Hotfix rollup package (build 4.4.1642.0) is available for Microsoft Identity Manager 2016 SP1

Issue 1

If the SQL Server "Always On" feature is enabled, when the primary server that hosts the FIM Service database goes down during the processing of a big requests sequence (about 500), one request always fails. 

After you apply this update, the FIM Service tries to recover the request during the validating stage if an error occurs. This change does not guarantee that the request is completed. However, it makes the request more stable.

For more information about alwaysOnRetryRequestProcessingTransaction setting, see following:

• By default, this setting is disabled.

• If you try to enable this setting, an exception occurs, and two entries are made in the FIM event log that have the following conditions:

  • The first entry includes the original error.

  • The second entry includes the AlwaysOnRetryRequestProcessingTransaction keyword.

• This property is set in the ResourceManagementService section of the Microsoft.ResourceManagement.Service.exe.config file. For example:
  

  <resourceManagementService externalHostName="myMIMServer" AlwaysOnRetryRequestProcessingTransaction="true" />

Issue 2

The Word() function does not return an empty string as documented if there are fewer words in the input string than the number that's specified to be output in the function. This function throws an exception and does not return an empty string. 

After you install this update, an empty string will be returned. For more information, see Function Reference for FIM 2010.

Issue 3

In a dynamic group or set, if a dereferencing criterion is located beneath other criteria in the filter builder, the View Members command may return the incorrect membership. 

After you install this update, the View Members button will return the correct membership.

Issue 4

Under certain circumstance, an AuthZ Workflow denies a request and returns the following error message:

After you install this update, the authorization workflow works as expected without throwing the error. 

Issue 5

When a workflow runs an enumerate resource activity to query MIM, it experiences intermittent failures.

After you install this update, the enumerate resource activity no longer fails.

Issue 6

When you run the Import-FIMReportingSchemaDefinition PowerShell cmdlet, the following exception is returned:

After you install this update, the Import-FIMReportingSchemaDefinition cmdlet works as expected. 

Issue 7

Privileged Access Management (PAM)-related management policy rules and Navigation bar items are enabled even though the PAM component is not installed. 

After you install this update, these objects are hidden until the PAM component is installed. 

Issue 8

When you create a new PAM object by using PAM PowerShell cmdlets, the following warning may be enetered in the FIM event log:

This issue occurs because there is no associated DomainConfiguration object in the FIM Service to match the domain to which the object is being added by the New-PAM* cmdlet.

After you install this update, the New-PAMDomainConfiguration cmdlet will create a corresponding DomainConfiguration object in the FIM Service, and the New-PAMForest cmdlet will create a corresponding ForestConfiguration object in the FIM Service. 

Issue 9

A PAM scenario that has approvals does not work correctly if there’s a child domain in the managed (Corp) forest. 

After you install this update, this scenario works as expected.

 

Issue 1

If an object in a connected data source is excluded from the import by using a Declared Import filter, the import filter doesn’t discover the replacement name of an object that is identified by a placeholder name in the management agent’s connector space.

After you install this update, the replacement name of the object is discovered by the import filter as expected. 

Issue 2

Import attribute flow precedence doesn’t transfer to the next precedent object when the previous object that has a higher precedence is disconnected.

After you install this update, precedence works as expected.

Issue 3

The Password Reset (MIIS_CSObject.PasswordSet() method) fails if there’s no trust relationship with the target Active Directory Domain Services (AD DS). 

After you install this update, this failure no longer occurs. 

Issue 4

After you install an update to an ECMA v2 connector instance, such as an update to the Generic LDAP Connector, the property sheets may stop responding when you turn off the Connectivity tab. 

After you install this update, this problem no longer occurs. 

Issue 5

When you use the “Oracle (previously Sun) Directory Servers” management agent against a Sun-Java System Directory, the management agent tries to use LDAP paging even though the directory server doesn’t have a listed LDAP control that supports LDAP paging. 

After you install this update, this issue will no longer occur. 

Issue 6

When you dynamically change the object type of a metaverse object in the management agent rules extension code, the synchronization service may periodically crash. 

After you install this update, dynamic changes between metaverse object types that previously caused the synchronization service to crash will throw an exception. 

 

Issue 1

When you access the portal through Firefox browser, the filter builder doesn’t work as expected.

After you install this update, the filter builder can be used in the Firefox browser.

Issue 2

Portal Search renders incorrectly in some screen resolutions.

After you install this update, the Portal renders correctly.

Issue 3

In the Portal, the calendar control in the Advanced Search is truncated.

After you install this update, the calendar control is displayed correctly.

Issue 4

In some cases, the filter builder in the MIM Portal is displayed incorrectly in some modern browsers. 

After you install this update, the filter builder is displayed correctly.

Issue 5

All MIM Portal Popups have a fixed size, and the edit controls don’t display correctly.

After you install this update, the popup dialog boxes are resizable, and the controls are displayed properly.

Issue 6

In some languages, the Navigation menu cuts off some menu items.

After you install this update, the Navigation bar is resizable through the Common Portal Customizations object. 

Issue 7

When you copy a URL from a pop-up window in the MIM Portal, the URL can’t be generated to the active tab. 

After you install this update, the URL from the pop-up window can be generated to the active tab directly.

 

Issue 1

When you use double-byte characters to provide answers in the Question and Answer authentication gate, a warning is added to the Password Registration Portal registration form. These characters can’t be entered when you use the MIM Windows Credential Provider Extension (logon screen) to reset passwords.

Improvement 1

Add the option to enable and disable IME usage on the SSPR Registration form.

• IME is now customizable by using the following new setting for QAGate activity in the Password Reset workflow:

  

  Note This setting also enables copy-paste operations.

• Assume that IME setting is turned on. When you input a special character, a warning is displayed at the Password Registration portal:

  

• When the IME setting is turned on, special characters are still not supported in Windows Client. This issue occurs only in the Password Reset portal.

• Character sets for this warning are customizable by using Unicode ranges at the \Password Registration Portal\GateResources\isIME.js file.
  
  

Improvement 1

When you try to reset a password through Self-Service Password Reset, the answers entered in the Question and Answer gate can’t be masked until the cursor moves out of the control.  After this update is applied, a registry key is added to support the complete masking of characters in the Q&A gate. 

Note If the IME is enabled in the Password Registration and Password Reset portals, this setting is ignored.   

In the Password Reset portal, text is always hidden when you type the answer. This helps to prevent "shoulder surfing" by others.

When the IME setting is turned on, text is displayed while you type, and hidden when the focus leaves the text box.

 

Issue 1

When you use the language pack for the MIM Add-ins and Extensions client in Windows 10, the client doesn’t display in French as expected even the Windows Display Language/locale is configured to fr-CA.

After you install this update, the MIM Add-ins and Extensions language pack will try to map all similar languages to the one that is supported.  For example, if the Windows Display Language is ES-CL (Spanish Chile), or any ES-**, it will try to map this to ES-ES (Spanish Spain). 

Override Configuration

If the automatic mappings doesn’t work as you want, you can use the following registry key to override the Windows Display Language setting with a specific language:

Registry Value Name: OverrideDefaultUILocale

Value Type: String Value

Location: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Identity Manager\2010\Extensions]

For example:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Identity Manager\2010\Extensions]

"OverrideDefaultUILocale"="ES-ES"

Note The value that is provided in the OverrideDefaultUILocale registry key should match one of the languages of the installed MIM Add-ins and Extensions language packs. 

Limitations

This override value takes effect only if the Windows Display Language doesn’t have an exact match to an MIM Add-ins and Extensions language pack. The following are examples of this limitation:

• If the Windows Display Language is es-ES, and you have the es-ES MIM language pack installed, you can't override this match by using another language, such as fr-FR.

• Assumne that the locale of a system is set to zh-HK, and separate SSPR localization packages are installed for zh-CN and zh-TW. By default, SSPR selects zh-CN (according to internal order). In this situation, you can add an OverrideDefaultUILocale registry key and set the value to zh-TW to force SSPR to select zh-TW. You can also install any other localization package (like fr-FR or ko-KR) and configure it by using this registry key.

Note If you have installed valid localization package for the current system locale (for example: locale es-ES and localization es-ES), other localizations can’t be selected by using the registry or any other mechanism.

The following is a list of valid values in this update:

• bg-BG

• cs-CZ

• da-DK

• de-dDE

• el-GR

• es-ES

• et-EE

• fi-FI

• fr-FR

• hi-IN

• hr-HR

• hu-HU

• it-IT

• ja-JP

• ko-KR

• it-IT

• lv-LV

• nb-NO

• nl-NL

• pl-PL

• pt-BR

• pt-PT

• ro-RO

• ru-RU

• sk-SK

• sl-SL

• sv-SE

• th-TH

• tr-TR

• uk-UA

• zh-CN

• zh-TW
  
  

Issue 1

The Certificate Management (CM) Bulk Client requires the same CM Server version. Otherwise, it can’t do a smooth upgrade (that is, upgrade CM Server first and then the Bulk Client).

Smooth upgrade is supported since version 4.4.1642.0 (include CM Server and Bulk Client). Newer versions of CM Server can work with earlier version Bulk Client (not earlier than 4.4.1642.0). You can also upgrade from the version earlier than 4.4.1642.0. However, we recommend that you work with Microsoft Support to do this.