MPR configuration for FIM Portal Access

Using Power Shell to check your MPR configuration for FIM Portal Access

http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/73954797-afb4-4448-8c3e-af5b4f9e2eb5

FIM Portal

Create a Search Scope for Groups in FIM portal.

How to display the new attribute in FIM Portal from the serch within tab. The steps are below to show the All Groups attribute in the seach within tab in FIM portal.

Click Administrator --> Click Search Scope-->Click New

On the General pages,type
Display Name: All Groups
Description:All Groups
Usage Keyword(on Separate lines):
BasicUI
Global
GlobalSearchResult
Group

Order: 94

Click Next

On the search definition page,type:
Attribute Searched: DisplayName
Filter: /Group
Click Next

On the result tab, from the resource type drop-down list, select Group, and then in Attribute ,type DisplayName,Email
Click Finish and submit.

Perform an IISRESET.
Browse the FIM Home pages.

Groups Errors in FIM.

From user side if they create group in FIM and are not provision in AD, then there is no indication that group creation was successful unless the user does not get the feeling that group is not working at all or some one from IT get into it to investigate.

As I have experienced a user created group with scope universal and domain local group as member, the group failed to sync and if the user want to delete the group in FIM, it errors out ObjectSIDString is either null and empty, cannot delete the group at this time.

To delete the group I have to go advanced view of the group in FIM, locate the field for “ObjectSIDString Group binding”, and type any number in it (for example 1234).Click OK and submit the change.

The group got deleted at last.

Fine-Grained Password Policies

In Day to Day life at my work  if there is a  need to extend the password of the system accounts I enrolled the system account to the security group in AD or in FIM and the requestor will need to  re set the password of the accounts.

I grab information on FGPP's and present in details way what it is and how it works..............

Active Directory domain could only have one password and account lockout policy per domain for domain accounts.
FGPP's allowed organizations to specify multiple password policies within a single domain. You can use fine-grained password policies to apply different restrictions for password and account lockout policies to different sets of groups and users in a domain.

To know more about how it works refer to

http://blogs.technet.com/b/seanearp/archive/2007/10/06/windows-server-2008-fine-grained-password-policy-walkthrough.aspx

Windows Server 2008 R2 - Recycle Bin feature is an irreversible action.

Active Directory Recycle Bin provides a very quick way to recover Active Directory objects that have been deleted without needing to reboot a domain controller, perform authoritative restore operations, and wait for replication. Once enabled, any object can be quickly restored using a simple PowerShell command

Error - NoSuchManagementAgentException Error

There are a few gaps in TechNet and it can be confusing switching from one article to other, so I have collate it here in my Blog...Hope it will make sense.

In My lab I have use the Notepad as my HRdatabase,to project the user in metaverse and finally provisioning in FIM portal. 

Create the data file.
Copy the records from the following data and then paste them into a new Notepad file

EmployeeID:1
FirstName:Anirban
LastName:Singha
UserID:ansi
EmployeeType:Full Time Employee

EmployeeID:2
FirstName:Anil
LastName:Panem
UserID:Anilkp
EmployeeType:Full Time Employee

Save the Notepad file on your local drive as C:\HRData.txt


For creation of Notepad MA,FIM MA and Inbound Sync Rule please refer to - http://technet.microsoft.com/en-us/library/ee534902(WS.10).aspx

Challenges – when I run the Sync of FIM MA and Notepad MA receiveing the below error.

Use the PowerShell to enable provisioning you can do this by running the script, Using Windows PowerShell to Enable Provisioning (http://go.microsoft.com/fwlink/?LinkId=189660).

Make sure your Notepad MA have precedence over the FIM MA.  

Overview -

Groups not provisioning in Active Directory.

 

I have seen user coming back and say I have created group and my group is still not working L and it relay feels pain to go back and say you have to delete the group and re create the group.

FIM 2010 and R2 never checks the existing display name of the group, it goes fine with the alias.so what cause the group falling with the same display name ?

I have done some TS into it and find the group fails to provision in AD and if you do the metaverse search of the group you will find group with already existing display name.

Now again I am coming back to my question? Why the group are failing.

Each object in AD has a GUID assigned to it, but since the GUIDs are hard to remember, we generally use DNs

Every object in AD have a specific location and stored uniquely in AD and store the data as CN=DisplayName,OU=XXXXX,DC=COM.

If group with the same display name created it conflict with the already existing DN in AD and Synchronization Rule in FIM not allow the groups to get provision in AD. J