Microsoft has released an hotfix for MIM2016 SP, with an awful lot of updates and improvements.. to much to list… but more to read:
Last update: 2020-12-30
hotfix
Microsoft released #MIM2016 Service Pack 1 UPDATE package
Source: https://aka.ms/mim2016sp1upgrade
Since the release of MIM 2016 SP1 just a few weeks ago, Microsoft received significant feedback from the community, their partners and customers regarding the upgrade paths for the service pack.
8th of November, Microsoft announced the availability of the MIM 2016 SP1 Update MSP.
This MSP allows current customers on MIM 2016 RTM, or any hotfix build since 2016 RTM to perform an in-place upgrade to the current build of this MSP (4.4.1302.0).
The supported in-place upgrade scenarios are outlined in the table below. To obtain this update, please click here.
Please note, an updated MSI for new implementations is likely to be released soon.
Carefully check the upgrade paths, as this MSP cannot be applied to build 4.4.1296.0 (MIM 2016 SP1 RTM).
The download page explicitly mentions: “MIM 2016 RTM Versions to update their infrastructure to the latest SP1 Build without complete uninstall. Customers already on MIM 2016 SP1 (4.4.1237) can not install this patch.
Supported Operating System
Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
MIM 2016 RTM or one of the following hotfix builds: 4.3.2064.0 4.3.2195.0 4.3.2266.0″
| Initial Build | Hotfix Applied | Build after SP1 Update |
| RTM | None | 4.4.1302.0 |
| RTM | 4.3.2064.0 | 4.4.1302.0 |
| RTM | 4.3.2064.0, 4.3.2195.0 | 4.4.1302.0 |
| RTM | 4.3.2195.0 | 4.4.1302.0 |
| RTM | 4.3.2266.0 | 4.4.1302.0 |
Additionally, for customers running Office 2010 needing the x86 Add-ins and Extensions, do not update using this MSP, a forthcoming hotfix will be made available in the coming months.
If you have any comments for the Product Group, please send us an email at: mim2016@microsoft.com
(Last update: 2020-12-31)
A hotfix rollup package (build 4.1.3765.0) is available for #FIM2010
Source: https://support.microsoft.com/en-us/kb/3171318
Issues that are fixed and features that are added in this update
This update fixes the following issues and adds the following features that were not previously documented in the Microsoft Knowledge Base.
FIM Certificate Management
- Issue 1 A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.
- Issue 2 The Duplicate Revocation Settings policy is replaced because some users could not set it.
- Issue 3 There is a redundant space in the “Profile Summary” string on the Request Complete page for some languages.
FIM Synchronization Service
- Issue 1 In a metaverse search and when you view the object, there is a Last Modified field. But when you sort that field, it sorts as a generic text field instead of as a date field.
- Issue 2 Error messages (such as Event ID 6313) are logged in the event log. Additionally, performance counters don’t work.
- Issue 3 The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.
- Issue 4 When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the size value quietly changes to the minimum or the maximum after you click Finish.
- Issue 5 An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.
- Issue 6 You receive a “Reference to undeclared entity ‘qt'” error message when you run the history process and the history text contains the “greater than” symbol (>).
- Issue 7 Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.
- Issue 8 A “MEMORY_ALLOCATION_FAILURE” error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.
FIM Portal
- Issue 1 Multivalued labels are displayed incorrectly in a single line in the UI.
FIM Service
- Issue 1 During an Export process between the Synchronization and FIM Service, the msidmCompositeType request may fail if some multivalued string attribute value is changed in the scope of the Export session. This behavior affects performance.
- Issue 2 In SharePoint Server 2013 and later versions, if you change a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.
BHOLD
- Issue 1 When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.
- Issue 2 Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.
- Issue 3 When you use the Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.
- Issue 4 An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.
- Issue 5 If two or more roles assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.
- Issue 6 An email alias is truncated if it is longer than 30 characters.
Updated: 2020-12-30
New hotfix rollup package (build 4.3.2266.0) is available for #MIM2016
Source: https://support.microsoft.com/en-us/kb/3171342
Quick overview below, full detail in KB article referenced.
Issues that are fixed and features that are added in this update
This update fixes the following issues and adds the following features that were not previously documented in the Microsoft Knowledge Base.
Privileged Access Management (PAM)
Issue 1: PAM monitor service error with PRIV only PAM USER
FIM add-ins and extensions
Issue 1: SSPR windows clients with high DPI have incorrect scaling of the final page
Issue 2: SSPR Windows client text message overlap
FIM Certificate Management
Issue 1: <span “text-base”=””>ExecuteOperations.Disable operation issue
Issue 2: Smart Card search issue
Issue 3: Profile summary issue
Issue 4: Duplicate revocation settings policy issue
Issue 5: Certificae Management portal issue with LDAP CN name
Issue 6: misplaced link in Certificate Management portal for certain languages
FIM Synchronization Service
Issue 1: MA config wizard issue
Issue 2: error messages logged in Event Viewer + Perf counter issue
Issue 3: Issue with Full sync vs Equal precedence
Issue 4: ECMA2 issue with incorrect page size
Issue 5 :error message from the Management Agent cannot be parsed if it contains some special symbols
Issue 6″Reference to undeclared entity ‘qt'” error message
Issue 7: <span “text-base”=””>New Functionality:/span> The ability to skip the Management Agent during the import of a server configuration is added.
Issue 8: A “MEMORY_ALLOCATION_FAILURE” error occurs in the Performance Monitoring tool.
FIM Portal
Issue 1: incorrect display of multivalue labels
Issue 2: RCDC update XML format not verified
Issue 3: cannot drag and drop user to remove box
Issue 4: Local date and time issue
Issue 5 RCDC additional attributed included
FIM Service
Issue 1: SharePoint Server 2013 and later , workflow issue, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.
BHOLD
Issue 1: issue with incompatible permissions
Issue 2 attribute based AuthZ issues
Issue 3: Acces management connector issue
Issue 4: error during BHOLD installl in IIS
Issue 5: user role permission issue with extraction
Issue 6: email alias truncated if longer than 30 char.
Last update: 2020-12-30
Note-to-self: FIM/MIM hotfix download link failing
Some people reported that the download links to the recent hotfix failed…
The 4.3.2064.0 hotfix page is: https://support.microsoft.com/en-us/kb/3092179
When you click the link, it forwards to
http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=3092179&kbln=en-us (or similar language)
You need to accept the EULA. (After reading it ! 😉 )
Next you need to select the hotfix (only one to select).
Fill in your email and you’ll get the download link.
The link you receive in the mail should look like…
Package:
———————————————————–
———————————————————–
KB Article Number(s): 3092179
Language: All (Global)
Platform: x64
Location: (/<blah>/http%3a%2f%2fhotfixv4.microsoft.com%2fMicrosoft%2520Identity%2520Manager%2flatest%2fKB3092179%2f4.3.2064.0%2ffree%2f488603_intl_x64_zip.exe/<blah/)
But when you click that link, in some cases the encoded URL seems to fail, where the spaces, slashes, dashes and underscores weren’t decoded correctly.
By clicking the link the %2520 code is not correctly translated to a space…
To solve this, copy the URL text and paste the URL in your favorite browser.
It should guide you to: http://hotfixv4.microsoft.com/Microsoft%20Identity%20Manager/latest/KB3092179/4.3.2064.0/free/488603_intl_x64_zip.exe
Be prepared, this hotfix takes 213 MB of your bandwidth and disk…
Note-to-self: A hotfix rollup package (build 4.3.2064.0) is available for Microsoft Identity Manager 2016
Hotfix rollup package (build 4.1.3671.0) for Forefront Identity Manager 2010 R2
Source: https://support.microsoft.com/en-us/kb/3092178
From the KB Article:
”
Issues that are fixed or features that are added in this update
This update also fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.
FIM add-ins and extensions
Issue 1
This hotfix addresses an issue in the password reset window that occurs on displays that have high DPI settings when the Windows display sizing of items is set to a custom size, such as 200% or more.
FIM Certificate Management
Issue 1
If you try to enroll a smart card that has the correct profile selected (and the correct adminKey), but the user PIN does not correspond to the smart card PIN policy, you receive the following error message:
The card cannot be accessed because the wrong PIN was presented.
FIM Synchronization Service
Issue 1
When you configure an ECMA2 run profile, you receive the following exception:
Value of ‘10’ is not a valid value
Issue 2
The Sync Engine reports a staging error during delta import when the Generic LDAP connector detects the renaming of the distinguished name for an object.
Issue 3
During the export run DN modification of a user, an object is deleted from a group membership in Oracle Directory Enterprise Edition (ODSEE) instead of changing the DN LDAP.
Issue 4
When you try to select an OU that contains more than 4,000 sub-OUs on the Directory Partitions tab, you receive the following error message:
The administrative size limit on the server was exceeded.
Issue 5
When you perform an Export, CS Search, or CS Deletion during ECMA2 Export Only, the MA displays the following error message:
The image or delta doesn’t have an anchor.
Issue 6
The Sync Service stops responding because of high CPU usage when you stop a run profile for the ECMA connector.
Issue 7
When you have characters in the SMTP address that are unsupported by Exchange Server, a GALSync Export operation stops, and you receive an ma-extension error. This triggers a provisioning loop that causes object duplication.
FIM Portal
Issue 1
This hotfix addresses an issue in the FIM Portal that affects sorting a customized list view that’s based on the columns specified in the ColumnsToDisplay field.
Issue 2
This hotfix updates HTML elements and attributes in the password registration portal and the FIM Portal.
Issue 3
The object picker does not search objects that contain special characters in their file names.
Issue 4
This hotfix updates the translation into Russian of the user interface strings that relate to “Password Reset AuthN Workflow” activity.
Issue 5
This hotfix addresses an issue that affects the Leave and Remove Member buttons when the group resource type is customized.
Issue 6
This hotfix adds a new search scope (All Groups) to enable searching for and joining groups if the user does not know whether the group is a security group or a distribution list.
FIM Service
Issue 1
This hotfix addresses an issue in which broker service conversations are not closed after an export from FIM Sync to the FIM Service database.
Issue 2
When there are too many negative conditions in the Group Criteria, the SQL & FIM service stop running.
Issue 3
SET filter definitions are unsuccessful during save after you upgrade to version 4.1.3634.0.
Issue 4
When you use the CustomExpression option, the Concatenate operator is replaced with the “+” character. This triggers an error when it saves.
Issue 5
This hotfix addresses an issue that affects FIM Service database stored procedures. Specifically, deadlocks might occur in approval workflows. This issue occurs particularly in deployments with complex or general Set definitions such as sets matching “/*” instead of with specific resource types.
BHOLD
Issue 1
There’s an inconsistency between the Permission name and the value if an attribute changes. After Export\Import\Export flow in FIM Sync, BHOLD receives duplicates of a renamed group and retains the original group in the database.”
New #FIM2010 R2 SP1 hotfix released to fully support Windows Server 2012 R2 ADDS (Build 4.1.3634.0)
Microsoft has released a very important hotfix for FIM2010 R2 SP1: full details at https://support.microsoft.com/kb/3048056. (FIM Build 4.1.3634.0)
As indicated in the article, Microsoft recommends that all customers apply this update to their production systems.
The most important fix in this hotfix is that FIM2010 R2 (SP1) now fully supports Windows Server 2012 R2 Active Directory Domain Services, both for domain and forest level.
Still an important condition for this support is that the FIM Synchronization Service must be installed only on
- Windows Server 2008,
- Windows Server 2008 R2,
- or Windows Server 2012 member server.
FIM 2010 Server components must NOT be installed on a Windows Server 2012 R2 member server.
Only the PCNS component can be installed on a Windows Server 2012 R2 domain controller.
More information:
New Hotfix rollup (build 4.1.3627.0) is available for #FIM2010 R2 Service Pack 1
Source: http://support2.microsoft.com/kb/3022704
A hotfix rollup package (build 4.1.3627.0) is available for Microsoft Forefront Identity Manager (FIM) 2010 R2 Service Pack 1 (SP1).
The build number for BHOLD components that are included in this release is 5.0.2959.0. This hotfix rollup resolves some issues and adds some features that are described in the “More Information” section of the article.
New hotfix rollup released for #FIM2010 R2 (now build 4.1.3613.0)
Source: http://support2.microsoft.com/kb/3011057
Issues that are fixed or features that are added in this update
This update fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.
BHOLD Attestation
Issue 1
- Symptoms: When a steward is added to an in-progress campaign, the steward receives the “New entries for Steward” email.Changes after the fix: When a steward is added to an in-progress campaign, the steward receives the “Instance Start” email.
BHOLD Core
Issue 1
- Symptoms: When a user has conflicting ABA roles, and the user’s “EndDate” field is changed through the BHOLD Core UI, the user may be assigned an incorrect role.Changes after the fix: Changing the user’s “EndDate” field does not affect any other ABA role attributes.
BHOLD Core and FIM provisioning
Issue 1
- When you use the Access Management Connector, and an import is performed immediately following an export that caused ABA role membership changes, the import may indicate that users have fewer permissions than are assigned by either their previous or new role memberships.After you install this fix: If an import is performed immediately following an export that caused ABA role membership changes, the import indicates that users have the permissions assigned by either their previous or new role memberships. After queue processing is completed, the import indicates that users have the permissions that are assigned by their new role memberships.
Issue 2
- In some deployments, deletion of multiple groups through the Access Management Connector is not successful if there are two or more pending exports. After you install the fix, the deletion of multiple groups through the Access Management Connector is successful.
Issue 3
- In some deployments, export of changes through the Access Management Connector to OU objects that specify a new parent OU do not take effect.
- After you install the fix: A Parent OU can be changed from root to any other OU through the Access Management Connector.
FIM Service and IdentityManagement Portal
Issue 1
- Some text that is displayed in the FIM Portal and added to email templates always uses the English language. For example, this issue occurs in the Display Name of Approval objects.
- After you install the fix: The string translation for objects that are created by the FIM Service in the FIM Service database is performed according to the FIM Service account locale that was in effect when the object was created. Note that this functionality is not affected by the client browser locale.
- To change the language that is used for string translation to a setting other than English, log on to each computer where the FIM Service is installed as the FIM Service account, and then set the locale for this account through Control Panel.
Issue 2
- Creating synchronization rules in the FIM IdentityManagement Portal fails to load connected system object types in the External System Resource Type drop-down list. This behavior may occur if the size of the connector instance definition (ma-data) is larger than the 14 MB default WCF message size limit in the ResourceManagementClient configuration. This size is configured by using the maxReceivedMessageSizeInBytes property of the ResourceManagementClient.
Before you apply this fix, maxReceivedMessageSizeInBytes values that are configured in the web.config for the IdentityManagement Portal are ignored in favor of the default setting. After you apply this fix, the maxReceivedMessageSizeInBytes setting is applied.
Note that this setting is case-sensitive.
For more information about this setting, go to the following Microsoft website: Registry keys and configuration file settings in FIM 2010 (http://technet.microsoft.com/en-us/library/ff800821(v=ws.10).aspx)
FIM Certificate Management
Issue 1
- Online certificate updates are failing because of a constraint violation.
Issue 2
- The FIM Certificate Management (CM) exit module does not honor the CT_FLAG_DONOTPERSISTINDB flag on a certificate. This may cause many certificates to be written to the FIM CM database. This, in turn, causes performance issues.
- After you install this fix, the FIM CM exit module honors the CT_FLAG_DONOTPERSISTINDB flag on certificates, and those certificates are not written to the FIM CM database.
FIM Clients (Portal, Outlook, Windows logon)
Issue 1
- After you install the FIM Windows logon extension, and then you (or a user) try to log on to the computer through a remote desktop, you must enter your credentials two times.
- After you apply the fix, remote desktop logons work as expected.
Synchronization Service
Issue 1
- The Synchronization Service crashes during an Export run profile run on a SQL Server management agent.
Issue 2
- When you run a Delta Import on the FIM Service management agent, the MIIServer.exe process terminates with a CLR_EXCEPTION_SYSTEM.APPDOMAINUNLOADEDEXCEPTION exception.
- After you install this fix, the race condition that triggers this exception no longer occurs.
Issue 3
- If a synchronization rule uses the NULL() function in an incoming attribute flow rule, returning NULL() is seen as a value instead of being blank, and attribute precedence does not continue to the next precedent incoming attribute flow. After you apply this fix, attribute flow precedence on incoming attribute flow rules that use the NULL() function works as expected.
Password Change Notification Service (PCNS)
Issue 1
- The following error message is logged:
-
6914 The connection from a password notification source failed because it is not a Domain Controller service account.
- After you install this fix, adding a backslash character to a domain name causes the function to return the domain controller Security Identifier (SID) instead of an empty user SID.
FULL Detail at: http://support2.microsoft.com/kb/3011057
Identity Underground 
You must be logged in to post a comment.