What groups are used in my Microsoft Identity Manager installation

I came across a question today what the actual group names are used in a MIM installation. For a production system that should never be a question but in test labs with one AD and multiple "flying" setups, it can understand that it come sometimes to confusion. So thought it can be helpful to others to show how to find that out.

At first, I was looking into the registry under the FIMsync service but there was nothing to find there.
So I check in the sync database and voila I found the SIDs in the FIMsynchronization database in table [mms_server_configuration]. I copied the value from administrators_sid and pasted it into ldp.exe to run the translation to a human-readable group name. But bummer. The sid format looked already a little bit strange and ldp.exe could not use it as well.

0x010500000000000515000000D1D64379336F47EB77D1D6B32D760C00

I know ldp.exe can use a SID in the format S-1-5-...and so I googled it and found on http://poshcode.org/3181a script to convert the hex sid into the format ldp.exe (and I) like.

S-1-5-21-2034489041-3947327283-3017199991-816685

So now I know the group name is TESTLAB\LAB4711-MIMSyncAdmins ;-)

Microsoft Ignite - Identity Manager

Reviewing this week being at the Ignite conference I can say I was there because of the presentations Mark Wahl (http://goo.gl/yY0unq) has given about Identity Management. Here the highlights:

- Microsoft Identity Manager 2016 is still coming mid-year 2015 (actually the technical preview from April is saying 2015, but all new server apps are 2016 versions)
- Privileged Access Management (PAM, don't be confused with the Unix PAM - Pluggable Authentication Module) is integrated
- MS will not provide management agents for MIM for all SaaS applications as they provide that as functionality in Azure AD
- Cloud password reset will be supported only through the new Azure AD connect tool (you can think about it as Dirsync with more features) not through the FIM or MIM Azure AD management agent
- MIM certificate management works completed without ActiveX controls. The new Internet Edge web browser in Windows 10 - aka Spartan web browser - will cut the support for ActiveX controls anyway
- time-limited groups managed by MIM
- in-place upgrade from FIM 2010 to MIM 2016 is supported (no major changes e.g. no API changes)



Your are welcome to see the presentations on Channel9:

http://ignite.microsoft.com/session/sessionmoreinfo/?topicid=518ea07c-58a2-e411-b87f-00155d5066d7

http://ignite.microsoft.com/session/sessionmoreinfo/?topicid=f859bbd9-8ab0-e411-b87f-00155d5066d7

AD finduser project

Hi there.
I was just working on a project where we had to find user information by searching for SMTP address, or username, or GUID.
So instead of adding a paramter for everything I thought the script can find out itself if I have provided an SMTP address or an GUID. And if you work with Office 365/Azure AD you might have already received notifications about certain user accounts from MS and they provide the GUID, or here called Immutable, in a different format.

So the outcome of my thinking and lazyeness providing parameters all the time can now be found on CodePlex (https://adfinduser.codeplex.com/).

Examples:
finduser.ps1 userA
finduser.ps1 user.A@domain.com
finduser.ps1 5Gz/Z7McHEWGzHdUTs5Kuw==
finduser.ps1 67ff6ce4-1cb3-451c-86cc-77544ece4abb
finduser.ps1 "{67ff6ce4-1cb3-451c-86cc-77544ece4abb}"

The script can work with remote Active Directories as well as with AD LDS servers, just see the 2 lines you have to activate or to deactivate.

Feel free to use it and to adapt. You can also add some more error handling if you like.

MIM with new feature: SSAU

Microsoft Identity Manager is not released yet but in CTP2 a new feature is added to mitigate the problem that after a user is changing his/her password there are these days plenty of devices and RDP sessions still using the old password and the user account is locked within a few minutes.
Until now the user had to call the helpdesk fur account unlocking or wait the grace period for automated unlock.
With MIM a self-service account unlock feature is added to the password reset page. So a user can unlock his/her account and keep the existing password. E.g. then he/she can log in to the RDP session and close it or update the password on the smartphone.
SSAU can be integrated with Azure Multi-Factor-Authentication (MFA, previously PhoneFactor)

See also: http://blogs.technet.com/b/ad/archive/2015/03/03/microsoft-identity-manager-public-preview-2-is-available.aspx

Welcome MIM

Welcome Microsoft Identity Manager!

after MMS, MIIS, CLM, ILM and FIM we got a new acronym: MIM - Microsoft Identity Manager.

http://blogs.technet.com/b/server-cloud/archive/2014/04/23/forefront-identity-manager-vnext-roadmap-now-microsoft-identity-manager.aspx

Perhaps because I never understood why it was called Forefront .. Microsoft thought simpler is better.
So then the only question is why FIM did become MIM and not CIM - Cloud Identity Manager. Perhaps one day we all have just one ID in the cloud and there is no need for  identity management anymore. Nice dream.

.