Hi, I have a set with all security groups associated to an application (all security groups wich DispalyName Begins with "APPLICATIONX"). XPATH for this set is: /Group[starts-with(DisplayName, 'APPLICATIONX')] I need to create a distribution list with all the members of all security groups in this set. I tried with: /Person[ObjectID = /Group[starts-with(DisplayName, 'APPLICATIONX')]/ComputedMember]</Filter> But I receive Access Denied Error and in Forefront Identity Management event log there is 2 events: Log Name: Forefront Identity Manager Source: Microsoft.ResourceManagement Date: 27/04/2011 03:24:11 p.m. Event ID: 3 Task Category: None Level: Error Keywords: Classic User: N/A Computer: SRV... Description: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: SystemConstraint ---> Procedure: CreateMembershipConditionStatement. Line number: 539. Message: Invalid membership condition statement de-referenced value.. --- End of inner exception stack trace --- Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft.ResourceManagement" /> <EventID Qualifiers="0">3</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-04-27T18:24:11.000Z" /> <EventRecordID>27201</EventRecordID> <Channel>Forefront Identity Manager</Channel> <Computer>SRV...</Computer> <Security /> </System> <EventData> <Data>Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: SystemConstraint ---&gt; Procedure: CreateMembershipConditionStatement. Line number: 539. Message: Invalid membership condition statement de-referenced value.. --- End of inner exception stack trace ---</Data> </EventData> </Event> ---------- Log Name: Forefront Identity Manager Source: Microsoft.ResourceManagement Date: 27/04/2011 03:24:11 p.m. Event ID: 3 Task Category: None Level: Error Keywords: Classic User: N/A Computer: SRV... Description: Requestor: urn:uuid:7fb2b853-24f0-4498-9534-4e10589723c4 Microsoft.ResourceManagement: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: SystemConstraint ---> Procedure: CreateMembershipConditionStatement. Line number: 539. Message: Invalid membership condition statement de-referenced value.. --- End of inner exception stack trace --- at Microsoft.ResourceManagement.Utilities.ExceptionManager.ThrowException(Exception exception) at Microsoft.ResourceManagement.Data.Exception.DataAccessExceptionManager.ThrowException(SqlException innerException) at Microsoft.ResourceManagement.Data.DataAccess.CreateMembershipConditionStatement(String xpath, Int32 referentKey, String attribute, Boolean operatorEqual, Boolean operatorGreater, Boolean operatorLess, Boolean operatorLike, Boolean operatorInversion, Nullable`1 literalValueBoolean, Nullable`1 literalValueDateTime, Nullable`1 literalValueInteger, Nullable`1 literalValueReference, String literalValueString, String functionValue, Boolean missingValue, Int32[] dereferencedValueMembershipConditionKeys, String dereferencedValueAttribute, String recursivelyDereferencedAttribute, Boolean recursionFrom, Boolean recursionTo, String[] attributes) at Microsoft.ResourceManagement.FilterEvaluation.Language.Statement.Create() at Microsoft.ResourceManagement.FilterEvaluation.Language.MembershipCondition.BasicMembershipCondition.Create() at Microsoft.ResourceManagement.FilterEvaluation.Language.MembershipCondition.Create(ReadOnlyCollection`1 membershipConditions) at Microsoft.ResourceManagement.FilterEvaluation.Language.MembershipCondition.Create(QueryFilter queryFilter, Int32[]& membershipConditions) at Microsoft.ResourceManagement.ActionProcessor.FilteredResourceActionProcessor.FilteredResourceActionProcessHelper.DoPreProcessRequest(RequestType request) at Microsoft.ResourceManagement.ActionProcessor.FilteredResourceActionProcessor.PreProcessRequestFromAttribute(RequestType request) at Microsoft.ResourceManagement.ActionProcessor.ActionDispatcher.PreProcessRequestFromAttribute(RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(CreateRequestDispatchParameter dispatchParameter) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(UniqueIdentifier requestor, UniqueIdentifier targetIdentifier, OperationType operation, String businessJustification, List`1 requestParameters, CultureInfo locale, Boolean isChildRequest, Guid cause, Boolean doEvaluation, Nullable`1 serviceId, Nullable`1 servicePartitionId) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(UniqueIdentifier requestor, UniqueIdentifier targetIdentifier, OperationType operation, String businessJustification, List`1 requestParameters, CultureInfo locale, Boolean isChildRequest, Guid cause, Boolean doEvaluation) at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Put(Message request) Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft.ResourceManagement" /> <EventID Qualifiers="0">3</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-04-27T18:24:11.000Z" /> <EventRecordID>27202</EventRecordID> <Channel>Forefront Identity Manager</Channel> <Computer>SRV...</Computer> <Security /> </System> <EventData> <Data>Requestor: urn:uuid:7fb2b853-24f0-4498-9534-4e10589723c4 Microsoft.ResourceManagement: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: SystemConstraint ---&gt; Procedure: CreateMembershipConditionStatement. Line number: 539. Message: Invalid membership condition statement de-referenced value.. --- End of inner exception stack trace --- at Microsoft.ResourceManagement.Utilities.ExceptionManager.ThrowException(Exception exception) at Microsoft.ResourceManagement.Data.Exception.DataAccessExceptionManager.ThrowException(SqlException innerException) at Microsoft.ResourceManagement.Data.DataAccess.CreateMembershipConditionStatement(String xpath, Int32 referentKey, String attribute, Boolean operatorEqual, Boolean operatorGreater, Boolean operatorLess, Boolean operatorLike, Boolean operatorInversion, Nullable`1 literalValueBoolean, Nullable`1 literalValueDateTime, Nullable`1 literalValueInteger, Nullable`1 literalValueReference, String literalValueString, String functionValue, Boolean missingValue, Int32[] dereferencedValueMembershipConditionKeys, String dereferencedValueAttribute, String recursivelyDereferencedAttribute, Boolean recursionFrom, Boolean recursionTo, String[] attributes) at Microsoft.ResourceManagement.FilterEvaluation.Language.Statement.Create() at Microsoft.ResourceManagement.FilterEvaluation.Language.MembershipCondition.BasicMembershipCondition.Create() at Microsoft.ResourceManagement.FilterEvaluation.Language.MembershipCondition.Create(ReadOnlyCollection`1 membershipConditions) at Microsoft.ResourceManagement.FilterEvaluation.Language.MembershipCondition.Create(QueryFilter queryFilter, Int32[]&amp; membershipConditions) at Microsoft.ResourceManagement.ActionProcessor.FilteredResourceActionProcessor.FilteredResourceActionProcessHelper.DoPreProcessRequest(RequestType request) at Microsoft.ResourceManagement.ActionProcessor.FilteredResourceActionProcessor.PreProcessRequestFromAttribute(RequestType request) at Microsoft.ResourceManagement.ActionProcessor.ActionDispatcher.PreProcessRequestFromAttribute(RequestType request) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(CreateRequestDispatchParameter dispatchParameter) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(UniqueIdentifier requestor, UniqueIdentifier targetIdentifier, OperationType operation, String businessJustification, List`1 requestParameters, CultureInfo locale, Boolean isChildRequest, Guid cause, Boolean doEvaluation, Nullable`1 serviceId, Nullable`1 servicePartitionId) at Microsoft.ResourceManagement.WebServices.RequestDispatcher.CreateRequest(UniqueIdentifier requestor, UniqueIdentifier targetIdentifier, OperationType operation, String businessJustification, List`1 requestParameters, CultureInfo locale, Boolean isChildRequest, Guid cause, Boolean doEvaluation) at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Put(Message request)</Data> </EventData> </Event> ---------- I am working with Administrator user, it has all the persmissions. I am a newbie with Xpath, I am trying to modify examples. Any help with the xpath definition? Thanks JuanCC Technology Specialist

Unfortunately you've hit the same limitation I did some time last year ... FIM won't let you define a set in terms of the membership of a group. This is a limitation which I have pointed out before in this previous thread as follows ... No - unfortunately you CAN'T save this as a set definition (any more at least!), as it violates one of the rules about sets that appears to have been introduced post RC0 ... see http://technet.microsoft.com/en-us/library/ff356871(WS.10).aspx and scroll down to the last entry under Unsupported filter definitions where it says "Sets cannot reference the membership of Group resources". As a consequence (even if you use /* instead of /Group) you will always get an "Access Denied" error. I think this may be "by design" for a number of reasons, but I too wish it wasn't because it would have saved an awful lot of effort in coding a custom workflow activity to maintain nominated groups with a corresponding set (matched through a schema extension of the Group object to include "MatchingSetID"). If you were sync'ing any other object with a ComputedMember attribute this would have worked ...Bob Bradley, www.unifysolutions.net (FIMBob?)

Unfortunately you've hit the same limitation I did some time last year ... FIM won't let you define a set in terms of the membership of a group. This is a limitation which I have pointed out before in this previous thread as follows ... No - unfortunately you CAN'T save this as a set definition (any more at least!), as it violates one of the rules about sets that appears to have been introduced post RC0 ... see http://technet.microsoft.com/en-us/library/ff356871(WS.10).aspx and scroll down to the last entry under Unsupported filter definitions where it says "Sets cannot reference the membership of Group resources". As a consequence (even if you use /* instead of /Group) you will always get an "Access Denied" error. I think this may be "by design" for a number of reasons, but I too wish it wasn't because it would have saved an awful lot of effort in coding a custom workflow activity to maintain nominated groups with a corresponding set (matched through a schema extension of the Group object to include "MatchingSetID"). If you were sync'ing any other object with a ComputedMember attribute this would have worked ...Bob Bradley, www.unifysolutions.net (FIMBob?)