Verify that you have the following administrative credentials:

• You must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site.
  
  
• The Farm Administrator account, which is created during the SharePoint farm setup, must also be a System Administrator (sysadmin) on the server where the User Profile Synchronization service is deployed
  
  
• The Farm Administrator account must be a Service Administrator with Full Control permissions for the User Profile Service that you are configuring. For more information about how to set Full Control permissions, see Delegate administration of a User Profile service application (SharePoint Server 2010).
  
  
• The Service Administrator account can log on locally to the server where Profile Synchronization will be deployed.
  
  
• If you are using a Windows Server 2003 AD DS forest, the Service Administrator account must be a member of the Pre-Windows 2000 Compatible Access group for the domain with which you are synchronizing. For more information about adding accounts to the Pre-Windows 2000 Compatible Access group, see Some applications and APIs require access to authorization information on account objects (http://go.microsoft.com/fwlink/?LinkId=179420).
  
  

For the steps that are needed to start the User Profile Synchronization service, see Starting or stopping a service .

When starting the User Profile Synchronization service, you are asked to associate the service with the appropriate User Profile Service application. Select the appropriate User Profile Service application from the Select the User Profile Service Application drop-down list and then click OK.

Note:
After starting the User Profile Synchronization service, wait for 5-10 minutes before proceeding to the next step.

Run services.msc and verify that the Forefront Identity Manager Synchronization Service and the Forefront Identity Manager Service are running.

These services are started automatically when the User Profile Synchronization service is started. It may take up to 10 minutes for these to start after starting the User Profile Synchronization Service. Do not start them manually.

Verify that the ILMMA and MOSS-<User Profile Service application name> folders are present in %Programfiles%\Microsoft Office Servers \14.0\Synchronization Service\MaData. These folders will be empty.

Run IISReset on the server where the User Profile Synchronization service is provisioned. For more information about IISReset, see IIS Reset Activity (http://go.microsoft.com/fwlink/?LinkId=179336).

Verify that you have the following administrative credentials:

• You must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site
  
  
• You must be a Service Administrator with Full Control permissions for the User Profile Service that you are configuring. For more information about how to set Full Control permissions, see Delegate administration of a User Profile service application (SharePoint Server 2010).
  
  
• If you are synchronizing profile information by using AD DS, the account that is used to connect to AD DS must have Replicate Directory Changes permissions in AD DS. This account must be the same as the farm administrator account or the User Profile Service administrator account and is required to do either full or incremental synchronization with AD DS
  
  

Before proceeding, make sure that you have determined which directory service containers that you want synchronized with SharePoint Server.

Note:
We recommend that you create only one Profile Synchronization connection per directory service forest.

On the Central Administration Web site, in the Application Management section, click Manage service applications.

On the Manage Service Applications page, click in the Title column of the User Profile Service Application row to select it.

In the Operations group of the ribbon, click Manage.

On the Manage Profile Service page, in the Synchronization section, click Configure Synchronization Connections.

On the Synchronizations Connections page, click Create New Connection.

On the Add new synchronization connection page, type a name for the synchronization connection in the Connection Name box.

From the Type list, select the kind of directory service to which you want to connect.

If the selected type is Business Data Catalog, select a Business Data Catalog entity and select whether the entity has a 1:1 mapping or a 1:many mapping. Then click OK. Otherwise, continue with the following steps.

In the Connection Settings section, type the name of the directory service forest to which you want to connect, the account credentials for the directory service, and the port that you want to use when you connect to the directory service. Select Auto discover domain controller to automatically locate the domain controller for this forest or type the name of the domain controller in the Domain controller name box.

Important:
In SharePoint Server 2010 Beta, when you are using AD DS, the first segment of the directory service forest name must contain the NetBIOS name of the computer that is running active directory.

In the Connection Settings section, select the Use SSL-secured connection: check box, if needed, to use a Secure Socket Layer connection when you connect to the directory service.

In the Containers section, click Populate Containers and then select the containers from the directory service that you want to synchronize. Click Select All if you want to synchronize all containers. For example, if you only want to synchronize user information, you can select only those containers that have user profile information.

Note:
In SharePoint Server 2010 Beta, this part of the user interface may not function correctly in Internet Explorer 8. If this happens, press F12 to start the developer console and select Internet Explorer 7 from the drop-down menu at the top. Let Internet Explorer reload the page and then click Populate Containers.

Click OK.

Verify that you have the following administrative credentials:

• you must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site
  
  
• you must be a Service Administrator with Full Control permissions for the User Profile Service that you are configuring. For more information about how to set Full Control permissions, see Delegate administration of a User Profile service application (SharePoint Server 2010).
  
  
• The Farm Administrator account, which is created during the SharePoint farm setup, must also be a System Administrator (sysadmin) on Microsoft SQL Server 2005 or Microsoft SQL Server 2008
  
  
• If synchronizing profile information with AD DS, the account that is used must have Replicate Directory Changes permissions. This account must be the same as the farm administrator account or the User Profile Service administrator account and is required to do either full or incremental synchronization with AD DS
  
  

On the Central Administration Web site, in the Application Management section, click Manage service applications.

On the Manage Service Applications page, click in the Title column of the User Profile Service Application row to select it.

In the Operations group of the ribbon, click Manage.

On the Manage Profile Service page, in the Synchronization section, select Configure Synchronization Connections.

On the Synchronization Connections page, right-click the connection for which you want to change Profile Synchronization connection filters and select Edit Connection Filters.

Note:
In SharePoint Server Beta, this part of the user interface may not function correctly in Internet Explorer 8. If this happens, press F12 to start the developer console and select Internet Explorer 7 from the drop-down menu at the top. Let Internet Explorer reload the page and then select Edit Filters.

On the Edit connection filters page, in the Exclusion Filters for Users section, select the user property for which you want to apply a synchronization filter from the attributes list, configure the filter parameters for that property and then click Add.

On the Edit connection filters page, in the Exclusion Filters for Groups section, select the group property for which you want to apply a synchronization filter from the attributes list, configure the filter parameters for that property and then click Add.

When you have finished adding Profile Synchronization connection filters, click OK.

Verify that you have the following administrative credentials:

• You must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site
  
  
• You must be a Service Administrator with Full Control permissions for the User Profile Service that you are configuring. For more information about how to set Full Control permissions, see Delegate administration of a User Profile service application (SharePoint Server 2010).
  
  
• The Farm Administrator account, which is created during the SharePoint farm setup, must also be a System Administrator (sysadmin) on Microsoft SQL Server 2005 or Microsoft SQL Server 2008
  
  
• If you are synchronizing profile information with AD DS, the account that is used must have Replicate Directory Changes permissions. This account must be the same as the farm administrator account or the User Profile Service administrator account and is required to do either full or incremental synchronization with AD DS
  
  

On the Central Administration Web site, in the Application Management section, click Manage service applications.

On the Manage Service Applications page, click in the Title column of the User Profile Service Application row to select it.

In the Operations group of the ribbon, click Manage.

On the Manage Profile Service page, in the People section, select Manage User Properties.

On the Manage User Properties page, right-click the user property that you want to map to a directory service mapping and select Edit.

On the Edit user profile property page, in the Add New Mapping section, select the Profile Synchronization connection that you want to use from the Source Data Connection list.

On the Edit user profile property page, in the Add New Mapping section, select the directory service attribute with which you want to synchronize the user profile property from the Attribute list.

On the Edit user profile property page, in the Add New Mapping section, select import to import the property value from the directory service into the user profile store or select export to export the property value from the user profile store to the directory service and then click Add.

When you have finished adding user profile property mappings, click OK.

Verify that you have the following administrative credentials:

• You must be a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration Web site
  
  
• You must be a Service Administrator with Full Control permissions for the User Profile Service that you are configuring. For more information about how to set Full Control permissions, see Delegate administration of a User Profile service application (SharePoint Server 2010).
  
  
• The Farm Administrator account, which is created during the SharePoint farm setup, must also be a System Administrator (sysadmin) on Microsoft SQL Server 2005 or Microsoft SQL Server 2008
  
  
• If you are synchronizing profile information with AD DS, the account that is used must have Replicate Directory Changes permissions. This account must be the same as the farm administrator account or the User Profile Service administrator account and is required to do either full or incremental synchronization with AD DS
  
  

On the Central Administration Web site, in the Application Management section, click Manage service applications.

On the Manage Service Applications page, click in the Title column of the User Profile Service Application row to select it.

In the Operations group of the ribbon, click Manage.

On the Manage Profile Service page, in the Synchronization section, click Configure Synchronization Settings.

On the Configure Synchronization Settings page, in the Synchronization Entities section, select Users and Groups to synchronize both user information and group information or select Users to synchronize only user information.

Note:
You should first do a full synchronization of users only. Once this is complete, run an incremental synchronization of both users and groups.

On the Configure Synchronization Settings page, in the Synchronize BDC Connections section, click to clear the Include existing BDC connections for synchronization? check box if you want to exclude data import from the Business Data Connectivity service.

On the Configure Synchronization Settings page, in the External Identity Manager section, select Use SharePoint Profile Synchronization to use the Profile Synchronization engine in SharePoint Server 2010 or select Enable External Identity Manager to use an external synchronization application such as Microsoft Identity Lifecycle Manager 2007.

Note:
Enabling an external identity manager disables all Profile Synchronization options and the status display in SharePoint Server 2010.

Click OK.