Unattended Installation of FIM 2010

Article
07/11/2012

Applies To: Forefront Identity Manager 2010

Unattended installation of FIM 2010

All components of Microsoft® Forefront® Identity Manager (FIM) 2010 accept properties that allow unattended and silent installation. Those properties can either be set in a Windows Installer Transform (MST) file or specified on the command line during installation.

The FIM installation packages do not support advertisement (msiexec /j) or administrative (msiexec /a) installations.

There are several different ways to install FIM silently (unattended). Two methods are described in this section: pass-in parameters in a command line and MST files. It is outside the scope of this document to describe unattended installations in general.

Pass-in parameters on the command line

This can be used with Microsoft System Center Configuration Manager 2007. To install, silently use the command msiexec with an option, followed by properties, for example:

Msiexec /i NameofMSI.msi /Option ADDLOCAL=MSIFeatureName Property=Value

The possible values of MSIFeatureName and Property can be found in Features and properties later in this document. Note that all parameters are case sensitive.

The following is an example command for an installation of FIM Add-ins and Extensions from a file server where only the FIM Outlook add-in is installed:

msiexec /i “\\MyServer\Distribution\FIM\32\Add-ins and extensions.msi” /quiet ADDLOCAL=OfficeClient PORTAL_LOCATION=MyPortalServer PORTAL_PREFIX=https MONITORED_EMAIL=fimservice@contoso.com

Note

Windows Installer has a limit of 256 characters in the path when for installation of applications. Ensure that you do not place the root of the tree in a very deep structure, or the installation might fail.

Create an MST file

Another solution is to use an MST file. MST files can be created with tools such as Orca (shipped with the Windows Software Development Kit (SDK)), and they contain the same settings as are passed in on the command line.

Troubleshoot an installation

If an unattended installation fails, add the option /l*v NameOfLogFile.txt to the command line. This option creates a log file that you can use for troubleshooting. You can identify an error in a Windows Installer log file by looking for the text Return Value 3.

Features and properties

The tables in this section list the settings in the order that they appear during the user interface (UI) installation. Default values are in brackets.

Table 1 Name of feature in Windows Installer file

Name of feature in UI	Windows Installer feature name
FIM Add-in for Outlook	OfficeClient
FIM Password and Authentication Extensions FIM Password and Authentication Extensions for Windows XP FIM Password and Authentication Extensions for Windows Vista	PasswordClient
FIM Portal Authentication Extensions	PasswordClientX86
FIM Service	CommonServices
FIM Portal	WebPortals
FIM Password Reset Portal	PwdPortals
FIM Synchronization Service	N/A (only one feature in the installer)
Forefront Identity Manager Certificate Management (FIM CM) Update Service	CLM_Service
FIM CM Portal	Web_Files
FIM CM CA Modules	CA_Modules
FIM CM Smart Card PIN Reset Tool	ChangePin
FIM CM Smart Card Personalization Control	AppletManagement
FIM CM Smart Card Client	SelfServiceControl
FIM CM Update Client	ProfileUpdateControl
FIM CM Bulk Issuance Client	ClientFiles
Microsoft Password Change Notification Service	PCNSSVC

Table 2 FIM Service and FIM Portal properties

Property name	Description
SQMOPTINSETTING	1 – opt in, 0 – opt out (default)
SQLSERVER_SERVER	(Required) Name of SQL Server instance
SQLSERVER_DATABASE	Name of database (FIMService)
EXISTINGDATABASE	0 – New database (default), 1 – Existing database
SERVICE_ACCOUNT_NAME	(Required) Service account name
SERVICE_ACCOUNT_PASSWORD	(Required) Service account password
SERVICE_ACCOUNT_DOMAIN	(Required) Service account domain
SERVICE_ACCOUNT_EMAIL	(Required) Service account e-mail address
SYNCHRONIZATION_SERVER_ACCOUNT	FIM Service Management Agent account in format domain\accountname
CERTIFICATE_NAME	Name of certificate to generate (ForefrontIdentityManager)
MAIL_SERVER	(Required) Name of mailserver
MAIL_SERVER_IS_EXCHANGE	0 – SMTP, 1 – Exchange (default)
MAIL_SERVER_USE_SSL	0 – Disable SSL, 1 – Enable SSL (default)
POLL_EXCHANGE_ENABLED	0 – Server will not poll for e-mail messages1 – Server will poll for e-mail messages (default)
SYNCHRONIZATION_SERVER	(Required) Address of FIM Synchronization Service server
SERVICEADDRESS	Address used by clients to contact the server
SHAREPOINT_URL	URL used to contact the SharePoint server
FIREWALL_CONF	0 – Do not configure firewall (default)1 – Configure firewall
SHAREPOINTUSERS_CONF	0 – Do not add authenticated users (default1 – Add authenticated users
PASSWORDUSERS_CONF	0 – Do not add authenticated users (default1 – Add authenticated users
SHAREPOINTTIMEOUT	Timeout in seconds the installer should wait for Office SharePoint to deploy the solution packs.

Table 3 Synchronization Service properties

Property Name	Description
STORESERVER	Name of SQL Server
SQLDB	Name of database (FIMSynchronization)
SQLINSTANCE	Name of database instance
SERVICEACCOUNT	(Required) Service account name
SERVICEPASSWORD	Required) Service account password
SERVICEDOMAIN	(Required) Service account domain
GROUPADMINS	Name of admin group (FIMSyncAdmins)
GROUPOPERATORS	Name of operators group (FIMSyncOperators)
GROUPACCOUNTJOINERS	Name of joiners group (FIMSyncJoiners)
GROUPBROWSE	Name of browse group (FIMSyncBrowse)
GROUPPASSWORDSET	Name of password set group (FIMSyncPasswordSet)
FIREWALL_CONF	0 – Do not configure firewall (default)1 – Configure firewall

Table 4 Add-ins and Extensions properties

Property name	Description
SQMOPTINSETTING	1 – opt in, 0 – opt out (default)
RMS_LOCATION	Address to the FIM Service. Used by Password Reset extensions
PORTAL_LOCATION	Address to the FIM Portal. Used by Outlook add-in.
PORTAL_PREFIX	Prefix used to contact the FIM Portal. http or https (default)
MONITORED_EMAIL	FIM Service e-mail address. Used by the Outlook add-in when sending e-mail messages.
SITELOCK_DOMAIN	Semi-colon separated list of sites the Password Reset ActiveX control can be activated on
IE7TRUSTEDSITES	If Internet Explorer 7 is installed, then this is the prefix to add to the list of sites defined in SITELOCK_DOMAIN. None – Do not add sites to trusted sites (default)http – Add sites with http as prefixhttps – Add sites with https as prefix
BEST_EFFORT_INSTALL	If both components are selected, but one cannot be installed due to failed prerequisites, silently continue installation with the other component.0 – Fail installation (default)1 – Silently continue

Unattended Installation of FIM 2010