Allowing FIM Service to set passwords
The FIM Service account will be the account that calls FIM Synchronization Service, and tells it to reset the password in AD. But in order for the FIM Service account to be able to do that, we need to assign it some permissions with the following steps:
We need to add the account to a couple of groups created during installation (see Chapter 3, Installation) of FIM Synchronization Service.
Add the FIM Service account to the FIMSyncBrowse group:
By default, this is a local group on the FIM Synchronization server; but you might have chosen to use groups in Active Directory instead. This will give FIM Service the ability to read information in FIM Synchronization Service.
To actually be allowed to initiate a password reset, we also need to add the FIM Service account to FIMSyncPasswordSet:
The call from FIM Service to FIM Synchronization Service to do a password reset is made using Windows Management Instrumentation (WMI). This in turn means we need to give...