MIM Archives - Page 2 of 3

KISS for MIM – Autosync

This one has been long overdue and about time that the community realizes how easy it can make your daily life with FIM/MIM.

A wonderful tool which keeps our engine purring like a kitten and all the cogs moving – Autosync written by @RyanLNewington

Since the past two year or so, it has evolved and now it is becoming mainstream with him making it more user friendly, GUI enabled and with KISS strategy (Love the strategy – Keep It Simple Stupid!!!).. It has now culminated as AutoSync.

We’ve worked together and I’ve done a lot of testing (somehow I have the notorious name of bug finder – I find them or say they find me in every product I’ve touched – FIM / MIM / Google / Lithnet / Oracle MA / Generic LDAP MA <– don’t even get me started with that one)

It’s extremely simple to use and self explanatory. It installs as a service, and has a easy to read XML config (no need to dive into as GUI makes it easy) and an “Execution Monitor” to show you the status of all your runs.

Some of the features to list

Auto detect all MA in the environment and list them for configuration.
Automatically detect and prepopulate run profiles tab with best matching one.
Advance trigger capability to detect changes in the MA source and run only when needed
Ability to make changes to individual MA and restart only that component.
Ability to mention a list of MA’s not to run if a particular MA is running (to give priority or avoid deadlock situations)
One-Click button to create MPR / Set and service account in FIMService which helps in change detection in FIM/MIM Service.
Easy to configure and send mail notification of errors and customize it according to the errors you want to see / or ignore
Clear run history and store it as a maintenance task.
Different execution modes according to your choice (Supported / Exclusive / Unsupported)

The above is definitely not an exhaustive list and there are many more hidden and advance features which I can cover if it makes it to the final cut.

Let’s take an example on how we can utilize it in real world very easily. No coding experience needed.

We have an environment with 9 Management Agents (not the biggest in the world out there by far). We have some business rules which bind us to set provisioning times and deprovisioning times. Which means we need to keep the wheel moving – always and in sync.

Lithnet Autosync has a very easy to understand GUI interface. We can set which profiles to run to confirm an export (Confirming Import) or say which profile to run if the MA hasn’t run for X amount of time – scheduled import (which you can set as well).

For AD / LDS / LDAP MA we have change detection capabilities which basically runs the delta import / Full Import (whatever you configure) only when it detects a change for the system.

In the above example you can see I have also configured a “scheduled interval” which runs a full import for the MA every day at 2am. We do this to make sure the system is clean and up-to-date with the source. I have configured it for all the MA to run daily at different time intervals during non business hours so that the system is “clean” when we come back the next day. You can also configure them run exclusively to each other so that no clash occur (if that is a concern in your system).

You can also do change detection by writing power shell scripts and then running import run profile. We use an SQL based MA (ACMA) where we use such and example where the script looks at the Object Delta table and makes runs the DI (Delta Import) profile only if a change is detected. It can be as little as every second check but I run it every 5 second.

Add-Type -AssemblyName System.Data

$global:lastRowVersion = 0

function Get-RunProfileToExecute 
{
	$table = Invoke-SQL "localhost" "DBNAME" "SELECT TOP 1 cast(rowversion AS BIGINT) AS RV FROM DBO.MA_OBJECTS_DELTA where rowversion >= $global:lastRowVersion order by rowversion asc";

	if ($table.Rows.Count -gt 0)
	{
		$rv = $table.Rows[0].RV
        
        if($global:lastRowVersion -ne $rv)
        {
            $global:lastRowVersion = $rv;

			$p = New-Object Lithnet.Miiserver.Autosync.ExecutionParameters;
			$p.RunProfileName = "DI";
			$p.Exclusive = $false;
    		write-output $p
        }
	}
}

function Invoke-SQL {
    param(
        [string] $dataSource = "localhost",
        [string] $database = "DBNAME",
        [string] $sqlCommand = $(throw "Please specify a query.")
      )

    $connectionString = "Data Source=$dataSource; " +
            "Integrated Security=SSPI; " +
            "Initial Catalog=$database"

    $connection = new-object system.data.SqlClient.SQLConnection($connectionString)
    $command = new-object system.data.sqlclient.sqlcommand($sqlCommand,$connection)
    $connection.Open()

    $adapter = New-Object System.Data.sqlclient.sqlDataAdapter $command
    $dataset = New-Object System.Data.DataSet
    $adapter.Fill($dataSet) | Out-Null

    $connection.Close()
    $dataSet.Tables
}

Add-Type -AssemblyName System.Data

$global:lastRowVersion = 0

function Get-RunProfileToExecute

{

$table = Invoke-SQL "localhost" "DBNAME" "SELECT TOP 1 cast(rowversion AS BIGINT) AS RV FROM DBO.MA_OBJECTS_DELTA where rowversion >= $global:lastRowVersion order by rowversion asc";

if ($table.Rows.Count -gt 0)

{

$rv = $table.Rows[0].RV

if($global:lastRowVersion -ne $rv)

{

$global:lastRowVersion = $rv;

$p = New-Object Lithnet.Miiserver.Autosync.ExecutionParameters;

$p.RunProfileName = "DI";

$p.Exclusive = $false;

write-output $p

}

function Invoke-SQL {

param(

[string] $dataSource = "localhost",

[string] $database = "DBNAME",

[string] $sqlCommand = $(throw "Please specify a query.")

)

$connectionString = "Data Source=$dataSource; " +

"Integrated Security=SSPI; " +

"Initial Catalog=$database"

$connection = new-object system.data.SqlClient.SQLConnection($connectionString)

$command = new-object system.data.sqlclient.sqlcommand($sqlCommand,$connection)

$connection.Open()

$adapter = New-Object System.Data.sqlclient.sqlDataAdapter $command

$dataset = New-Object System.Data.DataSet

$adapter.Fill($dataSet) | Out-Null

$connection.Close()

$dataSet.Tables

}

There are more such examples in “C:\Program Files\Lithnet\AutoSync\Examples” folder once you install it. We also have scripts to detect changes in a PostGres DB.

There is so much more we do with it. There are some MA which we use just for versioning purpose. So we simply have them as “unconfigured” so they are not used in the run.

Two most useful features I would like to show you are

Execution Mode

The text below are self explanatory but in a nutshell

Supported (Recommended): What Microsoft dictates – Never run sync profiles while any other profile is running. Import and export profiles of different MA can still run in parallel. When a sync profile runs its take precedence lock and doesn’t allow other profiles to run (they queue up)
Exclusive Mode (I call it the SloMo Mode): Every run profile in every MA are run exclusively. Slowest mode and possibly the safest mode if you are not concerned with timings and speed.
Unsupported Mode (Against the Bible): I use this quite often as I am confident of our environment and what we need in terms of SLA to provision / deprovision users. The difference in this mode v/s supported is that in this mode a sync profile can run while other MA are running their import / export profile.

Execution Monitor

This is where you can keep an eye on things like what is MA is running, what profile is running, what has the lock and what others are waiting to run next.

You can see a lot of live and useful information there.

You can see two MA are executing Full Import (FI) – A Play button indicates that
You can see that an MA has a lock and its preparing to start a Delta Sync (DS) and then after that it has Delta Import (DI) and EALL (Export All) queued up.
Another MA wants to run a delta sync (DS) and is waiting to take lock from the previous MA.
You can click on the MA and see the run history and logs of what it has done (depicted in the windows below)
As you would have guessed – my system is running in unsupported mode currently.
You can stop all execution and/or stop and cancel all runs from the button on top.
You can also uncheck the “Automatically start executors when service starts” so that when Autosync service starts it will not start any executions – handy when you want to check all config before you kick off the syncs.

There is so much you can do with the package that I haven’t even begin to list them here.

Hope this small post has given you some insight on the capabilities of Autosync and the potential it has to radicalize and make your environment more friendly and easy to use.

Let me know if you need a solution with AutoSync and I can probably help you with that….

By Piyush Khandelwal, 7 years ago

MIM

Fixing MIM Error: The dimage indicates an update or replace operation, but the image doesn’t exist.

So there was a delete operation sent to an AD MA. It was deleted successfully but on import (Full / Delta) MIM was still seeing the object with a staging error

Error: The dimage indicates an update or replace operation, but the image doesn’t exist.

Cause: Unknown – The Object Information was corrupted in connector space.

Resolution: Did some digging with Microsoft and came up with the solution

Open SQL Server management studio and logon. Backup FIMSynchronizationService database.
In a new query script, input the below command

USE [FIMSynchronizationService]
GO

SELECT * FROM dbo.mms_connectorspace WHERE RDN ='RDN value'

USE [FIMSynchronizationService]

SELECT * FROM dbo.mms_connectorspace WHERE RDN ='RDN value'

You can get the RDN from the object corrupted.
After that, record the object_id from the query result, which we will use in the later statements.
Run the below statements to turn it into a phantom

USE [FIMSynchronizationService]
GO

UPDATE [mms_connectorspace]

SET [creation_date]=NULL,[is_provisioned]=NULL,[disconnection_id]=NULL,[disconnection_modification_date]=NULL,[last_import_modification_date]=NULL,[last_export_modification_date]=NULL,[count_import_modications]=NULL,[count_export_modications]=NULL,[is_connector]=0,[connector_state]=0,[pending]=0,[is_rename_retry]=0,[is_reference_retry]=0,[is_rebuild_in_progress]=0,[is_seen_by_import]=1,[is_phantom_parent]=0,[is_phantom_link]=1,[is_phantom_delete]=0,[is_full_sync]=0,[is_obsoletion]=0,[is_pending_reference_delete]=NULL,[import_operation]=NULL,[export_operation]=NULL,[is_import_error]=0,[count_import_error_retries]=0,[initial_import_error_date]=NULL,[last_import_error_date]=NULL,[import_error_code]=0,[is_export_error]=0,[count_export_error_retries]=0,[initial_export_error_date]=NULL,[last_export_error_date]=NULL,[export_error_code]=0,[current_export_batch_number]=NULL,[current_export_sequence_number]=NULL,[unapplied_export_batch_number]=NULL,[unapplied_export_sequencer_number]=NULL,[original_export_batch_number]=NULL,[original_export_sequencer_number]=NULL,[key_id]=NULL,[hologram]=NULL,[deltas]=NULL,[import_error_detail]=NULL,[export_error_detail]=NULL WHERE object_id='<object ID from the previous statement>'

USE [FIMSynchronizationService]

UPDATE [mms_connectorspace]

SET [creation_date]=NULL,[is_provisioned]=NULL,[disconnection_id]=NULL,[disconnection_modification_date]=NULL,[last_import_modification_date]=NULL,[last_export_modification_date]=NULL,[count_import_modications]=NULL,[count_export_modications]=NULL,[is_connector]=0,[connector_state]=0,[pending]=0,[is_rename_retry]=0,[is_reference_retry]=0,[is_rebuild_in_progress]=0,[is_seen_by_import]=1,[is_phantom_parent]=0,[is_phantom_link]=1,[is_phantom_delete]=0,[is_full_sync]=0,[is_obsoletion]=0,[is_pending_reference_delete]=NULL,[import_operation]=NULL,[export_operation]=NULL,[is_import_error]=0,[count_import_error_retries]=0,[initial_import_error_date]=NULL,[last_import_error_date]=NULL,[import_error_code]=0,[is_export_error]=0,[count_export_error_retries]=0,[initial_export_error_date]=NULL,[last_export_error_date]=NULL,[export_error_code]=0,[current_export_batch_number]=NULL,[current_export_sequence_number]=NULL,[unapplied_export_batch_number]=NULL,[unapplied_export_sequencer_number]=NULL,[original_export_batch_number]=NULL,[original_export_sequencer_number]=NULL,[key_id]=NULL,[hologram]=NULL,[deltas]=NULL,[import_error_detail]=NULL,[export_error_detail]=NULL WHERE object_id='<object ID from the previous statement>'

Stop the FIM service.
Delete the record via the below commands

DELETE FROM mms_cs_link WHERE object_id='<object ID from the previous statement>'

DELETE FROM mms_csmv_link WHERE cs_object_id='<object ID from the previous statement>'

DELETE FROM mms_connectorspace WHERE object_id='<object ID from the previous statement>'

DELETE FROM mms_cs_link WHERE object_id='<object ID from the previous statement>'

DELETE FROM mms_csmv_link WHERE cs_object_id='<object ID from the previous statement>'

DELETE FROM mms_connectorspace WHERE object_id='<object ID from the previous statement>'

Restarted the FIM Services
Run the FIM Sync to see if the issue fixed.

By Piyush Khandelwal, 7 years ago

MIM

FIM/MIM Powershell: XPath Demystified

I have been promising to get this post out there.. So here it is..

If you make extensive use of Lithnet ResourceManagement Powershell for MIM/FIM (You should if you don’t) you will probably be using the cmdlets “Search-Resources” or “Search-ResourcesPaged” which require an “-XPATH” input.

Now my xpath is real bad in for a complicated search.

Thankfully Ryan (Lithnet God) has written a few tools to make it easier for us to write xpath queries. We would use his cmdlets like New-XPathQuery , New-XPathQueryGroup and New-XPathExpression

Let’s start with simple query: Find everyone whose AccountName (string) starts with “P”

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName AccountName -Operator StartsWith -Value "P"
$b = New-XPathExpression -ObjectType Person -QueryObject $a
$b.ToString()

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName AccountName -Operator StartsWith -Value "P"

$b = New-XPathExpression -ObjectType Person -QueryObject $a

$b.ToString()

Output

/Person[(starts-with(AccountName, ‘P’))]

Easy yeah?

Lets do a boolean: Find every user for whom accountDisabled (Boolean) is present

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725" 

$a = New-XPathQuery -AttributeName accountDisabled -Operator IsPresent
$b = New-XPathExpression -ObjectType Person -QueryObject $a
$b.ToString()

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName accountDisabled -Operator IsPresent

$b = New-XPathExpression -ObjectType Person -QueryObject $a

$b.ToString()

Output

/Person[((accountDisabled = true) or (accountDisabled = false))]

Lets do a complex one: Find all users who Email Starts with “P” and are not disabled

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725" 

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"
$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false
$group = New-XPathQueryGroup -Operator And -Queries @($a,$b)

$result = New-XPathExpression -ObjectType Person -QueryObject $group
$result.ToString()

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"

$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false

$group = New-XPathQueryGroup -Operator And -Queries @($a,$b)

$result = New-XPathExpression -ObjectType Person -QueryObject $group

$result.ToString()

Output

/Person[((starts-with(Email, ‘P’)) and (accountDisabled = False))]

You can see how you can build on this..

One final one: Find all accounts which have an email address starting with P and are not disabled or which have an AccountName and have Email containing “p@”

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725" 

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"
$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false
$c = New-XPathQuery -AttributeName AccountName -Operator IsPresent
$d = New-XPathQuery -AttributeName Email -Operator Contains -Value "p@"

$group1 = New-XPathQueryGroup -Operator And -Queries @($a,$b)
$group2 = New-XPathQueryGroup -Operator And -Queries @($c,$d)

$finalgroup = New-XPathQueryGroup -Operator Or -Queries @($group1,$group2)

$result = New-XPathExpression -ObjectType Person -QueryObject $finalgroup
$result.ToString()

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"

$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false

$c = New-XPathQuery -AttributeName AccountName -Operator IsPresent

$d = New-XPathQuery -AttributeName Email -Operator Contains -Value "p@"

$group1 = New-XPathQueryGroup -Operator And -Queries @($a,$b)

$group2 = New-XPathQueryGroup -Operator And -Queries @($c,$d)

$finalgroup = New-XPathQueryGroup -Operator Or -Queries @($group1,$group2)

$result = New-XPathExpression -ObjectType Person -QueryObject $finalgroup

$result.ToString()

Output

/Person[(((starts-with(Email, ‘P’)) and (accountDisabled = False)) or ((starts-with(AccountName, ‘%’)) and (contains(Email, ‘p@’))))]

Above searches might not make sense logically in real world scenarios but what I am trying to show here is that how easy it is to build complex XPath search strings without knowing the XPath language and doing it pretty easily on Powershell.. (And don’t get me started how many times I have messed up the brackets 😛 )

Enormous potential and implantation capabilities if you come to think of it..

By Piyush Khandelwal, 7 years05/15/2017 ago

MIM

Migrating Lost Identities from AD to MIM

Setting up a new identity system from scratch is so easy.. but we know that kinda never happens… we are always migrating from an old system to new or changing an existing system due to business changes.

We went through the same process whereby we went from an OpenLDAP (ODSEE) being our primary source to FIM/MIM pushing out to AD. We were syncing identities manually from ODSEE to AD via Perl scripts in the old days..

So after the original migration done we have a lot of identities in AD not joined to MIM i.e. Disconnectors as we know them. This was because as per our policy we always added / modified from ODSEE -> AD but never a delete. Thus it left a lot of users and groups in AD which never came across in the initial migration.

So once the migration was complete, the big mammoth task came to migrate the unknowns from AD -> MIM and then join the identities in AD.

Using few wonderful tools suite called Lithnet written by @RyanLNewington

NOTE: Always remember, my script are as-is and have lots of rules and logics specific to my environment and business needs. Its there to give a basic understanding on what can be done. You will obviously have to modify it for your environment and needs.

REQUIREMENTS

Migrate AD Disconnectors to MIM Service
Join them to AD
Make sure no existing values are overwritten in AD like sAMAccountName, DN, DisplayName etc
Make sure membership (member) is not lost. memberOf is not cared for atm as that will take care of itself (Point 4 below).
Sync Engine SHOULD NOT be provisioning. Stop the syncs (not service itself)

LOGIC

I wrote two different scripts – one to migrate users and one to migrate groups. There are some things to note here

We have our own business rules engine called ACMA to which we provision all our identities which then generates all the required attribute values according to our business rules. So you will see each object being written to both FIMService and ACMA DB (SQL). Do have a look at it.. Its powerful yet so simple… Must have…
We have a unique ID which is pushed to all system called monashObjectID which is basically a random guid which is generated in ACMA DB. We use this to have a constant ID between all system and thus later helpful to join ID etc.
Due to the above point, my script assumes that all objects in AD , if they have monashObjectID means they are connected to FIM/MIM. Thus, on reverse, if they don’t have it means they have to be migrated.
Simplification of OUs: Due to our previous messy environment we have over 100-200 OU’s in AD where all these objects exist. In the new age, we have simplified it and MIM only manages 8-10 OU’s. Therefore according to the “Type” of the object being migrated they are moved to the respective new OU in AD prior to migration (you need rights to do so in AD if you migration account doesn’t so already). Again you can comment out the whole function if its not required.
Groups gets tricky. As they can be member of another group and if they group doesn’t already exist in MIM, it will loose membership once imported, I decided to get around it by scripting a check that if the group has members and if all of those members have monashObjectID then dump them in a CSV file. Thus this migration is run multiple times.
1. Create 1st batch of CSV for those groups who don’t have members or which all members exist in MIM (by checking their monashObjectID as that comes from MIM)
2. Migrate them
3. Export to AD – this will write out monashObjectID for the newly migrated groups
4. Repeat step a-c till all are done.

USER MIGRATION SCRIPT

Will start will user migrations as they can be members of a group. Again remember, loads of logic for our environment.

CSV Requirements

The CSV requires the following fields

Name,Type,OrgUnit,Owners

1	Name,Type,OrgUnit,Owners

Name: sAMAccountName of the user to be migrated
Type: We have accounttypes in our environment like person / service / custom etc. Need to mention that (or modify code to remove it)
OrgUnit: We need to mention an OrgUnit DisplayName for each user to which it belongs to (our environment specific again)
Owners: This is to mention the owner / supervisor of the user. They are sAMAccountName of already existing users in MIM. They can be multiple with ; separating them.

Script

Import-Module LithnetRMA
Import-Module ACMAPS

Set-ResourceManagementClient -BaseAddress "http://{FIMService-Address}:5725"


Function CheckADObjectInFIM($monashobjectid, $objectclass)
{
	try
	{
		$obj = Get-Resource -ObjectType $objectclass -AttributeName monashObjectID -AttributeValue $monashobjectid -AttributesToGet ObjectID
		return ($obj.ObjectID.Value)
	}
	catch
	{
		throw "Resource Not Found in FIMService"
	}
}

Function SearchACMAFSObject($fsobjectid)
    {
        $dbQuery = New-AcmaQuery -AttributeName fimServiceObjectID -Operator Equals -Value $fsobjectid
        $acmaobjectid = Get-AcmaObjects -DBQuery $dbQuery      
        return ([guid]$acmaobjectid.objectId.Guid)

    }

Function CreateACMAGroup($fsObjectID, $username, $idmExpiryDate, $samaccountname, $unixgid, $addn, $orgUnitFSObjectID, $ownerFSObjectID, $idmPreferredName, $idmSn, $adupn)
{
	Connect-AcmaEngine Lithnet.acma localhost D:\madata\acma\acma-prod.acmax D:\MAData\acma\Logs\Add-ACMAAccount-$username.log Debug

	$acmaaccount = Add-AcmaObject -ObjectClass account
	$acmaaccount.fimServiceObjectID = [guid]$fsObjectID
	$acmaaccount.displayName = $username
    $acmaaccount.idmPreferredName = $idmPreferredName
    if ($idmSn) { $acmaaccount.idmSn = $idmSn } 
    elseif ($idmPreferredName) { $acmaaccount.idmSn = $idmPreferredName }
    else { $acmaaccount.idmSn = $username }
	$acmaaccount.accountName = $samaccountname
    $acmaaccount.userPrincipalName = $adupn
	$acmaaccount.idmExpiryDate = $idmExpiryDate.ToUniversalTime()
    $acmaaccount.idmOrganizationalUnit = SearchACMAFSObject($orgUnitFSObjectID)
    $acmaaccount.owner = SearchACMAFSObject($ownerFSObjectID)
    switch ($UserType) 
        {
                service { $acmaaccount.accountType = 'service' }
                custom { $acmaaccount.accountType = 'custom' }
                external { $acmaaccount.accountType = 'external' }
                test { $acmaaccount.accountType = 'test' }
                external-student { $acmaaccount.accountType = 'external-student' }
                default { Write-Warning “Account Type not found for $username .. Not migrating"; return  } 

            }
	$acmaaccount.monashADDN = $addn
	if ($unixgid) { $acmaaccount.unixgid = $unixgid }

	try
	{
		Write-Host "Creating ACMA Object" -ForegroundColor Cyan
		Save-AcmaObject $acmaaccount
	}
	catch
	{
		Write-Warning ("Unable to create person in ACMA:" + $_.Exception.Message)
		return
	}
	$acmaObject = Get-AcmaObject -ObjectType person -AttributeName accountName -AttributeValue $samaccountname       

	$Global:acmaObjectsList += ,$acmaObject.ObjectID    

}

Function CreateFIMServiceUser
{

	$adUser = Get-ADUser -Filter {samaccountname -eq $username} -Properties *

	$Global:userADDN +=, $adUser.DistinguishedName

	$FSUser = New-Resource -ObjectType Person
    $FSUser.activationDisabled = $true
    $FSUser.accountType = $UserType
    $FSUser.idmPreferredName = $adUser.GivenName
    if ($adUser.Surname) { $FSUser.idmSn = $aduser.Surname }
    elseif ($adUser.GivenName) { $FSUser.idmSn = $aduser.GivenName }
    else { $FSUser.idmSn = $adUser.Name }
    $FSUser.DisplayName = $adUser.Name
	$FSUser.Description = $adUser.Description

    switch ($UserType)
	{
		service {
            $FSUser.idmExpiryDate = [dateTime]"9999-12-31"
		}
		default {
			$expirydate = (Get-Date).AddDays(730).ToUniversalTime()
			$FSUser.idmExpiryDate = $expirydate 
		    }

	}
	
	$FSUser.Domain = $env:USERDOMAIN        

    if ($UserOwners)
        {
			 foreach ($owner in $UserOwners)
                {
            $adObj = Get-ADObject -Filter {sAMAccountName -eq $owner} -Properties *

            if ($adObj.monashobjectid)
                {
                    switch ($adObj.ObjectClass)
			            {
				            user { $objClass = "Person" }
				            group { $objClass = "Group" }
			            }

			            try
			            {
				            $ownerObjectID =  CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)
				            $FSUser.Owner.Add($ownerObjectID)       
			            }
			            catch
			            {
				            Write-Warning ("Unable to retrive Owner: $adObj and will loose its membership" + $_.Exception.Message)

				
			            }

                }
		            else
		            {
			            Write-Warning "Owner of AD Group not in I@M System: $adObj and will loose its membership"
		            }
                }
            $FSUser.DisplayedOwner = $FSUser.Owner[0]

	    }

    else
        {
            if ($env:USERDOMAIN -eq 'MONASH')
                    {
                        #Default Value for FIM PROD (Unknown Owner Role Account)
                        Write-Warning "Setting Unknown Owner Account as Owner in PROD"
                        $FSUser.Owner.Add("<GUID OF THE DEFAULT OWNER>")
                        $FSUser.DisplayedOwner = "<GUID OF THE DEFAULT OWNER>"
                    }
        }

  if ($UserOrgUnit)
        {
            try {
                    
                    $OrgUnitObjectID =  Get-Resource organizationalUnit DisplayName "$UserOrgUnit"
                    $FSUser.idmOrganizationalUnit = $OrgUnitObjectID.ObjectID.Value
                }
            catch
                {
                    Write-Warning "$OwningOrgUnit not found in I@M.. Defaulting to IDS in PROD else will have OR9999 for other Env"
                    if ($env:USERDOMAIN -eq 'MONASH')
                        {
                            $FSUser.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"
                        }
                }
        }
    else
        {
            if ($env:USERDOMAIN -eq 'MONASH')
                {
                    Write-Warning "OrgUnit not given in CSV.. Defaulting to IDS as Owning Org Unit in PROD"
                    $FSUser.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"

                }

        }


	
	
	try 
	{
		Write-Host "Creating FIMSerivce Person:” $FSUser.DisplayName -ForegroundColor Cyan
		Save-Resource $FSUser
		
	}
	catch 
	{
		Write-Warning ("Unable to create person in FIMService:" + $_.Exception.Message)
		return
	}

	$fimServiceObject = Get-Resource -ObjectType Person -AttributeName DisplayName -AttributeValue $FSUser.DisplayName


	$Global:fimServiceObjectsList += ,$fimServiceObject.ObjectID

	if ($adUser.MemberOf)
	{
		foreach ($member in $adUser.MemberOf)
		{
			$adObj = Get-ADObject $member -Properties *

			if ($adObj.monashobjectid)
			{

				switch ($adObj.ObjectClass)
				{
					user { $objClass = "Person" }
					group { $objClass = "Group" }
				}

				try
				{
					$parentgroupObjectID =  CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)
					$parentgroup = Get-Resource -ID $parentgroupObjectID -AttributesToGet ExplicitMember, DisplayName
					$parentgroup.ExplicitMember.Add($fimServiceObject.ObjectID.Value) | Out-Null
					Save-Resource $parentgroup
					Write-Host "Added person to its memberOf Group:" $parentgroup.DisplayName -ForegroundColor Cyan
					
				}
				catch
				{
					Write-Warning ("Unable to retrive memberOf Group: $adObj " + $_.Exception.Message)

					
				}

			}
			else
			{
				Write-Warning ("memberOf AD Group not in I@M System:" + $adObj.Name)
			}

		}
	}

	CreateACMAGroup ($fimServiceObject.ObjectID) ($fimServiceObject.DisplayName) ($fimServiceObject.idmExpiryDate) ($adUser.SamAccountName) ($adUser.gidNumber) ($adUser.DistinguishedName) ($fimServiceObject.idmOrganizationalUnit.Value)($fimServiceObject.DisplayedOwner.Value)($fimServiceObject.idmPreferredName)($fimServiceObject.idmSn)($adUser.UserPrincipalName)
	
	
}


Function SyncMIMObjects()
{
	
	Write-Host "Disabling MRE Provisioning" -ForegroundColor Cyan
	Set-MVProvisioningRulesExtension -Enabled $false;

	write-host "Delta import FIMService MA" -ForegroundColor Cyan
	Start-ManagementAgent FIMService DI
	
    $count = 0
	write-host "Sync group FIMService object" -ForegroundColor Cyan
	foreach ($item in $fimServiceObjectsList)
	{
		Get-CSObject -MA FIMService -DN $item.Value | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Sycned $count of" $fimServiceObjectsList.Count
	}

	write-host "Delta import ACMA MA" -ForegroundColor Cyan
	Start-ManagementAgent ACMA DI

	$count = 0
	write-host "Sync group ACMA Object" -ForegroundColor Cyan
	foreach ($item in $acmaObjectsList)
	{
		Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Sycned $count of" $acmaObjectsList.Count
	}
	

	write-host "Delta import MonashAD MA" -ForegroundColor Cyan
	Start-ManagementAgent MonashAD DI

	$count = 0
	write-host "Joining AD Object" -ForegroundColor Cyan
	foreach ($item in $userADDN)
	{
		Get-CSObject -MA MonashAD -DN $item | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Joined $count of" $userADDN.Count
	}

	Write-Host "Enabled MRE Provisioning" -ForegroundColor Cyan
	Set-MVProvisioningRulesExtension -Enabled $true;

	$count = 0
	Write-Host "Doing Full Provision Cycle" -ForegroundColor Cyan
	foreach ($item in $acmaObjectsList)
	{
		Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Provisioned $count of" $acmaObjectsList.Count
	}

	write-host "Clearing Full Sync Warnings" -ForegroundColor Cyan
	Clear-FullSyncWarning
	Write-Host "DONE!!!" -ForegroundColor Cyan


}


Function CheckUserInAD
{
	try 
	{
		$adUser = Get-ADUser -filter {samaccountname -eq $username} -Properties monashobjectid
	}
	catch
	{
		Write-Warning -Message "User not found in AD: $username"  
		return;
	}     
	
	if ($adUser.monashobjectid)
	{
		write-warning "User $username has a monashobjectid Might already exist in I@M.. Exiting"
		return;
	}

	Write-Host "User Found in AD: $username" -ForegroundColor Cyan

	CreateFIMServiceUser

}

Function MoveADUsers
{
	try
	{
		$domain = (Get-ADDomain).DistinguishedName
        switch ($UserType) 
            {
                service { $targetOU = "OU=ServiceAccounts,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }
                custom { $targetOU = "OU=OtherAccounts,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }
                external { $targetOU = "OU=External,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }
                test { $targetOU = "OU=TestAccounts,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }
                external-student { $targetOU = "OU=External,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }
                default { Write-Warning "Group Type not found for $username .. Not migrating"; break  } 

            }
		$currentDN = (Get-ADUser -Filter {samaccountname -eq $username}).DistinguishedName
		$currentOU = $currentDN.Substring($currentDN.IndexOf("OU="))
		if ($currentOU -ne $targetOU)
		{
			Move-ADObject $currentDN -TargetPath $targetOU 
			Write-Host "Moved $username to" $targetOU -ForegroundColor Yellow
		}
		else
		{
			Write-Host "$username already in" $targetOU -ForegroundColor Green
		}
		
	}

	catch
	{
		Write-Error "Unable to move Group" + $_.Exception.Message
		return
	}

}

Function Get-File($initialDirectory)
{
	[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null
	
	$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
	$OpenFileDialog.initialDirectory = $initialDirectory
	$OpenFileDialog.filter = "CSV (*.csv)| *.csv"
	$OpenFileDialog.ShowDialog() | Out-Null
	$OpenFileDialog.filename
}

function MigrateADUsers
{

	$ServiceStatus = (Get-Service miisautosync).Status

	if ($ServiceStatus -ne "Stopped")
	{
		Write-Warning "Autosync still running. Make sure Autosync is stopped and no MA are running any profiles"
		exit
	}


	$inputFile = Get-File
	$users = Import-Csv $inputFile
    $leaf = Split-Path $inputFile -Leaf
    Start-Transcript -Path D:\ADUserMigration-$leaf.log -Append

	foreach ($item in $users)
	{
        	$Global:username = $item.Name.Trim()
			$Global:UserType = $item.Type.Trim()
            $Global:UserOrgUnit = $item.OrgUnit.Trim()
            $Global:UserOwners = $item.Owners.Split(";").Trim()

		try
		{

			if (!$UserType)
			{
				Write-Warning "Group $username is missing Type in CSV.. Not Migrating"
				continue
			}


			MoveADUsers            
			CheckUserInAD
		}
		catch
		{
			write-host "An error occurred with $username";
		}
	}
	if ($fimServiceObjectsList)
	{
		SyncMIMObjects
	}

}

$acmaObjectsList = @()
$fimServiceObjectsList = @()
$userADDN = @()

Measure-Command { MigrateADUsers }
Stop-Transcript

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

Import-Module LithnetRMA

Import-Module ACMAPS

Set-ResourceManagementClient -BaseAddress "http://{FIMService-Address}:5725"

Function CheckADObjectInFIM($monashobjectid, $objectclass)

{

try

{

$obj = Get-Resource -ObjectType $objectclass -AttributeName monashObjectID -AttributeValue $monashobjectid -AttributesToGet ObjectID

return ($obj.ObjectID.Value)

}

catch

{

throw "Resource Not Found in FIMService"

}

Function SearchACMAFSObject($fsobjectid)

{

$dbQuery = New-AcmaQuery -AttributeName fimServiceObjectID -Operator Equals -Value $fsobjectid

$acmaobjectid = Get-AcmaObjects -DBQuery $dbQuery

return ([guid]$acmaobjectid.objectId.Guid)

}

Function CreateACMAGroup($fsObjectID, $username, $idmExpiryDate, $samaccountname, $unixgid, $addn, $orgUnitFSObjectID, $ownerFSObjectID, $idmPreferredName, $idmSn, $adupn)

{

Connect-AcmaEngine Lithnet.acma localhost D:\madata\acma\acma-prod.acmax D:\MAData\acma\Logs\Add-ACMAAccount-$username.log Debug

$acmaaccount = Add-AcmaObject -ObjectClass account

$acmaaccount.fimServiceObjectID = [guid]$fsObjectID

$acmaaccount.displayName = $username

$acmaaccount.idmPreferredName = $idmPreferredName

if ($idmSn) { $acmaaccount.idmSn = $idmSn }

elseif ($idmPreferredName) { $acmaaccount.idmSn = $idmPreferredName }

else { $acmaaccount.idmSn = $username }

$acmaaccount.accountName = $samaccountname

$acmaaccount.userPrincipalName = $adupn

$acmaaccount.idmExpiryDate = $idmExpiryDate.ToUniversalTime()

$acmaaccount.idmOrganizationalUnit = SearchACMAFSObject($orgUnitFSObjectID)

$acmaaccount.owner = SearchACMAFSObject($ownerFSObjectID)

switch ($UserType)

{

service { $acmaaccount.accountType = 'service' }

custom { $acmaaccount.accountType = 'custom' }

external { $acmaaccount.accountType = 'external' }

test { $acmaaccount.accountType = 'test' }

external-student { $acmaaccount.accountType = 'external-student' }

default { Write-Warning “Account Type not found for $username .. Not migrating"; return }

}

$acmaaccount.monashADDN = $addn

if ($unixgid) { $acmaaccount.unixgid = $unixgid }

try

{

Write-Host "Creating ACMA Object" -ForegroundColor Cyan

Save-AcmaObject $acmaaccount

}

catch

{

Write-Warning ("Unable to create person in ACMA:" + $_.Exception.Message)

return

}

$acmaObject = Get-AcmaObject -ObjectType person -AttributeName accountName -AttributeValue $samaccountname

$Global:acmaObjectsList += ,$acmaObject.ObjectID

}

Function CreateFIMServiceUser

{

$adUser = Get-ADUser -Filter {samaccountname -eq $username} -Properties *

$Global:userADDN +=, $adUser.DistinguishedName

$FSUser = New-Resource -ObjectType Person

$FSUser.activationDisabled = $true

$FSUser.accountType = $UserType

$FSUser.idmPreferredName = $adUser.GivenName

if ($adUser.Surname) { $FSUser.idmSn = $aduser.Surname }

elseif ($adUser.GivenName) { $FSUser.idmSn = $aduser.GivenName }

else { $FSUser.idmSn = $adUser.Name }

$FSUser.DisplayName = $adUser.Name

$FSUser.Description = $adUser.Description

switch ($UserType)

{

service {

$FSUser.idmExpiryDate = [dateTime]"9999-12-31"

}

default {

$expirydate = (Get-Date).AddDays(730).ToUniversalTime()

$FSUser.idmExpiryDate = $expirydate

}

$FSUser.Domain = $env:USERDOMAIN

if ($UserOwners)

{

foreach ($owner in $UserOwners)

{

$adObj = Get-ADObject -Filter {sAMAccountName -eq $owner} -Properties *

if ($adObj.monashobjectid)

{

switch ($adObj.ObjectClass)

{

user { $objClass = "Person" }

group { $objClass = "Group" }

}

try

{

$ownerObjectID = CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)

$FSUser.Owner.Add($ownerObjectID)

}

catch

{

Write-Warning ("Unable to retrive Owner: $adObj and will loose its membership" + $_.Exception.Message)

}

else

{

Write-Warning "Owner of AD Group not in I@M System: $adObj and will loose its membership"

}

$FSUser.DisplayedOwner = $FSUser.Owner[0]

}

else

{

if ($env:USERDOMAIN -eq 'MONASH')

{

#Default Value for FIM PROD (Unknown Owner Role Account)

Write-Warning "Setting Unknown Owner Account as Owner in PROD"

$FSUser.Owner.Add("<GUID OF THE DEFAULT OWNER>")

$FSUser.DisplayedOwner = "<GUID OF THE DEFAULT OWNER>"

}

if ($UserOrgUnit)

{

try {

$OrgUnitObjectID = Get-Resource organizationalUnit DisplayName "$UserOrgUnit"

$FSUser.idmOrganizationalUnit = $OrgUnitObjectID.ObjectID.Value

}

catch

{

Write-Warning "$OwningOrgUnit not found in I@M.. Defaulting to IDS in PROD else will have OR9999 for other Env"

if ($env:USERDOMAIN -eq 'MONASH')

{

$FSUser.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"

}

else

{

if ($env:USERDOMAIN -eq 'MONASH')

{

Write-Warning "OrgUnit not given in CSV.. Defaulting to IDS as Owning Org Unit in PROD"

$FSUser.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"

}

try

{

Write-Host "Creating FIMSerivce Person:” $FSUser.DisplayName -ForegroundColor Cyan

Save-Resource $FSUser

}

catch

{

Write-Warning ("Unable to create person in FIMService:" + $_.Exception.Message)

return

}

$fimServiceObject = Get-Resource -ObjectType Person -AttributeName DisplayName -AttributeValue $FSUser.DisplayName

$Global:fimServiceObjectsList += ,$fimServiceObject.ObjectID

if ($adUser.MemberOf)

{

foreach ($member in $adUser.MemberOf)

{

$adObj = Get-ADObject $member -Properties *

if ($adObj.monashobjectid)

{

switch ($adObj.ObjectClass)

{

user { $objClass = "Person" }

group { $objClass = "Group" }

}

try

{

$parentgroupObjectID = CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)

$parentgroup = Get-Resource -ID $parentgroupObjectID -AttributesToGet ExplicitMember, DisplayName

$parentgroup.ExplicitMember.Add($fimServiceObject.ObjectID.Value) | Out-Null

Save-Resource $parentgroup

Write-Host "Added person to its memberOf Group:" $parentgroup.DisplayName -ForegroundColor Cyan

}

catch

{

Write-Warning ("Unable to retrive memberOf Group: $adObj " + $_.Exception.Message)

}

else

{

Write-Warning ("memberOf AD Group not in I@M System:" + $adObj.Name)

}

CreateACMAGroup ($fimServiceObject.ObjectID) ($fimServiceObject.DisplayName) ($fimServiceObject.idmExpiryDate) ($adUser.SamAccountName) ($adUser.gidNumber) ($adUser.DistinguishedName) ($fimServiceObject.idmOrganizationalUnit.Value)($fimServiceObject.DisplayedOwner.Value)($fimServiceObject.idmPreferredName)($fimServiceObject.idmSn)($adUser.UserPrincipalName)

}

Function SyncMIMObjects()

{

Write-Host "Disabling MRE Provisioning" -ForegroundColor Cyan

Set-MVProvisioningRulesExtension -Enabled $false;

write-host "Delta import FIMService MA" -ForegroundColor Cyan

Start-ManagementAgent FIMService DI

$count = 0

write-host "Sync group FIMService object" -ForegroundColor Cyan

foreach ($item in $fimServiceObjectsList)

{

Get-CSObject -MA FIMService -DN $item.Value | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Sycned $count of" $fimServiceObjectsList.Count

}

write-host "Delta import ACMA MA" -ForegroundColor Cyan

Start-ManagementAgent ACMA DI

$count = 0

write-host "Sync group ACMA Object" -ForegroundColor Cyan

foreach ($item in $acmaObjectsList)

{

Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Sycned $count of" $acmaObjectsList.Count

}

write-host "Delta import MonashAD MA" -ForegroundColor Cyan

Start-ManagementAgent MonashAD DI

$count = 0

write-host "Joining AD Object" -ForegroundColor Cyan

foreach ($item in $userADDN)

{

Get-CSObject -MA MonashAD -DN $item | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Joined $count of" $userADDN.Count

}

Write-Host "Enabled MRE Provisioning" -ForegroundColor Cyan

Set-MVProvisioningRulesExtension -Enabled $true;

$count = 0

Write-Host "Doing Full Provision Cycle" -ForegroundColor Cyan

foreach ($item in $acmaObjectsList)

{

Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Provisioned $count of" $acmaObjectsList.Count

}

write-host "Clearing Full Sync Warnings" -ForegroundColor Cyan

Clear-FullSyncWarning

Write-Host "DONE!!!" -ForegroundColor Cyan

}

Function CheckUserInAD

{

try

{

$adUser = Get-ADUser -filter {samaccountname -eq $username} -Properties monashobjectid

}

catch

{

Write-Warning -Message "User not found in AD: $username"

return;

}

if ($adUser.monashobjectid)

{

write-warning "User $username has a monashobjectid Might already exist in I@M.. Exiting"

return;

}

Write-Host "User Found in AD: $username" -ForegroundColor Cyan

CreateFIMServiceUser

}

Function MoveADUsers

{

try

{

$domain = (Get-ADDomain).DistinguishedName

switch ($UserType)

{

service { $targetOU = "OU=ServiceAccounts,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }

custom { $targetOU = "OU=OtherAccounts,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }

external { $targetOU = "OU=External,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }

test { $targetOU = "OU=TestAccounts,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }

external-student { $targetOU = "OU=External,OU=Accounts,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName }

default { Write-Warning "Group Type not found for $username .. Not migrating"; break }

}

$currentDN = (Get-ADUser -Filter {samaccountname -eq $username}).DistinguishedName

$currentOU = $currentDN.Substring($currentDN.IndexOf("OU="))

if ($currentOU -ne $targetOU)

{

Move-ADObject $currentDN -TargetPath $targetOU

Write-Host "Moved $username to" $targetOU -ForegroundColor Yellow

}

else

{

Write-Host "$username already in" $targetOU -ForegroundColor Green

}

catch

{

Write-Error "Unable to move Group" + $_.Exception.Message

return

}

Function Get-File($initialDirectory)

{

[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null

$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog

$OpenFileDialog.initialDirectory = $initialDirectory

$OpenFileDialog.filter = "CSV (*.csv)| *.csv"

$OpenFileDialog.ShowDialog() | Out-Null

$OpenFileDialog.filename

}

function MigrateADUsers

{

$ServiceStatus = (Get-Service miisautosync).Status

if ($ServiceStatus -ne "Stopped")

{

Write-Warning "Autosync still running. Make sure Autosync is stopped and no MA are running any profiles"

exit

}

$inputFile = Get-File

$users = Import-Csv $inputFile

$leaf = Split-Path $inputFile -Leaf

Start-Transcript -Path D:\ADUserMigration-$leaf.log -Append

foreach ($item in $users)

{

$Global:username = $item.Name.Trim()

$Global:UserType = $item.Type.Trim()

$Global:UserOrgUnit = $item.OrgUnit.Trim()

$Global:UserOwners = $item.Owners.Split(";").Trim()

try

{

if (!$UserType)

{

Write-Warning "Group $username is missing Type in CSV.. Not Migrating"

continue

}

MoveADUsers

CheckUserInAD

}

catch

{

write-host "An error occurred with $username";

}

if ($fimServiceObjectsList)

{

SyncMIMObjects

}

$acmaObjectsList = @()

$fimServiceObjectsList = @()

$userADDN = @()

Measure-Command { MigrateADUsers }

Stop-Transcript

Rundown

Script records everything via transcript command so you can set and forget, come back later and see what broke or potentially could break (loss of membership my main concern). Saves it to D:\ADUserMigration-{CSVFileName}.log
Asks for CSV file on run.
If the “Type” is missing in CSV it will skip that user (MUST in our logic)
Moves the account to respective OU in AD as per the account type.
Checks if the user doesn’t have monashObjectID – thus good to migrate.
Creates the object in FIMService using LithnetRMA
- Depending on the type either we set expiry date to never (9999-12-31) or two years from date of migration
- Checks the owner if its a person or a group and then looks it up if it exits in MIM and adds it as owner.
- If no owner then we set a default account we have as owner
- Checks OrgUnit and if found it adds it to the object else sets a default OrgUnit.
Checks if the memberOf exists in MIM and adds the user to those groups in MIM.
Creates the object in ACMA
Repeats the steps above for all users in the CSV
Sync the identities in MIM via MIIS Powershell
- Disables MRE Provisioning
- DI the FIMService
- DS / Commit just the ones which were migrated into MV (as its prod others could come in from Portal which needs MRE rules and thus excluding them)
- DI ACMA MA
- DS / Commit just the ones which were migrated into MV – this should join them due to our join rules looking for same fimserviceobjectID which was written to ACMA DB during create
- DI AD MA – all moved objects will now show in correct OU in CS
- DS / Commit just the ones which were migrated into MV – this will join due to our join rules looking for same sAMAccountName.
- Enable provisioning
- DS all of them again to make sure MRE rules apply to those objects for any provisioning if required.

Done..

Speed

Can’t remember to be honest but was quite quick (had nearly none to do for accounts)

GROUP MIGRATION SCRIPT

Remember, loads of logic for our environment.

CSV Requirements

The CSV requires the following fields

Name,Type,ServiceID,Owners,OrgUnit

1	Name,Type,ServiceID,Owners,OrgUnit

Name: sAMAccountName of the group to be migrated
Type: We have account types in our environment like UserGroup / ServiceManagedGroup / IdMAuthZGroup etc. Need to mention that (or modify code to remove it)
ServiceID: For our environment – mandatory.
Owners: This is to mention the owner / supervisor of the user. They are sAMAccountName of already existing users in MIM. They can be multiple with ; separating them.
OrgUnit: We need to mention an OrgUnit DisplayName for each user to which it belongs to (our environment specific again.

Script

Import-Module LithnetRMA
Import-Module ACMAPS

Set-ResourceManagementClient -BaseAddress "http://{FIMService-Address}:5725"


Function CheckADObjectInFIM($monashobjectid, $objectclass)
{
	try
	{
		$obj = Get-Resource -ObjectType $objectclass -AttributeName monashObjectID -AttributeValue $monashobjectid -AttributesToGet ObjectID
		return ($obj.ObjectID.Value)
	}
	catch
	{
		throw "Resource Not Found in FIMService"
	}
}

Function CreateACMAGroup($fsObjectID, $groupName, $idmExpiryDate, $samaccountname, $unixgid, $addn)
{
	Connect-AcmaEngine Lithnet.acma localhost D:\madata\acma\acma-prod.acmax D:\MAData\acma\Logs\Add-ACMAGroup-$groupName.log Debug

	$acmagroup = Add-AcmaObject -ObjectClass group
	$acmagroup.fimServiceObjectID = [guid]$fsObjectID
	$acmagroup.displayName = $groupName
	$acmagroup.accountName = $samaccountname
	$acmagroup.idmExpiryDate = $idmExpiryDate.ToUniversalTime()
	if ($GroupType -eq "UserGroup") { $acmagroup.accountType = "UserGroup" }
	if ($GroupType -eq "ServiceManagedGroup") { $acmagroup.accountType = "ServiceManagedGroup" }
	$acmagroup.monashADDN = $addn
	$acmagroup.groupScope = "Global"
	$acmagroup.groupType = "Security"
	if ($unixgid) { $acmagroup.unixgid = $unixgid }

	try
	{
		Write-Host "Creating ACMA Object" -ForegroundColor Cyan
		Save-AcmaObject $acmagroup
	}
	catch
	{
		Write-Warning ("Unable to create group in ACMA:" + $_.Exception.Message)
		return
	}
	$acmaObject = Get-AcmaObject -ObjectType group -AttributeName accountName -AttributeValue $groupName       

	$Global:acmaObjectsList += ,$acmaObject.ObjectID    

}

Function CreateFIMServiceGroup($groupname)
{

	$adgroup = Get-ADGroup -filter {samaccountname -eq $groupname} -Properties *

	$Global:groupDN +=, $adgroup.DistinguishedName

	$group = New-Resource -ObjectType Group
    $group.activationOrNotificationMailSent = $true
	$group.DisplayName = $adgroup.Name
	$group.Description = $adgroup.Description

	switch ($groupType)
	{
		UserGroup {
			$expirydate = (Get-Date).AddDays(730).ToUniversalTime()
			$group.idmExpiryDate = $expirydate
			$group.accountType = "UserGroup"     
		}
		ServiceManagedGroup {
			$group.idmExpiryDate = [dateTime]"9999-12-31"
			$group.accountType = "ServiceManagedGroup"
			$group.serviceID = $ServiceID

		}
		IdMAuthZGroup {
			$group.idmExpiryDate = [dateTime]"9999-12-31"
			$group.accountType = "IdMAuthZGroup"
		}
		default {
			$warning = "GroupType not found for " + $groupname
			Write-Warning $warning
			return
		}
	}

	$group.Type = "Security"
	
	$group.Domain = $env:USERDOMAIN        
	$group.MembershipLocked = $false
	$group.Scope = 'Global'
	$group.MembershipAddWorkflow = "None"

    if ($Owners)
        {
            $ownercount = 0
            foreach ($owner in $Owners)
                {
		            $adObj = Get-ADObject -Filter {samaccountname -eq $owner} -Properties *

		            if ($adObj.monashobjectid)
		            {

			            switch ($adObj.ObjectClass)
			            {
				            user { $objClass = "Person" }
				            group { $objClass = "Group" }
			            }

			            try
			            {
				            $ownerObjectID =  CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)
				            $group.Owner.Add($ownerObjectID)
                            $ownercount++
				            
			            }
			            catch
			            {
				            Write-Warning ("Unable to retrive Owner: $adObj and will loose its membership" + $_.Exception.Message)

				
			            }
		            }
		            else
		            {
			            Write-Warning "Owner of AD Group not in I@M System: $adObj and will loose its membership"
                        $ownercount++
		            }
                 Write-Host "Done Owners: $ownercount of" $Owners.Count
                }
            $group.DisplayedOwner = $group.Owner[0]

	}

else
    {
        if ($env:USERDOMAIN -eq 'MONASH')
            {
                Write-Warning "Setting Unknown Owner Account as Owner in PROD"
                #Default Value for FIM PROD (Unknown Owner Role Account)
                $group.Owner.Add("<GUID OF THE DEFAULT OWNER>")
                $group.DisplayedOwner = "<GUID OF THE DEFAULT OWNER>"
            }
    }

    if ($OwningOrgUnit)
        {
            try {
                    
                    $OrgUnitObjectID =  Get-Resource organizationalUnit DisplayName "$OwningOrgUnit"
                    $group.idmOrganizationalUnit = $OrgUnitObjectID.ObjectID.Value
                }
            catch
                {
                    Write-Warning "$OwningOrgUnit not found in I@M.. Defaulting to IDS in PROD else will have OR9999 for other Env"
                    if ($env:USERDOMAIN -eq 'MONASH')
                        {
                            $group.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"
                        }
                }
        }
    else
        {
            if ($env:USERDOMAIN -eq 'MONASH')
                {
                    $group.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"

                }

        }


	if ($adgroup.member)
	{
        $memberscount = 0
		foreach ($member in $adgroup.member)
		{
			$adObj = Get-ADObject  "$member" -Properties *

			switch ($adObj.ObjectClass)
			{
				computer { 
					try {
						$fimComputerObjID = Get-Resource -ObjectType computer -AttributeName DisplayName -AttributeValue $adobj.Name -AttributesToGet ObjectID
						if ($fimComputerObjID.ObjectID.Value)
						{
							$group.ExplicitMember.Add($fimComputerObjID.ObjectID.Value) | Out-Null
                            $memberscount++
						}
					}
					catch
					{
						Write-Warning ("Unable to retrive computer in FIMService: $adObj will loose its membership")
                        $memberscount++
					}
				}
				user { 
					$objClass = "Person"

					
					try
					{
						$memberObjectID =  CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)
						$group.ExplicitMember.Add("$memberObjectID") | Out-Null
                        $memberscount++

					}
					catch
					{
						Write-Warning ("Unable to retrive user in FIMService: $adObj and will loose its membership")
                        $memberscount++
						
					}

				}

				group {

					$objClass = "Group" 
					try
					{
						$memberObjectID =  CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)
						$group.ExplicitMember.Add("$memberObjectID") | Out-Null
                        $memberscount++

					}
					catch
					{
						Write-Warning ("Unable to retrive group in FIMService: $adObj and will loose its membership")
                        $memberscount++
						
					}

				}


				deafult
				{
					Write-Warning ("This Objectclass of memeber $adObj is not catered for migration" + $adObj.ObjectClass)
                    $memberscount++
				}


			}

        Write-Host "Done Member: $memberscount of" $adgroup.member.Count
		}
	}
	
	
	try 
	{
		Write-Host "Creating FIMSerivce Group:" $group.DisplayName -ForegroundColor Cyan
		Save-Resource $group
		
	}
	catch 
	{
		Write-Warning ("Unable to create group in FIMService:" + $_.Exception.Message)
		return
	}

	$fimServiceObject = Get-Resource -ObjectType Group -AttributeName DisplayName -AttributeValue $group.DisplayName


	$Global:fimServiceObjectsList += ,$fimServiceObject.ObjectID

	if ($adgroup.MemberOf)
	{
        $memberofcount = 0
		foreach ($member in $adgroup.MemberOf)
		{
			$adObj = Get-ADObject "$member" -Properties *

			if ($adObj.monashobjectid)
			{

				switch ($adObj.ObjectClass)
				{
					user { $objClass = "Person" }
					group { $objClass = "Group" }
				}

				try
				{
					$parentgroupObjectID =  CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)
					$parentgroup = Get-Resource -ID $parentgroupObjectID -AttributesToGet ExplicitMember, DisplayName
					$parentgroup.ExplicitMember.Add($fimServiceObject.ObjectID.Value) | Out-Null
                    $memberofcount++
					Save-Resource $parentgroup
					Write-Host "Added group to its memberOf Group:" $parentgroup.DisplayName -ForegroundColor Cyan
					
				}
				catch
				{
					Write-Warning ("Unable to retrive memberOf Group: $adObj " + $_.Exception.Message)
                    $memberofcount++
					
				}

			}
			else
			{
				Write-Warning ("memberOf AD Group not in I@M System:" + $adObj.Name)
                $memberofcount++
			}
           Write-Host "Done memberOf: $memberofcount of" $adgroup.MemberOf.Count
		}
	}

	CreateACMAGroup ($fimServiceObject.ObjectID) ($fimServiceObject.DisplayName) ($fimServiceObject.idmExpiryDate) ($adgroup.SamAccountName) ($adgroup.gidNumber) ($adgroup.DistinguishedName)
	
	
}


Function SyncMIMObjects()
{
	
	Write-Host "Disabling MRE Provisioning" -ForegroundColor Cyan
	Set-MVProvisioningRulesExtension -Enabled $false;

	write-host "Delta import FIMService MA" -ForegroundColor Cyan
	Start-ManagementAgent FIMService DI
	
    $count = 0
	write-host "Sync group FIMService object" -ForegroundColor Cyan
	foreach ($item in $fimServiceObjectsList)
	{
		Get-CSObject -MA FIMService -DN $item.Value | Sync-CSObject -Commit | Out-Null
        $count++
        Write-Host "Synced $count of" $fimServiceObjectsList.Count
	}

	write-host "Delta import ACMA MA" -ForegroundColor Cyan
	Start-ManagementAgent ACMA DI

	$count = 0
	write-host "Sync group ACMA Object" -ForegroundColor Cyan
	foreach ($item in $acmaObjectsList)
	{
		Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Sycned $count of" $acmaObjectsList.Count
	}
	

	write-host "Delta import MonashAD MA" -ForegroundColor Cyan
	Start-ManagementAgent MonashAD DI

	$count = 0
	write-host "Joining AD Object" -ForegroundColor Cyan
	foreach ($item in $groupDN)
	{
		Get-CSObject -MA MonashAD -DN $item | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Joined $count of" $groupDN.Count
	}

	Write-Host "Enabled MRE Provisioning" -ForegroundColor Cyan
	Set-MVProvisioningRulesExtension -Enabled $true;

	$count = 0
	Write-Host "Provisioning to LDS" -ForegroundColor Cyan
	foreach ($item in $acmaObjectsList)
	{
		Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null
		$count++
		Write-Host "Provisioned $count of" $acmaObjectsList.Count
	}

	write-host "Clearing Full Sync Warnings" -ForegroundColor Cyan
	Clear-FullSyncWarning
	Write-Host "DONE!!!" -ForegroundColor Cyan

}


Function MigrateADGroup($groupName)
{
	try 
	{
		$group = Get-ADGroup -filter {samaccountname -eq $groupname} -Properties monashobjectid

	}
	catch
	{
		Write-Warning -Message "Group not found in AD: $groupname"  
		return;
	}     
	
	if ($group.monashobjectid)
	{
		write-warning "Group ($groupname) has a monashobjectid Might already exist in I@M.. Exiting"
		return;
	}

	Write-Host "Group Found in AD: $groupname" -ForegroundColor Cyan

	CreateFIMServiceGroup($groupname)

}

Function MoveADGroup($groupname)
{
	try
	{
		$domain = (Get-ADDomain).DistinguishedName
		$targetOU = "OU=Public,OU=Groups,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName
		$currentDN = (Get-ADGroup -filter {samaccountname -eq $groupname}).DistinguishedName
		$currentOU = $currentDN.Substring($currentDN.IndexOf("OU="))
		if ($currentOU -ne $targetOU)
		{
			Move-ADObject $currentDN -TargetPath $targetOU 
			Write-Host "Moved $groupname to" $targetOU -ForegroundColor Yellow
		}
		else
		{
			Write-Host "$groupname already in" $targetOU -ForegroundColor Green
		}
		
	}

	catch
	{
		Write-Error "Unable to move Group" + $_.Exception.Message
		return
	}

}

Function Get-File($initialDirectory)
{
	[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null
	
	$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
	$OpenFileDialog.initialDirectory = $initialDirectory
	$OpenFileDialog.filter = "CSV (*.csv)| *.csv"
	$OpenFileDialog.ShowDialog() | Out-Null
	$OpenFileDialog.filename
}

function MigrateADGroups
{
	

	$ServiceStatus = (Get-Service miisautosync).Status

	if ($ServiceStatus -ne "Stopped")
	{
		Write-Warning "Autosync still running. Make sure Autosync is stopped and no MA are running any profiles"
		exit
	}

    $counter = 0
	$inputFile = Get-File
	$groups = Import-Csv $inputFile
    $leaf = Split-Path $inputFile -Leaf
    Start-Transcript -Path D:\ADGroupMigration-$leaf.log -Append

	foreach ($item in $groups)
	{
        	$groupname = $item.Name.Trim()
			$Global:GroupType = $item.Type.Trim()
			$Global:ServiceID = $item.ServiceID.Trim()
            $Global:Owners = $item.Owners.Split(";").Trim()
            $Global:OwningOrgUnit = $item.OrgUnit.Trim()

            $counter++

		try
		{
			if ($GroupType -eq "ServiceManagedGroup" -and (!$ServiceID))
			{
				Write-Warning "Group $groupname is a ServiceManagedGroup but does not have a ServiceID in CSV.. Not Migrating"
				continue
			}
			MoveADGroup($groupname)            
			MigrateADGroup($groupname)
		}
		catch
		{
			write-host "An error occurred with $groupname";
		}

    Write-Host "Done $counter of" $groups.Count -ForegroundColor Red
	}
	if ($fimServiceObjectsList)
	{
		SyncMIMObjects
	}

	
}

$acmaObjectsList = @()
$fimServiceObjectsList = @()
$groupDN = @()

Measure-Command { MigrateADGroups }

Stop-Transcript

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

Import-Module LithnetRMA

Import-Module ACMAPS

Set-ResourceManagementClient -BaseAddress "http://{FIMService-Address}:5725"

Function CheckADObjectInFIM($monashobjectid, $objectclass)

{

try

{

$obj = Get-Resource -ObjectType $objectclass -AttributeName monashObjectID -AttributeValue $monashobjectid -AttributesToGet ObjectID

return ($obj.ObjectID.Value)

}

catch

{

throw "Resource Not Found in FIMService"

}

Function CreateACMAGroup($fsObjectID, $groupName, $idmExpiryDate, $samaccountname, $unixgid, $addn)

{

Connect-AcmaEngine Lithnet.acma localhost D:\madata\acma\acma-prod.acmax D:\MAData\acma\Logs\Add-ACMAGroup-$groupName.log Debug

$acmagroup = Add-AcmaObject -ObjectClass group

$acmagroup.fimServiceObjectID = [guid]$fsObjectID

$acmagroup.displayName = $groupName

$acmagroup.accountName = $samaccountname

$acmagroup.idmExpiryDate = $idmExpiryDate.ToUniversalTime()

if ($GroupType -eq "UserGroup") { $acmagroup.accountType = "UserGroup" }

if ($GroupType -eq "ServiceManagedGroup") { $acmagroup.accountType = "ServiceManagedGroup" }

$acmagroup.monashADDN = $addn

$acmagroup.groupScope = "Global"

$acmagroup.groupType = "Security"

if ($unixgid) { $acmagroup.unixgid = $unixgid }

try

{

Write-Host "Creating ACMA Object" -ForegroundColor Cyan

Save-AcmaObject $acmagroup

}

catch

{

Write-Warning ("Unable to create group in ACMA:" + $_.Exception.Message)

return

}

$acmaObject = Get-AcmaObject -ObjectType group -AttributeName accountName -AttributeValue $groupName

$Global:acmaObjectsList += ,$acmaObject.ObjectID

}

Function CreateFIMServiceGroup($groupname)

{

$adgroup = Get-ADGroup -filter {samaccountname -eq $groupname} -Properties *

$Global:groupDN +=, $adgroup.DistinguishedName

$group = New-Resource -ObjectType Group

$group.activationOrNotificationMailSent = $true

$group.DisplayName = $adgroup.Name

$group.Description = $adgroup.Description

switch ($groupType)

{

UserGroup {

$expirydate = (Get-Date).AddDays(730).ToUniversalTime()

$group.idmExpiryDate = $expirydate

$group.accountType = "UserGroup"

}

ServiceManagedGroup {

$group.idmExpiryDate = [dateTime]"9999-12-31"

$group.accountType = "ServiceManagedGroup"

$group.serviceID = $ServiceID

}

IdMAuthZGroup {

$group.idmExpiryDate = [dateTime]"9999-12-31"

$group.accountType = "IdMAuthZGroup"

}

default {

$warning = "GroupType not found for " + $groupname

Write-Warning $warning

return

}

$group.Type = "Security"

$group.Domain = $env:USERDOMAIN

$group.MembershipLocked = $false

$group.Scope = 'Global'

$group.MembershipAddWorkflow = "None"

if ($Owners)

{

$ownercount = 0

foreach ($owner in $Owners)

{

$adObj = Get-ADObject -Filter {samaccountname -eq $owner} -Properties *

if ($adObj.monashobjectid)

{

switch ($adObj.ObjectClass)

{

user { $objClass = "Person" }

group { $objClass = "Group" }

}

try

{

$ownerObjectID = CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)

$group.Owner.Add($ownerObjectID)

$ownercount++

}

catch

{

Write-Warning ("Unable to retrive Owner: $adObj and will loose its membership" + $_.Exception.Message)

}

else

{

Write-Warning "Owner of AD Group not in I@M System: $adObj and will loose its membership"

$ownercount++

}

Write-Host "Done Owners: $ownercount of" $Owners.Count

}

$group.DisplayedOwner = $group.Owner[0]

}

else

{

if ($env:USERDOMAIN -eq 'MONASH')

{

Write-Warning "Setting Unknown Owner Account as Owner in PROD"

#Default Value for FIM PROD (Unknown Owner Role Account)

$group.Owner.Add("<GUID OF THE DEFAULT OWNER>")

$group.DisplayedOwner = "<GUID OF THE DEFAULT OWNER>"

}

if ($OwningOrgUnit)

{

try {

$OrgUnitObjectID = Get-Resource organizationalUnit DisplayName "$OwningOrgUnit"

$group.idmOrganizationalUnit = $OrgUnitObjectID.ObjectID.Value

}

catch

{

Write-Warning "$OwningOrgUnit not found in I@M.. Defaulting to IDS in PROD else will have OR9999 for other Env"

if ($env:USERDOMAIN -eq 'MONASH')

{

$group.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"

}

else

{

if ($env:USERDOMAIN -eq 'MONASH')

{

$group.idmOrganizationalUnit = "<GUID OF THE DEFAULT ORGUNIT>"

}

if ($adgroup.member)

{

$memberscount = 0

foreach ($member in $adgroup.member)

{

$adObj = Get-ADObject "$member" -Properties *

switch ($adObj.ObjectClass)

{

computer {

try {

$fimComputerObjID = Get-Resource -ObjectType computer -AttributeName DisplayName -AttributeValue $adobj.Name -AttributesToGet ObjectID

if ($fimComputerObjID.ObjectID.Value)

{

$group.ExplicitMember.Add($fimComputerObjID.ObjectID.Value) | Out-Null

$memberscount++

}

catch

{

Write-Warning ("Unable to retrive computer in FIMService: $adObj will loose its membership")

$memberscount++

}

user {

$objClass = "Person"

try

{

$memberObjectID = CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)

$group.ExplicitMember.Add("$memberObjectID") | Out-Null

$memberscount++

}

catch

{

Write-Warning ("Unable to retrive user in FIMService: $adObj and will loose its membership")

$memberscount++

}

group {

$objClass = "Group"

try

{

$memberObjectID = CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)

$group.ExplicitMember.Add("$memberObjectID") | Out-Null

$memberscount++

}

catch

{

Write-Warning ("Unable to retrive group in FIMService: $adObj and will loose its membership")

$memberscount++

}

deafult

{

Write-Warning ("This Objectclass of memeber $adObj is not catered for migration" + $adObj.ObjectClass)

$memberscount++

}

Write-Host "Done Member: $memberscount of" $adgroup.member.Count

}

try

{

Write-Host "Creating FIMSerivce Group:" $group.DisplayName -ForegroundColor Cyan

Save-Resource $group

}

catch

{

Write-Warning ("Unable to create group in FIMService:" + $_.Exception.Message)

return

}

$fimServiceObject = Get-Resource -ObjectType Group -AttributeName DisplayName -AttributeValue $group.DisplayName

$Global:fimServiceObjectsList += ,$fimServiceObject.ObjectID

if ($adgroup.MemberOf)

{

$memberofcount = 0

foreach ($member in $adgroup.MemberOf)

{

$adObj = Get-ADObject "$member" -Properties *

if ($adObj.monashobjectid)

{

switch ($adObj.ObjectClass)

{

user { $objClass = "Person" }

group { $objClass = "Group" }

}

try

{

$parentgroupObjectID = CheckADObjectInFIM ($adObj.monashobjectid) ($objClass)

$parentgroup = Get-Resource -ID $parentgroupObjectID -AttributesToGet ExplicitMember, DisplayName

$parentgroup.ExplicitMember.Add($fimServiceObject.ObjectID.Value) | Out-Null

$memberofcount++

Save-Resource $parentgroup

Write-Host "Added group to its memberOf Group:" $parentgroup.DisplayName -ForegroundColor Cyan

}

catch

{

Write-Warning ("Unable to retrive memberOf Group: $adObj " + $_.Exception.Message)

$memberofcount++

}

else

{

Write-Warning ("memberOf AD Group not in I@M System:" + $adObj.Name)

$memberofcount++

}

Write-Host "Done memberOf: $memberofcount of" $adgroup.MemberOf.Count

}

CreateACMAGroup ($fimServiceObject.ObjectID) ($fimServiceObject.DisplayName) ($fimServiceObject.idmExpiryDate) ($adgroup.SamAccountName) ($adgroup.gidNumber) ($adgroup.DistinguishedName)

}

Function SyncMIMObjects()

{

Write-Host "Disabling MRE Provisioning" -ForegroundColor Cyan

Set-MVProvisioningRulesExtension -Enabled $false;

write-host "Delta import FIMService MA" -ForegroundColor Cyan

Start-ManagementAgent FIMService DI

$count = 0

write-host "Sync group FIMService object" -ForegroundColor Cyan

foreach ($item in $fimServiceObjectsList)

{

Get-CSObject -MA FIMService -DN $item.Value | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Synced $count of" $fimServiceObjectsList.Count

}

write-host "Delta import ACMA MA" -ForegroundColor Cyan

Start-ManagementAgent ACMA DI

$count = 0

write-host "Sync group ACMA Object" -ForegroundColor Cyan

foreach ($item in $acmaObjectsList)

{

Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Sycned $count of" $acmaObjectsList.Count

}

write-host "Delta import MonashAD MA" -ForegroundColor Cyan

Start-ManagementAgent MonashAD DI

$count = 0

write-host "Joining AD Object" -ForegroundColor Cyan

foreach ($item in $groupDN)

{

Get-CSObject -MA MonashAD -DN $item | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Joined $count of" $groupDN.Count

}

Write-Host "Enabled MRE Provisioning" -ForegroundColor Cyan

Set-MVProvisioningRulesExtension -Enabled $true;

$count = 0

Write-Host "Provisioning to LDS" -ForegroundColor Cyan

foreach ($item in $acmaObjectsList)

{

Get-CSObject -MA ACMA -DN $item.Guid | Sync-CSObject -Commit | Out-Null

$count++

Write-Host "Provisioned $count of" $acmaObjectsList.Count

}

write-host "Clearing Full Sync Warnings" -ForegroundColor Cyan

Clear-FullSyncWarning

Write-Host "DONE!!!" -ForegroundColor Cyan

}

Function MigrateADGroup($groupName)

{

try

{

$group = Get-ADGroup -filter {samaccountname -eq $groupname} -Properties monashobjectid

}

catch

{

Write-Warning -Message "Group not found in AD: $groupname"

return;

}

if ($group.monashobjectid)

{

write-warning "Group ($groupname) has a monashobjectid Might already exist in I@M.. Exiting"

return;

}

Write-Host "Group Found in AD: $groupname" -ForegroundColor Cyan

CreateFIMServiceGroup($groupname)

}

Function MoveADGroup($groupname)

{

try

{

$domain = (Get-ADDomain).DistinguishedName

$targetOU = "OU=Public,OU=Groups,OU=IdM Managed Objects," + (Get-ADDomain).DistinguishedName

$currentDN = (Get-ADGroup -filter {samaccountname -eq $groupname}).DistinguishedName

$currentOU = $currentDN.Substring($currentDN.IndexOf("OU="))

if ($currentOU -ne $targetOU)

{

Move-ADObject $currentDN -TargetPath $targetOU

Write-Host "Moved $groupname to" $targetOU -ForegroundColor Yellow

}

else

{

Write-Host "$groupname already in" $targetOU -ForegroundColor Green

}

catch

{

Write-Error "Unable to move Group" + $_.Exception.Message

return

}

Function Get-File($initialDirectory)

{

[System.Reflection.Assembly]::LoadWithPartialName("System.windows.forms") | Out-Null

$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog

$OpenFileDialog.initialDirectory = $initialDirectory

$OpenFileDialog.filter = "CSV (*.csv)| *.csv"

$OpenFileDialog.ShowDialog() | Out-Null

$OpenFileDialog.filename

}

function MigrateADGroups

{

$ServiceStatus = (Get-Service miisautosync).Status

if ($ServiceStatus -ne "Stopped")

{

Write-Warning "Autosync still running. Make sure Autosync is stopped and no MA are running any profiles"

exit

}

$counter = 0

$inputFile = Get-File

$groups = Import-Csv $inputFile

$leaf = Split-Path $inputFile -Leaf

Start-Transcript -Path D:\ADGroupMigration-$leaf.log -Append

foreach ($item in $groups)

{

$groupname = $item.Name.Trim()

$Global:GroupType = $item.Type.Trim()

$Global:ServiceID = $item.ServiceID.Trim()

$Global:Owners = $item.Owners.Split(";").Trim()

$Global:OwningOrgUnit = $item.OrgUnit.Trim()

$counter++

try

{

if ($GroupType -eq "ServiceManagedGroup" -and (!$ServiceID))

{

Write-Warning "Group $groupname is a ServiceManagedGroup but does not have a ServiceID in CSV.. Not Migrating"

continue

}

MoveADGroup($groupname)

MigrateADGroup($groupname)

}

catch

{

write-host "An error occurred with $groupname";

}

Write-Host "Done $counter of" $groups.Count -ForegroundColor Red

}

if ($fimServiceObjectsList)

{

SyncMIMObjects

}

$acmaObjectsList = @()

$fimServiceObjectsList = @()

$groupDN = @()

Measure-Command { MigrateADGroups }

Stop-Transcript

Rundown

Script records everything via transcript command so you can set and forget, come back later and see what broke or potentially could break (loss of membership my main concern). Saves it to D:\ADGroupMigration-{CSVFileName}.log
Asks for CSV file on run.
If the “serviceID” is missing in CSV for a ServiceManagedGroup it will skip that user (MUST in our logic)
Moves the group to respective OU in AD as per the account type.
Checks if the group doesn’t have monashObjectID – thus good to migrate.
Creates the object in FIMService using LithnetRMA
- Depending on the type either we set expiry date to never (9999-12-31) or two years from date of migration
- Sets all as Security and Global groups.
- Checks the owner if its a person or a group and then looks it up if it exits in MIM and adds it as owner.
- If no owner then we set a default account we have as owner
- Checks OrgUnit and if found it adds it to the object else sets a default OrgUnit.
- Checks each member of the group and if they exist then adds them – else will spit out a warning that they will loose membership in AD (good to have logs eh?)
Checks if the memberOf exists in MIM and adds the user to those groups in MIM.
Creates the object in ACMA
Repeats the steps above for all users in the CSV
Sync the identities in MIM via MIIS Powershell
- Disables MRE Provisioning
- DI the FIMService
- DS / Commit just the ones which were migrated into MV (as its prod others could come in from Portal which needs MRE rules and thus excluding them)
- DI ACMA MA
- DS / Commit just the ones which were migrated into MV – this should join them due to our join rules looking for same fimserviceobjectID which was written to ACMA DB during create
- DI AD MA – all moved objects will now show in correct OU in CS
- DS / Commit just the ones which were migrated into MV – this will join due to our join rules looking for same sAMAccountName.
- Enable provisioning
- DS all of them again to make sure MRE rules apply to those objects for any provisioning if required.

Done..

Speed

This has varied for me. It really depends on number of members for the group.. about 3-5 groups / min .. I did about 1500 groups with 90% of them having 0-10 members but the last few having upto 1100 members in 6.5 hrs.

Hopefully this will help someone and see what can be done by combination of various tools out there.

By Piyush Khandelwal, 7 years ago

MIM

FIMService: Convert Static Group to Dynamic

Following from my previous post on how to create a group with both static members and dynamic filter, I came across a scenario where post migration we have some customers who initially had a group with explicit members but we thought they could be converted to a filter based group which matches the business case.

The script below helps you on doing the same. Again using LithnetRMA for the process.

Warning: Again, many custom attributes logic in FIMService for my environment but again you will get the whole idea. I have left the script as-is and not dumbed it down.

Please read my Groups with Static and Dynamic Members in FIMService post to understand the logic I have been applying for Autogen groups and how group and set tie up to each other in FIMService.

LOGIC

Asks for existing group name (DisplayName) in FIMService.
If found, outputs the number of explicit members found
Asks if you want to put a filter on the group and then asks for the XPATH filter (coming soon on how to create XPATH easily)
Checks if the filter is valid. If so (the fun part)
- Outputs the count of users in the new filter
- Compares the filter users to explicit members and gives a count of
  - New members to be added due to filter (i.e. not found in the explicit members list)
  - Count of common members found between existing explicit members and XPATH
  - Finally gives count of explicit members for the new set to be created (i.e. not found in the new filter).
Finally if the user wants to continue after above information
- Creates a set with “Autogen-GroupName” and set the filter and explicit members to that
- Modify’s existing group and deletes the current explicit members
- Converts the existing group to a filter based and sets the objectID of the set created above.
Done

Import-Module LithnetRMA
Set-ResourceManagementClient -BaseAddress "http://YOUR-FIMSERVICE-ENDPOINT:5725"

Function ModifyUserGroup($groupObjectID, $setObjectID)
    {
        $group = Get-Resource -ID $groupObjectID
        Write-Host "Deleting Group Explicit Members" -ForegroundColor Cyan
        $group.ExplicitMember = $null
        Write-Host "Changing accountType to AutogenGroup" -ForegroundColor Cyan
        $group.accountType = "AutogenGroup"
        Write-Host "Changing Group Type to Filter" -ForegroundColor Cyan
        $group.MembershipLocked = $true
        $group.MembershipAddWorkflow = "None"
        Write-Host "Adding Filter to Parent Group" -ForegroundColor Cyan
        $group.Filter = '<Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">/*[((ObjectType = "Person") or (ObjectType = "Group")) and (ObjectID = /Set[ObjectID ="' +$setObjectID+ '"]/ComputedMember)]</Filter>'
        $group.connectedSetObjectID = "$setObjectID"
        try 
            {
               Write-Host "Modifying Parent Group:" $group.DisplayName -ForegroundColor Cyan
               Save-Resource $group
               
            }
        catch 
            {
                Write-Warning ("Unable to modify group:" + $_.Exception.Message)
                exit
            }
    }


Function CreateSet($groupObjectID, $groupDisplayName, $explicitmembers, $newfilter)
    {
        
        $set = New-Resource -ObjectType Set
        $set.DisplayName = "Autogen-" + $groupDisplayName
        $set.accountType = "AutogenSet"
        if ($newfilter) {
        $set.Filter = '<Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">' +$newfilter+ '</Filter>'
        }
        $set.connectedGroupObjectID = $groupObjectID

        foreach ($member in $explicitmembers)
            {
                $set.ExplicitMember.Add($member) | Out-Null
            }

        try 
            {
               Write-Host "Creating new AutogenSet:" $set.DisplayName -ForegroundColor Cyan
               Save-Resource $set
               $setObjectID = Get-Resource -ObjectType Set -AttributeName DisplayName -AttributeValue $set.DisplayName
               return $setObjectID.ObjectID
            }

        catch 
            {
                Write-Warning ("Unable to create set:" + $_.Exception.Message)
                exit
            }

    }


Function CheckMembers($explicitmembers, $newfilter) 
    {
        try
            {
                $filtermembers = Search-Resources -XPath "$newfilter" -AttributesToGet ObjectID
            }
        catch
            {
                $host.UI.WriteErrorLine("Bad Filter")
                continue
            }

         if ($filtermembers -eq $null)
            {
                    $host.UI.WriteErrorLine("No Users found in new filter")
                    continue
            }
      
       $compare = $explicitmembers | ?{$filtermembers.ObjectID.Value -notcontains $_}
       
       Write-Host "New Filter Members:" $filtermembers.ObjectID.Count -ForegroundColor Cyan
       Write-Host "Found Common Members Between New Filter & Existing Explicit Members:" ($explicitmembers.Count - $compare.Count) -ForegroundColor Cyan
       Write-Host "Total Explicit Members for New Set:" $compare.Count -ForegroundColor Cyan
 
       return $compare
    }

Function ConvertStaticToAutogen()
{
    $groupname = Read-Host -Prompt "Enter the static group name" 



    $staticgroup = Search-Resources -XPath "/Group[(DisplayName = '$groupname')]" -AttributesToGet ExplicitMember, DisplayName, ObjectID, Filter -ErrorAction SilentlyContinue

    if ($staticgroup)
        {

            Write-Host "Found Group:" $staticgroup.DisplayName -ForegroundColor Cyan
            Write-Host "Current Explicit Members:" $staticgroup.ExplicitMember.Count -ForegroundColor Cyan
            

            if ($staticgroup.Filter)
                {
                    $host.UI.WriteErrorLine("This groups has a filter")
                    
                    continue 
                }

           
           $hasfilter = Read-Host -Prompt "Do you want to put a filter (y/n)"

           switch ($hasfilter)
            {
                y { 
                    $newfilter = Read-Host -Prompt "Enter the new filter for the group"
                    $filter = $newfilter.Trim()
                    $newexplicitmembers = CheckMembers ($staticgroup.ExplicitMember.Value) ($filter)
                  }
                
                n { Write-Warning "No Filter given"
                    $filter = $null }
                default {  Write-Warning "Please input y or n only"
                     exit
                }
            }
    
            
         
          $confirmcreation = Read-Host "Do you want to continue (y/n)"

          switch ($confirmcreation)
            {
                y {
                    $newSetObjectID = CreateSet ($staticgroup.ObjectID) ($staticgroup.DisplayName) ($newexplicitmembers) ($filter)
                    ModifyUserGroup ($staticgroup.ObjectID.Value) ($newSetObjectID.Value)
                    Write-Host "Done!!!" -ForegroundColor Cyan
                  }

                n { 
                        Write-Host "Exiting without creation"
                  }

           default { Write-Warning "Please input y or n only"
                     exit
                }
            }
        }
    else
        {
            
            $host.UI.WriteErrorLine("Group Not Found")
            continue
        }

}


ConvertStaticToAutogen

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

Import-Module LithnetRMA

Set-ResourceManagementClient -BaseAddress "http://YOUR-FIMSERVICE-ENDPOINT:5725"

Function ModifyUserGroup($groupObjectID, $setObjectID)

{

$group = Get-Resource -ID $groupObjectID

Write-Host "Deleting Group Explicit Members" -ForegroundColor Cyan

$group.ExplicitMember = $null

Write-Host "Changing accountType to AutogenGroup" -ForegroundColor Cyan

$group.accountType = "AutogenGroup"

Write-Host "Changing Group Type to Filter" -ForegroundColor Cyan

$group.MembershipLocked = $true

$group.MembershipAddWorkflow = "None"

Write-Host "Adding Filter to Parent Group" -ForegroundColor Cyan

$group.Filter = '<Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">/*[((ObjectType = "Person") or (ObjectType = "Group")) and (ObjectID = /Set[ObjectID ="' +$setObjectID+ '"]/ComputedMember)]</Filter>'

$group.connectedSetObjectID = "$setObjectID"

try

{

Write-Host "Modifying Parent Group:" $group.DisplayName -ForegroundColor Cyan

Save-Resource $group

}

catch

{

Write-Warning ("Unable to modify group:" + $_.Exception.Message)

exit

}

Function CreateSet($groupObjectID, $groupDisplayName, $explicitmembers, $newfilter)

{

$set = New-Resource -ObjectType Set

$set.DisplayName = "Autogen-" + $groupDisplayName

$set.accountType = "AutogenSet"

if ($newfilter) {

$set.Filter = '<Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">' +$newfilter+ '</Filter>'

}

$set.connectedGroupObjectID = $groupObjectID

foreach ($member in $explicitmembers)

{

$set.ExplicitMember.Add($member) | Out-Null

}

try

{

Write-Host "Creating new AutogenSet:" $set.DisplayName -ForegroundColor Cyan

Save-Resource $set

$setObjectID = Get-Resource -ObjectType Set -AttributeName DisplayName -AttributeValue $set.DisplayName

return $setObjectID.ObjectID

}

catch

{

Write-Warning ("Unable to create set:" + $_.Exception.Message)

exit

}

Function CheckMembers($explicitmembers, $newfilter)

{

try

{

$filtermembers = Search-Resources -XPath "$newfilter" -AttributesToGet ObjectID

}

catch

{

$host.UI.WriteErrorLine("Bad Filter")

continue

}

if ($filtermembers -eq $null)

{

$host.UI.WriteErrorLine("No Users found in new filter")

continue

}

$compare = $explicitmembers | ?{$filtermembers.ObjectID.Value -notcontains $_}

Write-Host "New Filter Members:" $filtermembers.ObjectID.Count -ForegroundColor Cyan

Write-Host "Found Common Members Between New Filter & Existing Explicit Members:" ($explicitmembers.Count - $compare.Count) -ForegroundColor Cyan

Write-Host "Total Explicit Members for New Set:" $compare.Count -ForegroundColor Cyan

return $compare

}

Function ConvertStaticToAutogen()

{

$groupname = Read-Host -Prompt "Enter the static group name"

$staticgroup = Search-Resources -XPath "/Group[(DisplayName = '$groupname')]" -AttributesToGet ExplicitMember, DisplayName, ObjectID, Filter -ErrorAction SilentlyContinue

if ($staticgroup)

{

Write-Host "Found Group:" $staticgroup.DisplayName -ForegroundColor Cyan

Write-Host "Current Explicit Members:" $staticgroup.ExplicitMember.Count -ForegroundColor Cyan

if ($staticgroup.Filter)

{

$host.UI.WriteErrorLine("This groups has a filter")

continue

}

$hasfilter = Read-Host -Prompt "Do you want to put a filter (y/n)"

switch ($hasfilter)

{

y {

$newfilter = Read-Host -Prompt "Enter the new filter for the group"

$filter = $newfilter.Trim()

$newexplicitmembers = CheckMembers ($staticgroup.ExplicitMember.Value) ($filter)

}

n { Write-Warning "No Filter given"

$filter = $null }

default { Write-Warning "Please input y or n only"

exit

}

$confirmcreation = Read-Host "Do you want to continue (y/n)"

switch ($confirmcreation)

{

y {

$newSetObjectID = CreateSet ($staticgroup.ObjectID) ($staticgroup.DisplayName) ($newexplicitmembers) ($filter)

ModifyUserGroup ($staticgroup.ObjectID.Value) ($newSetObjectID.Value)

Write-Host "Done!!!" -ForegroundColor Cyan

}

n {

Write-Host "Exiting without creation"

}

default { Write-Warning "Please input y or n only"

exit

}

else

{

$host.UI.WriteErrorLine("Group Not Found")

continue

}

ConvertStaticToAutogen

Hope it helps.. Please like, share or leave a comment below..

By Piyush Khandelwal, 7 years ago

MIM

MIM

KISS for MIM – Autosync

Execution Mode

Execution Monitor

Like this:

MIM

Fixing MIM Error: The dimage indicates an update or replace operation, but the image doesn’t exist.

Like this:

MIM

FIM/MIM Powershell: XPath Demystified

Like this:

MIM

Execution Mode

Execution Monitor

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

REQUIREMENTS

LOGIC

USER MIGRATION SCRIPT

CSV Requirements

Script

Rundown

Speed

GROUP MIGRATION SCRIPT

CSV Requirements

Rundown

Speed

Share this:

Like this:

LOGIC

Share this:

Like this: