Note-to-self: #MIM2016 & #FIM2010 Config documenter released on GitHub

Source: Announcement on MIM 2016 Group on LinkedIn by  Jef Kazimer

Source Code: https://github.com/Microsoft/MIMConfigDocumenter

Jef announced that the Identity Community Projects team has published the MIM Config Documenter tool to the Microsoft GitHub Organization as an open source community project.

The MIM configuration documenter is a very nice and easy tool to generate documentation of a MIM / FIM synchronization or service installation.

It allows to: 

  • Document deployment configuration details for the MIM / FIM solution, including MIMWAL Workflow definitions
  • Track any configuration changes you have made since a specific baseline
  • Build confidence in getting things right when making changes to the deployed solution

You can find the project code, releases, and documentation at https://github.com/Microsoft/MIMConfigDocumenter

 

Note-to-self: Hotfix rollup package (build 4.4.1459.0) is available for #MIM2016 SP1

Microsoft has released an hotfix for MIM2016 SP, with an awful lot of updates and improvements.. to much to list… but more to read:

See here: Source: https://support.microsoft.com/en-us/help/4012498/hotfix-rollup-package-build-4-4-1459-0-is-available-for-microsoft-iden

 

#FIM2010 / #MIM2016 not so dead, and what you didn’t hear.

What seemed to be a small note on a MPN blog, landed on LinkedIn and finally got into a pretty… eh how would you name it … disappointing, bizar, vicious, mean, deviant, misunderstood .. nah .. just a wrong direction, has caused quite some confusion.

And looking at the IM and messages I get, it still is.

Let me spoil the clue of the story: Microsoft Identity and Access, FIM, MIM,… IS … ALIVE. VERY MUCH ALIVE. (NOT DEAD)
If you need more detail, continue…

Lots of things have been said and I don’t want to repeat too much stuff, and certainly don’t want to take credit for it.
But let me pick some core components of the discussion and get a few things straight.

Why not refer to the sources first, by chrono. (If you want to have them in a short list all together, quickly read through the post till the end.)

It started here (by Gavriella Schuster on 12 April 2016):

https://blogs.partner.microsoft.com/mpn/microsoft-partner-network-evolution/?ln=en-US

In essence Gavriella discusses MPN (Microsoft Partner Network) competencies and mentions the “The retiring competencies”, which include: “Identity and Access”.
She doesn’t mention any product specifically, but she doesn’t mention either that “Identity and Access” is being moved to the Enterprise Mobility Management (EMM) competency.
This is clearly a cause for confusion, disappointment and misunderstanding.

But if you continue to read her post and check the next paragraph, you’ll see:

  • Interactive MPN Evolution Guide – This NEW interactive tool is your first step to guide your decision process. Use this to explore all of the new paths and options and easily identify which is the best fit for your business.
  • MPN Evolution Page – This is an overview of the changes, including the full list of impacted competencies and timeline.
  • FAQ – We have received feedback from some of your peers in our advisory councils and compiled answers to some of the questions we anticipate you might have. We will continue to build on these as we receive new questions.

 

After a few clicks in the MPN evolution guide, you’ll see that “Identity and Access” is now in the Enterprise Mobility Management (EMM) competency. But it takes a few pages to find out. Right.

Also the MPN Evolution FAQ (downloadable PDF) says:

“Identity and Access Competency

Q) Where can I find more information about Enterprise Mobility Suite and partner opportunities?
A) For Enterprise Mobility Suite information, go here. For competency information, go here.

Q) Where can I find more info around Enterprise Mobility Suite incentives eligibility via the Enterprise Mobility Management Competency?
A) To learn more about EMS Incentives, visit the portal page, here. ”

A few days later a post on LinkedIn interpretes the competency change as “It marks the end of MIIS, ILM, FIM, and MIM“.
This opinion/ interpretation ignited a discussion or list of comments that even got vicious and mean if not incorrect. But I’ll leave that to your own interpretation.

But I can certainly advise to read all of it.

One of the key comments is posted by Alex Simons (Director of PM, Microsoft Identity Division): (quote)

“This focus area has just been combined with Mobility as we believe the overall category is merging as part of the shift we are seeing among customers to a modern end-user productivity model which merges Identity, Mobiltiy and Information Protection together to enable workers to get their jobs done wherever they are. So don’t let the merger fool you! We have more engineers working on Identity and Access Managemebt today (600+ across the cloud and on-premises) than we have ever had before at Microsoft!”

Apparently, due to some technical issues, an important comment of David Steadman never got posted to that thread. And probably for that reason, it got disconnected.
But it’s a damn important insider-note or add-on to Alex’ message.

“Identity within Microsoft not Dead!!”

“/../ this is not the end to identity platform. It simply transforming to what customers are demanding, just like MIIS changed and ILM. Merging the assets makes sense, As we have seen with this product and others. If you do not change you will be left behind it is a strategic change that meets the demand of our Azure Customers and On-premise Customers. Also the MIM product group has release a few new additions to MIM CTP4 /../”

“… Because Microsoft is the Identity platform and as this merger of Identity, Mobility and Information Protection continues you will see great add to the story and services.”

A few days later, , posts an interesting reply to the discussion. To jump to his conclusion: “ Success in the cloud is underpinned by a well-engineered Identity and Access infrastructure – and that is usually a hybrid on-premises/cloud infrastructure involving MIM, AD, Azure AD and much more. You can call it what you like, but rumours of its death have been greatly exaggerated.

And to close the discussion, you might want to get up to speed on what Microsoft Identity and Access aka Enterprise Mobility is heading to… with another post by Hugh.
It’s the essence of the whole story: Identity and Acces, now Enterpise mobility is not limited to the ‘identity technology’ anymore: consider”Advanced Threat Analytics, Secure Islands, Adallom, hybrid identity, devices and enterprise mobility management, Microsoft Identity Manager (MIM) including Privileged Access Management (PAM), new features in Microsoft’s Enterprise Mobility Suite, including changes in Azure Active Directory, Rights Management, and Intune… and more.

It’s damn clear that a specialist in Microsoft Identity & Access (eh sorry, Enterprise Mobility), will have plenty of work in the future.

That being said, here’s the short list.

References list of LinkedIn articles:

But that’s not all.
Recheck the Microsoft support lifecycle for the various products and save it for future reference:

 

*EDIT – 13/may/2016 … the discussion continues*
Above was the customer friendly version, as I’ve got quite some queries for details.
So it allows to explain that the pronounced dead essentially was a hoax.

On the FIM/MIM FB group, there was a very pertinent remark by Gil Kirkpatrick which I’m allowed to share here:

I’ve been utterly baffled at the public reaction to all of this… I’ve had probably a dozen people (a Kuppinger-Cole guy for chrissakes) tell me how MSFT has failed to crack the IAM market and how they’ve given up and EOL’d FIM/MIM, and now its a free-for-all and tha datacenter is on fire, and …, well you get the idea. It’s like nobody even bothered to read the announcement, and I don’t know, maybe look up some of the words in the dictionary if they were having trouble understanding it.”

+1

I personally think this is exactly the reason that David, Hugh and others (including me) have been fighting this hoax.

And I’ll not go into the view and recent reports of the market watchers, like Kuppinger-Cole and Gartner on Identity and Access, Identity Governance, .. whatever.
These are valuable if the reports are built on current, solid data.
But if a vendor does not participate in the survey for a year, or two, because their product stack is been overhauled and set ready for the future.. and therefore the ‘product suite’ does not fit to the market watchers categories (so it drops from the reports), it’s no reason to burry a product/vendor.

And certainly if these reports are published one year later…
Things are moving fast, very fast.

Note-to-self: EMET 5.5 released

Source: http://blogs.technet.com/b/srd/archive/2016/02/02/enhanced-mitigation-experience-toolkit-emet-version-5-5-is-now-available.aspx

Microsoft announced “the release of EMET 5.5, which includes the following new functionality and updates:

  • Windows 10 compatibility
  • Improved configuration of various mitigations via GPO
  • Improved writing of the mitigations to the registry, making it easier to leverage existing tools to manage EMET mitigations via GPO
  • EAF/EAF+ pseudo-mitigation performance improvements
  • Support for untrusted fonts mitigation in Windows 10″

Download is available at: https://www.microsoft.com/en-us/download/details.aspx?id=50766

More interesting information at:

EMET 5.5 FAQ: https://support.microsoft.com/en-us/kb/2458544

EMET at the Security TechCenter: https://technet.microsoft.com/en-us/security/jj653751

FIM2010# MIISActivate – FIM Sync service terminated with service-specific error %%-2146234334

This article has been posted on TNWiki at: FIM2010 Troubleshooting: MIISActivate – FIM Sync service terminated with service-specific error %%-2146234334.


 

Situation

 

Failing over a FIM Sync Server to the standby FIM sync server using MIISActivate.

After using successfully MIISActivate, the FIMSync Service fails to start and logs an error in the eventviewer.


 

Symptoms

 

You’ll see 2 error messages in the event viewer, erro 7024 and error 6324.

Error 7024

 

Reference

 

This error is pretty similar or exactly like the error described in the following Wiki article:

FIM2010 Troubleshooting: FIM Sync service terminated with service-specific error %%-2146234334.

 

Screen

 

 

Error message Text

 

Log Name: System
Source: Service Control Manager
Date: 3/02/2016 15:08:59
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: servername.domain.customer
Description:
The Forefront Identity Manager Synchronization Service service terminated with service-specific error %%-2146234334.
Event Xml:
<System>
<Provider Name=”Service Control Manager” Guid=”{555908d1-a6d7-4695-8e1e-26931d2012f4}” EventSourceName=”Service Control Manager” />
<EventID Qualifiers=”49152″>7024</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime=”2016-02-03T14:08:59.670239000Z” />
<EventRecordID>679744</EventRecordID>
<Correlation />
<Execution ProcessID=”516″ ThreadID=”1212″ />
<Channel>System</Channel>
<Computer>servername.domain.customer</Computer>
<Security />
</System>
<EventData>
<Data Name=”param1″>Forefront Identity Manager Synchronization Service</Data>
<Data Name=”param2″>%%-2146234334</Data>
</EventData>
</Event>

 

Error 6324

 

Error message Text

 

Log Name: Application
Source: FIMSynchronizationService
Date: 3/02/2016 15:08:59
Event ID: 6324
Task Category: Server
Level: Error
Keywords: Classic
User: N/A
Computer: servername.domain.customer
Description:
The server encountered an unexpected error and stopped.
“BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\sqlstore\storeimp.cpp(5096): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\sqlstore\storeimp.cpp(493): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(429): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x8023060d (The computer_id in the database does not match this computer.)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2145188339. This is retry number 0.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\shared\utils\clrhost.cpp(224): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\rules\scriptmanagerimpl.cpp(7886): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(272): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x80131022 (unable to get error text)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2146234334. This is retry number 1.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\shared\utils\clrhost.cpp(224): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\rules\scriptmanagerimpl.cpp(7886): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(272): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x80131022 (unable to get error text)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2146234334. This is retry number 2.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\shared\utils\clrhost.cpp(224): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\rules\scriptmanagerimpl.cpp(7886): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(272): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x80131022 (unable to get error text)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2146234334. This is retry number 3.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1041): 0x80131022 (unable to get error text)
Forefront Identity Manager 4.1.3634.0″
Event Xml:
<System>
< Provider Name=”FIMSynchronizationService” />
<EventID Qualifiers=”49152″>6324</EventID>
<Level>2</Level>
<Task>3</Task>
< Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2016-02-03T14:08:59.000000000Z” />
< EventRecordID>266336</EventRecordID>
<Channel>Application</Channel>
< Computer>servername.domain.customer</Computer>
<Security />
</System>
< EventData>
<Data>BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\sqlstore\storeimp.cpp(5096): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\sqlstore\storeimp.cpp(493): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(429): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x8023060d (The computer_id in the database does not match this computer.)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x8023060d (The computer_id in the database does not match this computer.)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2145188339. This is retry number 0.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\shared\utils\clrhost.cpp(224): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\rules\scriptmanagerimpl.cpp(7886): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(272): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x80131022 (unable to get error text)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2146234334. This is retry number 1.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\shared\utils\clrhost.cpp(224): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\rules\scriptmanagerimpl.cpp(7886): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(272): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x80131022 (unable to get error text)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2146234334. This is retry number 2.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\shared\utils\clrhost.cpp(224): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\rules\scriptmanagerimpl.cpp(7886): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(272): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\server.cpp(3960): 0x80131022 (unable to get error text)
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1588): 0x80131022 (unable to get error text)
ERR_: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1027): Error creating com objects. Error code: -2146234334. This is retry number 3.
BAIL: MMS(7916): d:\bt\39459\private\source\miis\server\server\service.cpp(1041): 0x80131022 (unable to get error text)
Forefront Identity Manager 4.1.3634.0</Data>
</EventData>

</Event>

 


 

Solution

 

Restart Service twice

 

At the first attempt, the service will take a very long time to try starting.

When the initial attempt fails, try restarting the FIM Synchronization again.

 

Check DB connection

 

Use a UDL file with the Data Link Properties tool to check if you can connect to the FIM Sync Database.

More info:
FIM2010 Troubleshooting: FIM Sync service terminated with service-specific error %%-2146234334.

 


 

Also on this blog

 


Announcing the public availability of the #MIMWAL for #MIM2016 project, now available as an Open Source Project on GitHub

Source: https://social.technet.microsoft.com/Forums/en-US/e613bbd9-5a2a-46c2-8d91-5f1e0116521b/announcing-the-public-availability-of-the-mimwal-project-now-available-as-an-open-source-project-on?forum=ilm2

Announcing the public availability of the MIMWAL project, now available as an Open Source Project on GitHub.

The MIMWAL is a Workflow Activity Library (WAL) for building complex workflows in the Microsoft Identity Manager (MIM) 2016 and Forefront Identity Manager (FIM) 2010 R2 solution.

The WAL is a powerful solution accelerator for MIM / FIM that provides foundational activities which can be combined to create complex workflows to implement business processes within a MIM / FIM solution simply by configuration instead of coding for days and months.

MIMWAL Features

  • Building-block Workflow Activities
  • Conditional Execution Capability for Building-block Activities
  • Support for Iteration Over a Collection of Values in Building-block Activities
  • Deep Resolution Capability for FIM Lookup Grammar
  • Rich Library of Workflow Functions
  • UI Framework for Building Additional Custom Workflow Activities
  • Support for ETW Event Tracing
  • Optimization of Update Requests
    • Combining multiple updates into a single request per resource per activity
    • Issuing update request only when resource is actually modified.

More information

Please visit the MIMWAL site at http://aka.ms/MIMWAL for information on project source code, releases and documentation, and discussion forums.

Please post any questions or discussions about the MIMWAL project on this forum, which can also be found at http://aka.ms/MIMWAL/Forum

MIMWAL Links

Note-to-self: #FIM2010/#MIM2016 Generic SQL Connector technical reference

Please note that Andreas Kjellman published/updated the information on the Generic SQL connector for FIM/MIM

Source:

As described on the tech page:

This article describes the Generic SQL Connector. The article applies to the following products:

  • Microsoft Identity Manager 2016 (MIM2016)
  • Forefront Identity Manager 2010 R2 (FIM2010R2)
    • Must use hotfix 4.1.3461.0 or later KB2870703.

For MIM2016 and FIM2010R2 the Connector is available as a download from the Microsoft Download Center.

/../

The Connector is supported with all 64-bit ODBC drivers. It has been tested with the following:

  • Microsoft SQL Server & SQL Azure
  • IBM DB2 10.x
  • IBM DB2 9.x
  • Oracle 10 & 11g
  • MySQL 5.x

 

You might have some trouble to get to the download link, if so : keep an eye on it and retry later. The download will be activated any time soon…