When starting a full or incremental import of Active Directory, either manually or scheduled, the import is successful, but there is an error thrown as soon as the import is initiated. The following error is presented in the eventviewer.
Event Type: Error Event Source: Office SharePoint Server Event Category: Office Server General Event ID: 7888
Description: A runtime exception was detected. Details follow.
Message: Access Denied! Only site admin can access Data Source object from user profile DB.
Technical Details: System.UnauthorizedAccessException: Access Denied! Only site admin can access Data Source object from user profile DB. at Microsoft.Office.Server.UserProfiles.SRPSite.AdminCheck(String message) at Microsoft.Office.Server.UserProfiles.DataSource._LoadDataSourceDef(IDataRecord rec) at Microsoft.Office.Server.UserProfiles.DataSource._LoadDataSourceDef(String strDSName) at Microsoft.Office.Server.UserProfiles.DataSource..ctor(SRPSite site, Boolean fAllowEveryoneRead) at Microsoft.Office.Server.UserProfiles.DataSource..ctor(SRPSite site) at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.GetDataSource() at Microsoft.Office.Server.UserProfiles.BDCConnector.RefreshConfiguration(String sspName) Resolution
- Go to: Central Administration > Operations > Services on Server > Office SharePoint Server Search.
- In the “Configure Office SharePoint Server Search Service Settings” page, locate the account defined for “Farm Search Service Account” and write down the account name.
- Go to: Central Administration > Shared Services > Personalization services permissions.
- For reference, the account defined serves as the account for the AD “Configure Profile Account” access account.
- For reference, you can get to AD Profile Account page: Central Administration > Shared Services > User Profile and Properties > Configure Profile Import.
- Go to Central Administration > Shared Services > Personalization services permissions.
- On the “Manage Permissions: Shared Service Rights” page, add the account from before (or edit if already exists). The account needs the following permissions:
- Manage user profiles
- Manage permissions
- Run a full import and your problem should be solved.