Deleting orphaned FIM MA CS objects

Question

Has anyone ever found that they needed to do this, but couldn't afford to delete the entire FIM MA CS to achieve this outcome?
In my case I have a sync design which imports entitlement objects from two separate HR sources into FIM, but had the object deletion and FIM MA deprovisioning rules set incorrectly resulting in orphaned objects in the FIM MA when the source (projecting) MA
object was deleted.  I have since corrected the rules, but had a few hundred bogus entitlement objects to delete out of FIM ... and wasn't prepared to work through the FIM Metaverse and manually disconnect each one ... and with no guarantee that I had
solved my design problem yet, there was a chance they would come back again anyhow.
So I needed to come up with a clever way of deleting these, and resorted to an old fashioned provisioning MVExtension to achieve this.  Here is the code snippet for my Provision method:
        void IMVSynchronization.Provision (MVEntry mventry)
            // disconnect any orphaned entitlements (this should be unnecessary
if we can work out what is generating them)
            if (mventry.ObjectType.Equals(Properties.Settings.Default.EntitlementMVObjectName)
                && mventry.ConnectedMAs.Count.Equals(1))
                ConnectedMA fimMA = mventry.ConnectedMAs[Properties.Settings.Default.FIMMAName];
                if (fimMA.Connectors.Count.Equals(1))
                    mventry.ConnectedMAs.DeprovisionAll();
What I want to know is how others have approached this problem themselves.  I don't know if I really want to leave my MVExtension wired up forever, and am thinking there's probably a better way.  I can already hear Carol asking "why wouldn't you just
use a PowerShell script?", and I can see how I might be able to copy the table results of an MV query from the Identity Manager into the clipboard, and paste it into a CSV, then process the CSV ... but there may not always be an easy way of identifying these
objects with such a query (although there probably is!).
Any other ideas people?
Thanks.
Bob Bradley (FIMBob @ http://thefimteam.com/) ... now using Event Broker 3.0 @ http://www.fimeventbroker.com/ for just-in-time delivery of FIM 2010 policy via the sync engine

Answer 1

I accidently provisioned a few hundred objects into the FIM connector space, however they were never actually provisioned to the FIM portal due to attribute violation.  Long story short, these objects had nothing to match on aside from their guid.  So
what I did was:
Use PowerShell to find the CS DN of each orphaned object (link)
Correlate these DNs to MV IDs
Export the MV IDs to a csv file
Create a tab-delimited MA, with a simple join rule - to join on this MV ID
Configure deletion rule to delete MV object when <new MA> object was deleted
Run a full import and sync (this joins to all the orphaned objects)
Delete the <new MA> CS and then the MA itself.  This removes the orphaned objects per the deletion rule in #5.  
sample code:
#Import the FimSyncPowerShellModule Module
ipmo FimSyncPowerShellModule
$maNAME = 'Contoso FIMMA'
#Get the last export run
$LastExportRun = (Get-MIIS_RunHistory -MaName $maNAME -RunProfile 'Export')[0]
#Get error objects from last export run (adjust your filter as needed...)
$errorObjects = $LastExportRun | Get-RunHistoryDetailErrors | ? {($_.dn -ne $null) -and ($_.ErrorType -eq 'failed-creation-via-web-services')}
#Build the custom Output Object
$outputFile = @()
$errorObjects | % {
$TmpCSObject = Get-MIIS_CSObject -ManagementAgent $maNAME -DN $_.DN
[xml]$UserXML = $TmpCSObject.UnappliedExportHologram
$MyObject = New-Object PSObject -Property @{
MVObjectID = (Select-Xml -Xml $UserXML -XPath "/entry/attr" | select -expand node | ? {$_.name -eq 'MVObjectID'}).value
$outputFile += $MyObject
#Output to file
$outputFile | Export-Csv -NoTypeInformation $env:USERPROFILE\desktop\Deletions.csv
See Wiki for latest updates:
http://social.technet.microsoft.com/wiki/contents/articles/25249.deleting-orphaned-fim-ma-cs-objects.aspx
Mike Crowley | MVP
My Blog --
Planet Technologies