Migrating ILM 2007 database to FIM 2010 R2 fails while "Converting representation of references"
My first attempts to "upgrade" my test environment from ILM 2007 FP1 (build 3.3.118.0) to FIM 2010 R2 have met with some resistance. Is R2 supposed to be able to upgrade the database going back that far? I haven't been able to find a document that clarifies it. The database is at compatibility level 90. The FIM 2010 R2 server is on a VMware guest (Server 2008 R2) with 1GB RAM and the SQL Server 2008 R2 instance is on a separate virtual server with 4GB. The ILM installation was physical and has 12 MAs configured, one of which I know is not compatible with FIM and I planned on deleting it after the migration. I do some group management via a custom SQL MA, so I know there are a lot of references mapped. I have ~50k users mapped into 160 groups (mostly 5k or less per group), and a total of 145k metaverse objects. After following the steps laid out in Migrating from ILM 2007 to FIM 2010 steps 1-6, it finds the database and begins to upgrade it after giving me cautions about reusing it and having to do significant updating. I've repeated the install a couple of times, the last time executing with msiexec so I could get a verbose install log. The following snippet indicates when the trouble starts: Action 13:47:16: ConfigDB. Converting representation of references Action 13:47:45: ConfigDB. Converting representation of references Action 13:50:58: ConfigDB. Converting representation of references Action 13:53:33: ConfigDB. Converting representation of references Action 13:54:17: ConfigDB. Converting representation of references Action 13:57:26: ConfigDB. Converting representation of references Action 14:00:20: ConfigDB. Converting representation of references Action 14:01:35: ConfigDB. Converting representation of references Action 14:04:51: ConfigDB. Converting representation of references CustomAction ConfigDB returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) Action ended 14:07:32: InstallFinalize. Return value 3. MSI (s) (68:1C) [14:07:32:977]: User policy value 'DisableRollback' is 0 MSI (s) (68:1C) [14:07:32:977]: Machine policy value 'DisableRollback' is 0 MSI (s) (68:1C) [14:07:32:977]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1087329585,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) MSI (s) (68:1C) [14:07:32:977]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (68:1C) [14:07:32:977]: Executing op: DialogInfo(Type=1,Argument=Forefront Identity Manager Synchronization Service) MSI (s) (68:1C) [14:07:32:977]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) Action 14:07:32: Rollback. Rolling back action: Rollback: Configuring SQL database Has anyone else seen this? How can I further troubleshoot the upgrade process? There doesn't seem to be much information in the system or application logs to shed additional light. I would probably have an easier time exporting the ILM server configuration and importing it on a fresh, new metaverse. But I'd like to see if I can preserve all the metadata about the existing identities. It is useful in troubleshooting certain problems that really don't have anything to do with the sync engine itself. Thanks! Chris
June 15th, 2012 3:47pm

I've got the same error in my test environment, upgrading from 4.0.3606.2 to FIM 2010 R2. Reported it to Microsoft, but no feedback yet.
Free Windows Admin Tool Kit Click here and download it now
June 18th, 2012 4:16am

Fairtec, thank you for the sanity check. It is comforting to know I'm not alone. How/where did you report it to Microsoft, and have you heard anything from them yet? I ended up trying the import of the server configuration on top of a fresh, new metaverse and got a similar problem with the AD MA regarding Exchange to that reported in this thread. I'd be curious to see if the same problem appeared if I was actually able to upgrade the database. I'm starting to wonder if the MA that is not supported on FIM (Windows Live MAv3) needs to be deleted in ILM prior to the database being copied to SQL Server 2008 R2 and FIM installed on top of it, rather than after. Either that or the large managed security groups might be too much for the conversion process to handle, since there would be a lot of references to process in the SQL MA, the metaverse and the AD MA where those references are all maintained. If I have time I may do some additional testing, deleting MAs prior to the upgrade until the process completes. Chris
June 27th, 2012 10:10am

Today I tried the upgrade process again using a backup taken of the ILM 2007 database post-Windows Live MA deletion to restore to my SQL Server 2008 R2 instance for FIM and installing on top of that. The result was the same...after about 3.5 hours and exactly 411 lines that read Action [timestamp]: ConfigDB. Converting representation of references it gives up with the error 1603. I'm not sure I'm up for deleting my group management SQL MA to see if it is the number of references that are the problem. That would likely take an entire day itself. Chris
Free Windows Admin Tool Kit Click here and download it now
June 27th, 2012 4:30pm

Chris, According the Microsoft Escalation Engineer, they could reproduce the error in our case and a new installable version (no Hotfix) should be available by end of July/August. (problem in DB-Update process in some special situations)
June 29th, 2012 8:56am

fairtec, I am curious to know the escalation engineer that mentioned this fix as I have not heard of this fix, and am curious to know more about it. Tim Tim Macaulay Security Identity Support Team Support Escalation Engineer
Free Windows Admin Tool Kit Click here and download it now
July 19th, 2012 2:36pm

Hi Chris, Good detailed information! The first thing we need to cover is that moving from ILM 2007 to FIM 2010 R2 directly is not a supported path. You need to go to FIM 2010 first because of the huge schema changes that take place. You can find more information on Microsoft TechNet. Considerations for upgrading to FIM 2010 R2: http://technet.microsoft.com/en-us/library/jj134291(v=ws.10)#general_info Secondly, it is important to note that our install is very SQL Server intensive, as we is our use of SQL Server in general. If possible we do recommend a physical server for SQL Server, but virtual is good. However, that stated, I noticed that your SQL Server 2008 R2 only has 4 GB of RAM, and the FIM Synchronization Service machine only has 1 GB of RAM. The process that is actually happening during the installation is very SQL Server intensive in the process that it is actually doing. And the fact that you have 12 Management Agents, I would recommend that you look at your SQL Server being around 16 GB of RAM. To upgrade ILM 2007, you would need to follow these very high level steps: Upgrade your ILM 2007 FP1 to FIM 2010 RTM Upgrade your FIM 2010 RTM to FIM 2010 R2 Hope that helps.Tim Macaulay Security Identity Support Team Support Escalation Engineer
July 19th, 2012 2:49pm

Thanks for that, Tim! I guess I missed what was said by not saying it in the considerations for upgrading. My current testing activity is progessing having imported the ILM server configuration into FIM 2010 R2. Is that supported, or should I also be making a pit stop at FIM 2010 before proceeding to R2? As noted in this thread and also this one, the Exchange provisioning UI in the AD MA was broken after the server configuration import but I found what seems to be a decent workaround pending the testing of actual provisioning. Thank you also for the suggestions regarding SQL Server. My test environment isn't ideal but it is what I have available. I'll keep your recommendation in mind as I request the resources for production deployment. If there is time before I have to go live with FIM, I may try the two-step upgrade and see how that goes. Chris
Free Windows Admin Tool Kit Click here and download it now
July 19th, 2012 3:36pm

HI Chris So if I understand correctly, you executed these actions: Exported your ILM 2007 FP1 Configuration by File > Export Server ConfigurationInstalled FIM 2010 R2 against a clean backend databaseImported the ILM 2007 FP1 Configuration by File > Import Server Configuration If this is true, you find that the configuration imports successfully. However, what does not happen is the schema changes, and new FIM 2010 R2 changes. So essentially you are left in an environment where you have FIM 2010 R2, but with ILM 2007 FP1 Management Agents. The conversion code is only done through the installation process. Yes, there are some UI issues that we have seen with the AD MA that normally have been easily resolved by exporting the AD MA and re-importing the AD MA. In some cases, the AD MA must be re-created. The only way to keep your configuration is to go through the upgrade steps and convert the database and information along the way. The process that you were failing on at the top of this thread is a change in how we handle reference attributes. This is a huge change but in the end improves performance when working with reference attributes. Hope this helps. Tim Macaulay Security Identity Support Team Support Escalation Engineer
July 19th, 2012 3:48pm

As a character in one of my favorite Sci-Fi shows once said, "I do believe you have got it surrounded." My very next step, therefore, is to export and save everything as a backup (since I've replaced an incompatible MA with a compatible one and adjusted the provisioning code) and start fresh with the two-step upgrade. This is very helpful. Thank you again, Tim! Chris
Free Windows Admin Tool Kit Click here and download it now
July 19th, 2012 4:22pm

There is some confusing documentation out there. I wonder if someone isn't getting happy with the search-and-replace in the FIM 2010 documentation. From Migrating from ILM 2007 to FIM 2010 which was supposedly last updated in April 2010: "Installing FIM 2010 on your FIM 2010 R2 server by reusing the ILM 2007 database. " "While FIM 2010 R2 is completely compatible with ILM 2007, a migration from nondeclarative to declarative provisioning may require some changes to your current scenario." I'm starting on the two-step method now. I expect it will run into next week. Chris
July 20th, 2012 3:03pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics