fim2010R2

Microsoft Identity Manager online resources (#MIM2016)

Quick note on Microsoft Learn & Docs

A while ago Microsoft moved from Docs (Docs.microsoft.com) to Learn (Learn.microsoft.com), but still some older information might point to the Docs links. In case the redirect fails, replace the docs prefix in the URL to learn an try again.
If it still fails, Bing it and let me know.

Microsoft news and announcements

Microsoft Product support lifecycle

https://docs.microsoft.com/en-us/lifecycle/products/?terms=Identity

Feeds

Official documentation – Microsoft

Microsoft Learn- MIM landing page: https://learn.microsoft.com/en-us/microsoft-identity-manager
Microsoft Identity Manager 2016 news and updates: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016
Version History: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/version-history

Getting prepared

Supported platforms: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-supported-platforms

Best practices

https://learn.microsoft.com/en-us/microsoft-identity-manager/mim-best-practices

Deployment documentation

Capacity planning: https://learn.microsoft.com/en-us/microsoft-identity-manager/capacity-planning-guide
Deploy and use: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-deploy
Deprecated features: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features

MIM for developers

•Microsoft Identity Manager 2016 developer reference: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/microsoft-identity-manager-2016-developer-reference
•Microsoft Identity Manager Cmdlets Reference: https://learn.microsoft.com/en-us/powershell/microsoft-identity-manager/overview?view=idm-ps-2016sp1

MIM reference material

Developer reference: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/microsoft-identity-manager-2016-developer-reference
Functions reference: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/mim2016-functions-reference
Management agent run error codes: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/maerrorcodes
RCDC configuration XML: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/rcd-configuration-xml-reference

Github

(Microsoft) MIM Configuration Documenter

https://github.com/microsoft/MIMConfigDocumenter

(Microsoft) Workflow Activity Library (WAL)

https://github.com/microsoft/MIMWAL

MIM projects

https://github.com/search?q=mim2016

Microsoft Community

Forums (Active)

Tech Community : https://techcommunity.microsoft.com/

Microsoft Learn – Q&A : https://learn.microsoft.com/en-us/answers/search.html?type=question%20OR%20idea%20OR%20kbentry%20OR%20answer%20OR%20topic%20OR%20user&redirect=search%2Fsearch&sort=relevance&q=identity%20manager

Microsoft Answers

•Microsoft Answers: https://answers.microsoft.com/en-us/search/search?SearchTerm=MIM%202016
•FIM 2010: https://answers.microsoft.com/en-us/search/search?SearchTerm=FIM%202010

Forums (Achive)

(archive) Technet forum FIM/MIM: https://social.technet.microsoft.com/Forums/en-US/home?forum=ilm2&filter=alllanguages
(archive) Technet Forum ILM 2007: https://social.technet.microsoft.com/Forums/en-US/home?forum=identitylifecyclemanager&filter=alllanguages

Technet blogs archive

Technet blogs archive: https://learn.microsoft.com/en-us/archive/blogs/

Experts Exchange

Experts Exchange: https://www.experts-exchange.com/searchResults.jsp?searchTerms=MIM2016

Microsoft Wiki

Microsoft Wiki: https://social.technet.microsoft.com/wiki
Short URL: https://aka.ms/wiki

ILM/FIM/MIM article overview

https://social.technet.microsoft.com/wiki/contents/articles/3610.fim-2010-mim-2016-related-wiki-articles.aspx

ILM/FIM/MIM Troubleshooting

https://social.technet.microsoft.com/wiki/contents/articles/3610.fim-2010-mim-2016-related-wiki-articles.aspx#FIM_Troubleshooting_Article

The FIM/MIM geek blogs & posts…

Below you’ll find some interesting and helpful articles and posts (some of the are old/archived… But still valid for MIM too.)

In alphabetic order (on last name)

Bob Bradley: https://idm4real.com/
Blain Checkly: https://identityminded.wordpress.com/
Jorge de Almeida Pinto (MVP): https://jorgequestforknowledge.wordpress.com/
Soren Granfeldt: https://github.com/sorengranfeldt
Antony Ho (Microsoft) : https://learn.microsoft.com/en-us/archive/blogs/aho/
Jeff Ingalls (https://ingallsdesigns.com/),
Borys Majewski (http://idarchitect.net/)
Ryan Newington (https://twitter.com/RyanLNewington): https://lithnet.io/products/mim
Kent Nordstrom: https://konab.com/blog/
Darren Robinson: https://blog.darrenjrobinson.com/identity-manager-management-agents/
Carol Wapshere: https://www.wapshere.com/missmiis/rcdc-memberof-list
…

Facebook

https://www.facebook.com/groups/MicrosoftIdentityManager/

Twitter

Books

Online Companion guide for MIM 2016 book

https://social.technet.microsoft.com/wiki/contents/articles/34993.microsoft-identity-manager-2016-handbook-online-companion-guide.aspx

Visio Stencils

https://github.com/PeterGeelen/Microsoft-Identity-Manager/tree/main/FIM-MIM%20stencils

#MIM2016 Troubleshooting: SQL Connection issues

On TNWiki you’ll find my latest article on MIM 2016 troubleshooting.

MIM 2016 Troubleshooting: SQL Connection issues

This week I got (dragged into/) involved in a MIM 2016 performance troubleshooting, on a test / dev server, facing a large bunch of errors.

The first detection happened on the sync server, but apparently rather it’s twin brother was causing the issues.

It became pretty quickly obvious that MIM was not able to connect to (one of) it’s databases on the SQL server, so the sync engine was unable to pull information from the MIM service.

Also bizar, we could still work on the MIM sync GUI, but almost any MA action in the GUI failed…

Furthermore the Portal did not respond and finally the “MIM Service” service, didn’t behave as expected, not willing to start.

The event viewer contained the obvious amount of errors…

Finally, the SQL DBA to the rescue.

I’ve added a lot of significant technical event info into the article, to make it easy to search for you, for later reference.

Read the tech details in: MIM 2016 Troubleshooting: SQL Connection issues

Updated: 2020-12-29

Note-to-self: #MIM2016 & #FIM2010 Config documenter released on GitHub

Source: Announcement on MIM 2016 Group on LinkedIn by Jef Kazimer

Source Code: https://github.com/Microsoft/MIMConfigDocumenter

Jef announced that the Identity Community Projects team has published the MIM Config Documenter tool to the Microsoft GitHub Organization as an open source community project.

The MIM configuration documenter is a very nice and easy tool to generate documentation of a MIM / FIM synchronization or service installation.

It allows to:

Document deployment configuration details for the MIM / FIM solution, including MIMWAL Workflow definitions
Track any configuration changes you have made since a specific baseline
Build confidence in getting things right when making changes to the deployed solution

You can find the project code, releases, and documentation at https://github.com/Microsoft/MIMConfigDocumenter

#MIM2016 Troubleshooting: Uninstall fails with error – Administrator privileges are required to run installer. Please re-launch installer with administrator privileges.

I’ve got a new post up on TechNet Wiki about MIM2016 troubleshooting:

Full version at the TNWIKI: MIM2016/FIM2010 Troubleshooting: Uninstall fails with error – Administrator privileges required

Feel free to add useful information yourself, I’m looking forward to your feedback and cooperation to make it better.

The short version is below.

Rikard Strand has published a similar article, which has served as baseline for this article. Rik’s article is focussed on DirSync, but the troubleshooting below is more widely applicable and even programs not related to FIM/MIM/DirSync…

When you try to uninstall or to change the component from the Control Panel > Programs (Uninstall a program), you get a error pop up, saying:

Administrator privileges are required to run installer. Please re-launch installer with administrator privileges.

There are some troubleshooting steps, including running the Control Panel in administrator mode.

If that doesn’t work, you need to find the uninstaller info in the registry and run the msiexec command with the uninstaller info.

Open the registry editor and navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

In this directory you’ll find the installed programs with their GUID, which is mostly fixed per application.

MIM 2016: {5A7CB0A3-7AA2-4F40-8899-02B83694085F}
DirSync/AADConnect: {C9139DEA-F758-4177-8E0F-AA5B09628136}

And finally, the quick and dirty option is to kill the uninstall registry key before your run the uninstall from the control panel again

In case of MIM2016

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5A7CB0A3-7AA2-4F40-8899-02B83694085F}

You know the usual warning: I didn’t tell you to delete the registry key.

Last update: 2020-12-30

Note-to-self: Hotfix rollup package (build 4.4.1459.0) is available for #MIM2016 SP1

Microsoft has released an hotfix for MIM2016 SP, with an awful lot of updates and improvements.. to much to list… but more to read:

See here: https://support.microsoft.com/en-us/help/4012498/hotfix-rollup-package-build-4-4-1459-0-is-available-for-microsoft-iden

Last update: 2020-12-30

Protecting your #FIM2010/#MIM2016: Core account type differentiators

When handling solutions in the identity & access management area (and practically speaking working with FIM/MIM), a very basic discussion is always coming back: which types of accounts do you need?
It’s seems a trivial question but you can apply it to different areas of the solution, both from a technical as from a logical perspective…

When talking about the technical perspective, I’m looking at securing your technical implementation.

A more practical question would be: what user accounts do I need to prepare before I start implementing my IAM solution? What is needed to implement my solution in a secure, but manageable way, with respect to principles of “segregation of duties” and “least-privilege“, but also “due care”, “due governance”…

With a bit of experience (referring to the installation requirement of a typical FIM/MIM configuration), you can easily list at 5 categories of accounts you need:

installer accounts: typically administrator accounts to run the setup, with some privileges on the server and back-end systems to get the server components running
service accounts: account that will be configured on applications running continuously in the background (FIM Sync service, FIM Service service, SQL Database services
account that are not running full time in the background, but run a technical task now and then, not continuously, but automated without user interaction (eg like the FIM Sync run profile scheduling, …)
personal accounts, that logon to the desktop, what every single person is using to do his daily job and IT work (logging on on your laptop, remotely connecting to the server,… )
personal administrator accounts: that logon to the desktop, or to the server desktop for highly priviledged IT work (logging on your laptop as admin, connecting to the server as admin, administrative tasks…)

So what are the key differentiators to define and separate these accounts?

One of the primary differentiators is interactive desktop logon (1).
Typically an installation account or an administrator needs to logon…. A service account running the application in the background on the server, … does not.

Also, when securing your environment this is a key parameter to lock down the privileges.

This differentiator is also directly related to password management.

Account logging on in the desktop can change their passwords. Accounts running in the background, without interaction will have major trouble when they are under password change policy.
Unless the application supports managed service accounts, but that’s not wide spread yet, certainly not for the FIM/MIM components…so I’ll skip that track for now.

But an installer account, DOES NEED desktop logon, but SHOULD NOT be deleted when someone leaves the company.
The best example of this difference is the FIM Installer account, that gets local admin access to the Windows server and to the SQL server as SA. This account is also injected in the FIM portal as default (GOD MODE) admin, so you DON’T want to loose this account.

So, another easy differentiator is the link to a physical person (2).
Typically physical persons are ‘managed’ with a lifecycle (eg under contract with your company). You know the typical hire-change-fire processes… (people on-board, people change jobs, people leave the company)

You don’t want to run your background services on a personal account, because… if you are running your identity management the proper way (and you will), they will be deprovisioned one time, right?

In normal (I should rather say normalized) security situations, the principle of least-privilege dictates that normal user accounts should not have extensive administrative rights, these should be attributed to separate administrative accounts.

So, the parameter: “highly privileged rights” (3) is a another key differentiator between the different types of accounts that can logon to a desktop.

The opposite of the ‘physical’ account are accounts that are not (or better, SHOULD not be) used by people, but run in the background, most server and/or Active Directory admins immediately think about the following system / GPO settings

deny run as a service
deny logon as a batch job

So, considering “segregation of duties” and “least-privilege” makes them mutually exclusive. (I beg you to disagree and provide me motivated arguments …), which provides me 2 other differentiators

run as a background service (4)
run as a batch job (5)

Based on these differentiators, the basic accounts types you can define are

service accounts
technical accounts
functional accounts
personal accounts
personal admin accounts

	Account Type
Task type	Service Account	Technical Account	Functional Account	Personal Account	Personal Administrator Account
Run as a Background Service (continuously)	YES	NO	NO	NO	NO
Running a batch job (Specific Task or script)	NO	YES	NO	NO	NO
Interact with desktop/Physical Logon	NO	NO	YES	YES	YES
Highly Privileged Rights	NO	NO	YES	NO	YES
Direct Link to physical person (link to HR)	NO	NO	NO	YES	YES

I’ve been working with a variety of customers and environments and I challenge this matrix every single time.

So I would like to challenge you to find a better, easier, more solid matrix.
Is there anything in this set of parameters that doesn’t make sense? Too simple, to complex, anything missing?

If yes, let me know and we go for the next version.

More information

You can find more information on the TechNet Wiki in a series of articles on FIM/MIM security hardening and implementation:

Download from Gallery/Github

PDF version from Technet Gallery.

Github: FIM/MIM Planning security setup for accounts, groups and services

Last update: 2020-12-30

Keywords: accounts, account; segregation, separation, segregation of duties, SoD,

Note-to-self: Got #MIM2016 product feedback, feature wish list? aka.ms/mimfeedback

Very short note-to-myself (#memory-function-on)…

David Steadman, respected @fimguy, now @TheMIMGuy posted an interesting poke…

#MIM2016 Have an Idea? Have Feedback? https://aka.ms/mimfeedback

— David Steadman (@TheMIMGuy) February 14, 2017

So, got any constructive suggestion, move over to that feedback page at: https://aka.ms/mimfeedback

(Last update: 2020-12-31)

Microsoft released #MIM2016 Service Pack 1 UPDATE package

Source: https://aka.ms/mim2016sp1upgrade

Since the release of MIM 2016 SP1 just a few weeks ago, Microsoft received significant feedback from the community, their partners and customers regarding the upgrade paths for the service pack.

8th of November, Microsoft announced the availability of the MIM 2016 SP1 Update MSP.

This MSP allows current customers on MIM 2016 RTM, or any hotfix build since 2016 RTM to perform an in-place upgrade to the current build of this MSP (4.4.1302.0).

The supported in-place upgrade scenarios are outlined in the table below. To obtain this update, please click here.

Please note, an updated MSI for new implementations is likely to be released soon.

Carefully check the upgrade paths, as this MSP cannot be applied to build 4.4.1296.0 (MIM 2016 SP1 RTM).

The download page explicitly mentions: “MIM 2016 RTM Versions to update their infrastructure to the latest SP1 Build without complete uninstall. Customers already on MIM 2016 SP1 (4.4.1237) can not install this patch.

Supported Operating System

Windows Server 2012, Windows Server 2012 R2, Windows Server 2016

MIM 2016 RTM or one of the following hotfix builds: 4.3.2064.0 4.3.2195.0 4.3.2266.0″

Initial Build	Hotfix Applied	Build after SP1 Update
RTM	None	4.4.1302.0
RTM	4.3.2064.0	4.4.1302.0
RTM	4.3.2064.0, 4.3.2195.0	4.4.1302.0
RTM	4.3.2195.0	4.4.1302.0
RTM	4.3.2266.0	4.4.1302.0

Additionally, for customers running Office 2010 needing the x86 Add-ins and Extensions, do not update using this MSP, a forthcoming hotfix will be made available in the coming months.

If you have any comments for the Product Group, please send us an email at: mim2016@microsoft.com

(Last update: 2020-12-31)

#FIM2010 & #MIM2016 Error 25009 fun stuff on #TNWiki

For the FIM Geeks, I’ve submitted some new FIM/MIM 25009 event troubleshooting articles on TechNet Wiki (http://aka.ms/Wiki)

Plus, a page the collects all the 25009 troubleshooting resources, including lots of fun stuff of Tim Macauly.

FIM/MIM Troubleshooting Error 25009 Resource page

If you got more of this 25009 fun stuff yourself, feel free to add your articles and add them to the collection page.

Updated: 2020-12-30

A hotfix rollup package (build 4.1.3765.0) is available for #FIM2010

Source: https://support.microsoft.com/en-us/kb/3171318

Issues that are fixed and features that are added in this update

This update fixes the following issues and adds the following features that were not previously documented in the Microsoft Knowledge Base.

FIM Certificate Management

Issue 1 A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.
Issue 2 The Duplicate Revocation Settings policy is replaced because some users could not set it.
Issue 3 There is a redundant space in the “Profile Summary” string on the Request Complete page for some languages.

FIM Synchronization Service

Issue 1 In a metaverse search and when you view the object, there is a Last Modified field. But when you sort that field, it sorts as a generic text field instead of as a date field.
Issue 2 Error messages (such as Event ID 6313) are logged in the event log. Additionally, performance counters don’t work.
Issue 3 The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.
Issue 4 When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the size value quietly changes to the minimum or the maximum after you click Finish.
Issue 5 An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.
Issue 6 You receive a “Reference to undeclared entity ‘qt'” error message when you run the history process and the history text contains the “greater than” symbol (>).
Issue 7 Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.
Issue 8 A “MEMORY_ALLOCATION_FAILURE” error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.

FIM Portal

Issue 1 Multivalued labels are displayed incorrectly in a single line in the UI.

FIM Service

Issue 1 During an Export process between the Synchronization and FIM Service, the msidmCompositeType request may fail if some multivalued string attribute value is changed in the scope of the Export session. This behavior affects performance.
Issue 2 In SharePoint Server 2013 and later versions, if you change a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.

BHOLD

Issue 1 When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.
Issue 2 Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.
Issue 3 When you use the Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.
Issue 4 An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.
Issue 5 If two or more roles assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.
Issue 6 An email alias is truncated if it is longer than 30 characters.

Updated: 2020-12-30

Quick note on Microsoft Learn & Docs

Microsoft news and announcements

Microsoft Product support lifecycle

Feeds

Official documentation – Microsoft

Getting prepared

Best practices

Deployment documentation

MIM for developers

MIM reference material

Github

(Microsoft) MIM Configuration Documenter

(Microsoft) Workflow Activity Library (WAL)

MIM projects

Microsoft Community

Forums (Active)

Microsoft Answers

Forums (Achive)

Technet blogs archive

Experts Exchange

Microsoft Wiki

FIM/MIM related content (check the tags)

ILM/FIM/MIM article overview

ILM/FIM/MIM Troubleshooting

The FIM/MIM geek blogs & posts…

Social Media

Facebook

Twitter

Books

Online Companion guide for MIM 2016 book

Visio Stencils

Archives

Microsoft Learn – previous versions

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

More information

Download from Gallery/Github

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Issues that are fixed and features that are added in this update

FIM Certificate Management

FIM Synchronization Service

FIM Portal

FIM Service

BHOLD

Share this:

Like this: