Book Image

Microsoft Forefront Identity Manager 2010 R2 Handbook

By : Kent Nordstrom
Book Image

Microsoft Forefront Identity Manager 2010 R2 Handbook

By: Kent Nordstrom

Overview of this book

Microsoft's Forefront Identity Manager simplifies enterprise identity management for end users by automating admin tasks and integrating the infrastructure of an enterprise with strong authentication systems. The "Microsoft Forefront Identity Manager 2010 R2 Handbook" is an in-depth guide to Identity Management. You will learn how to manage users and groups and implement self-service parts. This book also covers basic Certificate Management and troubleshooting. Throughout the book we will follow a fictional case study. You will see how to implement IM and also set up Smart Card logon for strong administrative accounts within Active Directory. You will learn to implement all the features of FIM 2010 R2. You will see how to install a complete FIM 2010 R2 infrastructure including both test and production environment. You will be introduced to Self-Service management of both users and groups. FIM Reports to audit the identity management lifecycle are also discussed in detail. With the "Microsoft Forefront Identity Manager 2010 R2 Handbook" you will be able implement and manage FIM 2010 R2 almost effortlessly.
Table of Contents (21 chapters)
Microsoft Forefront Identity Manager 2010 R2 Handbook
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
8
Using FIM to Manage Office 365 and Other Cloud Identities
Afterword
Index

Managing groups in AD


We now have some groups in FIM. Both the ones created in FIM and those that come from the HR system.

We now need to configure FIM to export these groups to AD.

As discussed earlier, we now need to consider the groupType attribute in AD.

We also need to consider if we have different needs depending on group type.

At The Company, they have decided that FIM should not delete security groups once created in AD. This is a common approach, since deleting a security group—and thereby its SID (Security ID)—might cause dramatic events, if the group is used for some kind of permission. Recreating a group with the same name will not recreate the SID and will not fix the permissions.

On the other hand, when talking about distribution groups, we want FIM to be able to delete them. The owner might want to delete it and will use the FIM Portal interface to do so. Or, it could be that we have a policy stating that distribution groups where the owner has left the company and no new owner...