Hi All I am following the walkthrough "Introduction to Management Policy Rules". I have configured the MPR/WF as per the steps "Create a MPR that will send a notification to the users manager when an employee transitions between set." After changing the employee type, no email notification is generated. Can anyone please suggest the steps to debug the issue? TIA Sachin

I'd check the event log, it might be littered with errors from the FIM Service trying to poll Exchange.Also check the request history, it might should some error detail.Lastly, I would turn on tracing in the FIM Service. It will offer a lot more diagnostic detail, including errors from FIM trying to contact Exchange.CraigMartin Edgile, Inc. http://identitytrench.com

Thanks Craig. 1. No errors or warning in the event log 2. On request history page, Status: PostProcessingError Request Workflow Remarks: The workflow instance 'xyz' encountered an internal error during processing. Contact your system administrator for more information. 3. Tracing in FIM Service: Way to go to learn how to do this. Cheers, Sachin

Hi Sashin! If you have a look at the file C:\Program Files\Microsoft Forefront Identity Manager\2010\Service\Microsoft.ResourceManagement.Service.exe.config there are some parts that are commented out, follow the instructions within the file to uncomment them. Then I recommend you to download Windows 2008 SDK (6.1), with the SDK there's a tool called SvcTraceViewer.exe that helps you read the tracelog. You can find Windows Server 2008 SDK here . You don't have to install the complete SDK, just take the Win32 tools part (can't remember the exact name of it). A recommendation is to comment out the tracing parts when you don't need it because it steals a lot of performance. //HenrikHenrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

Hi Henrik I have uncommented out the parts inC:\Program Files\Microsoft Forefront Identity Manager\2010\Service\Microsoft.ResourceManagement.Service.exe.config and restarted the ILM Server. Where does service log all the trace and how to configure the location? Cheers Sachin

I'm not can't remember how the config file looks in original but at the end I have this... <!-- Step 2: Uncomment out this listener to write diagnostic information to a svclog file. --> <add initializeData="C:\Temp\fimDiagnostics.svclog" type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" name="DiagnosticListener" traceOutputOptions="LogicalOperationStack, DateTime, Timestamp, ProcessId, ThreadId, Callstack"> <filter type="" /> </add> Henrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

Thanks Henrik. Managed to get the error details from trace. Microsoft.ResourceManagement.Service: System.ArgumentException: Invalid or NULL email address at Microsoft.ResourceManagement.Mail.Utilities.ValidateMailMessage(GenericMessage message, IMailServer mailServer) at Microsoft.ResourceManagement.Mail.NotificationMessage.Send() at Microsoft.ResourceManagement.Workflow.Hosting.SendMailWorkItemProcessor.SendMailMessage(MessageContent messageContent) at Microsoft.ResourceManagement.Workflow.Hosting.SendMailWorkItemProcessor.ProcessWorkItem(WorkItem workItem) Still trying to figure out which email address is causing the problem. Cheers Sachin

...or is empty... //HenrikHenrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

email address and account name are specified for the user. Still not sure what could be wrong? Cheers Sachin

Have you specified the sending email address correctly when you installed the service? A good idea could be to perform a check in the C:\Program Files\Microsoft Forefront Identity Manager\2010\Service\Microsoft.ResourceManagement.Service.exe.config again for the email address within the sendAsAddress key in the appsettings. Also is your FIM Service Account email enabled?Henrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

sendAsAddress exists in the appsettngs and is email enabled. Also, I can send the mails to the sendAsAddress.

Hi! I've had a deeper look into this and it turns out the error message you get derives from the fact that no recipients email addresses are set to the mail message To attribute so once again I want you to check that you are really having recipients with valid email addresses and that the email addresses are set to to the Person E-mail attribute within FIM.Henrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

Thanks Henrik for the reply. Recipients for the email notification is set to user 'XYZ' (My account). I login on the Portal as user XYZ. On Portal, When I click My Setting, I see the following -------------------------------------------------------------------------------------------------------------------- Microsoft Identity Management > People and Groups > User Information Account: domain\XYZ Name: FirstName LastName E-Mail: FirstNameLastName@Domain.local -> Is FIM using this as email address -------------------------------------------------------------------------------------------------------------------- If I click Users link and then click on the user XYZ from the list of displayed user, I see the following AccountName: XYZ Domain: domain (This is drop down) E-mail Alias: FirstNameLastName -> Is FIM constructing email address from domain and alias here E-mail: Nothing is displayed here -------------------------------------------------------------------------------------------------------------------- In outlook, I can send and receive emails using the email address FirstNameLastName@Domain.local. My guess is, is FIM trying to send the email address to 'FirstNameLastName@domain' rather than to 'FirstNameLastName@Domain.local'. Cheers Sachin

According to this post: http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/b5b1e518-a9e2-43ca-a235-525aefabb1a1 Brjann Brekkan sais that the user must have an email address in FIM so that must be the E-mail attribute and it must be populated before the notification is created. If you try to send a notification to users when they're created make sure you do this from the action workflow when the attribute is already set using the CRUD operation. If it is only the Domain.local addresses that turns out being a problem why don't you try using your usual email address as recipient by setting it to the E-mail attribute manually before creating the notification. FIM uses the Email Alias value to construct the email address by default, this could be overridden using for example the Function Activity to set the email address. Henrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

Thanks Henrik. According to that post, FIM Service account should be able to access https: //<mail server> /EWS/Exchange.asmx . I can access the EWS web service, however FIM Service account can not. What rights/permissions are required to access the EWS web service? Cheers, Sachin

Hi Sachin! I recommend you to have a look at the Installation Guide where this is explained under: Configuring FIM Service Mailbox and Exchange Server 2007 Web Service (EWS) Certificate Installation . //HenrikHenrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

Thanks Henrik. After making sure that the ILM Service can access the exchange web service, now I get the following error. System: System.UriFormatException: Invalid URI: The format of the URI could not be determined. at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind) at System.Web.Services.Protocols.WebClientProtocol.set_Url(String value) at Microsoft.ResourceManagement.Mail.MailServer.CreateServer() at Microsoft.ResourceManagement.Mail.NotificationMessage.Send() at Microsoft.ResourceManagement.Workflow.Hosting.SendMailWorkItemProcessor.SendMailMessage(MessageContent messageContent) at Microsoft.ResourceManagement.Workflow.Hosting.SendMailWorkItemProcessor.ProcessWorkItem(WorkItem workItem) Cheers Sachin

Sashin, Did you find a solution to this? The exception you've got says it's something wrong with the web service url you're using. //HenrikHenrik Nilsson Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

Henrik I still haven't found the solution to this. Still struggling... Cheers Sachin

Please wait for update 3 when we will expose new MPR types for set transitions not-request based that will make this problem go away. You will have to use one of the new MPR types to handle this situation, then it will be much simpler.AhmadAW

This has been fixed?

Pretty sure. Are you having the same problem and have you gone through the troubleshooting steps above?CraigMartin Edgile, Inc. http://identitytrench.com