Adventures in identity management
There has been a WMI way to get info about the Sync service, MAs and connector space objects since the MIIS days. There used to be a bunch of vbscript samples on TechNet but I’ve never seen them updated for PowerShell. The other day I wanted to produce a report of MA stats and thought…
To completely remove a binding and/or an attribute from the schema you need to do two things: Make sure it is removed from every MPR, Workflow, Set definition, Search Scope, Email Template etc. A simple way is to use the ExportPolicy script and then just search for the attribute in the resulting file. NULL the…
I’ve been finding it useful to query Request objects for various reasons, mostly to get pending or historical changes out of them. This post contains a few script snippets and examples. Note I have developed and used these on FIM 2010 R2 only.
I needed to delete all the Managers from people in the FIM Portal where a particular Manager was set. I had blithely assumed this would be easy with the FIM PowerShell plugin – sadly, not so.
I’ve had this post sitting in draft for a long time and for some reason hadn’t posted it yet – but then today my colleague Matt sent me a link to the Scripting Guy’s PowerShell Holiday Gift Guide. Yes I do love my PowerShell (and I’m hoping that Santa will bring me a copy of…
For some reason I had assumed that I wouldn’t be able to remove and re-add the same value to a multivalued property in the same request – but it turns out you can – and it helped me greatly simplify a script, so hooray for that!
I’ve been trying to pass an ObjectID to the Approval activity via a WorkflowData parameter generated in the FIM PowerShell Activity but I had quite a bit of trouble getting the format right.
As much as possible I like to keep my Workflows simple with a minimum number of steps. When updating attributes I prefer, wherever possible, to only update a single attribute per Workflow Definition. So for example I’ll have separate Workflows for “Set DisplayName” and “Set AccountName” rather than rolling the two together in a single…
MPRs should either have “Grants Permission” ticked, or they should trigger Workflows, but preferably not both.
Run History should be regularly cleared to keep your database file sizes under control. There’s also not a lot of point keeping weeks (let alone months or years) worth of run history in the Sync Service. It shows when profiles ran and whether there were any errors, but click on a CS object and you…