live@edu and ILM to sync passwords

[ManuPug]

I have set up the ILM, for pass sync, and I entered the right credentials for the Admin Account.

Exchange is installed on the DC, we are testing it to migrate all the staff and faculty in the next few months.

When I installed ILM I selected the "exchange option" but I never configured it to work with ILM. Do I need to do something on that end?

Later

 

Manu

[RabbieBurns]

I didnt do a migration of accounts from Exchange to live@edu

 

Although we run exchange, it is for staff only. So I set it up as AD only.

 

But I dont imagine it would make a difference.

 

Did you remember to run all the powershell commands to link the local admin sync account to the live@edu admin account?

[ManuPug]

I probably missed those I only run the .\startsync. Do you have them? it might be it.

thx

[RabbieBurns]

Here is an extract from my instructions documentation:

 

After you create the OLSync and PWSync service accounts, sign out of the Outlook Live domain, and sign in to the Outlook Live domain again with the OLSync service account using Outlook Web App (https://www.outlook.com/owa). You have to do this one time to accept the terms of use for that new account. If you don't sign in to Outlook Web App and accept the terms of use, you will get Access Denied errors when you try to run ILM 2007 FP1 with the service account.

 

Connect Windows PowerShell on your local computer to Outlook Live

 

• Click Start > All Programs > Accessories > Windows PowerShell > Windows PowerShell.

• Run the following command:

 

$LiveCred = Get-Credential

 

• In the Windows PowerShell Credential Request window that opens, type the Windows Live ID and password of an Outlook Live account. When you are finished, click OK.

• Run the following command:

 

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection

Note The AllowRedirection parameter enables Outlook Live organizations all over the world to connect Windows PowerShell to Outlook Live by using the same URL.

• Run the following command:

 

Import-PSSession $Session

 

Assign the GALSynchronizationManagement RBAC role to the OLSync service account

The GALSynchronizationManagement role based access control (RBAC) role lets the OLSync service account run Exchange synchronization cmdlets on your Outlook Live domain.

• In a client-side session, run the following command:

 

New-ManagementRoleAssignment  -User OLSync@ -Role GALSynchronizationManagement -Name "OLSync Svc Role"

 

Give the OLSync service account access to WinRM:

 

The last configuration you need to make to the service account is to give the account access to Windows Remote Management (WinRM) so ILM 2007 FP1 can connect Windows PowerShell to Outlook Live. After you have run the command to enable WinRM on the OLSync service account, be sure to close the current Windows PowerShell session.

1. In a client-side session, run the following command:

 

Set-User OLSync@ -RemotePowerShellEnabled $true

 

Keep the powershell window open, and proceed to the next step to test the Service Account

 

Test the OLSync service account:

 

Because this OLSync service account will be used by ILM 2007 FP1 to synchronize your on-premises domain with your Outlook Live domain, the best way to test the configuration is to open a client-side session with the service account.

Using the session from the previous step, run the following cmdlets to make sure the account has the appropriate RBAC permissions:

Get-SyncMailbox

Get-AcceptedDomain

When you're finished using the Outlook Live server-side session, always disconnect Windows PowerShell from Outlook Live by running the following command:

Remove-PSSession $Session

Edited April 21, 2010 by RabbieBurns

[ManuPug]

Hello RabbieBurns. I ran these commands the first time that I created the OLSync account. It seems to be configured correctly. I still think that the password sync did not work somehow.

[ManuPug]

Is all this correct?

 

C:\Users\Administrator>setspn.exe -L OLsync

Registered ServicePrincipalNames for CN=OLSync,CN=Users,DC=adtest,DC=****

PCNSCLNT/DCTEST.ADTEST.****.EDU

 

 

C:\Program Files\Microsoft Password Change Notification>pcnscfg.exe -LIST

The service configuration is not set. Defaults will be used by the servic

 

Default Service Configuration

MaxQueueLength........: 0

MaxQueueAge...........: 259200 seconds

MaxNotificationRetries: 0

RetryInterval.........: 60 seconds

 

Targets

Target Name...........: PCNSCLNT

Target GUID...........: 9C3B135D-1B14-4666-949D-41AACC3EE2BC

Server FQDN or Address: DCTEST.ADTEST.****.EDU

Service Principal Name: PCNSCLNT/DCTEST.ADTEST.****.EDU

Authentication Service: Kerberos

Inclusion Group Name..: ADTEST\Domain Users

Exclusion Group Name..:

Keep Alive Interval...: 0 seconds

User Name Format......: 3

Queue Warning Level...: 0

Queue Warning Interval: 30 minutes

Disabled..............: False

 

Total targets: 1

 

C:\Program Files\Microsoft Password Change Notification>

 

Is seems that ILM doesn't like me!

[RabbieBurns]

Yep that looks good to me.

 

What errors are you getting now / Where is it going wrong?

[ManuPug]

Well that is the funny part I do not get errors I just can't get the password to sync. At this point I'm thinking that ILM is not configured right, even though I followed the instructions and check all the checkbox that they told me to. Tomorrow I'll send you the screen shot of the ILM settings.

Thanks Pal.

 

Manu

Edited April 29, 2010 by ManuPug

[RabbieBurns]

How you getting on did you get it sorted?

[ManuPug]

I noticed through verbose logging that my Pass Sync was using the wrong target, but the password is still not working. I am still trying to figure it out. Thanks

 

Manu

[ManuPug]

I have been setting things here and there and I managed to have the domain controller to give me the message that the password has been delivered to all targets, but on the ILM Server I get from the event viewer these messages:

"The management agent "Hosted" completed run profile "Delta Import (Stage Only)" with a delta import or delta synchronization step type. The rules configuration has changed since the last full synchronization.

 

User Action

To ensure the updated rules are applied to all objects, a run with step type of full synchronization should be completed."

for MIIS and this for OLMA:

"The following error occurred while reporting client data. The root cause may be that the server has not been upgraded to the latest version. Error: System.Management.Automation.RemoteException: A parameter cannot be found that matches parameter name 'ClientData'.

at System.Management.Automation.PowerShell.CoreInvoke[TOutput](IEnumerable input, PSDataCollection`1 output, PSInvocationSettings settings)

at System.Management.Automation.PowerShell.Invoke[T](IEnumerable input, IList`1 output, PSInvocationSettings settings)

at System.Management.Automation.PowerShell.Invoke[T](IEnumerable input)

at Microsoft.PowerShell.HostingTools.PowerShellProxy.InternalInvoke[T]()

at Microsoft.PowerShell.HostingTools.PipelineProxyBase.Invoke[T]()

at Microsoft.Exchange.XmaConnector.ElmaPSCommand.Invoke()

at Microsoft.Exchange.XmaConnector.PSDataProvider.InvokeCmdlet(PSCommand cmd)

at Microsoft.Exchange.XmaConnector.PSDataProvider.ReportScorecard()"

Have you seen anything like this? Let me know.

 

Manu

[ManuPug]

SON OF B@#%$!! WORKS!!

Thanks anyway man! I found out that the error message is negligible.

Cheers.

 

Manu

[RabbieBurns]

SON OF B@#%$!! WORKS!!

Thanks anyway man! I found out that the error message is negligible.

Cheers.

 

Manu

 

Nice one!! Glad you got it sorted in the end

[mezmerrick]

Hi Guys, bit of a long shot (I realise this is an old thread).

 

I'm having trouble setting up our PCNS solution for our Live@EDU.

 

When I configure as per MS instructions and RabbieBurns pdf guide (found in a different thread), I change a password to test and get an error in the event log:

 

PCNSSVC
6025

Password Change Notification Service received an RPC exception attempting to deliver notification.

The password change notification target could not be contacted.

User Action: The target server may not be running. Verify that the target server is running.

 

Now what I'm slightly confused about during setup is regarding PCNSCLNT. Is this the actual word I use? Or a computer name supposed to go in place of that?

 

I hope someone can help me out. Starting to hit my head against a brick wall!

[RabbieBurns]

PCNSCLNT i think can be anything, its not a computer name.

 

The computer name comes later in the string when you need to set the spn. Its been a while since I did it, do not sure of ideas a this time of night but will write more in the morning.

 

Have you installed the PCNS client on each and every one of your DC's and rebooted them all?

[mezmerrick]

Thanks for the fast response and for clearing up the PCNSCLNT bit!

 

Yes, I have it installed on all of my DC's and rebooted them. According to the Event Viewer, the service starts fine; but as soon as I change a password I get errors (as mentioned above).

 

I've tried so many different combinations of SPN and PCNS settings, but nothing seems to work! :/

[RabbieBurns]

yeh it was a pain to set up I had to do it a few times before I got it wrong..

 

If you run a

 

pcnscfg.exe -LIST

 

can you paste the results ?

[RabbieBurns]

Ill need to have another look at my documentation when I get back to the office in the morning, but the service you account you created for ILM has to be the one you use in the SPN and PCNS command line settings

[RabbieBurns]

Event ID: 6025 Source: PCNSSVC

[mezmerrick]

Sure, I get:

 

C:\Program Files\Microsoft Password Change Notification>pcnscfg.exe -LIST
The service configuration is not set. Defaults will be used by the service.

Default Service Configuration
 MaxQueueLength........: 0
 MaxQueueAge...........: 259200 seconds
 MaxNotificationRetries: 0
 RetryInterval.........: 60 seconds

Targets
 Target Name...........: PCNSCLNT
 Target GUID...........: 1A1DFADF-FC93-4716-8A40-492BDE7F3337
 Server FQDN or Address: pcs-billy-01.priory.internal
 Service Principal Name: PCNSCLNT/pcs-billy-01.priory.internal
 Authentication Service: Kerberos
 Inclusion Group Name..: PRIORY\Domain Users
 Exclusion Group Name..:
 Keep Alive Interval...: 0 seconds
 User Name Format......: 3
 Queue Warning Level...: 0
 Queue Warning Interval: 30 minutes
 Disabled..............: False

Total targets: 1

C:\Program Files\Microsoft Password Change Notification>

 

pcs-billy-01 is the name of the server running ILM.

[mezmerrick]

Ill need to have another look at my documentation when I get back to the office in the morning, but the service you account you created for ILM has to be the one you use in the SPN and PCNS command line settings

 

It sure is. I've named it: ilmservice

 

Event ID: 6025 Source: PCNSSVC

 

Yes, I've seen that. Wasn't much use i'm afraid.

 

Thanks, I appreciate your effort.

[mezmerrick]

I decided to go ahead and start from fresh in case I missed something, or messed something up.

 

I built a new server running 2008 this time (I used 2003 last time). Followed your pdf guide and all is working hunky dory! Password changes are now moving with out error.

 

Now I'm not sure if this was just a glitch somewhere a long the line, because I'm using 2008 instead of 2003, or because during building my new server I decided to check my GPO for password requirements and it was less than 6 characters.

 

Thank you for your help anyway! Much appreciated.

[RabbieBurns]

The gpo for password requirements shouldn't matter as long as the actual passwords were more than 6.

 

My ILM runs on 2008 Server x86

 

Glad you got it sorted

[mezmerrick]

Yeh, I did think that wouldn't matter. Oh well, seems happy with 2008 x86.

[Trapper]

How much did you pay for FIM?