I can not sync and provision due to the thousands of disconnectors that were created because we made a change to a SQL MA Anchor "SAMAccountID+EmailAccountName+LocalStudentID"..... we removed the "EmailAccountName"... imported , synced, and export failed and still fails due to the object already exists in the DS MA. If I turn off provisioning..Import/Sync from both DSMA and SQLMA.... I get 41k+ records in the Metaverse Search tab that have no errors in the preview from the SQLMA and I have 39k+ records under the Join tab as disconnectors which are all identical records from the 41k+ records. I am missing something. The sync/export will not complete because the the 39k+ already exist DN name. How do I join or mesh or delete??? What do I do to these 39k+ records so I can move forward? Note: I have deleted connector spaces multiple times. And I have Imported/Synced in many different was to see if I get a different result. tlight

Hi There, This sounds like you need to configure the join rules. If you have all the SQL objects projected into the metaverse (as it appears is the case when you disabled the provisioning rules), go into the DS MA and set up join rules for the user objects to join to the metaverse objects. Make sure the join criteria make sense and will give you a unique match (name information is generally a bad thing for this) Once you have the join rules set up, run a test on a couple of the entries in the AD MA using the Preview function (go into the connector space, pick one that was causing errors and run preview). If the join rules apply correctly, it should reattach itself as a connector back to the SQL entry you previously provisioned with that is now using the new anchor value. Thanks B

OK, well I is still saying Failed: Duplicate Object in the status on the previous sync students ones. the new students that have not provisioned yet get no errors. Now the stack trace refers to the Distinguished Name being a duplicate. "cn=abd123456, ou=student, ........" Now that you wrote the above and i am looking at the big picture of my project... SQL(Student Info) is the data source but do I need Join and Projection Rules on the on the ADMA. there wasn't a join or a project from that side, I just created the Join. Only a projection from the SQL? Would it help for you to see my mvextention... someone else wrote it I just changed the OU information in it!

Hi There, I don't really need to see your MV extension. The error code would be helpful. The join rules in AD are helpful in cases like this because the problems your having with the existing students are caused from the anchor changes which most likely disconnected and abandoned the entries in the AD MA. If you turn off provisioning and configure the join rules, then run a full sync from the AD MA, it should rebuild all those connections and allow you to continue. Post the error code so I can see exactly what the code is saying. We may be talking to different issues. The error code will certainly help focus the discussion. Thanks B

OK I was told not to run a sync from ADMA...? Let me try! thanks tlight

Ok with the rules i got very little change. Do the rules work .... if all conditions in one join rule apply==> join? or If any condition in one join rule apply ==> join Should I have more than one join rule? Hope that made since... i'm thinking in the AND/OR logic.... "if this and this and that ==> join" or "this or that or this ==> join" maybe i confused you more! :) Laughing! My brain is fried!

Blain, In response to your request:: "Post the error code so I can see exactly what the code is saying. We may be talking to different issues. The error code will certainly help focus the discussion" OPERATIONS Tab:: one of the flow error objects. SQL Full Sync selected ======================================================================================== On the Connector Space Oject Properties>> SQL Import Tab.. looks good.. all add.. no old value... all new value ... looks good. Synchronization Error TAB.. SQL MA error = extension-dll-exception synchronizationstep = provisioning Latest/Intial Occurences = time stamped 20 mins apart. Retry Count = 1 extension name = mvextension.dll extension rule = provisioning STACK TRACE :: Microsoft.MetadirectoryServices.ObjectAlreadyExistsException: An object with DN "CN=abc12345,OU=High School,OU=Students,DC=cherokee,DC=k12,DC=ga,DC=us" already exists in management agent "SIStoAD". at Mms_Metaverse.MVExtensionObject.Provision(MVEntry mventry) PREVIEW:: Source Object details looks normal :: status = projected. Join and Project :: Projected Declared Person Import Attribute Flow :: Has exactly what I setup in the MA Provisioning Summery:: Operation>> Add DN>> "CN=abc12345,OU=High School,OU=Students,DC=cherokee,DC=k12,DC=ga,DC=us" MA>> SQLMA Status>> Duplicate Connector ADD under provisioning summary shows the "Failed: Duplicate Object" ================================================================================================ FYI: in this order i am running Full import on both SQL and AD Full Sync on both SQL and AD (normally only SQL because I was told not to sync AD) Then I usually export the ADMA but have not since I've been getting this error on the sync of SQL. Hope this is not confusing or too much! Thanks tlight

Hi There, The join rules that are configued on one screen and show up in the interface as a numbered rule set are "ANDed" together. All criteria have to match. The individual rule sets that are numbered are "ORed" together. You may only need one join rule. My best practise is to have two or more as it takes fat finger issues on the data entry from the source system out of contention. Thanks B

You posted this while I was replying to the last one I guess. :) Anyway, the error your getting is definitely the MVExtension doing the provisioning to the new MA. Try configuring join rules that do something like this: cn=cn sAMAccountName = accountName (or whatever attribute you're using to store your account name). Thanks B

Ok then i have mine correct... I have three individual rules in three different numbers... so those are ORed ! Cool! tlight

I thought about that earlier and I didn't see it on the source side... so I over looked it!!! :) I just added the attribute... just got for the first time 40k+ updates !!!!!!! i will let you know!

Alright I just ran the import and sync just on the ADMA and the preview results are No Match on any of the criteria for the join! I have used UPN, sAMAcountName, studentID, and CN ...... NOTHING!!! :) Yikes. tlight

You need to find out why the objects in AD won't join up with your objects in the metaverse. Check the disconnectors in the Joiner tool and double click on one of the users and use "Preview" to verify the data is joining. If it isn't you need to figure out why. Another way to do it is to set up "search criteria" in the joiner (bottom pane) so that you can test to see if a search brings up a matching entry in the MV. I'm beginning to think you have duplicate MV entries. (But lets check it out and see) Thanks B

The preview for join says "no match" all the way down. I also tried that metaverse search filter option.. no results on any. I tired quite a few both ways.

We went back and added the anchor backin and we still get the errors. Is there an option to delete all the metaverse/CS space to sync what is in AD and what is in SQL from SIS.... go from there. I don't really understand what that does to FIM. My thought is... senerio: "What if I was new customer to FIM, all my users where in the system and I wanted to sync and allow FIM to take over from there would that not be the same?" Get everybody where they need to be and then redeploy? 95% of the users or more went on the first export to AD! tlight

Hi There, I may have been looking at the wrong side of this equation. Can you look in the synchronization engine in the Tools menu and select Statistics? That will give an idea of how many Metaverse entries you have versus how many connectors you have in each MA. I'm beginning to wonder if the SQL server objects that already are present in the AD MA are still linked to the OLD entries in the MV. If this is the case we should see at least 2 times the number of entries in the MV rather than a one to one mapping from SQL. Note: My assumption is a fairly simple system with SQL and AD MA. You'll have to translate the math accordingly however, if your total contributing sources for entries into the MV are higher than the number of entries in that MA, we will need to do some cleanup. Thanks B

I was able to look and the stats and the number of object deferences are accurate with the number of new enrollements from yesterday and day before. AD MA has 40,785 objects 40,712 disconnectors SQL MA has 41,088 objects 41,018 disconnectors 70 total connectors from both So if I go to the Metaverse search and search with no clauses I get 70 records and if I go to the join tab I get 40,712 disconnectors. I don't think I have massive amount of extra data... i think i just don't have joins . I am also beginning to wonder since I am such a newbie... do i have something set wrong with the data. So this morning I even had the attributes from the SQL side renamed so they are all the same all the way through.. did change things... which leads me to a questions do I have to have a CN form SQL to match UP with the CN coming from AD. Kinda thought UPN, samaccount name would work? tlight Note: I looked at your website! Do you do consulting?

Hi There, There are only 70 objects in your metaverse. How interesting is that because it would seem that something is preventing the objects from being pushed into there. Turn off the provisioning again (Tools->Options) and run a full synchronization on SQL and check the numbers again. Thanks B PS. Yes, I am a consultant that works at Edgile. http://www.edgile.com

With it off my projections just went boom.. still processing! at 20275 so far! I guess this is a good thing?

Yes, a very good thing. Once it completes, our next step will be to run a full synchronization on the AD MA (assuming the join rules are still configured there?) Hopefully at that point everything will link back up for you. Thanks B

joins are are there way up!!!! First time for that! I guess I was doing the syncs in the wrong order?

Once the joins have completed, see if the numbers seem to coincide well enough. There should ideally be no disconnectors left in AD (save for the structural objects). Then turn on the provisioning code again and run a full sync on SQL. Thanks B

Blain, You are the man! Thanks for all your help I plan to close this one as resolved. The additional things I need are way beyond the scope of technet. I still have to really learn how to use this product. I need to understand the extensions and portal and........ Until next time, Hope you get a Gold soon 8 Bronzes isn't enough! thanks again tlight