I'd like to add a statement "Only People, whose EmployeeEndDate is not less than today" to my security groups. I did a set "EndDate gone" with a statement "EmployeeEndDate prior to today" Then I added the following statement to my security group: "Resource ID not in EndDate gone" Then FIM says that request failed (Microsoft.ResourceManagement: Procedure: CreateMembershipConditionStatement. Line number: 533. Message: Invalid membership condition statement de-referenced value..) BUT If I do not add any statement to the set "EndDate gone" (so the filter is just /Person), I do not get the error and I can add the statement "EmployeeEndDate prior to today" to the set afterwards and everything works fine. What is this? Are there any other ways to solve this problem?

Why don't you put both conditions in the the same dynamic definition? That should work since you'd be eliminating a level of defererencing. The limit on the amount of dereferencing was put in for performance reasons.Eric

I would but FIM won't let me (it says: System.InvalidOperationException: This negation filter is not supported) this works: (EmployeeEndDate < fn:current-dateTime()) but this doesn't: not (EmployeeEndDate < fn:current-dateTime())

>Then I added the following statement to my security group: "Resource ID not in EndDate gone"Nesting a temporal set (set with a DateTime based condition) is not supported, and neither is having a nesting condition in a temporal set."EmployeeEndDate is not less than today" is logically equivalent to "EmployeeEndDate is greater than or equal to today".So, instead of not (EmployeeEndDate < fn:current-dateTime()), use (EmployeeEndDate >= fn:current-dateTime()).

Thanks for your reply. I tried (EmployeeEndDate >= fn:current-dateTime()), but some users don't have EmployeeEndDate, so i guess only not (EmployeeEndDate < fn:current-dateTime()) would work