A hotfix rollup package (build 3.3.1067.2) is available for Identity Lifecycle Manager 2007 Feature Pack 1

A hotfix rollup package (build 3.3.1067.2) is available for Microsoft Identity Lifecycle Manager (ILM) 2007 Feature Pack 1. This hotfix rollup package resolves the following problems.

Descriptive text for the GalSync MA

You try to create a new Management Agent (MA) for the Active Directory global address list. This new MA is usually known as GalSync. When you do this, the Create Management Agent page references Microsoft Exchange Server 2007, Microsoft Exchange Server 2003, and Microsoft Exchange 2000 Server.

The Certificate Services service (Certsrv.dll) process stops responding

When multiple certificate enrollments execute at the same time, the ILM Policy Module may cause the Certificate Services service (Certsrv.dll) process to stop responding. This problem occurs because a deadlock condition exists between the ILM Policy Module and the Certificate Services service. The cause of the deadlock was corrected in this hotfix rollup package.

Access-checking methodology changed in Certificate Lifecycle Manager (CLM)

Before this release, the CLM part of ILM used Kerberos delegation to perform operations in the Active Directory directory service. Therefore, CLM acted as the end-user to access the required Active Directory server objects, such as profile templates, subscribers, and other objects.

This hotfix rollup package implements an access-checking methodology in ILM. With this methodology, you do not have to enable CLM to use impersonation to become the user. Additionally, you do not have to delegate access to a particular computer that acts as the end-user or as the enrollment agent when the computer contacts Active Directory. CLM still uses delegation when it contacts the certification authority (CA) that is located on a computer that is not the one that is running CLM.

With this change, CLM now impersonates the CLM Auth Agent account before you make any read or write calls to the Active Directory. The CLM Auth Agent account then verifies whether the logged-on user has permissions to read the object or to make the changes that must be made on the Active Directory object. Therefore, the CLM Auth Agent account must have additional permissions. The CLM configuration wizard does not automatically make these changes. Therefore, you must manually add these permissions.

The CLM Auth Agent account must have the following permissions:

• Read permission on all users and groups that use the portal or that are subscribers
• Read permissions on the certificate templates that are used with the profile templates
• Read and write permissions on all existing profile templates
• Permission to create a child on the profile templates container

CLM cannot find the pkiEnrollmentService object when you add certificate templates to a profile template

When you try to add certificate templates to a profile template, no published certificate templates from a given CA server are found. This problem may occur when the sanitized short name of the CA differs from the sanitized name of the CA.

When the CA creates the pkiEnrollmentService object in Active Directory, the CA uses the sanitized short name of the CA. Before this hotfix rollup package, CLM used the sanitized name to search for the pkiEnrollmentService object. Therefore, CLM cannot find the pkiEnrollmentService object.

Support is added for Sun ONE directory server 6.x versions

The Management Agent for Sun and Netscape directory servers was certified to support Sun ONE directory server 6.x versions. To enable this support, you must modify the registry after you install the hotfix rollup package.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

1. Click Start, click Run, type Regedt32, and then click OK.
2. Locate and then right-click the following registry key:
   SYSTEM\CurrentControlSet\Services\miiserver\Parameters
3. Click New, and then click Multi-string Value.
4. Set the following parameter values:
   Value name: iPlanetMASupportedServers
   Value type: (REG_MULTI_SZ)
5. Set the value of the registry key to the following value:
   Sun-Java(tm)-System-Directory/6.3 B2008.0311.0946
   Note The precise format of the value may vary in different versions of Sun ONE.

Active Directory Management Agent does not ignore defunct classes

You add an auxiliary class to Active Directory that inherits from any class other than the top class. However, errors occur in ILM when you create an Active Directory MA or when you update the schema after you add the class.

These errors occur even if the auxiliary class is marked as Inactive in the Active Directory schema. ILM build 3.3.1067.2 ignores defunct Active Directory classes.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must have Identity Lifecycle Manager 2007 Feature Pack 1 installed on the computer.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Certificate Lifecycle Manager (CLM)

Identity Lifecycle Manager (ILM)

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.