Introduction
A hotfix rollup package (build 4.3.2266.0) is available for Microsoft Identity Manager (MIM) 2016. This hotfix rollup package resolves some issues and adds some features that are described in the "More Information" section.
Update information
A supported update is available from Microsoft Support. We recommend that all customers apply this update to their production systems.
Microsoft Support
If this update is available for download from Microsoft Support, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, go to the following Microsoft website:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Known issues in this update
Synchronization Service
After this update is installed, rules extensions and custom management agents (MAs) that are based on Extensible MA (ECMA1 or ECMA 2.0) may not run and may produce a run status of "stopped-extension-dll-load." This issue occurs when you run such rules extensions or custom MAs after you change the configuration file (.config) of one of the following processes:
-
MIIServer.exe
-
Mmsscrpt.exe
-
Dllhost.exe
For example, in the MIIServer.exe.config file, you change the default batch size for processing sync entries for the FIM Service MA.
In this case, the synchronization engine installer for this update does not replace the configuration file. This behavior is by design to avoid deleting your previous changes. However, because the configuration file is not replaced, entries that are required by this update are not present in the files, and the synchronization engine will not load any rules extension DLLs when the engine runs a Full Import or Delta Sync run profile.
To resolve this issue, follow these steps:
-
Make a backup copy of the MIIServer.exe.config file.
-
Open the MIIServer.exe.config file in a text editor or in Microsoft Visual Studio.
-
Find the <runtime> section in the MIIServer.exe.config file, and then replace the content of the <dependentAssembly> section by using the following:
<dependentAssembly>
<assemblyIdentity name="Microsoft.MetadirectoryServicesEx" publicKeyToken="31bf3856ad364e35" />
<bindingRedirect oldVersion="3.3.0.0-4.1.3.0" newVersion="4.1.4.0" />
</dependentAssembly> -
Save the changes to the file.
-
Find the Mmsscrpt.exe.config file in the same directory and the Dllhost.exe.config in the parent directory. Repeat steps 1 through 4 for these two files.
-
Restart the Forefront Identity Manager Synchronization Service (FIMSynchronizationService).
-
Verify that the rules extensions and custom management agents now work as expected.
Prerequisites
To apply this update, you must have Microsoft Identity Manager 2016 build 4.3.1935.0 or a later build installed.
For BHOLD deployments of the BHOLD FIM Integration module or Access Management Connector, you must have this hotfix rollup (4.3.2266.0) installed on your MIM servers before you apply any update to the BHOLD modules.
Restart requirement
You must restart the computer after you apply the Add-ins and Extensions (Fimaddinsextensions_xnn_kb3171342.msp) package. Additionally, you may have to restart the server components.
Replacement information
This update replaces update 3134725 (build 4.3.2195.0) for Microsoft Identity Manager 2016.
The global version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
|
File name |
File size |
Date |
Time |
Path |
|---|---|---|---|---|
|
Accessmanagementconnector.msi |
598,016 |
03-Jul-2016 |
08:48 |
492580_intl_x64_zip |
|
Bholdanalytics 5.0.3468.0_release.msi |
2,740,224 |
03-Jul-2016 |
08:38 |
492580_intl_x64_zip |
|
Bholdattestation 5.0.3468.0_release.msi |
3,317,760 |
03-Jul-2016 |
09:23 |
492580_intl_x64_zip |
|
Bholdcore 5.0.3468.0_release.msi |
5,058,560 |
03-Jul-2016 |
08:27 |
492580_intl_x64_zip |
|
Bholdfimintegration 5.0.3468.0_release.msi |
3,571,712 |
03-Jul-2016 |
09:00 |
492580_intl_x64_zip |
|
Bholdmodelgenerator 5.0.3468.0_release.msi |
3,289,088 |
03-Jul-2016 |
09:35 |
492580_intl_x64_zip |
|
Bholdreporting 5.0.3468.0_release.msi |
2,031,616 |
03-Jul-2016 |
09:11 |
492580_intl_x64_zip |
|
Fimaddinsextensions_x64_kb3171342.msp |
2,555,904 |
30-Jun-2016 |
04:48 |
492580_intl_x64_zip |
|
Fimaddinsextensions_x86_kb3171342.msp |
2,293,760 |
29-Jun-2016 |
21:54 |
492580_intl_x64_zip |
|
Fimcmbulkclient_x86_kb3171342.msp |
4,722,688 |
29-Jun-2016 |
21:54 |
492580_intl_x64_zip |
|
Fimcmclient_x64_kb3171342.msp |
5,722,112 |
30-Jun-2016 |
04:48 |
492580_intl_x64_zip |
|
Fimcmclient_x86_kb3171342.msp |
5,492,736 |
29-Jun-2016 |
21:54 |
492580_intl_x64_zip |
|
Fimcm_x64_kb3171342.msp |
18,337,792 |
30-Jun-2016 |
04:48 |
492580_intl_x64_zip |
|
Fimcm_x86_kb3171342.msp |
18,173,952 |
29-Jun-2016 |
21:54 |
492580_intl_x64_zip |
|
Fimservice_x64_kb3171342.msp |
19,267,584 |
30-Jun-2016 |
04:48 |
492580_intl_x64_zip |
|
Fimsyncservice_x64_kb3171342.msp |
14,901,248 |
30-Jun-2016 |
04:48 |
492580_intl_x64_zip |
More Information
Issues that are fixed and features that are added in this updateThis update fixes the following issues and adds the following features that were not previously documented in the Microsoft Knowledge Base.
Privileged Access Management (PAM)
Issue 1When you create a PRIV ONLY PAM user, the PAM monitor service throws the following warning message when it tries to update the PAM users email in active directory and the value already exists:
System.Exception: Set PAM object dictionary already contain attribute 'Email'.
FIM add-ins and extensions
Issue 1
SSPR windows clients on systems that use a high DPI setting have an incorrect scaling of the final page (the Password Reset Flow page) in which the radio buttons are overlapped.
Issue 2
SSPR windows clients have text messages that overlap after a password reset if the resulting message (success or error) contains more than three lines.
FIM Certificate Management
Issue 1
The ExecuteOperations.Disable operation from the Microsoft.Clm.BusinessLayer.Shared.dll public library does not work correctly and returns an error because of incorrect object initialization.
Issue 2
A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.
Issue 3
There is a redundant space in the "Profile Summary" string on the Request Complete page for some languages.
Issue 4
The Duplicate Revocation Settings policy is replaced because some users could not set it.
Issue 5
A certificate in the Certificate Management portal may use the LDAP CN name instead of DisplayName when it calls REST.
Issue 6
For ZH-Hans and some other languages, link underlining in the Certificate Management portal is misplaced (stroke instead of an underline) because of a font issue.
FIM Synchronization Service
Issue 1
Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.
Issue 2
Error messages are logged in the event log (such as Event ID 6313). Additionally, performance counters don't work.
Issue 3
The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.
Issue 4
When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the page size value quietly changes to the minimum or the maximum after you click Finish.
Issue 5
An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn't appear in the error list as expected, and a non-informative error window appears.
Issue 6
You receive a "Reference to undeclared entity 'qt'" error message when you run the history process and the history text contains the "greater than" (>) symbol.
Issue 7
New Functionality: The ability to skip the Management Agent during the import of a server configuration is added. A new -Skip parameter is added to the Import-MIISServerConfig cmdlet.
The names of MAs to skip should be delimited by a semicolon (;), as in the following example:
Import-MIISServerConfig -Path "C:\exported" -Skip "FIMMA;ADMA"
Note If you do not use the –Skip parameter, the default behavior occurs.
Issue 8
A "MEMORY_ALLOCATION_FAILURE" error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.
FIM Portal
Issue 1
Multivalued labels are displayed incorrectly in a single line in the UI.
Issue 2
When you upload Resource Control Display Configurations (RCDC), the xml-format is not verified.
Issue 3
You cannot drag-and-drop a user to the Remove box to delete the user or to remove the user from a group membership.
Issue 4 Local date and time settings are ignored for the Australian English (en-AU) locale.
Issue 5
This update enables customizations that have controls that are shown or hidden based on the state of the email-enabling check box.
An additional attribute to RCDCs configuration data is included in this update. The Now Event element may have a Parameters attribute. For Group RCDC for the OnChangeEmailEnabling event, the element should contain a comma-separated, case-sensitive list of controls to show or hide.
Example
<my:Control my:Name="EmailEnabling" my:TypeName="UocCheckBox" my:Caption="%SYMBOL_EmailEnablingCaption_END%" my:Description="%SYMBOL_EmailEnablingDescription_END%" my:AutoPostback="true" my:RightsLevel="{Binding Source=rights, Path=Email}">
<my:Properties>
<my:Property my:Name="Text" my:Value="%SYMBOL_EmailEnablingValue_END%"/>
</my:Properties>
<my:Events>
<my:Event my:Name="CheckedChanged" my:Handler="OnChangeEmailEnabling" my:Parameters="Alias,Email"/>
</my:Events>
</my:Control>
Note: If the Parameters attribute is not included, the default behavior occurs.
FIM Service
Issue 1
In SharePoint Server 2013 and later versions, if you edit a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.
BHOLD
Issue 1
When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.
Issue 2
Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.
Issue 3
When you use Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.
Issue 4
An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.
Issue 5
If two or more roles that are assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.
Issue 6
An email alias is truncated if it is longer than 30 characters.
References
Learn about the terminology Microsoft uses to describe software updates.
