This document is intended for IT planners, systems architects, technology decision-makers, consultants, infrastructure planners, and IT personnel who plan to deploy FIM 2010.

The server hosting the FIM 2010 Synchronization Service must have the following prerequisite software installed:

• Windows Server 2008 or Windows Server 2008 R2 64-bit Standard or Enterprise Editions.
  
  

  Important
  When you install Windows Server 2008, do not install Windows Server 2008 Terminal Services. If you install Terminal Services, the FIM 2010 server components do not install.

• Windows Installer 4.5
  
  

  Note
  Windows Installer 4.5 can be downloaded from Microsoft download center.

• SQL Server 2008 64-bit Standard or Enterprise Editions, Service Pack 1 or later.
  
  The following SQL features must be installed:
  
  
  • Database Engine Services
    
    
• Microsoft Visual Studio 2008
  
  

  Note
  Microsoft Visual Studio 2008 is required if you are planning to develop rules extensions for FIM 2010 Synchronization Service on this server.

• Windows PowerShell 1.0 or Powershell 2.0
  
  

  Note

  PowerShell 1.0 or newer is required to provision resources for Exchange 2007. PowerShell 2.0 is required to provision resources for Exchange 2010. You cannot have both versions of PowerShell installed at the same time. Windows PowerShell 1.0 Features can be installed from the Features options interface included with Windows Server 2008. Windows Server 2008 R2 ships with PowerShell 2.0. Windows PowerShell 2.0 can also be downloaded from the Microsoft download center for Windows Server 2008.

• Microsoft .NET 3.5 SP1 Framework
  
  You can download Microsoft .NET 3.5 SP1 Framework here http://go.microsoft.com/fwlink/?LinkId=129538.
  
  
  
  
• Exchange 2007 SP1 Management Console
  
  

  Note

  Exchange 2007 SP1 Management Tools is required to fully provision Exchange Server 2007 mailboxes, contacts, and groups that are created by the FIM Synchronization Service. You will receive an extension-dll-exception error if you attempt to synchronize these objects to Active Directory without the Exchange 2007 SP1 Management Console installed. Exchange 2010 provisioning does not require any additional tools to be installed on the FIM Synchronization Service server.

The server hosting the FIM Service must have the following software installed:

• Windows Server 2008 or Windows Server 2008 R2 64-bit Standard or Enterprise Editions.
  
  

  Important
  When you install Windows Server 2008, do not install Windows Server 2008 Terminal Services. If you install Terminal Services, the FIM server components do not install.

• Windows Installer 4.5
  
  

  Note
  Windows Installer 4.5 can be downloaded from Microsoft download center.

• SQL Server 2008 64-bit Standard or Enterprise Editions, Service Pack 1 or later.
  
  The following SQL features must be installed:
  
  
  • Database Engine Service
    
    
    • Full-Text Search
      
      

  Note
  You can use the same SQL Server 2008 instance that the FIM Synchronization Service is using.

  Note
  After installing SQL Server, make sure that the SQL Agent is running.

• Windows PowerShell 1.0 or PowerShell 2.0
  
  

  Note

  FIM Service will work both with PowerShell 1.0 and PowerShell 2.0. You cannot have both versions of PowerShell installed at the same time. Windows PowerShell 1.0 Features can be installed from the Features options interface included with Windows Server 2008. Windows Server 2008 R2 ships with PowerShell 2.0. Windows PowerShell 2.0 can be downloaded from Microsoft download center for Windows Server 2008.

• Microsoft .NET 3.0 Features
  
  

  Note
  Microsoft .NET Framework 3.0 Features can be installed from the Features options interface included with Windows Server 2008.

• Microsoft .NET 3.5 SP1 Framework
  
  You can download Microsoft .NET 3.5 SP1 Framework here http://go.microsoft.com/fwlink/?LinkId=129538.
  
  

The server(s) hosting the FIM Portal and Password Portal must have the following software installed:

Note
If you decide to install the FIM Portal and Password Portal software on different servers, the software prerequisites for both servers are the same.

• Windows Server 2008 or Windows Server 2008 R2 64-bit Standard or Enterprise Editions.
  
  

  Important
  When you install Windows Server 2008, do not install Windows Server 2008 Terminal Services. If you install Terminal Services, the FIM 2010 server components do not install.

• Microsoft .NET Framework 3.0 Features
  
  

  Note
  Microsoft .NET Framework 3.0 Features can be installed from the Features options interface included with Windows Server 2008.

• Microsoft .NET 3.5 SP1 Framework
  
  

  Note
  You can download Microsoft .NET 3.5 SP1 Framework here http://go.microsoft.com/fwlink/?LinkId=129538.

• Windows SharePoint Services 3.0 SP1 or SP2
  
  

  Note
  You can download Windows SharePoint Service 3.0 SP2 here http://go.microsoft.com/fwlink/?LinkID=152405.

  Note
  Make sure you install Windows SharePoint services before you install other server roles. Refer to the installation guide for SharePoint Services for further information: http://go.microsoft.com/fwlink/?LinkID=123878.

• Windows SharePoint Services 3.0 Language Pack
  
  

  Note
  If you have installed Windows SharePoint Services 3.0 in a different language than English, then you must install the Windows SharePoint Services 3.0 Language Pack. You can download SP2 from http://go.microsoft.com/fwlink/?LinkID=178266

The client computers that host the FIM add-ins and extensions components must meet the following software requirements:

• Windows XP Professional SP2 or later, 32bit or Windows Vista Enterprise SP1 or later, 32 or 64bit, or Windows 7, 32 or 64 bit.
  
  
• Windows Installer 3.1 or later (only needed for Windows XP SP2)
  
  

  Note
  You can download Windows Installer 3.1 here http://go.microsoft.com/fwlink/?LinkID=62933

• Microsoft .NET Framework 3.5 SP1
  
  

  Note
  You can download Microsoft .NET 3.5 SP1 Framework here http://go.microsoft.com/fwlink/?LinkId=129538.

• Microsoft Office Outlook 2007 SP2
  
  This software is required only if you use the FIM Office add-in.
  
  
  
  
• Microsoft Forms 2.0 .NET Programmability Support
  
  This software is required only if you use FIM 2010 Office Integration.
  
  

  Note
  This software is an add-in feature of Microsoft Office 2007. To install this software, select Microsoft Forms 2.0 .NET Programmability Support option under Office Tools when you run setup for Microsoft Office 2007.

• Smart Tag .NET Programmability Support
  
  This software is required only if you use FIM 2010 Office Integration.
  
  

  Note
  This software is an add-in feature of Microsoft Office 2007. To install this software, select Smart Tag .NET Programmability Support option under Office Tools when you run setup for Microsoft Office 2007.

• .Net Programmability Support for Microsoft Office Outlook
  
  This software is required only if you use FIM 2010 Office Integration.
  
  

  Note
  This software is an add-in feature of Microsoft Office 2007. To install this software, select the .NET Programmability Support option under Microsoft Office Outlook when you run setup for Microsoft Office 2007.

To run the FIM Service component, you must have a dedicated domain service account. To be able to use the Outlook integration feature, an Exchange mailbox must also be created for this account. To use the FIM Add-in for Outlook feature, you must set up the domain service e-mail account on a server that hosts Microsoft Exchange Server 2007 or Microsoft Exchange Server 2010.

This account will also be used to send e-mail notifications from FIM 2010.

This account should not be granted local administrator permissions.

Important

You must reserve the domain service e-mail account for the exclusive use of the FIM Service. If you do not, and any e-mail accounts move messages from the e-mail Inbox, the e-mail processor does not see these messages. In addition, after the e-mail processor reads a message from the Inbox, it moves the message to another folder, potentially causing problems for other accounts that attempt to use that e-mail account.

You must create a service account to run the FIM Synchronization Service, this service account must be a domain service account. This account should not be a local administrator account.

You must create a domain service account that is reserved for the exclusive use of the FIM management agent (FIM MA) used by the FIM Synchronization Service to communicate with the FIM Service. The FIM Service has to know the name of the account that the FIM MA is using so that during setup, it can give the account the required rights. This account should not be a local administrator account.

Understanding the Purpose of the FIM management agent account

As mentioned above, there are two service accounts used to run the FIM server components. They are called the FIM Service service account and FIM Synchronization Service service account in this guide. The FIM MA account is not considered a service account and should be a regular user account. For the FIM Synchronization Service service account to be able to impersonate the FIM MA account, the FIM MA must be able to logon locally. Start Administrative Tools, click Local Security Policy and open the node Local Policies, User Rights Assignment. In the policy Allow log on locally make sure the FIM MA account is explicitly specified or add it to one of the groups that is already granted access.

To configure the server(s) running the FIM server components in a secure manner, the service accounts should be restricted. The easiest way to do this is by running Local Security Policy from Administrative Tools, navigate to Local Policies\User Rights Assignment and add the service account to the policy.

Use the following restrictions on the service accounts:

• Deny logon as a batch job
  
  
• Deny logon locally
  
  
• Deny access to this computer from the network
  
  

The service accounts should not be a member of the local administrators group.

The FIM Synchronization Service service account should not be a member of the security groups used to control access to FIM Synchronization Service (groups starting with FIMSync, e.g. FIMSyncAdmins).

If you select to use the same account for both service accounts and you separate the FIM Service and the FIM Synchronization Service, then you cannot set Deny access to this computer from the network on the FIM Synchronization Service server. If access is denied that would prohibit the FIM Service to contact the FIM Synchronization Service to change configuration and manage passwords.

In a lab environment it might be that you want to run Exchange on the same server as the FIM Service. If you do, ensure that you are reconfiguring Exchange Web Service to not use the default port 80 or else Exchange Web Service will not be reachable.

You must either specify a different port, or a different IP or different host name in IIS.

If the installed version of SharePoint Services is non-English, FIM 2010 setup will fail. In order to install FIM 2010, you must first install the SharePoint Service English Language pack SP2, located here: http://go.microsoft.com/fwlink/?LinkID=178266.

Before you install the FIM Portal and Password Portal, run the SharePoint 3.0 Services configuration wizard. This will create a default SharePoint site for you.

If you have installed SharePoint in a SharePoint farm, the default site will not be created by the wizard and must be created manually. How to setup a SharePoint farm is outside the scope of this installation guide.

Verify the SharePoint installation by navigating to http://localhost:80 on the server where you will install the FIM Portal. You should see a SharePoint site and not the standard Welcome to IIS7. If you see the Welcome to IIS7 message, please reconfigure SharePoint to have a default SharePoint site at this server address.

If you do not perform this task you may have to reinstall the FIM Portal and Password Portal components of FIM 2010.

It is highly recommended that you use SSL on the FIM Portal server to secure the traffic between the clients and the server.

1. Open IIS Manager on the FIM Portal server.

2. Click the local computer name.

3. Click Server Certificates.

4. Click Create Certificate Request.

5. For Common Name, enter the name of the server.

6. Click Next, then Next.

7. Save the file to any location. You will need to access this in subsequent steps.

8. In Internet Explorer, browse to https://servername/certsrv. Replace servername above with the name of the server issuing certificates.

9. Click Request a new Certificate.

10. Click submit an Advanced Request.

11. Click Submit a Certificate Request by using a base-64-encoded.

12. Paste in the contents of the file you save in the above step.

13. From Certificate Template, select Web Server.

14. Click Submit.

15. Save the Certificate to your Desktop.

16. In IIS Manager, click Complete Certification Request.

17. Point it to the certificate you just saved to the Desktop.

18. For Friendly name, enter the name of the server.

19. Click Sites, then select Sharepoint – 80.

20. Click Bindings, then click Add.

21. Select https.

22. For certificate, select the one that has the same name as the server (this is the cert you just imported).

23. Click OK.

24. Remove the http binding.

25. Click SSL Settings and check Require SSL and Require 128-bit SSL

26. Save the settings.

27. Click Start, then click Administrative Tools, then click Sharepoint 3.0 Central Administration.

28. Click Operations, then select Alternate Access Mappings.

29. Click http://servername.

30. Change it to https://servername and click OK.

31. Click Start, Run, enter iisreset, and click OK.

32. In Internet Explorer, navigate to https://servername/identitymanagement.

Before you install the FIM Service, there are certain tasks which should be verified and completed on the SQL server.

Make sure the service accounts used by SQL Server Database and SQL Server Agent are either domain accounts or a built-in service accounts (e.g. Network Service).

When you configure the service account for SQL, please consult the following articles:

1. http://msdn.microsoft.com/en-us/library/ms345380.aspx
   
   
2. http://msdn.microsoft.com/en-us/library/ms191543.aspx
   
   

Important
The SQL Server service account should not be a local computer account. A local account cannot impersonate domain accounts and the FIM Service will not behave as expected.

Note
The Windows Services SQL Server, SQL Server Agent and SQL Full-text Filter Deamon Launcher must run under the same account.

Important
If you install the SQL 2008 database on a different server than the FIM Service or FIM Synchronization Service, you will need to open additional ports in order for FIM 2010 setup to communicate with SQL Server 2008. For more information, see Configuring the Windows Firewall to Allow SQL Server Access.

When FIM Service and FIM Synchronization Service are installed, the data and log files will be created in the default locations specified by SQL. For optimal performance, those should be located on different drives and on different spindles.

1. Start Microsoft SQL Server Enterprise Manager
   
   
2. Right-click the server and select Properties.
   
   
3. Go to Database settings. Make necessary adjustments on the Data and Log settings to make sure the database files are located on a different drive than the operating system.
   
   

If you plan to install FIM Service or FIM Synchronization Service on a SQL Server using a non-default port then you must create a SQL alias for setup to be able to contact the SQL server.

1. Start the SQL Server Configuration Manager.
   
   
2. Navigate to SQL Native Client 10.0 Configuration/Aliases.
   
   
3. Create a new alias with your server information.
   
   

For Kerberos to be enabled you have to establish SPNs in the domain. Enabling Kerberos will make the traffic secure and is required for the clients to be able to communicate with the FIM Service.

SPNs are needed if you separate the FIM Portal and the FIM Service to different servers or if you use the FIM Password Reset Extension. You also have to create SPNs if the network address used by users and clients is not the same as the server name (e.g. by using CNAMES).Different SPNs are used by the FIM Portal server and the FIM Service server. For the FIM Service server, take the following steps:

• Establish the Service Principal Names (SPN) for the FIM Service by running the following commands:
  
  
  • setspn –A FIMService/servername domain\serviceaccount
    
    
  • setspn –A HTTP/servername domain\serviceaccount
    
    
  • The servername above is the address entered during FIM Service setup and used by the clients to contact the Web Service.
    
    
  • The serviceaccount above is the account used by the FIM Service.
    
    
  • If you are using several different names, e.g. FQDN and NetBIOS names to contact the server, repeat the steps for every name.
    
    
• Enable the FIM Service server for Kerberos delegation in Active Directory. You can either select to enable delegation for the entire server by selecting Trust this computer for delegation to any service or by using constrained delegation (recommended) by selecting Trust this computer for delegation to the specified services only. If you select to use constrained delegation, search for the FIM Service service account and select the entries added in the previous step.
  
  

For the FIM Portal server, take the following steps:

• If the address the clients use to contact the FIM Portal is not the same as the server address you have to establish an SPN for http. E.g. If you use a CNAME in DNS for the clients to use, this address must be registered or Internet Explorer will not be able to use Kerberos when contacting the portal. Run the following command:
  
  setspn –A HTTP/FIMPortalAddress servername
  
  
  • The FIMPortalAddress above is the address used by clients to contact the FIM Portal server, repeat the steps for every name.
    
    
  • Servername is the real name of the server.
    
    
  • If you are using several different names, e.g. FQDN and NetBIOS names to contact the server, repeat the steps for every name.
    
    
  • If you have several servers hosting the FIM Portal, run this for every server.
    
    
  • Enable Kerberos delegation in Active directory for HTTP. You can either select to enable delegation for the entire server by selecting Trust this computer for delegation to any service or by using constrained delegation (recommended) by selecting Trust this computer for delegation to the specified services only. If you select to use constrained delegation, search for the servername and select the entry added in the previous step.
    
    

The FIM Synchronization Service consists of the metadirectory, provisioning engine, and management agents for various connected data sources. It supports synchronizing data between the FIM Synchronization database and other identity stores in the enterprise.

During the installation of the Synchronization Service, the firewall on the machine hosting this service is configured to allow Dynamic RPC and RPC endpoint mapper access to the FIM Synchronization Service.

The FIM Synchronization Service creates five security groups. The first three groups correspond to the FIM Synchronization Service user roles: Administrator, Operator, and Joiner. The other two groups are used for granting access to the Windows Management Instrumentation (WMI) interfaces: Connector Browse and Password Set.

By default the FIM Synchronization Service creates the five security groups as local computer groups, instead of domain global groups. If you plan to use domain global groups, you must create the groups before you install the FIM Synchronization Service.

1. From the FIM 2010 splash screen click the Install Synchronization service link.

2. Run setup.exe and then follow the instructions in the installation wizard.

   Important
   Setup.exe will be run with elevated privileges. If UAC is enabled, installing the FIM Synchronization Service without elevated privileges will cause the installation to fail.

   Important

   The user account used to install the FIM Synchronization Service must be granted the sysadmin role in SQL Server 2008.  By default, members of the Local Administrators group do not have the necessary permissions.  Unless the user account is either the built-in administrator account, or the user account used to install SQL Server 2008 then the user account must be granted the sysadmin role in SQL Server 2008.

3. On the Group Information page, when you are prompted for the five security groups use the default local groups or type the details for the global groups that you created. If you use global groups, prefix the groupname with domain\.

Installing the FIM Service installs the Web services parts of FIM 2010 and also configures the FIM Service database on the server that hosts SQL Server 2008.

During the installation of FIM Service, port 5725 and 5726 are opened and exceptions for these ports are added to the Windows Server 2008 firewall settings. Opening these ports enables communication to the FIM 2010 Service from the FIM Portal, FIM Password Reset Portal, FIM Synchronization Service and FIM Password Reset Extensions components installed on other computers in your organization.

1. From the FIM 2010 splash screen click the Install Service and Portal link.

2. Run Setup.exe, and then follow the instructions in the installation wizard.

   Important
   The SQL Agent must be running on the SQL server before you run the installation of FIM Service.

   Important
   The user account used to install the FIM Service must be granted the sysadmin role in SQL Server 2008.  By default, members of the Local Administrators group do not have the necessary permissions.  Unless the user account is either the built-in administrator account, or the user account used to install SQL Server 2008 then the user account must be granted the sysadmin role in SQL Server 2008.

3. On the Custom Setup page you are prompted for the applications that you want to install. From the drop-down menu located next to FIM Services, click, Will be installed on local hard drive. If you do not want to install all of the components on one server, deselect FIM Portal and FIM Password Portal by clicking the drop-down menus located next to them and clicking, Entire feature will be unavailable.

4. Click Next.

5. On the Configure Common Services page, in the Database Server field, enter the name of the server that hosts SQL Server 2008.

6. Click Next.

7. On the Configure Common Services - Configure mail server connection page, in Mail Server, type the name of the server hosting the Exchange Web services.

   Important
   If you have several FIM Service servers using the same database, make sure to only leave the checkbox Enable polling of Exchange Server 2007 enabled on one of the servers. This server will be responsible for fetching e-mail messages from the Exchange web service interface and make them into requests.

8. Click Next.

9. On the Configure Common Services - Configure service certificate page, select to generate a new self-issued Microsoft Forefront Identity Manager certificate that is used by the web service to validate communication from the clients, or select a certificate from the certificate store, then click Next.

   Note
   The certificate is only validated by the server so you do not have to trust it on the clients. For this reason you can safely use a self-issued certificate and do not need one issued by your enterprise CA.

   Note
   If your organization has already created an in-house Certification Authority (CA), then a public key pair can be generated for the service to use.

10. On the Configure Common Services - Configure the FIM service account page provide the credentials for the FIM domain service account.

    In Service e-mail Account, make sure that you type the e-mail address for the FIM service account, not your personal e-mail address.

11. Click Next.

12. On the Configure Common Services – Configure the Forefront Identity Manager synchronization connection, in the Synchronization Server field enter the name of the server hosting the FIM Synchronization Service component.

    In the FIM 2010 Management Agent Account* field enter the domain\Account of the FIM management agent account. This is the account you created in the Create a domain FIM management agent account section of this document.

13. Click Next.

14. In Configure FIM Service and Portal – Configure connection to the FIM Service, enter the address the clients should use to contact the FIM Service. If you plan to use an alternative name (e.g. a CNAME in DNS) then the alternative name should be entered. If you plan to have several FIM Service servers in an NLB cluster, then the name of the cluster address should be entered.

    Note
    The names should match the SPNs (Service Principal Names) you created in the pre-installation tasks.

    Important
    This name must be stable and clients must be able to resolve it to the IP addresses of the server where the FIM Service is installed. This address is also used by password reset clients to reach the server.

15. Click Next.

16. On the Configure FIM Service and Portal – Configure security changes configured by setup, check Open ports 5725 and 5726 in firewall to allow clients to contact the web service interface.

17. Click Next, then click Install.

The FIM Portal allows users who have authorized access to manage the activities that are requested and sent to the FIM Service.

Note

To be able to install the FIM Portal it is assumed that Windows SharePoint is installed with default settings and the default SharePoint site can be reached on the address specified in the UI and that the user installing the FIM Portal is authorized as an administrator of that SharePoint site. On a standalone WSS server the default address will be http://localhost and if you enabled SSL earlier, the address will be https://localhost.

Note

If you install the FIM Portal on a Windows SharePoint server farm, the address http://localhost is not available by default. To add localhost to the list of known addresses, start SharePoint 3.0 Central Administration and navigate to Operations, Alternate Access Mappings, Edit Public Zone URLs. Add http://localhost to the Intranet zone leaving the Default zone with the SharePoint server farm address.

Important
For security purposes, it is required that you implement Secure Sockets Layer (SSL) on the server running Internet Information Services (IIS). You can enable SSL before or after installation of the FIM Portal.

Note
If you add SSL after installation of the FIM Portal, make sure to run a change install on the FIM Service and Portal and change the address of the portal. If you do not provide the correct address to the installer, future updates to the product will not install successfully.

1. From the FIM 2010 splash screen click the Install Service and Portal link.

2. Run Setup.exe, and then follow the instructions in the installation wizard.

3. On the Custom Setup page you are prompted for the applications that you want to install. From the drop-down menu located next to FIM Portal, click, Will be installed on local hard drive. If you do not want to install all of the components on one server, deselect FIM Service and FIM Password Reset Portal by clicking the drop down menus located next to them and clicking Entire feature will be unavailable.

4. Click Next.

5. On the FIM Service server address page, enter the name of the server hosting the FIM Service. This should be the same address as used during the FIM Service installation.

6. Click Next.

7. In Enter the URL to the SharePoint.., enter the address to the SharePoint site where the FIM Portal should be installed. This is the full address, including port number if needed, to access the site collection. This address is http://localhost or https://localhost if you followed earlier steps.

8. Click Next.

9. On the Configure FIM Service and Portal – Configure security changes configured by setup, check Grant authenticated users access to the FIM Portal site to grant read permissions on the portal site

10. Click Next, then click Install.

Test the portal by opening Internet Explorer and navigate to http://servername/identitymanagement.

When using the FIM Portal in Windows Server 2008, the controls or buttons will not work unless the browser security settings for Internet Explorer are adjusted to enable JavaScript.

The FIM Password Reset Portal lets users perform self-service password reset by using a web portal.

1. From the FIM 2010 splash screen click the Install Service and Portal link.

2. Run setup.exe, and then follow the instructions in the installation wizard.

3. On the Custom Setup page you are prompted for the applications that you want to install. From the drop-down menu located next to FIM Password Reset Portal, click Will be installed on local hard drive. If you do not want to install all of the components on one server, deselect FIM Service and FIM Portal by clicking the drop down menus located next to them and clicking Entire feature will be unavailable.

4. Click Next.

5. On the FIM Service server address page, enter the name of the server hosting the FIM Service. This should be the same address as used during the FIM Service installation.

6. Click Next.

7. In Enter the URL to the SharePoint.., enter the address to the SharePoint site where the FIM Portal should be installed. This is the full address, including port number if needed, to access the site collection. This address is http://localhost or https://localhost if you followed earlier steps.

8. Click Next.

9. On the Configure FIM Service and Portal – Configure security changes configured by setup, check Grant authenticated users access to the FIM Portal site to grant read permissions on the portal site.

10. Click Next, then click Install.

The FIM Service and Portal Language Pack will install additional languages for the Portal. The localized components are both additional SharePoint server solution packs and database upgrades. For this reason, the installation must be completed on every server.

Important
The installation of a language to the database cannot be undone. Make sure you have a database backup before you install the Language Pack.

With the release of FIM 2010, nine additional languages are offered.

• • Chinese (Simplified)
    
    
  • Chinese (Traditional)
    
    
  • Dutch (Netherlands)
    
    
  • French (France)
    
    
  • German (Germany)
    
    
  • Italian (Italy)
    
    
  • Japanese (Japan)
    
    
  • Portuguese (Portugal)
    
    
  • Spanish (Spain)
    
    

1. From the FIM 2010 splash screen click the Download Server and Client Language Packs link.

2. Extract the download to a local directory.

3. Run Setup.exe, and then follow the instructions in the installation wizard.

4. On the Custom Setup page you are prompted for the languages you want to install. If you have separated the FIM Service from the FIM Portal, select only the features installed on this server.

5. Click Install.

Note
The installation of the Language Pack will take considerable time. The completion bar will go to 95% completed almost immediately and will not make any progress while the database is configured. This can take 10 minutes or more per installed language.

To verify that the language pack has installed successfully and that you can now view the FIM Portal in your selected language, follow the steps below.

1. Log on to the FIM Portal Server or navigate to the server from another computer using Internet Explorer.

2. Open Internet Explorer and go to the Tools and select Internet Options from the drop-down list.

3. On the General tab, select Languages from the bottom.

4. Click the Add button and select your desired language from the list.

5. Click OK.

6. On the Language Preferences page, select your desired language under Language: and click Move up. Do this until your language is at the top.

   Note
   For simplified Chinese, you need to set the language to zh-CN, and for traditional Chinese, set the language to zh-TW. Otherwise, the portal will not recognize it as supported language and will fall back to English.

7. Click OK.

8. Click OK.

9. Close Internet Explorer.

10. Open Internet Explorer and browse to the FIM 2010 home page. Everything should now be in your selected language.

The following steps will show how to install the Add-ins and Extensions language pack so that users can take advantage of localized versions of the FIM Outlook Add-in and the Password Reset Extensions. The following assumes that you have already setup and deployed the FIM 2010 Add-ins and Extensions software.

With the release of FIM 2010, 33 additional languages are offered for the FIM client.

• • Bulgarian (Bulgaria)
    
    
  • Chinese (Simplified)
    
    
  • Chinese (Traditional)
    
    
  • Croatian (Croatia)
    
    
  • Czech (Czech Republic)
    
    
  • Danish (Denmark)
    
    
  • Dutch (Netherlands)
    
    
  • Estonian (Estonia)
    
    
  • Finish (Finland)
    
    
  • French (France)
    
    
  • German (Germany)
    
    
  • Greek (Greece)
    
    
  • Hindi (India)
    
    
  • Hungarian (Hungary)
    
    
  • Italian (Italy)
    
    
  • Japanese (Japan)
    
    
  • Korean (Korea)
    
    
  • Latvian (Latvia)
    
    
  • Lithuanian (Lithuania)
    
    
  • Norwegian (Bokmal)
    
    
  • Polish (Poland)
    
    
  • Portuguese (Brazil)
    
    
  • Portuguese (Portugal)
    
    
  • Romanian (Romania)
    
    
  • Russian (Russia)
    
    
  • Serbian (Latin)
    
    
  • Slovak (Slovakia)
    
    
  • Slovenian (Slovenia)
    
    
  • Spanish (Spain)
    
    
  • Swedish (Sweden)
    
    
  • Thai (Thailand)
    
    
  • Turkish (Turkey)
    
    
  • Ukrainian (Ukraine)
    
    

1. Log on to a client with administrator permissions.

2. Run Setup.exe, and then follow the instructions in the installation wizard.

3. On the Microsoft Forefront Identity Manager Client Language Pack Setup screen, click Next.

4. On the End-User License Agreement screen, select I accept the terms in the License Agreement and click Next.

5. On the Custom Setup screen, select the languages you wish to install and click Next.

6. Click Install.

7. When the install has completed, click Finish.

The following steps will demonstrate how to verify that the FIM Add-in for Outlook is using localization.

1. Log on to a client computer with administrator permissions.

2. Go to Start and click Control Panel.

3. From Control Panel select Regional and Language Options.

4. On the Options tab, under Select an item to match its preferences, or click Customize to choose your own formats: select your desired language from the drop-down.

5. On the Languages tab, under Language to be used in menus and dialogs: select your desired language. Note: If you do not see any display languages you must install the MUI packs. For more information on this, see Install a display language in the Windows XP help.

6. Click the Advanced tab, under Select a language to match the language version of the non-Unicode programs you want to use: select your desired language from the drop-down list.

7. Click Apply.

8. This may bring up a pop-up window that says the required files are already installed on your hard disk. You can click Yes to use these files and skip the process of copying them from the CD, otherwise you may need the original Windows XP installation media to copy the required file.

9. Click Yes to reboot the Windows XP client.

10. When the client restarts log on to the machine.

11. Open Outlook and use the functionality of the FIM Add-in for Outlook.

12. To view in another language, repeat steps 1 through 10.

1. Log on to a client computer with administrator permissions.

2. Go to Start and click Control Panel.

3. From Control Panel select Regional and Language Options.

4. On the Formats tab, next to Current Format: select your desired language from the drop-down.

5. On the Keyboard and Languages tab, under Display language, select your desired language.

   Note
   If you do not see any display languages you must install the MUI packs. For more information on this, see Install a display language in the Windows Vista help.

6. Click OK.

7. Click Apply.

8. Click OK.

9. Open Outlook and use the functionality of the FIM Add-in for Outlook.

10. To view in another language, repeat steps 1 through 11.

• Add the service account used by the FIM Service to the FIMSyncAdmins group. This will allow the FIM Service to configure the FIM Synchronization service.
  
  
• If you plan to use the Password reset feature of FIM 2010, add the service account used by FIM Service to the security group FIMSyncPasswordSet.
  
  
• Restart the FIMService service for group membership to be effective.
  
  

The following are best practices for configuring Exchange for the FIM Service service account.

1. Configure the service account so that it can accept mail only from internal e-mail addresses. Specifically the service account mailbox should never be able to receive mail from external SMTP servers.
   
   In the Exchange Management Console, select the FIM Service service account, select Properties, Mail Flow Settings, and Mail Delivery Restrictions. Check the checkbox Require that all senders are authenticated. For further information, see
   
   http://technet.microsoft.com/en-us/library/bb397214.aspx
   
   
2. Configure the service account so that it rejects mail with sizes greater than 1 MB.
   
   Follow the best practice of configuring Exchange 2007 message size limits:
   
   http://technet.microsoft.com/en-us/library/bb124708.aspx.
   
   
3. Configure the service account so that it has a mailbox storage quota of 5 GB.
   
   Follow the best practice of configuring Exchange 2007 mailbox size limits:
   
   http://technet.microsoft.com/en-us/library/aa998353.aspx.
   
   

It is recommended that you disable Sharepoint indexing. There are no documents that need to be indexed, and indexing will result in many error log entries and potential performance problems with FIM 2010.

1. On the server that hosts the FIM 2010 Portal, click Start.

2. Click All Programs.

3. From the All Programs list click Administrative Tools.

4. Under Administrative Tools, click SharePoint 3.0 Central Administration.

5. On the Central Administration page, click Operations.

6. On the Operations page, under Global Configuration, click Timer job definitions.

7. On the Timer Job Definitions page, click SharePoint Services Search Refresh.

8. On the Edit Timer Job page, click Disable.

If your Exchange server is using a certificate that is untrusted by the FIM Service, the certificate used by the Exchange server must be added to the local certificate store.

You can verify if you have an untrusted certificate by:

1. Open Internet Explorer and navigate to https://mailserver/ews/Services.wsdl. If you receive a certificate error then you must complete the steps in this section. Mailserver above is the Microsoft Exchange server that you specified when you installed the FIM 2010 component.
   
   

If you have several FIM Service servers, this task must be completed on every server.

Note
You must run the installation of the Microsoft Exchange certificate with elevated rights. If UAC is enabled, installing the Microsoft Exchange certificate without elevated rights will cause the installation to fail.

1. Open Internet Explorer.

2. In the address bar, type https://mailserver/EWS/Services.wsdl.

   Mailserver is the Microsoft Exchange server that you specified when you installed the FIM 2010 component.

   Select Continue to this Web site.

3. In the Security Alert dialog box (where it reads Certificate Error), click View Certificate.

4. In the Certificate dialog box, click Install Certificate.

5. On the Welcome to the Certificate Import Wizard page, click Next.

6. On the Certificate Store page, select Place all certificates in the following store and click Browse.

7. Select the checkbox Show physical stores, navigate to Trusted People\Local Computer, and select this store. Click OK.

8. Select Next.

9. Select Finish to import the certificate.

In this procedure, you will ensure that the Exchange 2007 Web Service (EWS) is running and can be accessed as the FIM service account.

1. Open Internet Explorer as the FIM 2010.

2. In the address bar, type https://<mail server>/EWS/Exchange.asmx.This makes sure that you can access EWS using the FIM service account.

FIM 2010 uses Windows Communication Foundation (WCF) performance counters to monitor service usage. Monitoring service usage with WCF performance counters is an optional step to enable when diagnosing performance problems. It is not necessary to leave performance counters enabled for normal operations. To enable and configure WCF performance counters, see this MSDN article http://go.microsoft.com/fwlink/?LinkId=164848.

Recommended configuration

Assign dbo role to administrators

Assign enough space for the database

Create additional tempdb files

Limit SQL server memory usage

The Management Pack for FIM 2010 allows System Center Operations Manager to monitor identity management scenarios for FIM 2010. Examples include:

• Management agent errors requiring administrative intervention
  
  
• Events indicating service outages
  
  
• Alerts indicating configuration issues and connected data source changes
  
  
• Verification that all dependent services are running
  
  
• Notification if the password management is denying access to requests
  
  
• Notification when account provisioning doesn’t occur correctly
  
  

1. Go to the Microsoft System Center Pack Catalog.

2. In System Center Pack for: select Forefront Identity Manager 2010 and click Search.

3. In the search results, click the System Center Pack for FIM 2010.

4. Follow the download instructions.

Optionally, you may also download and install the management pack from within System Center Operations Manager 2007 R2. For more information, see the Microsoft Web site.

All components of FIM 2010 accept properties to allow unattended and silent installation. Those properties can either be set in a Windows Installer Transform (MST) file or specified on the command line during installation.

The FIM installation packages do not support advertisement (msiexec /j) or administrative (msiexec /a) installations.

There are several different ways to install FIM silently (unattended), Two methods are described in this section, pass in parameters in a command line and using MST files. It is outside the scope of this document to describe unattended installations in general.

Pass in parameters on the command line

Create an MST file

Troubleshoot an installation

Features and properties

FIM Portal Access

Every user who accesses the FIM Portal must have an Account in Active Directory and a resource in the FIM Service database with the ObjectSID, Domain, and Accountname attributes representing the user in Active Directory.

Note
For more information about synchronizing users between FIM 2010 and Active Directory, see Publishing Active Directory User From Two Authoritative Data Sources included in the FIM 2010 documentation set.

Active Directory to FIM 2010 Initial Data Load

If you have existing data that you want synchronized from Active Directory to FIM 2010, you have to perform an initial data load. This is a one-time operation and is not a continuous synchronization. It is not required to complete this to successfully setup FIM 2010.

Note
For more information about synchronizing users between FIM 2010 and Active Directory, see the Publishing Active Directory User From Two Authoritative Data Sources document included in the FIM 2010 documentation set.

Configure the SQL Server for initial data load

When you plan to initially load a lot of data, you can shorten the time it will take to populate the database by temporarily turning off the full text search and enable it again after the export on the FIM MA has completed.

Follow these steps to temporarily turn off Full Text Search:

1. Start SQL Enterprise Manager.
   
   
2. Select New Query
   
   
3. Run the following SQL statements:
   
   
   ALTER FULLTEXT INDEX ON [fim].[ObjectValueString] SET CHANGE_TRACKING = MANUAL
   ALTER FULLTEXT INDEX ON [fim].[ObjectValueXml] SET CHANGE_TRACKING = MANUAL
   

4. Complete the export of the FIM MA.
   
   
5. Run the following SQL statements to turn on Full Text search again:
   
   
   ALTER FULLTEXT INDEX ON [fim].[ObjectValueString] SET CHANGE_TRACKING = AUTO
   ALTER FULLTEXT INDEX ON [fim].[ObjectValueXml] SET CHANGE_TRACKING = AUTO