Microsoft powershell management agent

Recently microsoft released PS management agent. Actually i saw some of the MSDN article about it but i find them less informative.
1- Can any provide me more details on how to use PS management agents ? I have installed it but not able to use it.
Details about various sections like schema import export etc
2-A guide with step by step instructions for a scenario which I can implement in lab and learn more about PS MA and use it configure other PS compatible systems.
AdiKumar

Hi,
I faced the same problem, the documentation and sample are very rarly.
I compared the connector with the PowerShell MA from Soren and find him's easier to understand, in addition there are also some sample scripts and a lot of people use that MA as you can see on some questions here in the forum.
Sorens PowerShell MA
He did also a great introduction to his MA on the FIM Team User Group some time ago.
See:
https://unifysolutions.jira.com/wiki/display/FIMTEAMCOM/2013-07-17+-+A+quick+introduction+to+the+PowerShell+MA
/Peter
Peter Stapf - ExpertCircle GmbH - My blog:
JustIDM.wordpress.com

Similar Messages

Import Photos Powershell Management Agent

Hello ,
i'am using the powershell management agent to import photo to Metaverse but when i run a full import i have some errors
"Microsoft.MetadirectoryServices.ExtensibleExtensionException: Unable to cast object of type 'System.Byte[]' to type 'System.Object[]'.
at Granfeldt.PowerShellManagementAgent.GetImportEntries(GetImportEntriesRunStep importRunStep)
Forefront Identity Manager 4.1.3441.0"
any idea ?
Thanks

Be sure to use the latest version of the MA. There was a feature change regarding this. Remi did a post on this -
http://www.iamblogg.com/2013/04/14/import-pictures-into-fim-portal/
Regards, Soren Granfeldt
blog is at http://blog.goverco.com | facebook https://www.facebook.com/TheIdentityManagementExplorer | twitter at https://twitter.com/#!/MrGranfeldt

New version of PowerShell Management Agent

I just released a new version of my PowerShell Management Agent. It now supports two sets of credentials, allowing for greater flexibility for your scripts security contexts. Oh, and there is added script host robustness and a few bugfixes.
http://blog.goverco.com/2014/03/new-version-of-powershell-management.html
Regards, Soren Granfeldt
blog is at http://blog.goverco.com | facebook https://www.facebook.com/TheIdentityManagementExplorer | twitter at https://twitter.com/#!/MrGranfeldt

I am not really sure if Azure support this but its worth to make your configuration file to support .NET 4.0
$PShome\PowerShell_ISE.CONFIG and $PSHOME\PowerShell.exe.config will be not existing.
So you can make an entry in configuration to support .NET framework 4.0
like shown below
$config_text = @"
<?xml version="1.0"?>
<configuration>
<startup useLegacyV2RuntimeActivationPolicy="true">
<supportedRuntime version="v4.0.30319"/>
<supportedRuntime version="v2.0.50727"/>
</startup>
</configuration>
$config_text| Out-File $pshome\powershell.exe.config
$config_text| Out-File $pshome\powershell_ise.exe.config
Close PowerShell Console and open as administrator.
Try loading the modules back and let me know.
Regards Chen V [MCTS SharePoint 2010]

Grandfelt Powershell Management Agent...synch rules..joins?

Sorry for the newbie question.
I am following Kent's posting for managing O365 using the Powershell MA
https://konab.com/managing-office-365-licenses-using-fim-2010/
However, I am guessing I am missing something either in my synchronization rule or my understating of the PSMA.
Eventhough, I have setup a relationship of email to UPN on my Outbound Synch Rule I am unable to get any joining. It seems that joins do now work, unless I create a explicit join within the PSMA itself.
Do I need both the Sync rule and the join in the MA? Or I am just not understanding correctly? Any help would be appreciated.

Well, I'm sorry - from what you've sent me, I can't seem to find the issue. I don't use SR's that much anymore; I prefer classic so I might be missing something here :-)
Seems your data is okay, since direct-joins is working, so it must be some config error or similar in your SR's (scoped to the right object type?)
Sorry, I cant be of more help. This is not a PSMA problem, but a SR problem...
Regards, Soren Granfeldt
blog is at http://blog.goverco.com | facebook https://www.facebook.com/TheIdentityManagementExplorer | twitter at https://twitter.com/#!/MrGranfeldt

Microsoft Windows x64 Enterprise Manager Agent 12.1 file for Self Update

Anyone know where I can download the Microsoft Windows x64 Agent for Enterprise Manager 12c Self Update feature? This file will be used by 12.1 Self Update feature in offline mode. Installing the Management Agent on the host is not possible.

Hi,
You can keep a track of the release dates from the following document:
Note 793512.1 : Release Schedule of Current Enterprise Manager Releases and Patch Sets
Best Regards,
Venkat

The Windows PowerShell snap-in 'Microsoft.Exchange.Management.PowerShell.Admin' is not installed on this computer

hi all,
i am using Exchange server 2013.
when i run the below code i got the following error.
RunspaceConfiguration rsConfig = RunspaceConfiguration.Create();
PSSnapInException snapInException = null;
PSSnapInInfo info = rsConfig.AddPSSnapIn("Microsoft.Exchange.Management.PowerShell.Admin", out snapInException);
Runspace myRunSpace = RunspaceFactory.CreateRunspace(rsConfig);
myRunSpace.Open();
Pipeline pipeLine = myRunSpace.CreatePipeline();
Command myCommand = new Command("Get-Mailbox -ResultSize Unlimited");
pipeLine.Commands.Add(myCommand);
Collection<PSObject> commandResults = pipeLine.Invoke();
Error :
The Windows PowerShell snap-in 'Microsoft.Exchange.Management.PowerShell.Admin' is not installed on this computer.
when i run the command get-pssnapin
result :
Name : Microsoft.PowerShell.Core
PSVersion : 3.0
Description : This Windows PowerShell snap-in contains cmdlets used to manage components of Windows PowerShell
when i run below command
get-pssnapin -registered
result is:
PS C:\Users\Administrator> get-pssnapin -registered
Name : EnginePSSnapin
PSVersion : 2.0
Description : Register cmdlets for Content Engine
Name : HostControllerPSSnapIn
PSVersion : 2.0
Description : Register cmdlets for Host Controller
Name : InteractionEnginePSSnapIn
PSVersion : 2.0
Description : Register cmdlets for InteractionEngine
Name : JunoPSSnapin
PSVersion : 2.0
Description : Register cmdlets for Juno
Name : Microsoft.Exchange.Management.PowerShell.E2010
PSVersion : 1.0
Description : Admin Tasks for the Exchange Server
Name : Microsoft.Exchange.Management.PowerShell.Setup
PSVersion : 1.0
Description : Setup Tasks for the Exchange Server
Name : Microsoft.Exchange.Management.PowerShell.SnapIn
PSVersion : 1.0
Description : Admin Tasks for the Exchange Server
Name : Microsoft.Exchange.Management.Powershell.Support
PSVersion : 1.0
Description : Support Tasks for the Exchange Server
Name : Microsoft.Forefront.Filtering.Management.PowerShell
PSVersion : 2.0
Description : Microsoft Forefront Filtering PowerShell Interface
Name : SearchCorePSSnapIn
PSVersion : 2.0
Description : Register cmdlets for SearchCore
Name : WDeploySnapin3.0
PSVersion : 2.0
Description : This is a PowerShell snap-in that contains cmdlets for managing Microsoft Web Deployment infrastructure
All powershell commands is installed fine .
but still I am getting error
The Windows PowerShell snap-in 'Microsoft.Exchange.Management.PowerShell.Admin' is not installed on this computer

Hi Olaf Reitz,
After running the command still i am getting same error,
The Windows PowerShell snap-in 'Microsoft.Exchange.Management.PowerShell.SnapIn' is not installed on this computer
please see below my task and i achieved so far.
i need to get list of Users in C# from Exchange Server. for that i created new User [[email protected]]
in Exchange Server , then i give Full Access Permissions to that User to Access all other Mail Boxes.
By giving below command in PowerShell I am getting all Users List .
Get-Mailbox -ResultSize Unlimited
i need the same list In C# code. for that I
tried with below code.
Here i got only particular user [ [email protected]] details , instead of list.
SecureString secureString = new SecureString();
string myPassword = "EIS2014!@#"; string username = "[email protected]";
foreach (char c in myPassword)
secureString.AppendChar(c);
PSCredential ExchangeCredentials = new PSCredential(username, secureString);
WSManConnectionInfo connectionInfo = new WSManConnectionInfo(new Uri("http://ExchangeServer.admin.com/powershell ), "http://schemas.microsoft.com/powershell/Microsoft.Exchange , ExchangeCredentials);
Runspace runspace = System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspace(connectionInfo);
runspace.Open();
string newCommand = "Get-Mailbox | Get-MailboxPermission";
Pipeline cmd = runspace.CreatePipeline(newCommand);
Collection<PSObject> results = cmd.Invoke();
runspace.Close();
so , i changed the code below
RunspaceConfiguration rsConfig = RunspaceConfiguration.Create();
PSSnapInException snapInException = null;
PSSnapInInfo info = rsConfig.AddPSSnapIn("Microsoft.Exchange.Management.PowerShell.SnapIn", out snapInException);
Runspace myRunSpace = RunspaceFactory.CreateRunspace(rsConfig);
myRunSpace.Open();
Pipeline pipeLine = myRunSpace.CreatePipeline();
Command myCommand = new Command("Get-Mailbox -ResultSize Unlimited");
pipeLine.Commands.Add(myCommand);
Collection<PSObject> commandResults = pipeLine.Invoke();
i need Users list In C# , how can i achieve this ?
i am getting list in PowerShell , but i need it in C# code.
Is Visual studio Compiled code be 64 bit for running PowerShell scripts ?

FIM 2010 Management Agents usage

Hi all,
we have implemented some FIM management agent that read information from different AD forest and the write email contacts into a destination forest. I looking for a tool, or powershell cmdlets I can use to export management agents errors.
I try to explain better, ope FIM Syncronization Service, click on operations button, select the row that reports errors and in pane below show erros details and informations. In my case DistinguishedName for the object that encountered errors. I would
like to export this rows to have a list with all the Distinguishedname and the use that with a script to manage and resolve the issues. i hope to have explained my needed.
Thanks in advance for your help.
Regards

Hi!
You can get this info from FIM sync with WMI.
$maName = "AD-MA"
(Get-WmiObject -Namespace "root\MicrosoftIdentityIntegrationServer" -class "MIIS_ManagementAgent"| where {$_.name -eq $maName}).RunDetails().returnvalue
You will have to pick what you want from the xml but this should get you started.
/Robert
Thanks Robert,
well I try to ask again for more information: :)
Running your script I retrieve:
<?xml version="1.0" encoding="utf-16"?>
<run-history>
<run-details>
<ma-id>{AFB1D87E-1580-488F-9F2A-8A382FF4B14A}</ma-id>
<ma-name>MA_SI</ma-name>
<run-number>282</run-number>
<run-profile-name>Delta Sync</run-profile-name>
<security-id>DOMAIN\user</security-id>
<step-details step-number="1" step-id="{4550BF08-A3E1-40D4-854E-546C44FBE016}">
   <start-date>2014-04-16 05:10:26.320</start-date>
   <end-date>2014-04-16 05:10:43.310</end-date>
   <step-result>completed-sync-errors</step-result>
   <step-description>
    <step-type type="apply-rules">
<apply-rules-subtype>apply-pending</apply-rules-subtype>
</step-type>
<partition>DC=fqdn,DC=fqdn,DC=fqdn</partition>
<custom-data>
<adma-step-data><batch-size>100</batch-size><page-size>500</page-size><time-limit>120</time-limit></adma-step-data>
</custom-data>
   </step-description>
   <current-export-step-counter>0</current-export-step-counter>
   <last-successful-export-step-counter>0</last-successful-export-step-counter>
   <ma-connection>
   </ma-connection>
   <ma-discovery-errors>
   </ma-discovery-errors>
   <ma-discovery-counters>
   </ma-discovery-counters>
   <synchronization-errors><import-error cs-guid="{F56B20AE-8EA3-E311-A7B3-005056A80FB6}" dn="CN=NAME,OU=Contacts,OU=Resources,DC=fqdn,DC=fqdn,DC=fqdn">
<first-occurred>2014-04-15 22:20:32.657</first-occurred>
<retry-count>3</retry-count>
<date-occurred>2014-04-16 05:10:38.847</date-occurred>
<error-type>extension-dll-exception</error-type>
<algorithm-step>provisioning</algorithm-step>
<extension-error-info>
<extension-name>MVExtension.dll</extension-name>
<extension-callsite>provisioning</extension-callsite>
<call-stack>Microsoft.MetadirectoryServices.ObjectAlreadyExistsException: An object with DN ""CN=NAME,OU=Contacts,OU=Resources,DC=fqdn,DC=fqdn,DC=fqdn"" already exists in management agent "AD_CF". An object with
targetAddress smtp:[email protected] already exists, Contact for ObjectName from CAN NOT BE CREATED
   at Mms_Metaverse.MVExtensionObject.Microsoft.MetadirectoryServices.IMVSynchronization.Provision(MVEntry mventry)
</call-stack>
</extension-error-info>
</import-error>
</synchronization-errors>
   <mv-retry-errors/>
   <outbound-flow-counters ma="AD_CF" ma-id="{58020956-DC2A-4C09-9DF1-296778D4788E}">
<provisioned-add-flow detail="true">1</provisioned-add-flow>
</outbound-flow-counters>
   <staging-counters>
    <stage-no-change detail="false">0</stage-no-change>
    <stage-add detail="true">0</stage-add>
    <stage-update detail="true">0</stage-update>
    <stage-rename detail="true">0</stage-rename>
    <stage-delete detail="true">0</stage-delete>
    <stage-delete-add detail="true">0</stage-delete-add>
    <stage-failure detail="true">0</stage-failure>
   </staging-counters>
   <inbound-flow-counters>
    <disconnector-filtered detail="true">2711</disconnector-filtered>
    <disconnector-joined-no-flow detail="true">0</disconnector-joined-no-flow>
    <disconnector-joined-flow detail="true">0</disconnector-joined-flow>
    <disconnector-joined-remove-mv detail="true">0</disconnector-joined-remove-mv>
    <disconnector-projected-no-flow detail="true">0</disconnector-projected-no-flow>
    <disconnector-projected-flow detail="true">1</disconnector-projected-flow>
    <disconnector-projected-remove-mv detail="true">0</disconnector-projected-remove-mv>
    <disconnector-remains detail="false">235</disconnector-remains>
    <connector-filtered-remove-mv detail="true">0</connector-filtered-remove-mv>
    <connector-filtered-leave-mv detail="true">0</connector-filtered-leave-mv>
    <connector-flow detail="true">0</connector-flow>
    <connector-flow-remove-mv detail="true">0</connector-flow-remove-mv>
    <connector-no-flow detail="true">0</connector-no-flow>
    <connector-delete-remove-mv detail="true">0</connector-delete-remove-mv>
    <connector-delete-leave-mv detail="true">0</connector-delete-leave-mv>
    <connector-delete-add-processed detail="true">0</connector-delete-add-processed>
    <flow-failure detail="true">2</flow-failure>
   </inbound-flow-counters>
   <export-counters>
    <export-add detail="true">0</export-add>
    <export-update detail="true">0</export-update>
    <export-rename detail="true">0</export-rename>
    <export-delete detail="true">0</export-delete>
    <export-delete-add detail="true">0</export-delete-add>
    <export-failure detail="true">0</export-failure>
   </export-counters>
</step-details>
</run-details>
</run-history>
If I want to retrieve information from field:
<synchronization-errors> and <call-stack> how I can do this ?
I'd like to have an output with few rows reporting something like:
<synchronization-errors><import-error cs-guid="{F56B20AE-8EA3-E311-A7B3-005056A80FB6}" dn="CN=NAME,OU=Contacts,OU=Resources,DC=fqdn,DC=fqdn,DC=fqdn">
<call-stack>Microsoft.MetadirectoryServices.ObjectAlreadyExistsException: An object with DN ""CN=NAME,OU=Contacts,OU=Resources,DC=fqdn,DC=fqdn,DC=fqdn"" already exists in management agent "AD_CF". An object with targetAddress
smtp:[email protected] already exists, Contact for ObjectName from CAN NOT BE CREATED
   at Mms_Metaverse.MVExtensionObject.Microsoft.MetadirectoryServices.IMVSynchronization.Provision(MVEntry mventry)
</call-stack>
Do you have any ideas on how to do that ?
Thanks in advance!!!
Regards

Powershell sql agent jobs

Hi, I am trying to check status of sql agent jobs on various servers using powershell howerver I successfully list all the servers but cant seem to be able to
Write-Output
$job.name
for any of the servers including the monitoring server that I am absolutely sure I have all required permissions. I get no errors which makes troubleshooting that much
more difficult. Any ideas? Thank you
foreach($sqlserver
in $sqlservers)
#***THIS WORKS***
write-host
$sqlserver.instancename
$srv
= New-Object ('Microsoft.SqlServer.Management.Smo.Server')
$sqlserver;
foreach ($job
in $srv.Jobserver.Jobs)
$jobName
= $job.Name;
$jobEnabled
= $job.IsEnabled;
#***THIS DOESN'T WORK***
write-host
$jobName
write-host
$job.Name
Paula

I figured it out
The line
$srv = New-Object ('Microsoft.SqlServer.Management.Smo.Server') $sqlserver;
should be:
$srv = New-Object ('Microsoft.SqlServer.Management.Smo.Server') $sqlserver.InstanceName ;
Paula

SO I am getting a strange error when trying to access the FIM Management Agents

Hi Everyone,
So I am getting a really odd error when I go to FIM --> Management Agents -->MOSS-guid ID right click on that and choose porperties, then Configure Connection Information, then I click OK and I get this pop up error "the type of 'pictureurl' string
is not compatible with the type of 'sps_mv_octelstring_pictureurl'. I got here by noticing that in the error log there was an error that said:
The management agent "MOSS-guid ID" failed on run profile "MOSS_EXPORT_Guid ID" because the server encountered errors.
when I searched on that error, it lead me to a ton of blogs that said to do the following:go to FIM --> Management Agents -->MOSS-guid ID right click on that and choose porperties, then Configure Connection Information at the bottom of the page there
is a Connect To field and every blog I read said to change it to direct:{Domain}:{Port}. The thing is that my domain and port were fine, so that is when I clicked ok, and got that error message. Ever since this happened, my FIM has been broken, and I really
can't figure out why???
So I haven't done any updates to the server in at least a year, so nothing could be happening there.
Any help at all with this would be taken with the greatest appreciation.
Best regards, Mike

What you're doing is unsupported. You need to manipulate the MAs via Central Admin -> Manage Service Applications, find your UPA SA and manage it. You can then Manage User Properties and make changes to the Picture property from here.
Trevor Seward
Follow or contact me at...
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Too Slow - Domino 6.5.4 with access manager agent 2.2 ?

I don't know how to tune Domino 6.5.4 with access manager agent 2.2?
I think AMAgent.properties is not good for SSO.
Please help me to tune it.
# $Id: AMAgent.properties,v 1.103 2005/09/19 22:08:34 madan Exp $
# Copyright ? 2002 Sun Microsystems, Inc. All rights reserved.
# U.S. Government Rights - Commercial software. Government users are
# subject to the Sun Microsystems, Inc. standard license agreement and
# applicable provisions of the FAR and its supplements. Use is subject to
# license terms. Sun, Sun Microsystems, the Sun logo and Sun ONE are
# trademarks or registered trademarks of Sun Microsystems, Inc. in the
# U.S. and other countries.
# Copyright ? 2002 Sun Microsystems, Inc. Tous droits r閟erv閟.
# Droits du gouvernement am閞icain, utlisateurs gouvernmentaux - logiciel
# commercial. Les utilisateurs gouvernmentaux sont soumis au contrat de
# licence standard de Sun Microsystems, Inc., ainsi qu aux dispositions en
# vigueur de la FAR [ (Federal Acquisition Regulations) et des suppl閙ents
# ? celles-ci.
# Distribu? par des licences qui en restreignent l'utilisation. Sun, Sun
# Microsystems, le logo Sun et Sun ONE sont des marques de fabrique ou des
# marques d閜os閑s de Sun Microsystems, Inc. aux Etats-Unis et dans
# d'autres pays.
# The syntax of this file is that of a standard Java properties file,
# see the documentation for the java.util.Properties.load method for a
# complete description. (CAVEAT: The SDK in the parser does not currently
# support any backslash escapes except for wrapping long lines.)
# All property names in this file are case-sensitive.
# NOTE: The value of a property that is specified multiple times is not
# defined.
# WARNING: The contents of this file are classified as an UNSTABLE
# interface by Sun Microsystems, Inc. As such, they are subject to
# significant, incompatible changes in any future release of the
# software.
# The name of the cookie passed between the Access Manager
# and the SDK.
# WARNING: Changing this property without making the corresponding change
# to the Access Manager will disable the SDK.
com.sun.am.cookie.name = iPlanetDirectoryPro
# The URL for the Access Manager Naming service.
com.sun.am.naming.url = http://sportal.yjy.dqyt.petrochina:80/amserver/namingservice
# The URL of the login page on the Access Manager.
com.sun.am.policy.am.login.url = http://sportal.yjy.dqyt.petrochina:80/amserver/UI/Login
# Name of the file to use for logging messages.
com.sun.am.policy.agents.config.local.log.file = c:/Sun/Access_Manager/Agents/2.2/debug/C__Lotus_Domino/amAgent
# This property is used for Log Rotation. The value of the property specifies
# whether the agent deployed on the server supports the feature of not. If set
# to false all log messages are written to the same file.
com.sun.am.policy.agents.config.local.log.rotate = true
# Name of the Access Manager log file to use for logging messages to
# Access Manager.
# Just the name of the file is needed. The directory of the file
# is determined by settings configured on the Access Manager.
com.sun.am.policy.agents.config.remote.log = amAuthLog.Dominoad.yjy.dqyt.petrochina.80
# Set the logging level for the specified logging categories.
# The format of the values is
#     <ModuleName>[:<Level>][,<ModuleName>[:<Level>]]*
# The currently used module names are: AuthService, NamingService,
# PolicyService, SessionService, PolicyEngine, ServiceEngine,
# Notification, PolicyAgent, RemoteLog and all.
# The all module can be used to set the logging level for all currently
# none logging modules. This will also establish the default level for
# all subsequently created modules.
# The meaning of the 'Level' value is described below:
#     0     Disable logging from specified module*
#     1     Log error messages
#     2     Log warning and error messages
#     3     Log info, warning, and error messages
#     4     Log debug, info, warning, and error messages
#     5     Like level 4, but with even more debugging messages
# 128     log url access to log file on AM server.
# 256     log url access to log file on local machine.
# If level is omitted, then the logging module will be created with
# the default logging level, which is the logging level associated with
# the 'all' module.
# for level of 128 and 256, you must also specify a logAccessType.
# *Even if the level is set to zero, some messages may be produced for
# a module if they are logged with the special level value of 'always'.
com.sun.am.log.level =
# The org, username and password for Agent to login to AM.
com.sun.am.policy.am.username = UrlAccessAgent
com.sun.am.policy.am.password = LYnKyOIgdWt404ivWY6HPQ==
# Name of the directory containing the certificate databases for SSL.
com.sun.am.sslcert.dir = c:/Sun/Access_Manager/Agents/2.2/domino/cert
# Set this property if the certificate databases in the directory specified
# by the previous property have a prefix.
com.sun.am.certdb.prefix =
# Should agent trust all server certificates when Access Manager
# is running SSL?
# Possible values are true or false.
com.sun.am.trust_server_certs = true
# Should the policy SDK use the Access Manager notification
# mechanism to maintain the consistency of its internal cache? If the value
# is false, then a polling mechanism is used to maintain cache consistency.
# Possible values are true or false.
com.sun.am.notification.enable = true
# URL to which notification messages should be sent if notification is
# enabled, see previous property.
com.sun.am.notification.url = http://Dominoad.yjy.dqyt.petrochina:80/amagent/UpdateAgentCacheServlet?shortcircuit=false
# This property determines whether URL string case sensitivity is
# obeyed during policy evaluation
com.sun.am.policy.am.url_comparison.case_ignore = true
# This property determines the amount of time (in minutes) an entry
# remains valid after it has been added to the cache. The default
# value for this property is 3 minutes.
com.sun.am.policy.am.polling.interval=3
# This property allows the user to configure the User Id parameter passed
# by the session information from the access manager. The value of User
# Id will be used by the agent to set the value of REMOTE_USER server
# variable. By default this parameter is set to "UserToken"
com.sun.am.policy.am.userid.param=UserToken
# Profile attributes fetch mode
# String attribute mode to specify if additional user profile attributes should
# be introduced into the request. Possible values are:
# NONE - no additional user profile attributes will be introduced.
# HTTP_HEADER - additional user profile attributes will be introduced into
# HTTP header.
# HTTP_COOKIE - additional user profile attributes will be introduced through
# cookies.
# If not within these values, it will be considered as NONE.
com.sun.am.policy.agents.config.profile.attribute.fetch.mode=NONE
# The user profile attributes to be added to the HTTP header. The
# specification is of the format ldap_attribute_name|http_header_name[,...].
# ldap_attribute_name is the attribute in data store to be fetched and
# http_header_name is the name of the header to which the value needs
# to be assigned.
# NOTE: In most cases, in a destination application where a "http_header_name"
# shows up as a request header, it will be prefixed by HTTP_, and all
# lower case letters will become upper case, and any - will become _;
# For example, "common-name" would become "HTTP_COMMON_NAME"
com.sun.am.policy.agents.config.profile.attribute.map=cn|common-name,ou|organizational-unit,o|organization,mail|email,employeenumber|employee-
number,c|country
# Session attributes mode
# String attribute mode to specify if additional user session attributes should
# be introduced into the request. Possible values are:
# NONE - no additional user session attributes will be introduced.
# HTTP_HEADER - additional user session attributes will be introduced into HTTP header.
# HTTP_COOKIE - additional user session attributes will be introduced through cookies.
# If not within these values, it will be considered as NONE.
com.sun.am.policy.agents.config.session.attribute.fetch.mode=NONE
# The session attributes to be added to the HTTP header. The specification is
# of the format session_attribute_name|http_header_name[,...].
# session_attribute_name is the attribute in session to be fetched and
# http_header_name is the name of the header to which the value needs to be
# assigned.
# NOTE: In most cases, in a destination application where a "http_header_name"
# shows up as a request header, it will be prefixed by HTTP_, and all
# lower case letters will become upper case, and any - will become _;
# For example, "common-name" would become "HTTP_COMMON_NAME"
com.sun.am.policy.agents.config.session.attribute.map=
# Response Attribute Fetch Mode
# String attribute mode to specify if additional user response attributes should
# be introduced into the request. Possible values are:
# NONE - no additional user response attributes will be introduced.
# HTTP_HEADER - additional user response attributes will be introduced into
# HTTP header.
# HTTP_COOKIE - additional user response attributes will be introduced through
# cookies.
# If not within these values, it will be considered as NONE.
com.sun.am.policy.agents.config.response.attribute.fetch.mode=NONE
# The response attributes to be added to the HTTP header. The specification is
# of the format response_attribute_name|http_header_name[,...].
# response_attribute_name is the attribute in policy response to be fetched and
# http_header_name is the name of the header to which the value needs to be
# assigned.
# NOTE: In most cases, in a destination application where a "http_header_name"
# shows up as a request header, it will be prefixed by HTTP_, and all
# lower case letters will become upper case, and any - will become _;
# For example, "common-name" would become "HTTP_COMMON_NAME"
com.sun.am.policy.agents.config.response.attribute.map=
# The cookie name used in iAS for sticky load balancing
com.sun.am.policy.am.lb.cookie.name = GX_jst
# indicate where a load balancer is used for Access Manager
# services.
# true | false
com.sun.am.load_balancer.enable = false
####Agent Configuration####
# this is for product versioning, please do not modify it
com.sun.am.policy.agents.config.version=2.2
# Set the url access logging level. the choices are
# LOG_NONE - do not log user access to url
# LOG_DENY - log url access that was denied.
# LOG_ALLOW - log url access that was allowed.
# LOG_BOTH - log url access that was allowed or denied.
com.sun.am.policy.agents.config.audit.accesstype = LOG_DENY
# Agent prefix
com.sun.am.policy.agents.config.agenturi.prefix = http://Dominoad.yjy.dqyt.petrochina:80/amagent
# Locale setting.
com.sun.am.policy.agents.config.locale = en_US
# The unique identifier for this agent instance.
com.sun.am.policy.agents.config.instance.name = unused
# Do SSO only
# Boolean attribute to indicate whether the agent will just enforce user
# authentication (SSO) without enforcing policies (authorization)
com.sun.am.policy.agents.config.do_sso_only = true
# The URL of the access denied page. If no value is specified, then
# the agent will return an HTTP status of 403 (Forbidden).
com.sun.am.policy.agents.config.accessdenied.url =
# This property indicates if FQDN checking is enabled or not.
com.sun.am.policy.agents.config.fqdn.check.enable = true
# Default FQDN is the fully qualified hostname that the users should use
# in order to access resources on this web server instance. This is a
# required configuration value without which the Web server may not
# startup correctly.
# The primary purpose of specifying this property is to ensure that if
# the users try to access protected resources on this web server
# instance without specifying the FQDN in the browser URL, the Agent
# can take corrective action and redirect the user to the URL that
# contains the correct FQDN.
# This property is set during the agent installation and need not be
# modified unless absolutely necessary to accommodate deployment
# requirements.
# WARNING: Invalid value for this property can result in the Web Server
# becoming unusable or the resources becoming inaccessible.
# See also: com.sun.am.policy.agents.config.fqdn.check.enable,
# com.sun.am.policy.agents.config.fqdn.map
com.sun.am.policy.agents.config.fqdn.default = Dominoad.yjy.dqyt.petrochina
# The FQDN Map is a simple map that enables the Agent to take corrective
# action in the case where the users may have typed in an incorrect URL
# such as by specifying partial hostname or using an IP address to
# access protected resources. It redirects the browser to the URL
# with fully qualified domain name so that cookies related to the domain
# are received by the agents.
# The format for this property is:
# com.sun.am.policy.agents.config.fqdn.map = [invalid_hostname|valid_hostname][,...]
# This property can also be used so that the agents use the name specified
# in this map instead of the web server's actual name. This can be
# accomplished by doing the following.
# Say you want your server to be addressed as xyz.hostname.com whereas the
# actual name of the server is abc.hostname.com. The browsers only knows
# xyz.hostname.com and you have specified polices using xyz.hostname.com at
# the Access Manager policy console, in this file set the mapping as
# com.sun.am.policy.agents.fqdn.map = valid|xyz.hostname.com
# Another example is if you have multiple virtual servers say rst.hostname.com,
# uvw.hostname.com and xyz.hostname.com pointing to the same actual server
# abc.hostname.com and each of the virtual servers have their own policies
# defined, then the fqdnMap should be defined as follows:
# com.sun.am.policy.agents.fqdn.map = valid1|rst.hostname.com,valid2|uvw.hostname.com,valid3|xyz.hostname.com
# WARNING: Invalid value for this property can result in the Web Server
# becoming unusable or the resources becoming inaccessible.
com.sun.am.policy.agents.config.fqdn.map =
# Cookie Reset
# This property must be set to true, if this agent needs to
# reset cookies in the response before redirecting to
# Access Manager for Authentication.
# By default this is set to false.
# Example : com.sun.am.policy.agents.config.cookie.reset.enable=true
com.sun.am.policy.agents.config.cookie.reset.enable=false
# This property gives the comma separated list of Cookies, that
# need to be included in the Redirect Response to Access Manager.
# This property is used only if the Cookie Reset feature is enabled.
# The Cookie details need to be specified in the following Format
# name[=value][;Domain=value]
# If "Domain" is not specified, then the default agent domain is
# used to set the Cookie.
# Example : com.sun.am.policy.agents.config.cookie.reset.list=LtpaToken,
# token=value;Domain=subdomain.domain.com
com.sun.am.policy.agents.config.cookie.reset.list=
# This property gives the space separated list of domains in
# which cookies have to be set in a CDSSO scenario. This property
# is used only if CDSSO is enabled.
# If this property is left blank then the fully qualified cookie
# domain for the agent server will be used for setting the cookie
# domain. In such case it is a host cookie instead of a domain cookie.
# Example : com.sun.am.policy.agents.config.cookie.domain.list=.sun.com .iplanet.com
com.sun.am.policy.agents.config.cookie.domain.list=
# user id returned if accessing global allow page and not authenticated
com.sun.am.policy.agents.config.anonymous_user=anonymous
# Enable/Disable REMOTE_USER processing for anonymous users
# true | false
com.sun.am.policy.agents.config.anonymous_user.enable=false
# Not enforced list is the list of URLs for which no authentication is
# required. Wildcards can be used to define a pattern of URLs.
# The URLs specified may not contain any query parameters.
# Each service have their own not enforced list. The service name is suffixed
# after "# com.sun.am.policy.agents.notenforcedList." to specify a list
# for a particular service. SPACE is the separator between the URL.
com.sun.am.policy.agents.config.notenforced_list = http://dominoad.yjy.dqyt.petrochina/*.nsf http://dominoad.yjy.dqyt.petrochina/teamroom.nsf/TROutline.gif?
OpenImageResource http://dominoad.yjy.dqyt.petrochina/icons/*.gif
# Boolean attribute to indicate whether the above list is a not enforced list
# or an enforced list; When the value is true, the list means enforced list,
# or in other words, the whole web site is open/accessible without
# authentication except for those URLs in the list.
com.sun.am.policy.agents.config.notenforced_list.invert = false
# Not enforced client IP address list is a list of client IP addresses.
# No authentication and authorization are required for the requests coming
# from these client IP addresses. The IP address must be in the form of
# eg: 192.168.12.2 1.1.1.1
com.sun.am.policy.agents.config.notenforced_client_ip_list =
# Enable POST data preservation; By default it is set to false
com.sun.am.policy.agents.config.postdata.preserve.enable = false
# POST data preservation : POST cache entry lifetime in minutes,
# After the specified interval, the entry will be dropped
com.sun.am.policy.agents.config.postcache.entry.lifetime = 10
# Cross-Domain Single Sign On URL
# Is CDSSO enabled.
com.sun.am.policy.agents.config.cdsso.enable=false
# This is the URL the user will be redirected to for authentication
# in a CDSSO Scenario.
com.sun.am.policy.agents.config.cdcservlet.url =
# Enable/Disable client IP address validation. This validate
# will check if the subsequent browser requests come from the
# same ip address that the SSO token is initially issued against
com.sun.am.policy.agents.config.client_ip_validation.enable = false
# Below properties are used to define cookie prefix and cookie max age
com.sun.am.policy.agents.config.profile.attribute.cookie.prefix = HTTP_
com.sun.am.policy.agents.config.profile.attribute.cookie.maxage = 300
# Logout URL - application's Logout URL.
# This URL is not enforced by policy.
# if set, agent will intercept this URL and destroy the user's session,
# if any. The application's logout URL will be allowed whether or not
# the session destroy is successful.
com.sun.am.policy.agents.config.logout.url=
#http://sportal.yjy.dqyt.petrochina/amserver/UI/Logout
# Any cookies to be reset upon logout in the same format as cookie_reset_list
com.sun.am.policy.agents.config.logout.cookie.reset.list =
# By default, when a policy decision for a resource is needed,
# agent gets and caches the policy decision of the resource and
# all resource from the root of the resource down, from the Access Manager.
# For example, if the resource is http://host/a/b/c, the the root of the
# resource is http://host/. This is because more resources from the
# same path are likely to be accessed subsequently.
# However this may take a long time the first time if there
# are many many policies defined under the root resource.
# To have agent get and cache the policy decision for the resource only,
# set the following property to false.
com.sun.am.policy.am.fetch_from_root_resource = true
# Whether to get the client's hostname through DNS reverse lookup for use
# in policy evaluation.
# It is true by default, if the property does not exist or if it is
# any value other than false.
com.sun.am.policy.agents.config.get_client_host_name = false
# The following property is to enable native encoding of
# ldap header attributes forwarded by agents. If set to true
# agent will encode the ldap header value in the default
# encoding of OS locale. If set to false ldap header values
# will be encoded in UTF-8
com.sun.am.policy.agents.config.convert_mbyte.enable = false
#When the not enforced list or policy has a wildcard '*' character, agent
#strips the path info from the request URI and uses the resulting request
#URI to check against the not enforced list or policy instead of the entire
#request URI, in order to prevent someone from getting access to any URI by
#simply appending the matching pattern in the policy or not enforced list.
#For example, if the not enforced list has the value http://host/*.gif,
#stripping the path info from the request URI will prevent someone from
#getting access to http://host/index.html by using the URL http://host/index.html?hack.gif.
#However when a web server (for exmample apache) is configured to be a reverse
#proxy server for a J2EE application server, path info is interpreted in a different
#manner since it maps to a resource on the proxy instead of the app server.
#This prevents the not enforced list or policy from being applied to part of
#the URI below the app serverpath if there is a wildcard character. For example,
#if the not enforced list has value http://host/webapp/servcontext/* and the
#request URL is http://host/webapp/servcontext/example.jsp the path info
#is /servcontext/example.jsp and the resulting request URL with path info stripped
#is http://host/webapp, which will not match the not enforced list. By setting the
#following property to true, the path info will not be stripped from the request URL
#even if there is a wild character in the not enforced list or policy.
#Be aware though that if this is set to true there should be nothing following the
#wildcard character '*' in the not enforced list or policy, or the
#security loophole described above may occur.
com.sun.am.policy.agents.config.ignore_path_info = false
# Override the request url given by the web server with
# the protocol, host or port of the agent's uri specified in
# the com.sun.am.policy.agents.agenturiprefix property.
# These may be needed if the agent is sitting behind a ssl off-loader,
# load balancer, or proxy, and either the protocol (HTTP scheme),
# hostname, or port of the machine in front of agent which users go through
# is different from the agent's protocol, host or port.
com.sun.am.policy.agents.config.override_protocol =
com.sun.am.policy.agents.config.override_host =
com.sun.am.policy.agents.config.override_port =
# Override the notification url in the same way as other request urls.
# Set this to true if any one of the override properties above is true,
# and if the notification url is coming through the proxy or load balancer
# in the same way as other request url's.
com.sun.am.policy.agents.config.override_notification.url =
# The following property defines how long to wait in attempting
# to connect to an Access Manager AUTH server.
# The default value is 2 seconds. This value needs to be increased
# when receiving the error "unable to find active Access Manager Auth server"
com.sun.am.policy.agents.config.connection_timeout =
# Time in milliseconds the agent will wait to receive the
# response from Access Manager. After the timeout, the connection
# will be drop.
# A value of 0 means that the agent will wait until receiving the response.
# WARNING: Invalid value for this property can result in
# the resources becoming inaccessible.
com.sun.am.receive_timeout = 0
# The three following properties are for IIS6 agent only.
# The two first properties allow to set a username and password that will be
# used by the authentication filter to pass the Windows challenge when the Basic
# Authentication option is selected in Microsoft IIS 6.0. The authentication
# filter is named amiis6auth.dll and is located in
# Agent_installation_directory/iis6/bin. It must be installed manually on
# the web site ("ISAPI Filters" tab in the properties of the web site).
# It must also be uninstalled manually when unintalling the agent.
# The last property defines the full path for the authentication filter log file.
com.sun.am.policy.agents.config.iis6.basicAuthentication.username =
com.sun.am.policy.agents.config.iis6.basicAuthentication.password =
com.sun.am.policy.agents.config.iis6.basicAuthentication.logFile = c:/Sun/Access_Manager/Agents/2.2/debug/C__Lotus_Domino/amAuthFilter

Hi,
I installed opensso (so Sun Java(TM) System Access Manager 7.5) and the agent for Domino 6.5.4 and I have the message in logs "amAgent"
2007-07-11 18:40:16.119 Error 1708:3dbcf768 PolicyAgent: render_response(): Entered.
I have the box to identify but it doesnot connect me on my opensso server.
It still identify with Domino's server
Thanks for your response
Thomas

Microsoft Operations Manager Condolidator Module processing thread failed

Hello,
I got the error: The Microsoft Operations Manager Condolidator Module processing thread failed with an internal error and must be unload.
with event ID 11105 & 11108 but not the one in the article is it the same issue or more ...
I could not find any WMI issue as stated in http://thoughtsonopsmgr.blogspot.com/2011/01/error-consolidator-module-failed.html
Any idea?
Thanks,
Dom
System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

try clearing the health service cache on the agents and restart the health service to reload that workflow.
Juke Chou
TechNet Community Support
I did already twice and this did not fix the issue.
Thanks,
Dom
System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

Clash with Microsoft SMS Remote Agent

After installing the Zenworks Remote Management Agent on a Windows XP PC
(running SP1), I found two errors in Device Manager under Keyboards and
Pointing/Mouse Devices :
SMS Virtual Keyboard driver did not start
SMS Virtual Mouse driver did not start
Do I need to worry about these errors ? The Zenworks PC Remote Control
function works fine, but I suspect that Microsoft SMS Remote Control may
be effected.
Does anyone know of any way to remove these errors ?

Sunil,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Any script or tool to deploy small applications like Antivirus or Management agents remotely

Any script or tool to deploy small applications like Antivirus or Management agents remotely..? user will not have admin rights and they will be connected remotely mostly on VPN.
Unable to achieve mush results with SCCM as its depended on agent communication.
Please let me know if any other options to achieve this..
Thank you
Kris

Hi,
Prewritten scripts can be found in the repository:
http://gallery.technet.microsoft.com/scriptcenter
I recommend using ConfigMgr. It works just fine over a VPN or public internet.
Don't retire TechNet! -
(Don't give up yet - 13,225+ strong and growing)

How to debug a Diagnostic Data Adapter (custom data collector) for Microsoft Test Manager

Hello,
I have created a custom Diagnostic Data Adapter aka. custom data collector for Microsoft Test Manager (MTM) and installed it, all according to the guidelines under Creating
a Diagnostic Data Adapter to Collect Custom Data or Affect a Test Machine.
I would like to debug my data collector. On which machine should I perform the debugging and to which process should I attach from Visual Studio? Are there any restrictions regarding the user who is running the debug session?
How can I do that?
Thank you ,
Ana

It seems that I found the solution, but I would like someone still to verify if it is the right one.
Steps:
Turn on "Microsoft Symbol Server" under In Tools-->Options-->Debugging
Restart manually "Visual Studio Lab Agent Service" on the machine where the collector is installed (this actionautomatically restarts the Visual Studio Test Agent ("C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\QTAgentService.exe"))
Load code for your collector in Visual Studio
Attach the Visual Studio debugger to the processes QTAgentService.exe and QTDCAgent32.exe
Start test in MTM on client machine using test setting which trigger the data collector (diagnostic data adapter)
and finally hit a brake point in your code...
Thank you,
Ana

QuickStart Tool fails at Update AD management agent configuration

Hello,
Every time I add useAppPoolCredentials=”true” under <location path="SharePoint - 80"> in the application config file of IIS, when I run iisreset it doesn't not start. When I roll back iisreset works again. I have followed all the steps in FIM
setup, but am stuck at that point.
The article on Kerberos: http://social.technet.microsoft.com/wiki/contents/articles/3385.aspx
In a previous try I skipped this step and I experience the annoying popup, i did it on a purpose to see if I would actually get somewhere. Has anyone experience this? Please help?
Regards,
Dominique.

Hi Furqan,
Sorry I'm the one that omitted that. If you look carefully at the logs, the point where it verifies the OU is passed. (Verifying container). Below is one of the errors in my logs.
Log Name:      Forefront Identity Manager Management Agent
Source:        ForefrontIdentityManager.ManagementAgent
Date:          1/30/2013 3:17:21 PM
Event ID:      3
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      FIMTEST
Description:
System.Xml: System.Xml.XmlException: Root element is missing.
   at System.Xml.XmlTextReaderImpl.Throw(Exception e)
   at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
   at System.Xml.XmlLoader.Load(XmlDocument doc, XmlReader reader, Boolean preserveWhitespace)
   at System.Xml.XmlDocument.Load(XmlReader reader)
   at Microsoft.ResourceManagement.Utilities.XmlHelper.LoadXmlSafeExtension(XmlDocument xmlDocument, String xml)
   at MIIS.ManagementAgent.RavenMA.Initialize()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="ForefrontIdentityManager.ManagementAgent" />
    <EventID Qualifiers="0">3</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-01-30T13:17:21.000000000Z" />
    <EventRecordID>39</EventRecordID>
    <Channel>Forefront Identity Manager Management Agent</Channel>
    <Computer>FIMTEST</Computer>
    <Security />
</System>
<EventData>
    <Data>System.Xml: System.Xml.XmlException: Root element is missing.
   at System.Xml.XmlTextReaderImpl.Throw(Exception e)
   at System.Xml.XmlTextReaderImpl.ParseDocumentContent()
   at System.Xml.XmlLoader.Load(XmlDocument doc, XmlReader reader, Boolean preserveWhitespace)
   at System.Xml.XmlDocument.Load(XmlReader reader)
   at Microsoft.ResourceManagement.Utilities.XmlHelper.LoadXmlSafeExtension(XmlDocument xmlDocument, String xml)
   at MIIS.ManagementAgent.RavenMA.Initialize()</Data>
</EventData>
</Event>
and also:
Log Name:      Forefront Identity Manager Management Agent
Source:        ForefrontIdentityManager.ManagementAgent
Date:          1/30/2013 3:17:20 PM
Event ID:      3
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      FIMTEST
Description:
mmsmafim: System.NullReferenceException: Object reference not set to an instance of an object.
   at MIIS.ManagementAgent.RavenMA.UIGetData(String pszRequestInformation, Int32& pfSuccess, String& ppszResult)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="ForefrontIdentityManager.ManagementAgent" />
    <EventID Qualifiers="0">3</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-01-30T13:17:20.000000000Z" />
    <EventRecordID>35</EventRecordID>
    <Channel>Forefront Identity Manager Management Agent</Channel>
    <Computer>FIMTEST</Computer>
    <Security />
</System>
<EventData>
    <Data>mmsmafim: System.NullReferenceException: Object reference not set to an instance of an object.
   at MIIS.ManagementAgent.RavenMA.UIGetData(String pszRequestInformation, Int32& pfSuccess, String& ppszResult)</Data>
</EventData>
</Event>

Microsoft powershell management agent

Similar Messages

Maybe you are looking for