CAUSE
Typically, this problem occurs if one or both of the following conditions are true:
- Changes have been made to the Microsoft CRM security roles.
- Microsoft CRM business units have been reassigned.
Typically, only Microsoft CRM installations that contain more than 10,000 records experience performance-related symptoms. This problem is also affected by the performance of the computer that is running the Microsoft SQL Server application that hosts the Microsoft CRM databases.
MORE INFORMATION
This problem can be avoided if your organization does not have to have custom Microsoft CRM security roles. To avoid the problem, use the Microsoft CRM standard roles. This problem can also be avoided if your organization does not have to reassign business units. To avoid the problem, do not change the business unit structure.
A reassigned child business unit has Domain Local Security Groups that have a name of MSCRM Glbl (
Role name).
Role name is the name of the Microsoft CRM security role. MSCRM Glbl security groups should only exist under the root business unit in the Active Directory directory service for a Microsoft CRM installation.
The root cause of this problem is in every record in the
Organization_Name_MSCRM database that contains a value in the
SecurityDescriptor column.
SecurityDescriptor calculations are based on users' Microsoft CRM security roles and on the Microsoft CRM business units. The Microsoft CRM platform uses
SecurityDescriptor fields and the Microsoft CRM Security Service to grant security access to Microsoft CRM records. Because the additional MSCRM Glbl security groups are created, the
SecurityDescriptor field grows. If multiple business units are moved so that they have a different parent business unit, the field may grow exponentially.
Determine the lengths of the SecurityDescriptor field values
You can determine the lengths of the
SecurityDescriptor field values both before and after you move a business unit. To do this, use SQL Query Analyzer to run the following sample SQL SELECT statement against the
Organization_Name_MSCRM database.
Organization_Name is the licensed organization name for the Microsoft CRM installation. Run this statement before a business unit is moved, and then run the statement again after the business unit is moved. Then, compare the values to find the difference in the lengths.
select min(datalength(securitydescriptor)),
avg(datalength(securitydescriptor)),
max(datalength(securitydescriptor)) from SystemUserBase
This sample SQL SELECT statement shows the minimum length, the average length, and the maximum length of a
SecurityDescriptor field value for all the records in the
SystemUserBase table. The
SystemUserBase table is used because that table always has at least one record in it.
A typical size for the
SecurityDescriptor field is 1,000 characters if your Microsoft CRM installation has only a few Microsoft CRM business units and has no custom Microsoft CRM security roles. If you add Microsoft CRM business units and Microsoft CRM security roles, the size of the
SecurityDescriptor field value grows. This change is expected functionality.
Note Making SQL Server updates directly to the Microsoft CRM databases is not supported.
For more information about the terminology that is used to describe Microsoft product updates, see the following articles in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
887283 Microsoft Business Solutions CRM software hotfix and update package naming standards