Configure object cache user accounts
Published: June 17, 2010
The object cache stores properties about items in
Microsoft SharePoint Server 2010. Items in this cache are used by the
publishing feature when it renders Web pages. The goals of the object
cache are to reduce the load on the computer on which SQL Server is
running, and to improve request latency and throughput. The object cache
makes its queries as one of two out-of-box user accounts: the Portal
Super User and the Portal Super Reader. These user accounts must be
properly configured to ensure that the object cache works correctly. The
Portal Super User account must be an account that has Full Control
access to the Web application. The Portal Super Reader account must be
an account that has Full Read access to the Web application.
 Important: |
|---|
The
Portal Super User and Portal Super Reader accounts must be separate
accounts, and they must not be accounts that will ever be used to log in
to the site.
|
This
article explains why these object cache user accounts must to be
configured and describes how to configure the accounts. For information
about the object cache, see
Cache settings operations (SharePoint Server 2010).
In
SharePoint Server 2010, querying for items is linked with the user
account that makes the query. Various parts of the publishing feature
make queries for which the results are cached in the object cache. These
results are cached based on the user making the query. To optimize the
cache hit rate and memory requirements, the queries must be based on
whether a user can see draft items. When a publishing control requests
the object cache to make a query to get data for the control, the cache
makes the query, not as the user making the request, but instead it
makes the query twice: once as the Portal Super User account and once as
the Portal Super Reader account. The results of these two queries are
stored in the object cache. The results for the Portal Super User
account include draft items, and the results for the Portal Super Reader
account include only published items. The object cache then checks the
access control lists (ACLs) for the user who initiated the request and
returns the appropriate results to that user based on whether that user
can see draft items. By adding the Portal Super User and Portal Super
Reader accounts to the Web application, the cache must store results for
only two users. This increases the number of results that are returned
for a query and decreases the amount of memory that is needed to store
the cache.
By default, the Portal Super User account is the
site’s System Account, and the Portal Super Reader account is NT
Authority\Local Service. There are two main issues with using the
out-of-box accounts.
- The first issue is
that some items get checked out to System Account, so when a query that
includes these items is made, the checked out version of the item is
returned instead of the latest published version. This is a problem
because it is not what a user would expect to have returned, so the
cache has to make a second query to fetch the correct version of the
file. This negatively affects server performance for every request that
includes these items. The same problem would occur for any user who has
items checked out, if that user’s account was set to be the Portal Super
User account. This is why the accounts configured to be the Portal
Super User and the Portal Super Reader should not be user accounts that
are used to log into the site. This ensures that the user does not
inadvertently check items out and cause problems with performance.
- The
default Portal Super Reader account is NT Authority\Local Service,
which is not correctly resolved in a claims authentication application.
As a result, if the Portal Super Reader account is not explicitly
configured for a claims authentication application, browsing to site
collections under this application will result in an “Access Denied”
error, even for the site administrator. This error will occur on any
site that uses any feature that explicitly uses the object cache, such
as the SharePoint Server Publishing Infrastructure, metadata navigation,
the Content Query Web Part, or navigation.
In this article:
Configure object cache user accounts by using Central Administration and Windows PowerShell
You
can configure the user accounts for the object cache by using Central
Administration and Windows PowerShell. You must first create the
accounts in the Central Administration Web site and then add the
accounts to the Web application by using Windows PowerShell. You must
add the user accounts to each Web application.
| Caution: |
|---|
At
the end of this procedure, you must reset Internet Information Services
(IIS) to apply the changes to the Web application. Be sure to perform
this procedure when there will be minimal disruption to users that are
connected to the site. For more information about IISReset, see IIS Reset Activity.
|
To create the user accounts by using Central Administration
- Verify that you have the following administrative credentials:
- To
create the user accounts in Central Administration, you must be a
member of the Farm Administrators group on the computer that is running
the SharePoint Central Administration Web site.
- On the Central Administration Web site, in the Application Management section, click Manage web applications.
- Click the name of the Web application that you want to configure.
- On the Web Applications tab, in the Policy group, click User Policy.
- In the Policy for Web Application window, click Add Users.
- From the Zones list, select All zones, and then click Next.
- In the Users box, type the user name for the Portal Super User account.
- Click the Check Names icon to ensure that the account name can be resolved by the authentication providers on the application server.
- In the Choose Permissions section, check the Full Control - Has full control box.
- Click Finish.
- Repeat Steps 5 through 8 for the Portal Super Reader account.
- In the Choose Permissions section, check the Full Read - Has full read-only access box.
- Click Finish.
- Make note of how the names for the Object Cache Super Reader and Object Cache Super User accounts are displayed in the User Name
column. The displayed strings will be different depending on whether
you are using claims authentication for the Web application.
To add the user accounts to the Web application by using Windows PowerShell
- Verify that you meet the following minimum requirements: See Add-SPShellAdmin.
- Copy the following code and paste it into a text editor, such as Notepad:
$wa = Get-SPWebApplication -Identity ""
$wa.Properties["portalsuperuseraccount"] = ""
$wa.Properties["portalsuperreaderaccount"] = ""
$wa.Update()
- Replace the following placeholders with values:
- is the name of the Web application to which the accounts will be added.
- is the account to use for the Portal Super User account as you saw it displayed in the User Column field mentioned in Step 14 of the previous procedure.
- is account to use for the Portal Super Reader account as you saw it displayed in the User Column field mentioned in Step 14 of the previous procedure.
- Save the file, naming it SetUsers.ps1.
 Note: |
|---|
You can use a different file name, but you must save the file ANSI-encoded as a text file whose extension is .ps1.
|
- Close the text editor.
- On the Start menu, click All Programs.
- Click Microsoft SharePoint 2010 Products.
- Click SharePoint 2010 Management Shell.
- Change to the directory where you saved the file.
- At the Windows PowerShell command prompt, type the following command: ./SetUsers.ps1
- Reset Internet Information Services (IIS). For more information about IISReset, see IIS Reset Activity
