Wanted to say thank you for all the support and feedback

Today I am glad to announce March Hotfix release for Microsoft Identity Manager 2016 SP1

Some Major Enhancements to Include : SQL 2016 Always On Availability Groups and System Center Service Manager 2016 Reporting supportability

• Updated Supported Platforms: https://aka.ms/mim2016platformsupport

• KB Information can be found here

• Generic Connector Information here

• Official Support Blog here, We will be posting more information on Enhancements shortly
  

Summary of Items:

Platform Support baseline
------------------------------
Windows Server 2016 including ADCS
SQL Server 2016 including SQL Always On
Exchange Server 2016

MIM2016SP1 - All Up
-----------------------------
31 Bug Fixes
10 Enhancements

Generic Connectors All Up
----------------------
15 Bug Fixes
2 Enhancements

If you encounter issues downloading please try again in 12-24 hours as it is hot off the press and still propagating through the regions

Thank you

Enabling multiple user certificates on one Smart Card

Scenario: Create an automated way of adding two certificates to the same card each representing a different account.

Solution: provides the capability to put two or more certificates, each associated with a different account, on one card.

• The additional certificates are not limited to accounts solely owned by the smart card owner (i.e. a group account).
• Each additional certificate, when presented for selection, can have obviously distinct names.
• There is no need to limit the number of certificates to two.

Before continuing it is recommended to read about the custom policy modules and OID at:
https://technet.microsoft.com/en-us/library/gg418616(v=ws.10).aspx
https://technet.microsoft.com/en-us/library/cc708677(v=ws.10).aspx 
https://msdn.microsoft.com/en-us/library/windows/desktop/aa379070(v=vs.85).aspx

Here is the scenario we have a user called dsteadman and also a admin account called dsteadman_admin. We want to enroll in a smart card for both the user and his admin account to the same smart card. To do this we will link them using the extensionAttribute1, We also populated extensionAttribute2 with the username of the admin account

Thank you and credit for this collaboration to:

• Steve Light
• Jay Hoffmeier
  

Steps involved:

• Certificate Template changes:
  • Create one or more additional Smart Card Certificate Templates
    • These additional templates will be based on copies of the existing Certificate template
    • There will be one new certificate template required for each additional certificate to be issued
  • Enable deployment of these new templates by the same CA as the original
  • Create two new Custom Policy Modules on the CA for each of the new templates
    • The first will modify the certificate to associate it with a different AD account
    • The second will modify the certificate to have a unique display name
• CLM Changes
  • Create a new profile template which issues certificates from both (or more) smart card certificate templates
  • Add a data collection element at request time to allow the requestor to enter the AD account name for any additional certificates.
    

·

Procedure: (to be repeated for each additional certificate needed on a card)

• Create the duplicate Smart card Certificate Templates (performed on the issuing CA)
  • From the Administrative Tools menu, open Certification Authority.
  • In the Certification Authority window, expand the CA and right-click on Certificate Templates and select Manage.
  • In the certtmpl window, right-click on the certificate template currently used for Smartcard logon (ex: Smartcard Logon) and select Duplicate Template.

·

• In the Properties of New Template window, in the General tab, provide a new Template Display Name (ex: Smartcard Logon Certificate 2).
• Click OK to close the properties window.
• Close the certtmpl window.
• Enable issuance of this new certificate template
  • At the Certification Authority window, right click on Certificate Templates, and select New -> Certificate Template to Issue.
  • In the Enable Certificate Templates window, select the newly created certificate template (ex: Smartcard Logon Certificate 2), and click OK.
  • Close the Certification Authority Window
• Add the custom policy modules
• Subject Alternate Name module
  • From the Administrative Tools menu, open Certification Authority.
  • In the Certification Authority window, right click on Smartcard Issuing CA 1 and select Properties.
  • Click on the Policy Module tab.

·

• Click Properties to edit the Certificate Lifecycle Manager Policy module.
• On the Custom Modules tab, click Add

• Browse to the CA folder where Certificate Lifecycle Manager is installed (default location of c:\program files\microsoft certificate lifecycle manager\ca) and select Microsoft.Clm.PolicyModulePlugins.dll
  

• In the Clm Policy Module window, select SubjectAltName Module 1.1

·

• Assign a name to the custom module (ex: Smartcard Logon Certificate 2 Account Name) and click OK.

·

• Back on the Custom Modules tab, select the new custom module and click Properties.

·

• On the Custom Module Properties window, select the certificate template previously created (duplicated) that will be used for the second certificate (ex: SmartcardLogonCertificate2).

·

• On the Custom Module Properties window, select Configure…

·

• On the Certificate SubjectAltName Configuration window, click Add...
• On the SubjectAltName Name Entry window, under Type, select OtherName and enter the following OID: 1.3.6.1.4.1.311.20.2.3
• On the SubjectAltName Name Entry window, under Value, select UTF8String and enter {User!extensionAttribute1}. This will build the full SubjectAltName from information entered into active directory user attribute extensionAttribute1.
• Note: you can use attribute used on enrollment with data collection by defining it as {Clm!datacollectionitem}
• Check the option Do not include this name entry if the value is empty or not available.
• Click OK to close the SubjectAltName Name Entry window.
• Click OK to close the Certificate SubjectAltName Configuration window.
• Click OK to close the Custom Module Properties window.

• Certificate Subject Name module
  • On the Custom Modules tab, click Add
  • Browse to the CA folder where Certificate Lifecycle Manager is installed (default location of (c:\program files\microsoft certificate lifecycle manager\ca) and select Microsoft.Clm.PolicyModulePlugins.dll
  • In the Clm Policy Module window, select Certificate Subject Module 1.0

·

• Assign a name to the custom module (ex: Smartcard Logon Certificate 2 Display Name) and click OK.
  

• Back on the Custom Modules tab, select the new custom module and click Properties.
• On the Custom Module Properties window, select the certificate template previously created (duplicated) that will be used for the second certificate (ex: SmartcardLogonCertificate2). Note: This is optional and only SAN is required

• On the Custom Module Properties window, select Configure...
• For the Certificate Subject Name Template enter CN={User!extensionAttribute2}

·

• Click OK to close the Certificate Subject Name Configuration window.
• Click OK to close the Custom Module Properties window.
• Click OK to close the Configuration Properties window.
• Click OK to close the CA Properties Window. The CA will need to be restarted for the new changes to take effect.

• CM Configuration
• Log onto the Certificate Manager portal with an account that can edit profile templates.
• At the CM Manager Operations home screen, click on Manage Profile Templates.

• Select your current smartcard profile template (ex: SCMVSMARTCARD) and click on Copy a selected profile template

• Provide a new name for the profile template (ex: SCMVSMARTCARD2).
• Click on the new profile template to modify its settings.
• Perform these next steps for each additional certificate to be applied to the card
• In the Profile Details -> Certificate Templates section, add the second certificate template which was duplicated earlier (ex: SmartCardLogonCertificate2). You should now have both certificate templates enabled for this profile template.
• Click OK.

·

Testing: Log on with test user

• First lets login as our test user(dsteadman)
  • Insert Smart Card
  • Login to CM and select Request New Permanent Smart Card

• During Enrollment you will see the writing of both certificates for the user and the admin certificate

• Now let look at the certificate issues
  • The Normal User account (dsteadman)

• The Admin Account (dsteadman_admin)

To summarize what we have done we had 2 users 1 of which is the admin account used for login to do administrative functions. The scenario is the business wanted the login certs for the user and the admin account. In this scenario it writes both certificates and the CM profile is tied to the normal user so that if the use should go away the profile template with both user and admin certs go away.

1. Install SharePoint 2016 (Standard or Enterprise)
   • 
   • 
2. Install prerequisite for SharePoint 2016
   • .\prerequisiteinstaller.exe
     • 
   • If failed, setup the windows prerequisites manually
     • https://blogs.technet.microsoft.com/steady/2016/09/30/windows-2016-tp5-add-windowsfeature-fails-for-sharepoint-2016-prerequisite-installer/
     • 
3. Run SharePoint Configuration
   • 
   • 
4. I have staged the following accounts
   • svc-mimsps - MIM SharePoint Configuration Account
   • svc-mimspspool - MIM Sharepoint Pool Account  
   • 
   • 
   • 
   • 
     • In our setup we will use the standalone (Single-Server-Farm) as this portal server is dedicated to the MIM SP1 services


5. We will now create the SharePoint application that will host our site by running the following commands below in the SharePoint 2016 Management Shell(Elevated): We will use the mimsp1portal.thefinancialcompany.net as our url as we have MIM (PreSP1) within the environment.
   
   
   • $dbManagedAccount = Get-SPManagedAccount -Identity TFC\svc-mimsps New-SpWebApplication -Name "MIM Portal" -ApplicationPool "MIMAPPPool" -ApplicationPoolAccount $dbManagedAccount -AuthenticationMethod "Kerberos" -Port 80 -URL https://mimsp1portal.thefinancialcompany.net $t = Get-SPWebTemplate -compatibilityLevel 15 -Identity "STS#1" $w = Get-SPWebApplication https://mimsp1portal.thefinancialcompany.net:80 New-SPSite -Url $w.Url -Template $t -OwnerAlias TFC\svc-miminstall -CompatibilityLevel 15 -Name "MIM Portal" -SecondaryOwnerAlias TFC\administrator $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService; $contentService.ViewStateOnServer = $false; $contentService.Update(); Get-SPTimerJob hourly-all-sptimerservice-health-analysis-job | disable-SPTimerJob
   
   
   • 
6. Now we will confirm the site is reachable and ready for install
   • 
7. Now you're ready to install MIM SP1 Service and Portal (https://docs.microsoft.com/en-us/microsoft-identity-manager/deploy-use/install-mim-service-portal)
8. Now you can navigate using IE, Chrome, Firefox(How Exciting!!)
   • 
9. Once Complete and you can navigate to the MIM Portal you will also notice the Event log filling up with 215X error :(
   • 
10. As we look at the errors we need to evaluate if they are needed within the environment. The rules are helpful to identify performance and issue within the SharePoint farm it is not recommended to disable them all but identify and resolve any issues. To look at the rules
    • In central admin you would see this:
      • 
11. To disable the rule within SharePoint we can simply opened the SharePoint 2016 Management Shell(Elevated) and ran Get-SPHealthAnalysisRule with the Identity parameter to get the exact rule. We dumped all the rules by just passing the same commend without the Identity param to notepad and searched for the ones we wanted to possible disable:
    • BuiltInAccountsUsedAsProcessIdentities
    • ContentDatabaseCorruption
    • OutgoingEmailIsNotConfigured
    • BuiltInAccountsUsedAsProcessIdentities
    • DatabaseUpgradeRecommended
    • WindowsClassicTest
    • InfoPathStateServiceConfigurationHealthRule
    • WindowsClassicTest
12. Once we identified the ones that can be disabled we ran the following below
    • Get-SPHealthAnalysisRule -Identity OutgoingEmailIsNotConfigured | Disable-SPHealthAnalysisRule
    • 

Issue:  When trying to create NEW-PAMGROUP : Failed with Operation requires that destination domain auditing to be enabled

“System.Exception: Failed PAM group 'TFCAdmins' SID migration; Exception: System.ComponentModel.Win32Exception(0x80004005): The operation requires that destination domain auditing be enabled at Microsoft.IdentityManagement.WinTools.SidCloner.CloneSid(String sourceIdentity, String sourceDomain, StringsourceDC, String sourceUserName, SecureString sourcePassword, String targetIdentity, String targetDomain)”

---------------------------------------------

When looking at the Domain in question : the GPO look fine :

PRIV DC:

So then I dug in a bit further knowing this was set I went under the hoot to see what is actually set by running this command :

auditpol /get /category:*

And low and behold well not set right :

Ok now it time to uncover the why when the GPO setting is set and no errors in the gpresult to applying the default domain controller policy

So I went down through removing and re-adding with restart:

Item Performed : Remove the policy from the GPO / Reboot : Same Issue

Item Performed : Added directly to localpolicy / Reboot : Same Issue

Item Performed : Run “auditpol /set /category:"Account Management" /success:enable /failure:enable” / Reboot : Same Issue

Every time it showed up under local policy on the DC as not auditing : <screaming inside>

Research looking at this article clearly we did not have this set : https://support.microsoft.com/en-us/kb/921468 - can cause this behavior

Ok so now it’s even getting weird and scratching head even more so I asked myself what else and bingo!! “old policy lingering that in syvol that is re-applying”  - Kudos David Fisher for brain storm on this

So I dashed over to the C:\Windows\SYSVOL\domain\Policies

Searched for *.csv

Then opened it in notepad and wow look the same as the setting I am getting on reboot

Steps Taken :

• Moved CSV to desktop (I.e. Delete from the syvol) – Before removing this please consult with your Active directory expert to make sure your not going to see any adverse affect
• SET Domain Controller policy back to required settings
• gpupdate /force
• Reboot

Check setting after reboot : As they should be

Test New-PAM Group:

SharePoint used to have a menu option called “Sign in as Different User” in the top-right corner of every page. It is very useful but form admins sometimes it can be a bit of a pain. So simple solution is to build it right into the Home Page Resources like you see below.

In this configuration we are using SharePoint 2013 so SharePoint 2010 might be a bit different to close the connection .

First Step  Click on Administration –> Home Page Resources

Then click on New

Now you see the new information around our Home Page resource General tab

DisplayName: Sign in as Different User
Usage Keywords: BasicUI

Next screen : UI Position

Region: Right region of homepage
Parent order: 4
Order: 0

Next: Behavior

Finally: Localization Tab

Supported Languages: English
Localized Display Name: Sign in as Different User

Once complete click Ok and finish. You will need to run IISRESET to have the cache refresh so your users can see it . Once done if a user click on it they will get redirected to a sign in prompt to enter in new credentials.

Happy Identity !!

In this scenario there was a request to have a distribution list for all 

CIO > Manager + Direct Reports > Manager + Direct Reports.

The end result will be everyone who reports to the CIO both directly and indirectly.

Sample Data:

• CIO Direct and Indirect Reports Distribution List

• Directors DL
• Manager DL
• Supervisors DL
• Indirect DL

This is the sample Organizational structure

• Samantha Smith – CIO – 9 total

• Director - Jeff Ford

• Manager - Tim Schmid

• Supervisor Mark Crow

• Direct Report Ann Polyn
• Direct Report John Well

• Director - Terry Adam

• Manager - Jim Web

• Supervisor Niel Black

• Direct Report Lisa Miller

Sets Created :

Then we Create the Distribution List:

View Members and we have what we want:

Wonder why you get this error as we have seen this is a know issue in many of the MIIS/FIM products installations. Below is the error and the suggested fix:

Log Name:      Application
Source:        ADSync
Date:          1/12/2015 12:47:11 PM
Event ID:      6313
Task Category: Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      AADSync.contoso.com
Description:
The server encountered an unexpected error creating performance counters for management agent "steady1.onmicrosoft.com - AAD".
Performance counters will not be available for this management agent.
Event Xml:
<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ADSync" />
    <EventID Qualifiers="32768">6313</EventID>
    <Level>2</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-01-12T12:47:11.000000000Z" />
    <EventRecordID>299400</EventRecordID>
    <Channel>Application</Channel>
    <Computer>AADSync.contoso.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>steady1.onmicrosoft.com - AAD</Data>
  </EventData>
</Event>

Option 1. Perform a change mode install.

Option 2. Running the following commands from an elevated command prompt, he was able to reload the performance counters for the MA in question:

1. Stop ADsync Service
2. Delete registry key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADSync\Performance]
3. Recreate the 'Performance' registry key.
4. unlodctr.exe ADSync
   
5. lodctr.exe "C:\Program Files\Microsoft Azure AD Sync\Bin\mmsperf.ini”
   
6. Start ADsync Service
7. Looking at perfmon then you can see the counters once again
    

Continuing from our previous post  AADSync - Configure filtering Part 1 we will now look at using expressions on target attributes to decide who should get provisioned to the cloud. Will still use lessons learned from part one to make sure that our expression is properly being evaluated.

A list of functions that can be utilized can be found here (Click Here)

Scenario:
In my new discussion with the business we want to control who and what makes it to the cloud. In this we only want to create users that have the office items PPG or MS Value this attribute in AD is  ‘physicalDeliveryOfficeName’ . If the value is null or any other value ignore .

lets set the stage:  

 
(Picture 1) 

Like AADSync - Configure filtering Part 1  we will install AADSync with all the default rules – without running initial sync steps. I've also configured the active directory management agent to one OU like in part 1

Now for the Fun !

1. Open Sync Rule Editor – This step we will configure the users we want to sync
   
   
   (Picture 2)
   
2. Click New Sync rule 
   
    
   (Picture 3)
   
3. Give the rule a descriptive name(1), such as In from AD – User DoNotSyncFilter, select the correct forest(3), User as the CS object type (4), and Person as the MV object type(5). In Link Type select Join (6)and in precedence type a value currently not used by another Synchronization Rule, e.g. 50.(7) Click Next (8)
   
     (Picture 4)
   
4. In the next step we will be leave scoping filter and join rules empty as this rule will apply to all user objects and we will let our expression do the work Click Next twice
5. Click Add Transformation, Select the FlowType to Expression and select the Target Attribute to sourceObjectType. In the Source, Type in the following expression: this is
   the same one used here with a slight modification. later in the article we will change it again to support the business with multiple departments
   IIF(IsNullOrEmpty([physicalDeliveryOfficeName]),NULL,IIF([physicalDeliveryOfficeName]<>”PPG”,”DoNotSync”,NULL))
   
   
   
   • The expression we are using is the IFF statement
     • IIF(exp condition, var valueIfTrue, var valueIfFalse
       
   • (1) IsNullOrEmpty([physicalDeliveryOfficeName]),NULL = If true we pass NULL,
   • (2) IIF([physicalDeliveryOfficeName]<>”PPG”,”DoNotSync”,NULL
     • In this comparison we look at the attribute and using the VB compare operator <>(Not Equal to). 
     • This say if the physicalDeliveryOfficeName Not Equal to “PPG” , If true then the value is “DoNotSync” , If false value is NULL and we will continue to process of the default sync rules for this value
       
6. Click Add and save the rule
7. Now that reopen the sync rule as we want to make a change to the adjustment to the expression to fit our business rule
   IIF([physicalDeliveryOfficeName] = "PPG" || [physicalDeliveryOfficeName] = "MS",NULL,"DoNotSync")
   
   
8. Now that we that we have our expression rule we will go an preview the user objects in picture 1 above.
   
9. Using the Preview method we did in part –1.  we look at all our users and see if we have expected outcomes
10. 
11. 
12. 
13. 
14. As tested we see the users that should be created in the cloud using default rules and the objects that are blank or have something other than MS,PPG objects will be marked with “DoNotSync” thus not created in the cloud

AADSync can be a very powerful tool with the use of expression or even negative filtering. The two article I have written drives into the testing of the use of the tool so you know what your sending through the system.

Once you read this article you should take away the following

• Filter users & groups based on attributes using negative filtering
• Understand how to test your rules without actually syncing objects to the cloud
• Utilize the object preview tool within AADSync console  to confirm your rules are correctly configured

Scenario:
In my discussion with the business we want to control who and what makes it to the cloud. In this we only want to create users that have the office items PPG Value this attribute in AD is  ‘physicalDeliveryOfficeName’ . The additional requirement is they do not want any groups created in the cloud.

First lets set the stage:  

(Picture 1) 

Next we installed AAD with all the default sync rules – without running the initial sync steps
- As a note I have also configured the MA to scope to 1 OU to reduce time on sync during demo https://msdn.microsoft.com/en-us/library/azure/dn801051.aspx

Lets begin!

1. Open Sync Rule Editor – This step we will configure the users we want to sync

(Picture 2) 

2. Click New Sync rule 

(Picture 3) 

3. Give the rule a descriptive name, such as In from AD – User DoNotSyncFilter, select the correct forest, User as the CS object type, and Person as the MV object type. In Link Type select Join and in precedence type a value currently not used by another Synchronization Rule, e.g. 50. Click Next.

(Picture 4) 

4. In Scoping filter click Add Group, click Add Clause and in attribute select physicalDeliveryOfficeName. Make sure the Operator is set to NOTEQUAL and type in the value PPG in the Value box. Click Next.

(Picture 5) 

5. Leave the Join rules empty and click Next.

 
(Picture 6) 

6. Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.

(Picture 7) 

To test this we do not just simple run of automated sync as we want to confirm everything is sound. So for this we look at the way Identity management works. So first being a state based system we want to import the objects to the CS(Connector Space) . AD –> CS -->(SYNC RULE) --> MV

7. First lets run a full import

8. Now that the full import is complete we see out objects

9. Click on the 8 Objects

(Picture 8) 

10.  Now we see all objects staged in the connector

(Picture 9) 

11.  Next in this step we will simulate what a full sync would do for this object , expected result based on our rule is we create the user in the cloud , Select our PPG user and Select Properties

(Picture 10) 

12.  Next we see the staged object  we will then click Preview

(Picture 11) 

13.  Next Click Generate Preview

14.  Once this generate completes you will see several items and I will go into what we are looking at

1. Is what we see in the CS and what sync rules are being apply to the attribute or contributing . Like in the above we see ‘In from AD – User Common’ is contributing to  ‘sAMAccountName’. You will also notice that you do not see our sync rule or attribute being applied and this is confirmed by Item 4 as you will see it not listed.

2. This is the generated  connector object staged to be created

3. This is our original AD connected object. This would tell you if you had any updates being written back to this object if in a hybrid scenario

15.  Let’s now do the same steps for the non PPG user as steps 11-13 above

16.  Now we see a completely different story as we look at the other user type. 

1. Now we see that our scoping filter we defined back in Picture 4 has been applied as the Item 3 says this sync rule is connected .

2. We also notice this object has not created a pending connector for the cloud connector

17.  During steps 10-13 was a simulation on what we expect the Full/Delta sync to do when we decide to run

18. Now we want to do the same for group but exclude groups all together as this was the business rule not to sync any groups in the cloud

19. We will now do same steps in creating the Group sync rule with slight adjustments based on the scenario we do not want to create any groups in the cloud

1. Make sure Inbound is selected and click Add New Rule.
2. Give the rule a descriptive name, such as In from AD – Group DoNotSyncFilter, select the correct forest, Group as the CS object type, and Group as the MV object type. In Link Type select Join and in precedence type a value currently not used by another Synchronization Rule, e.g. 51. Click Next.
3. Leave Scoping filter empty and Click Next.  – This means this rule will apply to all Groups
4. Leave the Join rules empty and click Next.
5. Click Add Transformation, select the FlowType to Constant, select the Target Attribute cloudFiltered and in the Source text box, type in True. Click Add to save the rule.
   
20. Now if we run through the simulation with groups like we did with users we can see that the group is filtered from being created in the cloud

At the end of the day it only takes 2 sync rules to create users only with PPG in the Office attribute and then exclude all groups from being created in the cloud. This is one of 2 option with using attribute based filtering. I will never recommend Outbound filtering as these setting are not kept during upgrade as it says in the article mentioned above.