Hi, I am using the Introduction to the Configuration Migration Tool doc to migrate FIM config between environments. When running Export-FIMConfig -uri http://localhost:5725/ResourceManagementService -policyConfig -schemaConfig -portalConfig in the ExportPilot.ps1 script I get the following error: WARNING: A reference stored in a string does not correspond with a resource management object. This occurs when using arbitrary parameters in a XOML that are also guids or in filters which refer to users who no longer exist. Source ObjectID = Referred ObjectID = urn:uuid:d1230ef0-c5fa-4473-be2a-30918b42ea2b Failure = Microsoft.ResourceManagement.WebServices.Client.PermissionDeniedException: Access to the requested resource(s) is denied at Microsoft.ResourceManagement.WebServices.Client.Resource..ctor(UniqueIdentifier identifier, CultureInfo locale, ContextualSecurityToken securityToken, Boolean includePermissionHints, TimeZoneInfo resourceTimeZone) at Microsoft.ResourceManagement.WebServices.ResourceManager..ctor(UniqueIdentifier resourceIdentifier, CultureInfo locale, ContextualSecurityToken securityToken, Boolean includePermissionHints, TimeZoneInfo localTimeZone) at Microsoft.ResourceManagement.WebServices.ResourceManager..ctor(UniqueIdentifier resourceIdentifier, CultureInfo locale, ContextualSecurityToken securityToken, Boolean includePermissionHints) at Microsoft.ResourceManagement.WebServices.ResourceManager..ctor(UniqueIdentifier resourceIdentifier) at Microsoft.ResourceManagement.Automation.ExportConfig.ResolveReferences(UniqueId entifier objectIdentifier) and then ignoring the above error (naughty, but I have backed up FIM database) and importing the config using Syncproduction.ps1 script the following error is displayed Exporting configuration from production. Exported 1599 objects from production. Saving file production.xml . Loading pilot file pilot.xml . Loaded file pilot.xml . 1694 objects loaded. Executing join between pilot and production. Join-FIMConfig : Unable to find anchor attribute 'AccountName' for object type 'Group' with identifier urn:uuid:40b4dd4 8-114a-4e6f-b060-aeeba34de43d. At E:\FIMProjectFiles\MIISOther\Syncproduction.ps1:54 char:26 + $matches = Join-FIMConfig <<<< -source $pilot -target $production -join $joinrules -defaultJoin DisplayName Executing compare between matched objects in pilot and production. Compare-FIMConfig : The argument cannot be null or empty. At E:\FIMProjectFiles\MIISOther\Syncproduction.ps1:56 char:40 + $changes = $matches | Compare-FIMConfig <<<< Identified changes to apply to production. Saving changes to changes.xml . ConvertFrom-FIMResource : The argument cannot be null or empty. At E:\FIMProjectFiles\MIISOther\Syncproduction.ps1:59 char:35 + $changes | ConvertFrom-FIMResource <<<< -file $changes_filename Sync complete. The next step is to commit the changes using CommitChanges.ps1. The changes.xml is an empty file. I haven't changed anything in the schema for group objects. How do I troubleshoot these errors?

Great question -- this particular error is because the lockout gate is identified by a GUID and the export cmdlet assumes all GUIDs are references to other objects. However, since no such object exists you get thiswarning.To troubleshoot this error, you shouldinspecthow this GUID is used byopenning up thechanges.xml in notepad. Search for the GUID, and if it is in fact the lockout gate filter (i.e. GateTypeID='D1230EF0-C5FA-4473-BE2A-30918B42EA2B) and then make sure that attribute is FullyResolved=true. Make the change in the XML, and you should be good to go with commiting the changes.This is the general procedure for migrating GUIDs which do not refer to other objects. You need to handle them in a case-by-case basis and manually flip them to FullyResolved=true so the changes propagate. We are looking at how we can improve this experience and automate some of the editing, and we are working on additional documentation that provides more information for these special cases.