• For smartcard profiles, CM client uses CryptoAPI which doesn’t support elliptic curves.
• For software profiles, JavaScript client side code uses RSA only.

• Configuration Manager: https://blogs.technet.com/configurationmgr/
• Data Protection Manager: https://blogs.technet.com/dpm/
• Orchestrator: https://blogs.technet.com/b/orchestrator/
• Operations Manager: https://blogs.technet.com/momteam/
• Operations Management Suite: https://blogs.technet.microsoft.com/omsblog/
• Service Manager: https://blogs.technet.com/b/servicemanager
• Virtual Machine Manager: https://blogs.technet.com/scvmm
• Microsoft Intune: https://blogs.technet.microsoft.com/intunesupport/
• WSUS: https://blogs.technet.com/sus/
• AD and Azure RMS: https://blogs.technet.com/b/rms/
• Application Virtualization: https://blogs.technet.com/appv/
• MED-V: https://blogs.technet.com/medv/
• Application Proxy: https://blogs.technet.com/b/applicationproxyblog/
• Forefront Endpoint Protection: https://blogs.technet.com/b/clientsecurity/
• Forefront Identity Manager: https://blogs.msdn.com/b/ms-identity-support/
• Forefront TMG: https://blogs.technet.com/b/isablog/
• Forefront UAG: https://blogs.technet.com/b/edgeaccessblog/

In this illustration I will utilize the following:

1. Create the Management Agent Rules Extension
2. Update Source Active Directory Management Agent
3. Update Target Active Directory Management Agent
4. Visual Studio Solution – Add the code
5. Visual Studio Solution – Build the Solution
6. Visual Studio Solution – Copy the DLL
7. Additional Information

Create Management Agent Rules Extension

1. Open the Synchronization Service Manager Console and select Management Agents
2. From the Actions menu select Create Extension Projects > Rules Extension 
3. Create Extension Project Window
   1. Programming Language: Visual Basic or Visual C#
   2. Visual Studio Version: Choose your version of Visual Studio
   3. Project Name: Name of your Management Agent Extension (For this illustration I am going to use the default RulesExtension)
   4. Project Location: where do you want to store the source code for this Rules Extension
   5. Launch in VS.NET IDE: Default is checked.  Recommend to uncheck and open manually in Visual Studio
4. Once complete, click ok

Update Source Active Directory Management Agent

1. Open the Synchronization Service Manager Console and select Management Agents
2. Select the Source Active Directory Management Agent
3. From the Actions menu, select Properties and go to Configure Attribute Flow
4. proxyAddresses attribute flow
   1. Mapping Type: Rules Extension

b. Flow Direction: Import Attribute Flow

5. Click Ok to go back to the Management Agent Properties Window

6. Select Configure Extensions and update the Rules Extension Name with the name of your DLL (The name of your project “.DLL”)

7. Once updated, click Ok until you are back at the Synchronization Service Manager Console

Update Target Active Directory Management Agent

1. Open the Synchronization Service Manager Console and select Management Agents
2. Select the Target Active Directory Management Agent
3. From the Actions menu, select Properties and go to Configure Attribute Flow
4. proxyAddresses attribute flow
   1. Mapping Type: Direct
   2. Flow Direction: Export Attribute Flow
5. Once updated, click Ok until you are back at the Synchronization Service Manager Console

Rules Extension – Visual Studio Solution

1. Open the Microsoft Visual Studio Solution by navigating where you saved the solution and double click on the SLN file.  (SLN file = Visual Studio Solution File) 
2. Locate the function void IMASynchronization.MapAttributesForImport.
   1. We are using MapAttributesForImport so that the new values for the proxyAddresses attribute will be in the Metaverse Object.  Below you will find an example of the code utilized to review the proxyAddresses and change the primary SMTP based on mail suffix.

Rules Extension – Build Visual Studio Solution

1. From the Project Menu select RulesExtension Properties ( this would be the name of your rules extension project )

2. Select Build and then click Browse beside Output Path

3. By default, this will take you to the Extensions folder.  Here, create a new folder called New Rules Extension.

4. Double click on the new folder and then click the Select Folder button in the lower right

5. From the Build menu select Build Solution

Rules Extension – Copy the DLL to the Extensions Folder

• Navigate to the %programfiles%\Microsoft Forefront Identity Manager\2010\Synchronization Service\Extensions folder
• Create a new folder called Rules Extension Backup
  1. It is always important to back up your existing rules extension.  If you were to have a problem with a new DLL then you will be able to rollback fairly easily.
  2. Copy the Existing DLL, if you have one, to the Rules Extension Backup folder
  3. Copy the New DLL from the New Rules Extension Folder that you created in the previous section to the Extensions folder.
  4. Now you are ready to test

Additional Information / Resources

•  How to create a Management Agent Rules Extension: https://msdn.microsoft.com/en-us/library/windows/desktop/ms695365%28v=vs.100%29.aspx

• Microsoft Identity Manager Synchronization Service 2016
• Forefront Identity Manager Synchronization Service 2010

PROBLEM SCENARIO DESCRIPTION

You attempt to run the MIISACTIVATE.EXE command-line to activate a new FIM Synchronization Service Server.  In doing so, you receive the below error message.

ERROR MESSAGE

The operation encountered am error and cannot be completed.

Error: Logon failure: the user has not been granted the requested logon type at this computer

Error Code 569

CAUSE

The Synchronization Service Account is in the Local Security Policy > Local Policies > User Rights Assignment > Deny log on as a service.

RESOLUTION

1. Remove the FIM Synchronization Service Account from the Local Security Policy
2. Execute the MIISACTIVATE.EXE command-line
3. After success add the FIM Synchronization Service Account back to the Local Security Policy

LOCAL SECURITY POLICY

• Local Security Policy > Local Policies > User Rights Assignment > Deny log on as a service

ADDITIONAL INFORMATION

• MIISActivate: Server Activation Tool: https://technet.microsoft.com/en-us/library/jj590194(v=ws.10).aspx