Registry Keys and Configuration File Settings in FIM 2010

Updated: August 17, 2010

Applies To: Forefront Identity Manager 2010

Registry and Configuration Settings for FIM 2010

What this document covers

This document provides the registry settings and configuration file options for the Microsoft® Forefront Identity Manager (FIM) 2010 Service, the FIM Portal, and Forefront Identity Manager Certificate Management (FIM CM).

For an overview of FIM 2010 documentation and guidance for using it, see the Documentation Roadmap.

If you have questions regarding the content of this document or if you have general feedback, post a message to the Forefront Identity Manager 2010 TechNet Forum (http://go.microsoft.com/fwlink/?LinkId=163230).

Audience

This document is intended for information technology (IT) planners and systems administrators.

Group Policy settings

Add-ins and extensions

The values in Table 1 are located in the registry key: SOFTWARE\Policies\Microsoft\Forefront Identity Manager\2010\Add-ins.

Table 1

Registry value name Value type Class Display name Notes

MonitoredAccountName

<string>

User

Configure FIM Service mailbox address

With this policy setting, you can specify the mailbox address of the FIM Service service account that processes incoming requests sent by the FIM Add-in for Outlook®.

If you do not configure this policy setting, the mailbox address specified during the setup is used.

ValidApprovalRequestSenders

<string>

User

Configure valid senders of approval requests

With this policy setting, you can specify the mailbox addresses of valid service accounts which can send approval requests that are being accepted by the FIM Add-in for Outlook. You need to configure this policy setting if you change the FIM Service service account, for example, by using the policy setting “Configure FIM Service mailbox address.” This policy setting should contain both the new and old mailbox addresses to ensure that all previously sent approval e-mail messages are still treated as valid. You can specify several mailbox addresses by separating them with semicolon.

If you do not configure this policy setting, only the mailbox address in “Configure FIM Service mailbox address” is used.

ShowGroupManagementUi

<dword>

User

Configure group management in the user interface (UI)

With this policy setting, you can specify whether the FIM Add-in for Outlook should show the group management options in the Outlook ribbon.

The options for this value are:

  • 0 – Disable Group management UI

  • 1 – Enable Group management UI

If you do not configure this policy setting, the group management options in the Outlook ribbon are displayed.

PortalUrl

<string>

User

Configure FIM Portal address

With this policy setting, you can specify the URL for the FIM Portal used in the FIM Add-in for Outlook when the user selects Group Management Website.

If you do not configure this policy setting, the URL specified during the setup is used.

AllGroupsAddressBookName

<string>

User

Configure the address book containing valid groups

With this policy setting, you can specify the address book used by the FIM Add-in for Outlook when the user selects groups to add members to.

If you do not configure this policy setting, the address book All Groups is used.

AllMembersAddressBookName

<string>

User

Configure the address book containing valid members

With this policy setting, you can specify the address book used by the FIM Add-in for Outlook when the user selects members to add to groups.

If you do not configure this policy setting, the address book Global Address Book is used.

DeleteApprovalRequest

<dword>

User

Configure Approval Request deletion

With this policy setting, you can specify whether the FIM Add-in for Outlook should delete the Approval message when the user has responded.

The options for this value are:

  • 0 – Do not delete

  • 1 – Delete

If you do not configure this policy setting, the user can configure this setting in the FIM Add-in for Outlook. The default is to delete the e-mail.

The values in Table 2 are located in the registry key: SOFTWARE\Policies\Microsoft\Forefront Identity Manager\2010\Extensions.

Table 2

Registry value name Value type Class Display name Notes

SiteLock

<string>

User

Configure valid Microsoft ActiveX® sites

With this policy setting, you can specify the sites used by the FIM Password and Authentication component. The ActiveX control only runs from sites specified in this list. You can specify several sites by separating them with semicolons.

noteNote
Do not include a prefix in the addresses, for example, http://.

If you do not configure this policy setting, the sites specified during the setup are used.

CacheInterval

<dword>

User

Configure cache duration for password reset registration

With this policy setting, you can configure how often the password reset registration status is checked for a user at logon.

If you do not configure this policy setting, the password reset registration status is checked every time the user logs on.

MaxOffset

<dword>

User

Configure max random offset for password reset registration

With this policy setting, you can configure the offset for the policy setting “Configure cache duration for password reset registration” to prevent all password reset registration checks for all users from occurring during the same day.

If you do not configure this policy setting but have configured “Configure cache duration for password reset registration,” then password reset registration checks for all users will occur at the next logon after the duration has been reached.

If you do not configure this policy setting and have not configured “Configure cache duration for password reset registration,” then password reset registration checks happen at every logon for all users.

The values in Table 3 are located in the registry key: Software\Policies\Microsoft\Forefront Identity Manager\2010\Extensions\GatePlugins\45C4D8BB-D34C-453d-8346-C9061A2A1E4C.

Table 3

Registry value name Value type Class Display name Notes

PrivacyLink

<string>

Computer

Configure a custom privacy hyperlink for password reset registration

With this policy setting, you can configure a custom privacy hyperlink which will be displayed to the user during password reset registration.

If you do not configure this policy setting, the default privacy statement will be displayed during the password reset registration.

Maximum length is 127 characters.
noteNote
This registry key is only available in FIM version 4.0.3558 and later.

The values in Table 4 are located in the registry key: SOFTWARE\Policies\Microsoft\Forefront Identity Manager\2010\Extensions\Intranet.

Table 4

Registry value name Value type Class Display name Notes

Address

<string>

Computer

Configure FIM Service address

With this policy setting, you can specify the address to the FIM Service used by password reset. The format is: http://serveraddress:5725.

If you do not configure this policy setting, the address specified during the setup is used.

Certificate management client

The values in Table 5 are located in the registry key: SOFTWARE\Policies\Microsoft\Clm\v1.0\SmartCardClient.

Table 5

Registry value name Value type Class Display name Notes

SiteLock

<string>

User

Configure valid ActiveX sites

With this policy setting, you can specify the sites used by the FIM CM Client component. The ActiveX control only runs from sites specified in this list. You can specify several sites by separating them with semicolons.

noteNote
Do not include a prefix in the address, for example, http://.

If you do not configure this policy setting, the sites specified during the setup are used.

Registry settings

The following tables present the registry settings available for FIM and FIM CM.

noteNote
When both HKLM and HKCU are listed, then the system reads from both locations, in the order specified, and use the value it finds first.

Add-ins and extensions

The values in Table 6 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010.

Table 6

Registry value name Value type Class Created by Notes

AddinsandExtensionsCEIP

<string>

HKLM

Setup

This setting enables the CEIP (Customer Experience Improvement Program) and allows the components to collect data.

The options for this value are:

  • 0 – Not Enabled

  • 1 – Enabled

AddinsandExtensionsLocation

<string>

HKLM

Setup

The location of the main product.

AddinsandExtensionsX86Location

<string>

HKLM

Setup

The location of the main product for x86 components.

GUID

<string>

HKLM

Setup

Identifier for CEIP. This value is hard coded and should not be changed.

The values in Table 7 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Add-ins.

Table 7

Registry value name Value type Class Created by Notes

Location

<string>

HKLM

Setup

The directory path where the FIM Add-in component is installed.

MonitoredAccountName

<string>

HKCU

HKLM

User

Setup

The mailbox address of the FIM Service service account that processes incoming requests sent by the FIM Add-in for Outlook.

PortalUrl

<string>

HKCU

HKLM

User

Setup

The URL for the FIM Portal used in the FIM Add-in for Outlook when the user selects Group Management Website.

ValidApprovalRequestSenders

<string>

HKCU

HKLM

User

Admin

The mailbox addresses of valid service accounts which can send approval requests that are being accepted by the FIM Add-in for Outlook. You need to change this setting if you change the FIM Service service accountThis policy setting should contain both the new and old mailbox addresses to ensure that all previously sent approval e-mail messages are still treated as valid. You can specify several mailbox addresses by separating them with semicolons.

ShowGroupManagementUi

<dword>

HKCU

HKLM

User

Admin

You can specify whether the FIM Add-in for Outlook should show the group management options in the Outlook ribbon.

The options for this value are:

  • 0 – Disable Group management UI

  • 1 – Enable Group management UI

DeleteApprovalRequest

<dword>

HKCU

HKLM

User

Admin

You can specify whether the FIM Add-in for Outlook should delete the Approval Request message when the user has responded.

The options for this value are:

  • 0 – Do not delete

  • 1 – Delete

If you do not configure this setting, the user can configure this setting in the FIM Add-in for Outlook. The default is to delete the email.

AllGroupsAddressBookName

<string>

HKCU

HKLM

User

Admin

The address book used by the FIM Add-in for Outlook when the user selects groups to add members to.

If you do not configure this setting, the address book All Groups is used.

AllMembersAddressBookName

<string>

HKCU

HKLM

User

Admin

The address book used by the FIM Add-in for Outlook when the user selects members to add to groups.

If you do not configure this setting, the address book Global Address Book is used.

The values in Table 8 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Extensions.

Table 8

Registry value name Value type Class Created by Notes

Location

<string>

HKLM

Setup

The directory where this component is installed.

SiteLock

<string>

HKLM

Setup

The sites used by the FIM Password and Authentication component. The ActiveX control only runs from sites specified in this list. You can specify several sites by separating them with semicolons.

noteNote
Do not include a prefix in the address, for example, http://.

The values in Table 9 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Extensions\GatePlugins.

Table 9

Registry value name Value type Class Created by Notes

Path

<string>

HKLM

Setup

The path to the location of the password gate plug-ins.

The values in Table 10 are located in the registry key: \Software\Microsoft\Forefront Identity Manager\2010\Extensions\GatePlugins\45C4D8BB-D34C-453d-8346-C9061A2A1E4C.

Table 10

Registry value name Value type Class Created by Notes

PrivacyLink

<string>

HKLM

Admin

You can specify a custom privacy hyperlink which will be displayed to the user during password reset registration.

Maximum length is 127 characters.
noteNote
This registry key is only available in FIM version 4.0.3558 and later.

The values in Table 11 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Extensions\Intranet.

Table 11

Registry value name Value type Class Created by Notes

Address

<string>

HKLM

Setup

The address to the FIM Service used by password reset. The format is: http://serveraddress:5725.

FIM Service and Portal

The values in Table 12 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010.

Table 12

Registry value name Value type Class Created by Notes

ServiceandPortalCEIP

<dword>

HKLM

Setup

CEIP (Customer Experience Improvement Program, also known as SQM) is enabled and the components can collect data.

The options for this value are:

  • 0 – Not Enabled

  • 1 – Enabled

ServiceandPortalLocation

<string>

HKLM

Setup

Value of INSTALLDIR. By default, this path is c:\Program File\Microsoft Forefront Identity Manager\2010

The values in Table 13 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Portal.

Table 13

Registry value name Value type Class Created by Notes

Location

<string>

HKLM

Setup

The directory where the FIM Portal is installed. By default, this path is c:\Program File\Microsoft Forefront Identity Manager\2010\Portal.

BaseSiteCollectionURL

<string>

HKLM

Setup

The URL to the Microsoft SharePoint® site Collection where the FIM Portal is located. This value is used for patching during the Language Pack installation.

The values in Table 14 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Service.

Table 14

Registry value name Value type Class Created by Notes

Location

<string>

HKLM

Setup

The directory where FIM Service is installed.

The values in Table 15 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Service\Activities\QAActivity.

Table 15

Registry value name Value type Class Created by Notes

HashType

<dword>

HKLM

Setup

Default value is SHA256

Changing this value is not supported. It is reserved by Microsoft for future use.

The values in Table 16 are located in the registry key: SYSTEM\CurrentControlSet\Services\FIMService.

Table 16

Registry value name Value type Class Created by Notes

DatabaseServer

<string>

HKLM

Setup

Name of the FIM Service database server, with the instance name if needed.

DatabaseName

<string>

HKLM

Setup

Name of the FIM Service database. The default value is FIMService.

CertificateThumbprint

<string>

HKLM

Setup

The thumbprint of the certificate in the local computer store used by password reset.

DisableSecurityTokenService

<dword>

HKLM

Admin

If this value is set to 1, then the Security Token Service (STS) cannot be started and the CertificateThumbprint value cannot be consumed. If this key does not exist, or is set to 0, then the STS starts and a CertificateThumbprint must be present.

DefaultKeySize

<dword>

HKLM

Setup

This value is created by Setup, but is not used.

DefaultTokenLifetimeInMinutes

<dword>

HKLM

Setup

This value is created by Setup, but is not used.

ServiceAccountSid

<string>

HKLM

Setup

This value is created by Setup, but is not used.

MetadataEndpointAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

EnumerationEndpointAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

ResourceManagementServicePort

<string>

HKLM

Setup

This value is created by Setup, but is not used.

ResourceManagementServiceBaseAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

ResourceEndpointAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

SecurityTokenServicePort

<string>

HKLM

Setup

This value is created by Setup, but is not used.

SecurityTokenServiceBaseAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

SecurityTokenServiceEndpointAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

PasswordResetEndpointAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

WorkflowManagerEndpointBaseAddress

<string>

HKLM

Setup

This value is created by Setup, but is not used.

PollExchangeEnabled

<dword>

HKLM

Setup

Specifies whether this instance of the FIM Service should monitor the Microsoft Exchange Server mailbox for incoming mail.

The options for this value are:

  • 0 – Not Enabled

  • 1 – Enabled

noteNote
The FIM Service still may send outgoing mail if false.

FIM Synchronization Service

The values in Table 17 are located in the registry key: SOFTWARE\Microsoft\ERP Management Agent.

Table 17

Registry value name Value type Class Created by Notes

InstallPath

<string>

HKLM

Setup

The directory where the management agent for SAP R/3 (ERP MA) Configuration UI is installed.

MaInstallPath

<string>

HKLM

Setup

The directory where the ERP MA is installed.

The values in Table 18 are located in the registry key: SOFTWARE\Microsoft\ERP Management Agent\ERP Management Agent Configuration Tool.

Table 18

Registry value name Value type Class Created by Notes

ConnectionString

<string>

HKCU

Setup

A text string informing the user about the correct format for connecting to SAP.

InstallPath

<string>

HKLM

Setup

This has the same value as MaInstallPath in Table 15.

The values in Table 19 are located in the registry key: SOFTWARE\Microsoft\Forefront Identity Manager\2010\Synchronization Service.

Table 19

Registry value name Value type Class Created by Notes

ReadTimeOut

<dword>

HKLM

Admin

The default value is 58, specified in seconds.

noteNote
Only used by the management agent for FIM (FIM MA) for reading from the FIM Service data base.

FullImportPageSize

<dword>

HKLM

Admin

The default value is 100, specified in the number of objects returned.

noteNote
Only used by the FIM MA for reading from the FIM Service data base.

DeltaImportPageSize

<dword>

HKLM

Admin

The default value is 1,000, specified in the number of rows returned.

noteNote
Only used by the FIM MA for reading from the FIM Service data base.

The values in Table 20 are located in the registry key: SYSTEM\CurrentControlSet\Services\FIMSynchronizationService\ManagementAgents.

Table 20

Registry value name Value type Class Created by Notes

<name of MA>

<string>

HKLM

Setup

The name of the registry key is the name of the management agent. The value is a string representation of the CLSID for each type of management agent.

The values in Table 21 are located in the registry key: SYSTEM\CurrentControlSet\Services\FIMSynchronizationService\Parameters.

Table 21

Registry value name Value type Class Created by Notes

Server

<string>

HKLM

Setup

Name of the FIM Synchronization database server.

SQLInstance

<string>

HKLM

Setup

Name of the FIM Synchronization database instance.

DBName

<string>

HKLM

Setup

Name of the FIM Synchronization database.

Path

<string>

HKLM

Setup

The directory where the FIM Synchronization Service is installed.

EventSource

<string>

HKLM

Setup

The default value is FIMSynchronizationService.

EventProductName

<string>

HKLM

Setup

The default value is FIM Synchronization Service.

AdExtTimeout

<dword>

HKLM

Admin

This is the Exchange 2007 PowerShell utility timeout in milliseconds. The default value is 40,000 in FIM RTM and 120,000 in FIM Update 2.

DisableRunStepDetails

<dword>

HKLM

Admin

If this value is set to 1, then FIM does not save details of the current run. The default value is 0.

ErrorLimit

<dword>

HKLM

Admin

The value is an integer in the range of 0-100,000.

  • Value set to 0 = Error limit set to 100,000

  • Value in the range of 1-99,999 = Error limit set to value

  • Value set to 100,000 = Error limit set to 100,000

  • Value set greater than 100,000 = Error limit set to 100,000

  • No key present = Default error limit set to 5,000

noteNote
From FIM Update 2 and later, warnings will not be counted against the error limit.

ConnectionTimeout

<dword>

HKLM

Admin

SQL Connection timeout

ADMAUseACLSecurity

<dword>

HKLM

Admin

The options for this value are:

  • 0 – Use DirSync permissions

  • 1 - Use AD ACL permissions

If not defined, the default value is 0.

noteNote
This setting is only supported on FIM Update 2 and later.

eDirectoryMASupportedServers

<multi-sz>

HKLM

Admin

If the eDirectory MA does not recognize the NDS version, add the vendorVersion found in the RootDSE in NDS to this multi-valued string.

IBMDSMASupportedServers

<multi-sz>

HKLM

Admin

If the IBM DS MA does not recognize the DS version, add the vendorVersion found in the RootDSE in IBM DS to this multi-valued string.

iPlanetMASupportedServers

<multi-sz>

HKLM

AdminAdmin

If the Sun DS MA does not recognize the DS version, add the vendorVersion found in the RootDSE in Sun DS to this multi-valued string.

ADMADoNormalization

<dword>

HKLM

Admin

The options for this value are:

  • 1 - True

  • All other values - False

Setting this value to “1” will cause the ADMA to export an object to AD, and then read back the AD normalized ‘nTSecurityDescriptor’ attribute and write it back onto the export image to avoid ‘exported-change-not-reimported’ errors.

iPlanetMAAllowInvalidUTF8

<dword>

HKLM

Admin

The options for this value are:

  • 1 - True

  • All other values - False

Setting this value to “1” will cause the iPlanet MA to coerce invalid UTF8 data in the import stream to a base64 string and import the data in that form. This allows customers with misbehaving apps running against their iPlanet directory server to import the malformed data into the synchronization engine.

MinimalObjectLogging

<dword>

HKLM

Admin

The options for this value are:

  • 1 - True

  • All other values - False

Setting this value to “1” will cause the Sync Engine to only log minimal information about an object during if an error occurs.

noteNote
This setting is only supported on FIM Update 2 and later.

CsObjectCacheSize

<dword>

HKLM

Admin

If no value is specified, the default value is 20480.

This value describes how large the cache size for connector space objects is and the number of members the internal cache will hold. If there are more members in a group, we will process the group in chunks.

Set this to one of the following values:

  • 20480

  • 40960

  • 81920

  • (etc, multiply by 2 if needed)

The values in Table 22 are located in the registry key: SYSTEM\CurrentControlSet\Services\FIMSynchronizationService\Parameters\PerMAInstance\<ma name>.

Table 22

Registry value name Value type Class Created by Notes

AnchorCacheSize

<dword>

HKLM

Admin

The accepted value range is 100–100,000. Used by the management agents for SunOne and IBM DS to set the size of the cache for resolved anchor values.

StackSize

<dword>

HKLM

Admin

This value only applies to the Management Agent for Extensible Connectivity (ECMA). This specifies the stack size that a new instance of the management agent should have and is read every time a new ECMA is started.
Examples of values:
0x800000 = 512 MB, 0x1000000 = 1,024 MB
A value of 0 or a missing value means the default for the process.

ADMAUseACLSecurity

<dword>

HKLM

Admin

The options for this value are:

  • 0 – Use DirSync permissions

  • 1 - Use AD ACL permissions

If not defined, the default value is 0.

noteNote
This setting is only supported on FIM Update 2 and later.

ECMAAlwaysExportUnconfirmed

<dword>

HKLM

Admin

The options for this value are:

  • 0 – Do not re-export unconfirmed

  • 1 - Export until confirmed

The default value is 0.

noteNote
This value only applies to the Management Agent for Extensible Connectivity (ECMA)

noteNote
This setting is only supported on FIM Update 2 and later.

iPlanetMAOptionFiltering

<string>

HKLM

Admin

This value is used to specify the suffix of attributes that should be filtered from the image during import. If this is not specified, the attributes will be read, and any suffix will be stripped off before adding the value to the import image.

ADMAEnforcePasswordPolicy

<dword>

HKLM

Admin

The options for this value are:

  • 1 - True

  • All other values - False

Setting this value to “1” will cause the AD MA to verify the password history before it will reset a password during password reset.

noteNote
This setting is only supported on FIM Update 2 and later.

noteNote
This is only supported where the DC is Windows Server 2008 R2 SP1.

The values in Table 23 are located in the registry key: SYSTEM\CurrentControlSet\Services\FIMSynchronizationService\Performance.

Table 23

Registry value name Value type Class Created by Notes

Library

<string>

HKLM

Setup

The directory where the FIM Synchronization Service is installed.

Open/Collect/ Close

<string>

HKLM

Setup

These values are hard coded at setup time.

MaxObjectImportRate

<dword>

HKLM

Admin

This key specifies the number of objects per second that should serve as an upper boundary of any Import Run Profile run on the server. During an import run, the number of objects per second measured by the “Objects Read /sec” performance counter must remain below the value set in MaxObjectImportRate.

The range for this value is 1 to Max (Int32). A value of 0, or the absence of the key, is treated as having no maximum value defined.

MaxObjectSynchronizationRate

<dword>

HKLM

Admin

This key specifies the number of objects per second that should serve as an upper boundary of any Synchronization Run Profile run on the server. During a synchronization run, the number of objects per second measured by the “Objects Synchronized / sec” performance counter must remain below the value set in MaxObjectSynchronizationRate.

The range for this value is 1 to Max (Int32). A value of 0 or the absence of the key is treated as having no maximum value defined.

MaxObjectExportRate

<dword>

HKLM

Admin

This key specifies the number of objects per second that should serve as an upper boundary of any Export Run Profile run on the server. During an export run, the number of objects per second measured by the “Objects Exported / sec” performance counter must remain below the value set in MaxObjectExportedRate.

Certificate management

The values in Table 24 are located in the registry key: SOFTWARE\Microsoft\Clm\v1.0\Server\Setup.

Table 24

Registry value name Value type Class Created by

LogFile

<string>

HKLM

Setup

DATAFolder

<string>

HKLM

Setup

WebAppName

<string>

HKLM

Setup

Microsoft.Clm.Service.Exe.config

<string>

HKLM

Setup

ClmUtil.exe.config

<string>

HKLM

Setup

CaFolder

<string>

HKLM

Setup

Certificate management client

The values in Table 25 are located in the registry key: SOFTWARE\Microsoft\Clm\v1.0\SmartCardClient.

Table 25

Registry value name Value type Class Created by Notes

SiteLock

<string>

HKLM

Setup

A list of sites from which ActiveX is allowed to run.

Configuration file settings

This section describes the two configuration files used by the FIM Service and the FIM Portal.

  • C:\inetpub\wwwroot\wss\VirtualDirectories\80\web.config

  • C:\Program Files\Microsoft Forefront Identity Manager\2010\Service\Microsoft.ResourceManagement.Service.exe.config

The FIM Service and Portal share the same overall format of the configuration files. The main difference is that the client reads from the ResourceManagementClient section and the server reads from the ResourceManagementService section. Either section can appear in both the service and portal configuration files, but the way they are used is different.

The FIM Portal discards the ResourceManagementService section altogether and uses the ResourceManagementClient section for configuring the client to communicate with the service. The service uses the ResourceManagementService section as expected, but also uses the ResourceManagementClient section to configure how workflow activities, the mail listener, and other components within the service communicate with the Web service endpoints.

FIM Service and FIM Portal

ResourceManagementService

 

XPath Values Default value Notes

/configuration/ resourceManagementService/ @dataReadTimeoutInSeconds

[0,inf)

58

The timeout used in all SQL select commands.

/configuration/ resourceManagementService/ @dataWriteTimeoutInSeconds

[0,inf)

58

The timeout used in all SQL update, insert, and delete commands.

/configuration/ resourceManagementService/ @defaultKeySize

[0,inf)

256

The key size used in session keys.

/configuration/ resourceManagementService/ @defaultTokenLifetimeInMinutes

[0,inf]

10

The lifetime of tokens issued by the security token service.

/configuration/ resourceManagementService/ @enumerationEndpointAddress

<string>

ResourceManagementService/ Enumeration

The name of the WS-Enumeration enumeration endpoint.

configuration/ resourceManagementService/ @externalHostName

<string>

“localhost”

The base Uniform Resource Identifier (URI) to use when responding with CreateResponse and Authnetication (AuthN) responses. Use this value for load-balanced scenarios and to update the unified client resourceManagementServiceBaseAddress to have outgoing requests also go to the load-balanced server. This could be DNS name or IP Address.

If the base address is the string literal “localhost,” this also emits the health event http://sharepoint/sites/imtmanage/Lists/Ilm%20Events/DispForm.aspx?ID=43 to indicate to operators that the base address, in its current configuration, prevents external clients from communicating with the service.

/configuration/ resourceManagementService/ @hostActivationIntervalInMilliseconds

[0,inf]

120,000

This is the interval between the host activator polling workflow instances for status.

/configuration/ resourceManagementService/@intranetRegistrationEndpointAddress

<string>

ResourceManagementService/SecurityTokenService/Registration

The name of the intranet password reset registration endpoint.

/configuration/ resourceManagementService/ @metadataEndpointAddress

<string>

ResourceManagementService/MEX

The name of the metadata endpoint.

/configuration/ resourceManagementService/ @passwordResetEndpointAddress

<string>

ResourceManagementService/Alternate

The name of the password reset endpoint.

/configuration/ resourceManagementService/ @policyManagerIntervalInMilliseconds

[0,inf]

5,000

The interval between running the stored procedure DequeuePolicyApplication.

/configuration/ resourceManagementService/ @receiveTimeoutInSeconds

[0,inf]

300

The timeout used for receiving messages on all FIM endpoints. This is used as a parameter to the constructor for ServiceMultipleTokenBinding.

/configuration/ resourceManagementService/ @resourceEndpointAddress

<string>

ResourceManagementService/Resource

The name of the WS-Transfer resource endpoint.

/configuration/ resourceManagementService/ @resourceMailEndpointAddress

<string>

ResourceManagementService/ResourceMail

The name of the Resource Mail endpoint.

/configuration/ resourceManagementService/ @resourceFactoryEndpointAddress

<string>

ResourceManagementService/ResourceFactory

The name of the WS-Transfer resource factory endpoint.

/configuration/ resourceManagementService/ @securityTokenServiceEndpointAddress

<string>

ResourceManagementService/SecurityTokenService

The name of the WS-Trust security token endpoint

/configuration/ resourceManagementService/ @securityTokenServiceMetadataEndpointAddress

<string>

ResourceManagementService/SecurityTokenService/MEX

The name of the WS-Trust security token metadata endpoint.

/configuration/ resourceManagementService/ @servicePrincipalName

<string>

There is no default value. Omitting this value results in the endpoints having the default principle identity (which depends on the WCF implementation of endpoints and should be the Windows service account).

Used to create a service principle identity for all FIM endpoints.

/configuration/ resourceManagementService/ @workflowManagerEndpointBaseAddress

<string>

ResourceManagementService/WorkflowManager

The name of the workflow activity endpoint.

/configuration/ appSettings/ add[@key='synchronizationEngineAccountName’]

<string>

SyncEngineAccount

The logon name for the synchronization engine account. This enables the server to provide elevated access to the synchronization engine without special configuration in FIM.

/configuration/ appSettings/ add[@key='mailServer']

<string>

(None, and not required)

The URL that points to the Exchange 2007 Web service, for example, http://server/ews/exchange.asmx

/configuration/ appSettings/ add[@key='isExchange']

<string>

1

String literals 1 or 0 indicating whether the mail sender should instantiate an SMTP client or Exchange client. Note that the strings “true” and “false” are both treated as false.

/configuration/ appSettings/ add[@key='exchangeListenerInterval']

[0,3600]

30

Number of seconds to wait between polling the server running Exchange, measured in seconds.

/configuration/ resourceManagementService/ @mailBatchSize

[0,inf]

100

The maximum number of mail items to download from the Exchange mailbox in one batch.
ResourceManagementClient

 

XPath Values Default Notes

/configuration/ resourceManagementClient/ @resourceManagementServiceBaseAddress

<string>

This value is required.

The endpoint base address from the perspective of the client.

/configuration/ resourceManagementClient/ @maxReceivedMessageSizeInBytes

[0, Int16.MaxValue]

10 MB 0xE00000

The maximum received message size the client is willing to receive.

/configuration/ resourceManagementClient/ @servicePrincipalName

<string>

There is no default value. Omitting this value results in the endpoints having the default principle identity (which depends on the WCF implementation of endpoints and should be the Windows service account).

This value is used to create a service principle identity for the client.

/configuration/ resourceManagementClient/ @timeoutInMilliseconds

[0,360000]

90,000

The timeout of the client side of communication.

Tags :


Page view tracker