SharePoint 2010 - FIM Key

FIM Synchronization Service encryption key

In the case the of DR or a complete rebuild of a SharePoint 2010 environment it is very important that you back the up the FIM key on initial install of the environment. Without this on a rebuild you will NOT be able to re- start the user profile service.

To export the key:

1. From command prompt go to Program Files%\Microsoft Office Servers\14.0\Synchronization Service\Bin
2. Type miiskmu.exe /e D:\<path>\FIM_Key
3. This will backup the key to a directory - then and this is also important copy this off to another location just in case of OS failure.
4. the user name and password are the credentials for the farm administrator.
    

1. To import the encryption key, say on rebuild - complete these steps:
   
2. Use farm admin to log on to the computer that contains the new User Profile Service service application database.
   
3. Ensure the  User Profile Synchronization service has a status of the service is Stopped.
   
4. Open the Command Prompt window, and then change to the following folder:
   
   %Program Files%\Microsoft Office Servers\14.0\Synchronization Service\Bin\
   
5. Type the following command, and then press Enter:
   
   miiskmu.exe /i  D:\<path>\FIM_Key
   
   Where <Path> is the full path of the file to which you exported the key.

The following like is slightly less clear - 
http://technet.microsoft.com/en-us/library/ff806338.aspx

SharePoint 2010 - FIM Error removing a profile properties

We experienced an issue when removing incorrectly mapped user properties from user profiles.  The incorrectly mapped properties we added via code, and the code mapped a multi value user property to a single value Active Directory Property which is incorrect.  When we tried to remove this property and re-added correctly mapping single value to single value it would not let us add this in the UI.  After some investigation we found that it did not correctly remove from SharePoint FIM, which was stopping it from being added again.

The below error appears in windows application log

 "ERR: MMS(5888): iafparse.cpp(2731): IAF: the 'mv-attribute' attribute on element <import-flows> refers to non-existant MV attribute 'SPS_MV_String_<propertiy name>'

BAIL: MMS(5888): iafparse.cpp(2731): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

BAIL: MMS(5888): iafparse.cpp(2188): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

BAIL: MMS(5888): xstack.cpp(402): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

BAIL: MMS(5888): xparse.cpp(428): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

BAIL: MMS(5888): iafexec.cpp(146): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

ERR: MMS(5888): mastate.cpp(12450): Error creating import attribute flow rules object: 0x8023050e

BAIL: MMS(5888): mastate.cpp(12538): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

BAIL: MMS(5888): mastate.cpp(11237): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

BAIL: MMS(5888): server.cpp(4068): 0x8023050e (The import attribute flow rules XML defines an invalid/incomplete rule.)

Forefront Identity Manager 4.0.2450.34"

To fix this problem you have to do:

1)    Remove the user property from Sharepoint as normal, removing it from the Central admin under “application management”, “manage service applications”, “user profile service application”, Click Manage user properties.

2)    Open miisclient.exe from "C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe"

a.     Go to management agent, click on MOSS-<GUID>

b.     Click on Attribute Flow and expand options until you find the user property you have an issue with and click delete.

c.     Click on Configure attributes and delete the same user property from this list.

d.      to management agent, click on MOSSAD-<domain>

e.     Click on Attribute Flow and expand options until you find the user property you have an issue with and click delete.

f.      Finally Click Metarverse Designer, click person, and remove the attribute from here as well.

3)    Perform a full synchronisation, and now you will be able to add the same named user property