Strange issue with FIM2010
Hello,
I am facing issues with FIM2010 which suddenly started to come and are really very strange. i have an production environment with FIM server on windows 2008 ent, SQL server 2008 and AD DS
Now the issue is i have users and Groups in AD and they are being imported to FIM using sync rules and were working fine with import and export but one day suddenly i started getting different errors which are as follows
1- CD-Existing-Object : this error occurred while doing AD MA Export, which shows that it is trying to create user in FIMObjects and to my surprise these objects are already existing in AD under different OU. i could not understand
when these objects are already present why it is trying to provision them in FIMObjects and throwing errors.
2- ambiguous-export-flow-to-single-valued-attribute : there is nothing that has changed and trying to export ambiguous values
3- sync-rule-flow-provisioning-failed : This error occured when user is already present in FIMObjects OU in AD and FIM and while doing sync it is trying to reprovision.
all above errors occurred while provisioning which i did not changed anything, i could not understand how suddenly it started provisioning already provisioned objects.
Please help me out. Cheers, Mohit Goyal
November 2nd, 2010 1:45pm
Sounds like you have an issue with your join rules. How are they configured?My Book - Active Directory, 4th Edition
My Blog - www.briandesmond.com
Free Windows Admin Tool Kit Click here and download it now
November 2nd, 2010 2:08pm
Regarding your first item, this can happen if objects in AD, which it sounds like FIM manages, were moved to another OU, or the OU was renamed or the OU was taken out of scope(de-selected in contianers dialog).
The 2nd item happens when objects join to and then attempt to flow values via import synchronization. This is often caused by an issue with joins, as Brian as aluded to.
The 3rd issue can happen if the AD MA connector space was deleted. This would allow the objects to import back, but since the links between them and the MV objects are gone, FIM is attempting to re-provision the objects back into the AD MA CS.
It seems like if things were working properly and all of these symptoms showed up suddently, it seems as though something was changed, such as either an OU being changed/deleted/moved or the rules in FIM have been changed.
November 3rd, 2010 12:43am
is there anyway to track the root cause and rectify without rebuild of complete server. Because i do not see any of the above mentioned changes has occured.Cheers, Mohit Goyal
Free Windows Admin Tool Kit Click here and download it now
November 3rd, 2010 1:14am