Jorge's Quest For Knowledge!

All About Identity And Security On-Premises And In The Cloud – It's Just Like An Addiction, The More You Have, The More You Want To Have!

Archive for the ‘Microsoft Identity Manager (MIM)’ Category

(2016-12-23) New Password Change Notification Service (PCNS) Package Has Been Released

Posted by Jorge on 2016-12-23


If you have installed the MIM 2016 version with SP1 integrated, you will have PCNS version 4.4.1237.0 on your writable DCs if you are using PCNS at all

image

Figure 1: PCNS Version/Build 4.41237.0 Installed On A Writable DC

However as soon as you try to start the “Password Change Notification Service” service, it stops immediately. When you look in the Application event log, you will see:

image

Figure 2: PCNS Error About An Untrusted Root Certificate That Is Part Of A Certificate Chain Used To Sign The Binaries

The Password Change Notification service executable "C:\Program Files\Microsoft Password Change Notification\pcnssvc.exe" failed while verifying the file signature. The service will not be started and password notifications will not be sent.
pcnsfltapi.cpp (525): A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

To solve this issue, Microsoft has released a new version of the PCNS package, which can be downloaded from here.

Funny enough the new PCNS package carries the same version/build as MIM 2016 after applying the SP1 update package, but it does not mention MIM 2016 (with SP1) in the release notes. It does also not state it can run on Windows Server 2016 writable DCs.

Well I did install it on a Windows Server 2016 writable DC and it actually works also works with MIM 2016 SP1! Smile

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Microsoft Identity Manager (MIM), PCNS | Leave a Comment »

(2016-11-27) Issues With Popup Screens In IE On The MIM Portal Server After Installing/Applying SP1

Posted by Jorge on 2016-11-27


After installing MIM 2016 with SP1 or applying the SP1 update package you may experience issues with popup windows in the MIM Portal. An example is when you for example get a popup window because you click on an MPR object.

-hen doing this remotely on another server, other than the server with the MIM Portal, you may experience the following, which is expected when using any browser.50

image

Figure 1: MIM Portal On A Remote Server With A Working Popup Window

However, doing exactly the same on the server running the MIM Portal, you may experience the following when using IE, which is NOT expected! It keeps loading, and loading, and loading….

image

Figure 2: MIM Portal On The MIM Portal Server With A Non-Working Popup Window

The solution for this problem is quite easy!

On the MIM Portal server, open Internet Explorer and then open its internet options. On the “General” tab click the “Settings” button. Then click the “View Files” button.

image

Figure 3: MIM Portal On The MIM Portal Server With A Non-Working Popup Window

After clicking the “View Files” button, a Windows Explorer window opens. Click in the files section somewhere, press {CTRL]+[A] and then press [DEL]. Close all the windows by either closing them or clicking [OK].

After doing this, popup windows with IE on the MIM Portal server should work OK again as expected!

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Microsoft Identity Manager (MIM), Portal, Updates | Leave a Comment »

(2016-11-23) Microsoft Identity Manager (MIM) 2016 Service Pack 1 Packages

Posted by Jorge on 2016-11-23


Somewhere in September Microsoft released SP1 for MIM  2016 as you can read here. The first package was MIM 2016 with SP1 already included. If you wanted to install SP1 on your current deployment you had to uninstall first and reinstall with MIM 2016 with SP1 included where you would reuse all DBs. This procedure is described here. However, for some customers uninstalling everything and reinstalling it is a little bit too much. The impact and downtime is not acceptable. Because of that Microsoft has also released a SP1 update package that can be deployed on existing MIM 2016 deployments.

There is a subtle different of which you must be aware:

  • MIM 2016 with SP1: build 4.4.1237.0
  • SP1 update package: 4.4.1302.0

As you can see the builds are different! Please be aware you cannot apply the SP1 update package to a deployment already running MIM 2016 with SP1. You can only apply it when running MIM 2016 RTM.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM), Updates, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2016-09-26) Upgrading To MIM 2016 SP1

Posted by Jorge on 2016-09-26


Microsoft has released Microsoft Identity Manager (MIM) 2016 Service Pack 1 (build 4.4.1237.0).

You are running FIM 2010 (R2) or MIM 2016 and you want to upgrade to MIM 2016 SP1? Then read all about it here!

First check if you can simply upgrade to the newer version. If you cannot upgrade, you will see the message as displayed in figure 1. If you see that message you will have to uninstall the current version before installing the newer version. However, before uninstalling create a backup using the scripts mentioned in this blog post to create a backup FIRST!!!!

After having created the backup, you can uninstall all components one by one and reinstall the new version. For the required values use the values in the backups/exports if you do not know them anymore.

image

Figure 1: Message To Uninstall The Current Version First

Upgrading to MIM PCNS

This must be executed on a per writable DC basis!

First uninstall PCNS through Programs and Features

Then install PCNS by executing the MSI (attend) or using the command line with all the options defined (unattended)

Upgrading to MIM SYNC

This must be executed on a per FIM/MIM Sync Server basis!

First uninstall MIM Sync through Programs and Features

Then install MIM Sync by executing the MSI (attend) or using the command line with all the options defined (unattended)

image

Figure 2: Welcome Screen

image

Figure 3: License Agreement

image

Figure 4: Component Selection

image

Figure 5: Specifying SQL Server And SQL Instance

image

Figure 6: Specifying FIM/MIM Sync Service Account Credentials

image

Figure 7: Specifying FIM/MIM Sync Service Security Groups

image

Figure 8: Enabling Firewall Rules For RPC Connections

image

Figure 9: Last Screen Before The Actual Installation

image

Figure 10: Message About Finding The Existing Database And The It Will Be Upgraded

image

Figure 11: Installation Completed

image

Figure 12: The Build Of The FIM/MIM Sync Service

Now after installing the product:

  • Check and compare the config files and reconfigure as needed;
  • Check and compare the registry settings and reconfigure as needed;
  • Recompile any code you have (e.g. Rules Extensions) to use it in the new version;

Upgrading to MIM Service And Portal

REMARK: In my case as you can see below I had the MIM Service, the MIM Portal, the MIM Password Registration Portal and the MIM Password Reset Portal on one server running. If you have distributed the components amongst multiple servers, use the following order:

  • MIM Service
  • MIM Portal
  • MIM Password Registration Portal
  • MIM Password Reset Portal

This must be executed on a per FIM/MIM Server basis that hosts a specific component!

First uninstall MIM Service and Portal through Programs and Features

Then install MIM Service and Portal by executing the MSI (attend) or using the command line with all the options defined (unattended)

image

Figure 13: Welcome Screen

image

Figure 14: License Agreement

image

Figure 15: Joining CEIP

image

Figure 16: Component Selection

image

Figure 17: Specifying The SQL Server, The Database Name And Whether Or Not You Want To Reuse The Database

image

Figure 18: Warning About creating A Backup Before Continuing With The Upgrade

image

Figure 18: Specifying The Mail Server And Other Related Settings

REMARK: Have you noticed the option “Use Exchange Online”? As soon as you check that all the other options are greyed out.

image

Figure 19: Configuring The Service Certificate

image

Figure 20: Configuring The FIM/MIM Service Service Account Credentials And Mail Address

image

Figure 21: Specifying The FIM/MIM Sync Server And The Account For The FIM/MIM MA

image

Figure 22: Warning About Not Being Able To Contact The FIM/MIM Sync Service

image

Figure 23: Specifying The FIM/MIM Service FQDN

image

Figure 24: Specifying The Sharepoint Collection URL To Install The Portal In

image

Figure 25: Specifying The Password Registration Portal URL

image

Figure 26: Enabling Firewall Rules And Configuring Permissions

image

Figure 27: Specifying The Credentials, The Hostname And The Port For The Password Registration Portal

image

Figure 28: Warning About Not Using SSL Due To Custom Port

REMARK: SSL will be configured afterwards

image

Figure 29: Specifying The FIM/MIM Service FQDN And The Accessibility Of The Password Registration Portal

image

Figure 30: Specifying The Credentials, The Hostname And The Port For The Password Registration Portal

image

Figure 31: Warning About Not Using SSL Due To Custom Port

REMARK: SSL will be configured afterwards

image

Figure 32: Specifying The FIM/MIM Service FQDN And The Accessibility Of The Password Reset Portal

image

Figure 33: Last Screen Before The Actual Installation

image

Figure 34: Installation Completed

Now after installing the product:

  • Check and compare the IIS configuration and reconfigure as needed;
  • Check and compare the config files and reconfigure as needed;
  • Check our customizations for the Password Registration and Reset Portal still exist;
  • Check and compare the registry settings and reconfigure as needed;
  • Recompile any code you have (e.g. Rules Extensions) to use it in the new version;

Upgrading to MIM Add-In Extensions

This must be executed on every client running the FIM/MIM Add-In Extensions!

First uninstall MIM Add-In Extensions through Programs and Features

Then install MIM Add-In Extensions by executing the MSI (attend) or using the command line with all the options defined (unattended)

image

Figure 35: Welcome Screen

image

Figure 36: License Agreement

image

Figure 37: Joining CEIP

image

Figure 38: Component Selection

image

Figure 39: Specifying The MIM Portal Server Address And The MIM Service E-mail Address

REMARK: The MIM Portal Server Address should be entered as <FQDN> or <FQDN>:<PORT> when in the last case the port is a custom port. The screenshot shows the MIM Portal URL but that is not correct

image

Figure 40: Specifying The FIM/MIM Service FQDN

image

Figure 41: Specifying The Password Registration URL

image

Figure 42: Last Screen Before The Actual Installation

image

Figure 43: Installation Completed

Now after installing the product:

  • Check and compare the registry settings and reconfigure as needed;

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Microsoft Identity Manager (MIM) | 1 Comment »

(2016-09-26) Microsoft Identity Manager (MIM) 2016 Service Pack 1 Has Been Released

Posted by Jorge on 2016-09-26


Microsoft has released Microsoft Identity Manager (MIM) 2016 Service Pack 1 (build 4.4.1237.0)!

What does it bring you?

  • In addition to Internet Explorer, it now also supports Edge, Chrome, FireFox, and Safari;
  • The MIM service now supports a mailbox in Exchange Online for approvals and notifications;
  • Image file format validation on upload;
  • PowerShell deployment scripts for Privileged Access Management (PAM) infrastructure components;
  • Privileged Access Management (PAM) Just-In-Time (JIT) administration also works for the privileged AD forest in addition to the corporate AD forest;
  • MIM now also supports Windows Server 2016 and SQL Server 2016 (Supported platforms for MIM 2016);
  • PAM deployment automatically uses PowerShell to create and configure Authentication Policies and Authentication Policy Silos to harden security;
  • … and a few fixes

Read more about it:

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Microsoft Identity Manager (MIM), Updates | 1 Comment »

(2016-09-25) FIM/MIM Configuration Export Scripts

Posted by Jorge on 2016-09-25


When upgrading FIM or MIM to a newer version, you may need to uninstall the previous version first before installing the newer version. During the installation of the new version you need to reenter all the required information. But where do you get that data from? Either you have some installation/configuration guide or you make sure you make a copy (copy, export, backup) of the previous configuration so that you can look it up easily.

Making a copy of the previous configuration manually can take quite some time to finish and if unlucky you might even forget something!

Yes, you guessed it, PowerShell to the rescue! Smile

With the upcoming SP1 for MIM 2016 you may need this script.

Please provide feedback through the comments section OR you the contact page

DISCLAIMER (READ THIS!):

  • I wrote this script, therefore I own it. Anyone asking money for it, should NOT be doing that and is basically ripping you off!
  • The script is freeware, you are free to use it and distribute it, but always refer to this website (https://jorgequestforknowledge.wordpress.com/) as the location where you got it.
  • This script is furnished "AS IS". No warranty is expressed or implied!
  • I have NOT tested it in every scenario nor have I tested it against every Windows and/or AD version and/or FIM/MIM version and/or SQL version
  • Always test first in lab environment to see if it meets your needs!
  • Use this script at your own risk!
  • I do not warrant this script to be fit for any purpose, use or environment!
  • I have tried to check everything that needed to be checked, but I do not guarantee the script does not have bugs!
  • I do not guarantee the script will not damage or destroy your system(s), environment or whatever!
  • I do not accept liability in any way if you screw up, use the script wrong or in any other way where damage is caused to your environment/systems!
  • If you do not accept these terms do not use the script in any way and delete it immediately!

SYNTAX:

<PoSH Script File> [-allConfig] [-mainConfig] [-fimSyncConfig] [-fimSvcConfig] [-fimPortalConfig] [-fimPwdRegPortalConfig] [-fimPwdResetPortalConfig] [-backupDBs] [-mainBackupFolder <Folder To Backup/Export To>]

This PoSH script exports FIM/MIM configuration as a quick backup method. If applicabel, the following configuration components are exported:

  • FIM/MIM Main Configuration;
  • FIM/MIM Sync Configuration;
  • FIM/MIM Service Configuration;
  • FIM/MIM Portal Configuration;
  • FIM/MIM Registration Portal Configuration;
  • FIM/MIM Reset Portal Configuration;
  • SQL Server Database

I have NOT added support for:

  • FIM/MIM PCNS Configuration;
  • FIM/MIM CM Configuration;
  • FIM/MIM Reporting Configuration

Currently there is no import script. You will have to do it manually

Get the export script from HERE

When upgrading, you only need to the [-mainConfig option on every FIM server and the [-backupDBs] option on the SQL server! For example:

  • Everything on one server (incl. SQL server)? –> <PoSH Script File> -mainConfig -backupDBs -mainBackupFolder <Folder To Backup/Export To>
  • FIM/MIM servers without SQL –> <PoSH Script File> -mainConfig -mainBackupFolder <Folder To Backup/Export To>
  • SQL server without FIM/SQL –> <PoSH Script File> –backupDBs -mainBackupFolder <Folder To Backup/Export To>

REMARK: the installation of a newer version against an existing database WILL upgrade the database. Make sure to have a backup of your FIM/MIM DBs!!!

PARAMETER allConfig

Exports All The Configuration Of FIM/MIM. This is basically all the options combined.

PARAMETER mainConfig

Exports Only The Main Configuration Of FIM/MIM. This should be the option to use when upgrading FIM/MIM.

PARAMETER fimSyncConfig

Exports Only The FIM Sync Specific Configuration

PARAMETER fimSvcConfig

Exports Only The FIM Service Specific Configuration

WARNING: This export might take some considerabel amount of time!!!

PARAMETER fimPortalConfig

Exports Only The FIM Portal Specific Configuration

PARAMETER fimPwdRegPortalConfig

Exports Only The FIM Password Registration Portal Specific Configuration

PARAMETER fimPwdResetPortalConfig

Exports Only The FIM Password Reset Portal Specific Configuration

PARAMETER backupDBs

Backup Only The Databases In Use By FIM

PARAMETER mainBackupFolder

Main Backup Folder To Store The Backup

image

Figure 1: Exporting The FIM/MIM Configuration Before The Upgrade

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Backup/Export, Backup/Export, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM) | 1 Comment »

(2015-08-05) MIM 2016 Has Hit The Market Shelves And Is Now Available

Posted by Jorge on 2015-08-05


Microsoft has released the successor of Forefront Identity Manager 2010 R2 (FIM 2010 R2), Microsoft Identity Manager 2016 (MIM 2016).

MIM 2016 offers the same capabilities as FIM 2010 R2, with in addition:

  • Strong focus on hybrid identity (on premises and in the cloud)
  • Support for hybrid reporting from MIM included in Azure AD reports
  • In addition to Self-Service Password Reset, Self-Service Account Unlock is also supported
  • The Self Service Password Reset portal supports Azure multi-factor authentication (MFA) in the authentication gate
  • Privileged Identity Management controls and manages administrative access by providing temporary, task-based access to sensitive resources eliminating the carte blanche administrative access coveted by cyber attackers. In addition, Privileged Identity Management extracts and isolates administrative accounts from existing Active Directory forests.
  • Support in Certificate Management for REST API access
  • Certificate Management has support for multi-forest topologies, a Windows store app for virtual smartcard and certificate lifecycle management, updated events and troubleshooting capabilities
  • Support for:
    • Windows 8.1 with Internet Explorer 8 and higher
    • Windows Server 2012 R2
    • SQL 2014
    • Outlook 2013
    • System Center Service Manager 2012 and 2012 R2
  • The deprecated features are still deprecated, but are still available in MIM 2016 as mentioned by David Lundell

More information:

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Microsoft Identity Manager (MIM) | 1 Comment »

 
%d bloggers like this: