FIM portal, the setup needs to run under SharePoint Farm administrator

Well they got an error, it just turns out it is wrong, here is the answer.

Error message text:
To install FIM portal, the setup needs to run under SharePoint Farm administrator account with at least Open permission that allows users to open a Web site, list, or folder in order to access items inside that container. Please make sure you are a SharePoint Farm administrator with Open permission and then click “Retry”. Click “Cancel” to abort setup.
Despite what the message says, you configure the farm administrators group and it does not work. What it really needs is a Site Collection Administrator. The Site Collection Administrators is an individual user (ie not two and not a group)!

Go to, Central Admin (URL:34997), then click on Application Management, then click on Change Site Collection Administrators, change to the user.
 


Hattip: http://blog.msresource.net/2013/01/29/to-install-fim-portal-the-setup-needs-to-run-under-sharepoint-farm-administrator-account-with-at-least-open-permission-that-allows-users-to-open-a-web-site-list-or-folder-in-order-to-access-items-i/

A hotfix rollup (build 4.0.3594.2) is available for Forefront Identity Manager 2010 (FIM2010)

Original link: http://support.microsoft.com/?id=2520954

This hotfix rollup package replaces the following hotfix rollup packages:
2502631  2417774  2272389  2028634  978864 

Fixed issues in Workflow Engine

1. An error message: Cannot enlist in the transaction because a local transaction is in progress on the connection.
2. The time stamp is the same as the time when the operation fails.

Fixed issues in Sync Engine

1. Fixes an SQL query construction issue that occurs during an import. This issue affects a DB2 database that uses a non-Unicode character set.
2. Fixes many "Export not reimported" errors that might occur because of errors in SQL.
3. An ExpectedRulesEntry (ERE) object is associated to a child synchronisation rule of a Metaverse object. If the ERE object has a Remove action, deprovisioning of the object is also being triggered. which causes the deletion of the Metaverse object.
4. Fixes an access violation when a custom extension calls a COM+ object.
5. An earlier hotfix introduced a special Extensible Connectivity Management Agent (ECMA) mode to keep unconfirmed exports in escrow instead of awaiting confirmation. An issue with that hotfix causes delta sync to add new items that are not merged with an escrowed export into a pending export. After you install the hotfix that is mentioned in this article, if the ECMAAlwaysExportUnconfirmed registry entry is set to 1, the escrowed and pending changes are merged.
6. Improves the performance of all Sync Engine operations.
7. A password reset that uses the ADMAEnforcePasswordPolicy registry setting fails when the user is in the Administrator group but is not an administrator.

Fixed issues in Sets and Query

1. Fixes an issue that would sometimes cause incorrect Set calculations. This resulted in lots of set corrections. Also revised the Sets Correction job so that it does not change special sets that are maintained by another system maintenance job.
2. Revised the FIM "Query and Sets" features to treat underscores and precent signs as literals instead of as SQL wildcard characters.

Fixed issues in Certificate Management

1. Enables the random number generator in the server key generation function.
2. Improves the performance when enrolling a smartcard that has not previously been used with FIM Certificate Management (CM).

Fixed issues in FIM Management Agent (MA)

1. Fixes an issue in which the FIM synchronisation service configuration for synchronisation rules and codeless provisioning was not correctly written to the FIM Service database.

Fixed issues in FIM Service

1. Fixes an issue with SQL Server deadlocks that might occur during periods of high concurrency of requests or approvals.
2. Fixes an issue in which unexpected data in the FIM Service database could result in the FIM MA causing the Synchronisation service to fail during import, and a stopped-server error occurred.
3. Fixes an issue when you add or remove a value for a multivalued string attribute. If the request was subject to authorisation such as request reevaluation, the request would fail after approval.
4. Some ExpectedRuleEntry objects and DetectedRuleEntry objects in FIM 2010 can become "orphaned" over time. When a DetectedRuleEntry object is not referenced in the DetectedRulesList of any object in the system, that object is determined to be orphaned. Similarly, when an ExpectedRuleEntry object is not referenced in the ExpectedRulesList of any object in the system, that object is also determined to be orphaned.

You still need KB979214 if you turned on the AD trashcan: http://davestechnology.blogspot.com/2011/07/w2k8-r2-ad-recycle-bin-and-fim.html

Turned on the Active Directory trash can only to find out the FIM (Forefront Identity Manager) has not stoped synchronising some objects? Well fear not, they are in sync, but to the trash folder!

Below shows an object that is in sync, but to the delete item. There is a hotfix for it that installs on the DC. KB979214 is the patch.

W2K8 R2, AD Recycle bin and FIM

 

Turned on the Active Directory only to find out the FIM (Forefront Identity Manager) has not stoped synchronising some objects? Well fear not, they are in sync, but to the trash folder!

Below shows an object that is in sync, but to the delete item. There is a hotfix for it that installs on the DC. KB979214 is the patch.

Here is the KB article:

Consider the following scenario:

You enable the Active Directory Recycle Bin feature in a Windows Server 2008 R2-based domain.
You delete an object from Active Directory Domain Services (AD DS). For example, assume that you delete a user account.
You modify an object that has a relationship to the recently deleted object.
You perform an Active Directory directory synchronization (DirSync) control search to poll for the Active Directory changes in this domain.

In this scenario, the DirSync control search does not return the deactivated linked attributes from the modified object. Therefore, you cannot replicate these changes back to another database if you try to synchronize Active Directory Domain Services (AD DS) and another database.

For example, assume that you delete a user account that has the "testuser" name, and assume that this user account is a member of a group that has the "testgroup" name. Then, assume that you verify that the "testgroup" group does not include the "testuser" user account in the Active Directory Users and Computers window. In this scenario, a DirSync control search that polls for the Active Directory changes and for the request deactivated links cannot detect that the "testuser" account is joined to the "testgroup" group as an inactive member. Additionally, the "testgroup" group in another database does not include the user account "testuser" if you use the returned results from the DirSync control to synchronize Active Directory Domain Services (AD DS) and another database.

CAUSE
The Active Directory directory synchronization (DirSync) API functions do not identify the deactivated linked attributes correctly. This behavior causes the deactivated links not to be returned in the DirSync control search.

RESOLUTION
Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

For all supported x64-based versions of Windows Server 2008 R2
File name    File version    File size    Date    Time    Platform
Ntdsa.mof    Not applicable    227,765    10-Jun-2009    20:34    N/A
Ntdsai.dll    6.1.7600.20621    2,721,280    19-Jan-2010    10:29    x64