Cleaning an ILM2 installation
I'm testing a scenario with an initial "migration" from Active Directory; I want to import existing accounts from AD, join them with data from HR and check that everything is joined correctly without duplications or modification to the existing accounts. I changed part of the configuration, so I would like to restart my scenario from scratch keeping only the configuration, i.e. I would like to delete all users, groups etc while leaving Synchronization Rules, Workflows, MPRs... Is it possible to do this? I was planning to do the following: - delete the connector spaces of all the Management Agents - delete all the users from ILM, except "Administrator" and "Builtin Synchronization Account" - delete all the groups from ILM - delete all the Expected Rule Entries from ILM (with a custom program, using the web service; is it possible to do this with the portal?) Is this correct? Or have I just planned a fancy way to blast my installation beyond repair? Am I missing something? Thanks for any help, Paolo
June 25th, 2009 7:10pm
There are two methods I have used to do something like this with RC0.I found that some of the builds in the RC0 timeframe didnt really like connector space deletions, which is why I was using something else.Also, clearing a CS doesn't help you to get rid of objects in the portal - right :o)
Depending on what kind of testing your are planning on doing moving forward, the best option is to recreate your environment with your management objects (MPRs, Workflows and SRs) , and to work with database backups of certain states. That way, you can always restore your environment to a known state and move on with a different route.
The second option might sound a bit complicated, but it is not.Yes, it requires a bit work, but it is useful for long term testing.For this implementation, you need an operational MA a File MA is sufficient.Configure the object deletion rule to delete a MV object when disconnected from that MA and the deprovisioning synchronization rule on your FIM MA to stage a deletion on disconnect.
So, the idea is to use the operational MA to get a deletion staged on the affected objects in the FIM MA CS.
What you need, are the MV GUIDs of the affected objects. You can get them by using a script. With this script, you would first get a list of the objects you want to delete by using CSExport. This will give you the CS GUIDs of the affected objects. Now, you can take the list of CS GUIDs for another script that gives you the MV GUIDs you need.You can find here more information on how to script this part.
Your operational MA has a GUID attribute with the MV GUIDs to join to the right metaverse objects and amodification type column. In a first full import, full sync run, you would let the objects of your operational MA join to the required objects in the metaverse.
Then, you would use the same set of data with a modification type of delete in a delta import, delta sync run.
This will delete the MV objects and stage a deletion on the objects in the FIM CS. To delete the objects in the portal, you will only have to run an export on the FIM MA.
I have done this with user and group objects. It should also work with EREs you need a projection rule for them on the FIM MA to get them into the metaverse.
Like Ive said, this sounds more complicated than it actually is. The beauty of this approach is that is fully scriptable and as such you can automate it.Cheers,MarkusMarkus Vilcinskas, Technical Content Developer, Microsoft Corporation
Free Windows Admin Tool Kit Click here and download it now
June 26th, 2009 12:47am
Hi Markus, thanks for your answer; we could not yet try it out, but the fact that it's scriptable is great indeed :) Is there a way to script the attribute flow configuration order in the metaverse after the first full import + sull synch from ILM? Thanks, Paolo
June 29th, 2009 4:05pm
Paolo,to get an idea of how a scripted solution could look like, you might want to take a look at this.It is very simple to modify the solution in this article to work with FIM.I belief, you are referring to the flow precedence correct?If so, no, this is not scriptable.Cheers,MarkusMarkus Vilcinskas, Technical Content Developer, Microsoft Corporation
Free Windows Admin Tool Kit Click here and download it now
July 9th, 2009 4:07am