further, you need to configure WSS to use an SMTP mail server for outgoing e-mail. The receiving mail server can be any server that accepts SMTP messages, for example MS Exchange Server. The reason is that WSS needs to send messages in several different situations, for example:

• q Error messages to the owner of the site collection.

• q Warning messages whenever the size of the site collection is near the quota template limit.

• q Notifications to a user that she has been granted access to a site.

• q Alert messages to a user that has requested to be notified when a specific document library has been modified.

To set up WSS to use a specific mail server, in this case the local MS Exchange 2003 server, follow the instructions in this Try It Out.

Try It Out Configure WSS to Use a Mail Server

1. Log on as an administrator to the WSS server.

2. Start the SharePoint Central Administration tool.

3. Click Configure default e-mail server settings in the Server Configuration section.

4. In the following web form (see Figure 3-13), enter the e-mail settings.

   
   Figure 3-13

   1. Outbound SMTP server: Enter the full name for the mail server, also known as the Fully Qualified Domain Name (FQDN). Remember that it does not have to be an MS Exchange server; it can be any Simple Mail Transfer Protocol (SMTP) server, remote or local. However, you must make sure that this server allows WSS to send mail to your users; if not, the mail server may need extra configuration settings to allow it to relay messages. This is seldom a problem when using the internal mail servers in your network, but it may be a problem when using external mail servers located at an Internet service provider (ISP).

   2. From address: The virtual sender of these WSS messages, that is, the address that the receiver of messages from SharePoint will see listed as the sender. Note that this e-mail address does not need to exist! It can be any e-mail address.

   3. Reply-to address: If a user replies to a WSS message, it will go to this address. This address must exist. Avoid using a personal e-mail address here; instead, use a rolebased address, such as [e-mail].

   4. Character set: Defines what character set WSS will use for its e-mail messages. There is very seldom a reason for changing this from the default 65001 (Unicode UTF-8) unless you have a very old or strange SMTP mail server that will be receiving these messages.

   5. Click OK to save these settings.

Configuring WSS to Accept Incoming SMTP e-mail

A new feature introduced in SharePoint 2007 is that you can configure libraries to accept incoming e-mail messages. To make this work, you must first activate the Windows Component SMTP, since this will allow this Windows 2003 Server to operate as an SMTP server; you can then think of the libraries as mailboxes that accept e-mail, including any attachments. Some examples of when this can be handy are listed below:

• q Collect all e-mail regarding a specific project in a document library in the project site.

• q Let users send a help desk request to a document library.

• q Let customers send their orders to a document library.

To set up WSS to accept incoming SMTP messages follow the steps in the Try It Out.

Try It Out Configure WSS for Incoming SMTP Messages

1. Log on as an administrator to the WSS server.

2. Open the Windows Component, and activate the SMTP service:

   1. Click Start Control Panel Add or Remove Programs.

   2. Click Add/Remove Windows Component.

   3. Select the application server, click Details.

   4. Select Internet Information Service (IIS), and click Details.

   5. Finally, check the option SMTP Service. Click OK twice, then click Next, and Finish.

   6. To follow the best practice, you should now run Windows Update to make sure that this server has the latest updates and security patches for the SMTP service.

3. Open the SharePoint 3.0 Central Administration tool, and switch to the Operations page.

4. Click Incoming e-mail settings; in the web form (see Figure 3-14), enter these settings:

   
   Figure 3-14

   1. Enable sites on this server to receive e-mail? Select Yes.

   2. Settings mode: Select Automatic.

   3. Use the SharePoint Directory Management Service to create distribution groups and contacts? Select No this time. This will require that you manually add the e-mail address of each mail-enabled library to your ordinary e-mail servers global address list. Note that you can select Yes here, if you also configure the Directory Management Service. If you do, SharePoint will automatically create a mail-enabled Contact object in Active Directory whenever a SharePoint library is mail-enabled.

   4. e-mail server display address: Note this address, since this will be the Fully Qualified Domain Name (FQDN) address for all mail-enabled SharePoint libraries. Since SharePoint will operate as an SMTP server, it must have its own FQDN address, and it will be different from the ordinary address used for all user e-mail addresses in your domain! By default, this FQDN will be the name of this server, plus the domain name. For example, if the server is named SRV1 in the domain FILOBIT.COM, this FQDN name will be @srv1.filobit.com. You can change it, but then you must add an Mail Exchanger (MX) record to your Domain Name Server (DNS) for this FQDN.

   5. Safe e-mail Servers: The default setting is Accept mail from all e-mail servers, which will configure the SMTP service to accept e-mail from any SMTP server. For more security, you can enter the FQDN name of the SMTP servers that SharePoint will accept e-mail from.

   6. Click OK to save and close this web form.

5. The final steps are to mail-enable the document libraries, plus add their SMTP address to the global address list in your ordinary mail system. Open a SharePoint site based on the Team Site template (for example, http://srv1); it contains a document library that you can test this e-mail feature with. Then enter these values in the form (see Figure 3-15):

   
   Figure 3-15

   1. Click on the document library Shared Documents to open it.

   2. Click Settings Document Library Settings Incoming e-mail settings.

   3. Allow this document library to receive e-mail? Select Yes, and then enter the mail address for this library. Note that the FQDN address is preconfigured and cannot be modified. Use a naming convention for all mail-enabled SharePoint libraries to make it easier for you later to identify that a given e-mail address belongs to a SharePoint library.

   4. e-mail Attachments: Select how SharePoint should treat any mail attachment and whether saved attachments will be overwritten by new messages with the same file name. There are three different options for incoming attachments:

      • q Save all attachments in root folder: This will mix any attachment with the rest of the content for this library.

      • q Save all attachments in folder grouped by e-mail subject: This will create a new folder in this document library for every e-mail subject; all e-mail attachments with this subject will be saved in this folder. This is a good option if you want to organize attachments, based on the e-mail's subject.

      • q Save all attachments in folders grouped by e-mail sender: This option is very similar to the previous option, except it will organize the attachments in folders, based on the e-mail's sender address.

   5. Save original e-mail? Select Yes if you want to save the body of the actual message as a separate file. Select No if you just want to save the e-mail attachments.

   6. Save meeting invitations? Select Yes to save any message with a meeting invitation sent to this library.

   7. e-mail security policy: Select Accept e-mail messages based on document library permissions to ensure that only e-mail sent by users with permission to add content to this library will be accepted. If you select Accept e-mail messages from any sender, then it will accept any message, including e-mail spam.

   8. Click OK to save and close this web form.

6. If you configured SharePoint not to use the Directory Management Service in step 4c above, then you must add the e-mail address of each mail-enabled library manually in Active Directory (AD). You do this by creating a Contact object in AD, with the SMTP address for the library. For example, say you mail-enabled a document library and gave it the SMTP address [e-mail], then do this to add its address to the global address list in Active Directory:

   1. Log on as a domain administrator to a domain controller, and open the Active Directory Users and Computers (ADUC) tool.

   2. Select the Organizational Unit (OU) where you want to create the Contact object, for example Users.

   3. Right-click on the OU, and select New Contact.

   4. Enter a descriptive name in the form. The Display name will be listed in the global address list, so give it a descriptive name, then click Next.

   5. Accept the default, Create an Exchange e-mail address. This will, in fact, not create a mailbox in Exchange, but rather add an SMTP address for this Contact to the Global Catalog in Active Directory, thus making this address show up in Outlook users' global address list. To define the address for this Contact, click Modify SMTP Address and click OK, then enter the SMTP address for the mail-enabled document library. In this example, enter [e-mail], and click OK. Then click Next and Finish.

   6. Now you have to wait for the Remote Update Service in the Exchange Server to run, before this address shows up in the global address list. This process run every 60 seconds, but you can also force it to run, using the Exchange System Manager if you are impatient. To see if the process has finished, you can open the newly created Contact object in the ADUC tool, and see if its e-mail address is listed or not.

   Important 

   If the MS Outlook client is configured for cached mode, then it will not see the newly created Contact show up in the global address list (GAL) until MS Outlook has downloaded the updated GAL. You can force this update by selecting Tools Send/Receive Download Address Book.

7. All is now set to start sending e-mail to this document library. Start MS Outlook, and create an e-mail to this recipient (that should show up in the GAL in Outlook) with at least one attachment; enter a subject and some text in the message body, then click Send.

8. Open the receiving document library in SharePoint and wait for this attachment to show up; it will usually take a minute or two. Note that if you configured the library to only accept e-mail from users with permissions to add items to this list, you must send the test message as such a user! In Figure 3-16, the library has received one attachment that is stored in a folder named after the e-mail's subject, or in this case "Test 1."

Figure 3-16

Managing Access Control of Web Sites

By now, you know how to create sites. The next logical step is to learn to configure the access to these sites. This is something the creator of the site normally will do without any assistance from the SharePoint administrator.

You may remember from previous sections that any security object, such as local or domain user accounts or security groups, may be granted access to WSS sites. Usually, this is achieved by adding these users or groups to a SharePoint group, such as the Team Site Members. These objects must be associated with a Permission Level role, such as the Read or the Contribute role. For example, say you have two users: MarielleS (Filobit\MarielleS and AlexS (Filobit\AlexS). You want to add them as a visitor (Read access) and a member (Contribute access), respectively. You can do this by making them members of a SharePoint group with the matching permissions, or you can grant these user accounts the corresponding permission level directly (such as "Team Site Visitors" for visitor [read] access and "Team Site Members" for member [contribute] access). Best practice is to use SharePoint groups when possible; follow these steps to add these users to you first top site, in this example named Team Site:

Try It Out Add Users to Your Web Site

1. Log on as an administrator to any computer with network access to the WSS server.

2. Open Internet Explorer and open the team site by entering the URL http://srv1.

3. Click People and Groups in the Quick Launch bar to open the permissions page for this site.

4. Click the New button, and enter the first name, MarielleS (or Filobit\MarielleS), in the User/Groups field. Next use the menu in the Give Permissions section to select "Team Sites Visitors." Note that SharePoint on the same page allows you to send an e-mail to Marielle, to inform her about the new permission, including a link to this site. See Figure 3-17. Click OK to save and close this form, and send the e-mail.

   
   Figure 3-17

5. Click the New button to add the second user, AlexS, this time to the group "Team Site Members," which will grant Alex permissions corresponding to a contributor, then enter some text in the message body, and click OK.

6. These two users now have access to the team site; Marielle with Read access, and Alex with Contribute access. To see the membership, click on the name for each SharePoint group in the Quick Launch bar, that is, Team Sites Member, and Team Sites Visitor. You can also click the link All People, and it will show a list of all users with access to this site, including some of their properties, such as their Picture, Name, About Me, Job Title, and Department.

7. If you need to change the permission for any given user, you can in either of these ways, depending of how they are granted access:

   • q To change the membership of a SharePoint group: There is no way to reconfigure the membership directly, so you must first remove the user from the old SharePoint group, then add the user to the new SharePoint group.

   • q To change the permission granted for a user or group added directly to a site, that is, with no membership in a SharePoint group: Click Site Permissions in the Quick Launch bar displayed when looking at the People and Groups page. Next, check the check box for the user to be modified, and click Actions Edit User Permissions, then select the new permission and click OK.

Alternatively, instead of entering the user accounts manually (as described in steps 4 and 5), you can click the Address Book button on the same page; you can search for names and groups, including built-in groups such as Authenticated Users, in the Active Directory and add them to SharePoint (see Figure 3-18).

Figure 3-18

Important 

In previous SharePoint versions, you could select a Distribution List, and SharePoint would then expand that list and enter its members instead. This is no longer possible in WSS 3.0.