SAP IDM vs Microsoft Forefront Client(FIM)

Hi experts,
Actually my companyBig Company) is planning to implement tool for Identity Management but there are couple of options which we are thinking of considering particularly the last 2 options are SAP IDM and Microsoft Forefront(FIM) ... But I am not able to enough information or comparision points that will help me in convincing to my sr management to finally say to one of these tool.
I would really appreciate a quick response, if some one can explain the comparisions points among these 2 tools.
Thanks
SAP_Enthu

Hi All ,
Just to add to my previous question as currently we have MS Active Directory already and as per plan implementing SAP in almost all areas entreprise wide with GRC. So with this background , I will appreciate the advantages and disadvantages of SAP IDM 7.1(might use 7.2 if it comes within next 3 months as planned) with MS Forefront IDM(FIM 2010) in terms of Technical , functionally , architecture ,economic point of view.
This will help in selecting the best tool among them.
Thanks
SAP_Enthu

Similar Messages

Microsoft Forefront Client Security and Itunes

My Ipod sync screen doesnt appear when i connect my ipod to my laptop. This only happens when microsoft forefront client security has been installed otherwise everything goes normal. Is there any solution?

Hi,
Please refer to the articles below to check your system requirement and prerequirement for installing FCS.
http://technet.microsoft.com/en-us/library/bb404245(TechNet.10).aspx
http://technet.microsoft.com/en-us/library/bb404270.aspx
Best Regards
Quan Gu

Advantage and disadvantages of SAP IDM & Microsoft Identity management Tool

Hi Folks,
I am looking some points on SAP IDM and Microsoft tool for Identity Management. I am looking below mention points.
1. Difference in the feature and prize.
2. Limitation
3. Solution architecture for both
Relevant answers will be rewarded.
Regards,
Akshay Shail

Hi,
I can add some points about SAP NW IdM. Regarding your question about the prize: If you only connect SAP systems (it can handle all types of SAP ABAP and SAP Java Systems) they don't charge you extra, because it's already in the NetWeaver license. Furthermore, if you use the SAP Central User Administration: It isn't further developed and will be replaced by SAP NW IdM.
The systems you mentioned can be connected, I think these are basics for everey IdM solution. HR interation is possible with SAP IdM, don't know about the other solution in this point.
There are some whitepapers and presentations about SAP NW IdM: https://www.sdn.sap.com/irj/sdn/nw-identitymanagement?rid=/webcontent/uuid/f0b68fb1-d8af-2a10-2a8e-cc431c15bb39&anchor=section2.
Nevertheless, your question about limitations and solution architecture probably needs a PoC if you want to answer them in deep.
Best regards,
Nils

WSUS - Forefront Client definition update not yet been downloaded

Hi! I need help about
Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.167.1978.0)
I have WSUS 3 SP2 and this definition appears like approved but the file for this update have not yet downloaded
i downloaded the definition on Microsoft Catalog but i don't now how deploy in my clients with wsus automatically
where save the package ?
thanks !

Hi,
Mostly, update will only be downloaded after approval. So please confirm if you have approved it.
Since you have downloaded it from Microsoft catalog, you can import it into WSUS server.
Step 3 Import and Export: Copying Metadata from Database
http://technet.microsoft.com/en-us/library/cc720437(WS.10).aspx
Hope this helps.

Forefront Client Security Issue

After installlation of Microsoft Forefront Client Security,the icon is displayed with an exclamation mark.Is the installation not proper?How could this be solved?

Hi,
It seems that the definitions are out of date, please update to the latest and see how it works.
Thanks.
Jeremy Wu
TechNet Community Support

Oracle IdM integration with Microsoft ILM 2007/FIM 2010

We currently have ILM 2007 in our environment with limited usage at the moment. We are looking at purchasing Oracle Identity Manager to implement an enterprise wide IAM solution.
We were wondering if it is possible to continue using ILM like a middleware between our AD forests and the Oracle IdM. Where the Oracle IdM is the overarching IAM solution and Microsoft ILM 2007/FIM 2010 is like the metadirectory for our AD forests.
Is this possible without installing the Oracle Management Connector on any of our DCs and using ILM as the directory that Oracle IdM connects to. All AD account provisioning/de-provisioning, acct updates, password sync/reset will be initiated from the Oracle IdM to ILM and then implemented on AD. In order words no direct interaction with AD domain controllers from Oracle IdM, everything will go to ILM and ILM in turn applies it to AD.
Is this possible?
Is there a custom connector that will work with ILM 2007/FIM 2010
Is this a simple customization or something that can be problematic and expensive?
Any feedback is much appreciated
Thanks

user1106726 wrote:
We currently have ILM 2007 in our environment with limited usage at the moment. We are looking at purchasing Oracle Identity Manager to implement an enterprise wide IAM solution.
We were wondering if it is possible to continue using ILM like a middleware between our AD forests and the Oracle IdM. Where the Oracle IdM is the overarching IAM solution and Microsoft ILM 2007/FIM 2010 is like the metadirectory for our AD forests.
Is this possible without installing the Oracle Management Connector on any of our DCs and using ILM as the directory that Oracle IdM connects to. All AD account provisioning/de-provisioning, acct updates, password sync/reset will be initiated from the Oracle IdM to ILM and then implemented on AD. In order words no direct interaction with AD domain controllers from Oracle IdM, everything will go to ILM and ILM in turn applies it to AD.
Is this possible?yes
>
Is there a custom connector that will work with ILM 2007/FIM 2010Yes, if you write one you will have a custom connector
>
Is this a simple customization or something that can be problematic and expensive?It won't be simple. Problematic and expensive maybe, depends on how good you are with OIM and ILM

Windows 8.1 will not get Forefront Client Updates from WSUS

Recently I noticed that my Windows 8.1 clients were not getting updates from WSUS 3.2. After some searching I found it was an issue with HTTPS and the solution was to disable HTTPS or enable TLS. So I enabled TLS on the Server 2008 R2 WSUS server
and that fixed the issue with my 8.1 clients not getting updates except for Forefront Endpoint Protection 2010. My SCCM server deploys the client fine but it is version 2.1 and normally the client and definition updates come from WSUS with the
latest client version being 4.5. However, my Windows 8.1 machines will not get the client updates even though they are automatically approved for all machines.
I am just wondering what else I can check or change to make sure my Windows 8.1 clients get the Forefront client updates as they should?? I am wondering if I manually install the 4.1 client update if it will take the client updates after that.
I only have about eight Windows 8.1 machines so if I have to do that by hand for now then I will and I think my organization will be moving to Server 2012 and SCCM 2012 this summer sometime.

I reread your post and have another suggestion. If your SCCM 2007 server is still deploying the old 2.1 FEP client version, then you should install the latest anti-malware platform update for the SCCM server so you can deploy it from there instead of WSUS:
http://support.microsoft.com/kb/2952678
http://blogs.msdn.com/b/minfangl/archive/2013/08/15/guidance-on-install-anti-malware-platform-updates-for-fep-2010-su1-and-scep-2012-sp1.aspx
Also, you may be affected by this:
"Anti-malware platform updates on MU will use special detection logic and applicability rules to make the anti-malware platform updates available only on computers with previous N-2 anti-malware platforms installed. For example, on April 8<sup>th</sup>,
anti-malware platform of version 4.5.x will be released on MU, and it will only be offered to computers where anti-malware platform version 4.3.x or 4.4.x is available. If a computer has FEP or SCEP client with version 4.1.x, it has to be upgraded to version
4.3.x first, then to the latest version (4.5.x). If a computer has FEP or SCEP client with version older than 4.1.x, because of the same N-2 rule, it has to be upgraded to 4.1.x first, then to 4.3.x, and then to the latest version (4.5.x). Required updates
will be kept on MU to ensure that this upgrade process is available for computers running older versions of the Microsoft anti-malware platform."
http://blogs.technet.com/b/configmgrteam/archive/2014/03/27/anti-malware-platform-updates-for-endpoint-protection-will-be-released-to-mu.aspx

SAP IDM 7.0 integration with third party system

Hi Experts,
I know SAP IDM 7.0 can integrate with third party systems and create user ids on most of the third party systems.
But I need to know regarding If it is possible to integrate with following systems
1) Microsoft Exchange 2007 ( I know till exchange 2003 SAP IDM support )
2) Microsoft Active directory 2008 ( I know till Actice directory 2003)
3) EMC Documentum 6.5
4) ARIS 7.1.0
5) BlackBoard, Release 9.0
6) Oracle 10g ( Is it possible to create users at oracle level ? or at what level ? )
7) Sun Solaris Sparc ( Is it possible to create users at OS level )
If you have information how on this please share. I know that provisioning framework will have templates for most of the target systems. I want to know if they are available for above systems on SAP IDM 7.0 or if not have we can connect to them?

Hi Matthew
Your expertise in SAP IDM is indeed a great help!!
>Can't see why not, it's all done via SQL commands. I've done similar things with MSSQL
You mean that there will be oracle 10g drivers/oledb connectors in SAP IDM and in through SQL commands like "create user alfredo identified by alfredos_secret; " we can create user in oracle database ?. As you said this should be possible. What about creating user( user management ) in oracle 10g application like dba or scot and assigning the privileges in oracle application?
>might need to do via UNIX scripts, but it can be done
You mean that Unix scripts will be defined in SAP IDM and SAP IDM will execute these scripts in the Sun Solaris Sparc ?. It should be possible as you said. By the way how we will be able connect to Sun Solaris sparc ? Is it via the option "file " under the "Repositories" with repositories wizard and later executing the file from SAP IDM ?
Thank you once again for your expert answers on third party systems.

List Malware for the past 90 Days Forefront Client Security

Hello,
Is it possible to list all Malwares catched by FCS for the past 90 days?
The report Malware Summary or Malware Details are just running 72 hours maximum...
Thanks,
Dom
System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

Hi,
"By default, the OnePoint DB only maintains 72 hours worth of client data, but
the SystemCenterReporting DB holds 395 days worth of data, such as Historical data. Meanwhile, you can
modify the number of days to retain data in the SystemCenterReporting database. For more information, please refer to the following article.
http://support.microsoft.com/kb/887016/en-us"
For more information:http://social.technet.microsoft.com/Forums/forefront/en-US/c05a1528-9ae9-4a60-b2c6-a0bc9170152c/length-of-forefront-client-security-historical-reportsmalware-history?forum=Forefrontclientreporting
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Reconciliation reports in SAP IDM

Hello
I am working on IDM 7.2 SP8 configuration and so far its going good and was able to configured scenerios.
I wanted some reports (Reconcillation report) and saw some blog where its advised to install SAP IDM RDS solution, I am just wondering how can I adopt that solution since I am already on 7.2 SP8 and configure my tool with client required customization.
I checked that RDS solution is avaialble for IDM 7.2 SP4.
Is there any way I can find reconcillation report MCC File so I can upload and use ?
Thanks & Regards
Deepak Gupta

Thanks Matt / Peter
Do you mean that I can download the RDS Soultion from market place and then only upload the Reconicillation report to my current SP8 version and that would work fine ?
Does the downloads will have *.MCC files for reconcillation report which can be directly uploaded ?
Thanks & Regards
Deepak Gupta

Microsoft sql client deadlocked on lock resources with another process

Hi
I wrote a forecasting report for a customer which creates an excel spreadsheet with the information
Depending on how they run the report it can take between 5 to 15 minutes to run
We have just upgraded the customer to SAP 8.8 PL10 and Microsoft SQL Server 2008 and they seem to be getting an error -
Microsoft sql client deadlocked on lock resources with another process .......
The error seems intermittent, they may get the error once and the next time they run it, it is fine.
I have never seen this error before and they never had it before on SAP 2005
Can anyone suggest anything please?
Thanks
Regards Andy

Hi Andy,
I was having the same problem. I'm gonna tell you what i did.
My query usually takes from 10 to 15 minutes to show results. That long time also block all transaction in the database.
I was reading about some techniques to improve queries performance. Some of the tips are:
1. Review indexes in the table you are querying
2. Use Views
3. Avoid cursors
4. Archive old data
5. Use the correct transaction isolation level
The last one, was the tip that helped me to avoid the block in the database.
By default the isolation level in SQL Server is Read Commited, that explains why the database block some transactions. For example, if you have a query that take data from JDT1 table and it takes several minutes to show the results, other transactions that try to write in the same table should be blocked if they arrive at the same time of the first query.
To solve this, you can make your query in a transaction with Snapshot isolation level. It means that your select query will take a snapshot of the data without blocking any other transaction.
Here is an example how you can make it. The difference is that you may use ADO.NET connection replacing DI API Connection:
oConnection = OK1.Generic.Helpers.setConnection(server, password, userID, db); // You have to set anyway your sqlconnection
                    if (oConnection.State == ConnectionState.Open)
                        oCommand = new SqlCommand();
                        oCommand.Connection = oConnection;
                        oCommand.CommandTimeout = System.Convert.ToInt32(timeOut);
                        oCommand.CommandText = "ALTER DATABASE " + db + " SET ALLOW_SNAPSHOT_ISOLATION ON";
                        oCommand.ExecuteNonQuery();
                        sqlTran1 = oConnection.BeginTransaction(IsolationLevel.Snapshot);
                        oCommand.CommandText = query;
                        oCommand.Transaction = sqlTran1;
                        oCommand.ExecuteNonQuery();
                        sqlTran1.Commit();
                        oCommand.CommandText = "ALTER DATABASE " + db + " SET ALLOW_SNAPSHOT_ISOLATION OFF";
                        oCommand.ExecuteNonQuery();
                        if (oConnection.State == ConnectionState.Open)
                            oConnection.Close();
In this example I write the data to show in the report in other table, then the report takes the data from that table.
I hope it will be helpful for you.
Regards,
Juan Camilo

Sequencing Microsoft Forefront UAG Internet Explorer Addon

Hello,
I am trying to sequence the Microsoft Forefront UAG components to allow a remote access site to work.
I am using App-v 4.6, IE 10 and a Windows 2008 R2 sequencer.
I am sequencing as a plugin and pointing to the locally installed version of IE, then creating a shortcut to the website.
However, when i publish the package, the addon doesnt appear in the manage addons IE list, and the site still prompts to install it..
Does anyone have any advice please?
Thanks,
Fiona

Can you verify if your IE really runs inside the virtual environment (application is shown as 'in use' in the client management console or you can access the asset folder on the virtual drive (like Q:) from an file-open (Ctrl-o) dialog of that IE?
Falko
Twitter
@kirk_tn   |   Blog
kirxblog   |   Web
kirx.org   |   Fireside
appvbook.com

SAP IDM Lotus Notes : Missing dll

Hello
We are trying to connect SAP IDM to Lotus Notes, and we are facing some connexion issues.
When we run Notes u2013 initial load job, we have exactly the same error log as in this forum discussion: Provisioning framework for Lotus Notes
But additionally we can not find the MXEXTPWD.DLL files, witch is supposed to be in the Identity Center installation directory (C:\ProgramFiles\SAP\IdM\Identity Center)
In the forum discussion they talk bout MXVBNote.dll and MXNotes.dll, we canu2019t find them neither.
Does anyone know in witch step the MXEXTPWD.DLL is created? Or where we can find it?
Regards
SAP Netweaver IDM 7.1 SP5
Lotus Notes Client 8.5.1
Windows Server 2003 R2
Edited by: Jeremy Baars on Mar 7, 2011 11:57 AM
Edited by: Jeremy Baars on Mar 7, 2011 12:01 PM

Hi Experts,
I'm finally able to launch VB scripts to try to connect IDM to the Notes Client.
I said TRY because the initial Load for notes is still not working.
I'm facing another error message :
Open DB Names.nsf failed : error : the prompt for password was aborted by user.
Function OpenListNotes3 : Open DB Names.nsf failed : error : the prompt for password was aborted by user.
So I tried to enable/disabled the option in the Lotus client under "File/Security/User Security/(Enter password). Tab "Security Basics". Option:Don't prompt for a password from other Notes-based programs (reduced security) without success. Of course i restarted my server each time i made changes.
I also checked several times my constants in IDM. The Id_file/user/password are correct.
My connection parameters are also correct between Lotus Client and Domino server.
Any suggestion or idea?
It looks like IDM doesn't try to fill the password and just abort it...
Thanks en regards.
Jeremy

SAP IDM 7.2 Questions

Hi,
I just recently started with SAP IDM and have a few Questions, maybe someone has the time to explain, thanks in advance!
- What for is VDS (Virtual Directory Server)? I can write directly into AD? why another target system?
- If I create a Role in Identity Center for testing its available on the idm portal http://localhost:50000/idm but not in /useradmin or Umeadmin?
- Repository, does it matter in which repository I upload (CSV Import) users? I have multiple repositories and didn't understand the exact purpose of a repository?
- Org Units? how can I create Org Units and assign roles for inheritance? is this only available on a Netweaver AS ABAP installation? (I installed AS JAVA) According this link: Indirect Role Assignment Using Organizational Management (OM) - Identity Management - SAP Library
Thanks, Patrick

Hi Patrick,
here is some answers:
Main purpose of VDS is to be an interface INTO IdM. It is an LDAP interface into the data stored in IdM database. It allows you for example to search, read, write and authenticate to IdM data via LDAP interface.
IdM has its own UI (http:host:port/idm). You are not supposed to see business roles in useradmin of the J2EE. It is objects known to IdM, not to the J2EE.
Repositories are objects representing mostly a source or target system. For example AD could be a source system where you get users from. An ABAP client can be a target system where you provision users to. Uploading users is just a way of creating users that you cannot get from some other source system like HCM, AD or ABAP. It depends on your scenarios and user life cycle where you get your user information from (source system) and where you provision to (target system).
The link you shared regarding the org units is not really related to IdM as a product. If you do some automatic assignments in ABAP directly, you might need to reconcile with IdM. IdM is supposed to be a central user administration tool. If you have information about org units in IdM and want to use it to automatically assign authorizations you can do that for example by using dynamic groups.
IdM is a very powerful tool opening a lot of possibilities as you can basically implement every requirement if you only have the required information available somewhere. It might be helpful for you to have someone to answer all your questions and help you solving your requirements in best way in the beginning, enabling you to use it in the most efficient way.
Regards
Norman

Forefront Client Security to use Windows updates when WSUS not available

Hi all,
We currently deploy Forefront Client Security as our AV product to our estate and we use WSUS to get any definition update required.
However, we have a number of laptops that have been taken off site and have not been receiving any virus definition updates because they are off the domain.
We have a GPO in place that disables Windows Updates on all clients and redirects it to our WSUS server and we then use SCCM to push out our updates.
We also have a VPN client that won't allow you to connect to the network unless your virus definitions are up to date. This is obviously an issue as anyone who has a laptop and hasn't connected to the domain in a while won't have the latest windows updates
or virus definitions applied.
We need a way of ensuring those laptops get the latest updates before connecting via VPN.
Is there any way to do this?
Rgds,
Mark

Hi,
You could use NAP feature in SCCM 2007 which can help protect the integrity of your enterprise network to enforce compliance of software updates on client computers.
For more information:
http://technet.microsoft.com/en-us/library/bb693725.aspx
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

SAP IDM vs Microsoft Forefront Client(FIM)

Similar Messages

Maybe you are looking for