As you may or may not be aware, I wrote a SharePoint farm backup script using PowerShell (available for download via Codeplex). In an earlier post, namely SharePoint sites backup & -UseSqlSnapshot I described some of the behaviour when backing up sites via the Backup-SPSite cmdlet and how it locks the site during backup if the -NoSiteLock parameter is not used. This helps prevent corruption or inconsistencies.
SharePoint aware farm backups behave in a very similiar manner. The User Profile Service Application (UPA) has a lot of component parts, 3 databases (Sync, Social and Profile) and two services, User Profile Sync Service (UPS) and (User Profile Service (UP)). In an attempt to ensure consistency, SharePoint tries to 'pause' the User Profile Service Application during the backup. I am sure you don't need me to tell you how the term'Stuck on Starting' strikes fear in the heart of even the most experienced SharePoint consultant.
The last thing you want, having successfully managed to get the User Profile Service Application working is for something to come along and de-provision/provision it at will. Well, essentially that is exactly what your farm backup does. In short, the backup process de-provisions the UPS during the backup and then once the backup is complete it attempts to re-provision the UPS potentially unravelling all your hard work.
Through experience we have learnt that during the provisioning stage the farm admin account must be a member of the local admins. Additionally, if you run Central Admin on the same server as the UPS (a fairly common occurence) you will also be required to perform an IISRESET after provisioning.
What happens then if you remove your farm admin account from the local admins following the successful provisioning of your UPS? I mean, its not that unusual, quite the reverse in fact, removing your farm admin account from local admins is a recommended practice. Doing so however will have an effect. As previously mentioned, the provisioning process requires the farm admin account to be a local admin and if it isn't then re-provisioning will fail. This manifests itself in the following way:
- User Profile Synchronizations will no longer run.
- Forefront Identity Manager Service and Forefront Identity Manager Synchronization Service will be left in a 'Disabled' state.
