Active Directory Ports/Protocols between Firewall's/L3/4 Boundaries

If for whatever reason you have to have Domain Controllers separated by firewalls you will require the following ports and protocols allowed between the DC's to ensure you can A.) join the domain and B.) maintain a healthy Active Directory with replication etc.

LDAP TCP-in - 389
LDAP UDP in - 389
LDAP for Global Catalog TCP in - 3268
NetBIOS name Resolution UDP in - 138
SAM/LSA TCP in - 445
SAM/LSA UDP in - 445
Secure LDAP TCP in -  636
Secure LDAP for Global Catalog TCP in - 3269
W32Time NTP UDP in - 123
RPC - RPC Dynamic
RPC Endpoint Mapper
DNS - TCP and UDP 53
Kerberos V5 UDP in - 88
Netbios Datagram UDP in - 137

There are multiple ways to have Active Directory extended to none-trusted networks. Since Windows Server 2008 R2 the option to have a Read Only Domain Controller (RODC) in an un-trusted network has proved attractive to business. This ensure that if the un-trusted network is compromised, the RODC only holds a replicated copy of the Active Directory database. Even if the RODC was taken offline and attacked, no "write back" to Active Directory is possible so the impact is minimal. 

Depending on your requirements options such as Active Directory Federation Services (AD FS), DirSync, FIM 2010 R2 and Microsoft Identity Manager 2015 (MIM) can all be good solutions for identity and access management in an Active Directory environment.

FIM 2010 R2 SP1: Inbound Sync Rule CustomAttributes Script "DomainObjectSid_IFFSStatement.ps1" script provided by The FIM Scriptbox. "Error: Could not find a forest identified by: 'domain'."

After reviewing the Microsoft guide "Syncing Active Directory with FIM", I got to the stage of populating the Synchronization Rules using the FIM Portal. In the guide the following section outlines how you must generate a CustomExpression string.

 

How to Sync Active Directory with FIM.

http://technet.microsoft.com/en-us/library/ff686264(v=ws.10).aspx

The FIM Generate CustomExpression for Domain Attribute Flow Script (PowerShell) https://social.technet.microsoft.com/Forums/en-US/50088024-d86a-49dc-bb03-3243ebd677eb/using-powershell-to-generate-the-custom-expression-for-the-domain-attribute-flow?forum=ilm2

As the domain I was trying to sync with Active Directory was Windows Server 2003 based, which does not natively have PowerShell (or the AD DS PowerShell cmdlets) I used a Windows Server 2012 R2 VM with the AD DS server role installed.

At first I had to reconfigure the ExecutionPolicy to allow Unrestricted scripts. I then tried to run the DomainObjectSid_IFFSStatement.ps1 script provided by The FIM Scriptbox. I received the error Error: Could not find a forest identified by: 'domain'.

To recognize where in the code the script was failing I opened the script in the PowerShell ISE and selected small sections of the code and used the Run Selection button to break out where then the code encounters an error.

 

In this instance it was on Line 10 $ForestObject = Get-ADForest that was causing the script to fail. At first I thought it was a DNS issue that was causing the issues so I did all the usual things and could not find anything.

The fix in this case was to configure the Active Directory Web Services service to start Automatically on the system starting. Once I did this and re-run the script it generated the required CustomExpression string I needed to continue.

Forefront Identity Manager 2010 R2 (FIM) portal "Service not available."

When you try to access the FIM 2010 R2 portal you receive the following screen stating that "Service not available. Please contact your help desk or system administrator."

 

In the Event Logs there is a continuous error "Event 3, Microsoft.ResourceManagement" in the error states that "System.Net.WebException: Unable to connect to remote server ---->" and "No connection could be made because the target machine actively refused it 10.25.1.40:433." That IP was actually one of my Domain Controllers, so I disabled the Windows Firewall to see if it would resolve the error. No change unfortunately.

 

After a bit research with some travling through TechNet blogs I came across this link which is "A hotfix rollup package (build 4.1.3508.0) is available for Forefront Identity Management 2010 R2" http://support.microsoft.com/kb/2913228/en-us although my issue was not directly mentioned in th More Information section I though it would be best to install the updates for the components I had deployed.

 

I installed FIMSyncService_x64_KB2913228.exe first.

 

Then FIMService_x64_KB2913228 secondly.

After the second patch was applied the FIM portal then started to work.

 

FIM 2010 R2 SP1: Password Registration and Reset Portals Service Principal Names (SPN's) and Kerberos Delegation

If you complete the installation of Forefront Identity Manager 2010 R2 SP1 and do not manually create the Service Principal Names (SPN's) and configure Kerberos delegation when you try to browse to the Password Registration and Reset sites you will receive a cannot display website page, much like the IIS service has stopped or the ApplicationPool is not functioning correctly.

 

 

http://technet.microsoft.com/en-us/library/jj134295(v=ws.10).aspx

 

The following commands can be run on a Domain Controller to created the required SPN's, you must state the FQDN for both the Password Registration and Password Reset websites. You must also set the SPN for the FIM Service Account you have used throughout installing FIM.

setspn –s  HTTP/FQDNpasswordregservice DOMAIN\fimserviceaccount

 

setspn –s  HTTP/FQDNpasswordreset DOMAIN\fimserviceaccount

 

Some applications such as SQL Server automatically generate SPN's when they are installed this is not the case with this component of Forefront Identity Manager, however if you receive an error "Duplicate SPN: Operation Cancelled" from the setspn.exe, you can use the following command to display all the SPN's associated with a particular object.

setspn –l DOMAIN\computer or user object

 

Once the SPN's are created when you try to browse to the portal's you will see they are now starting to respond, you will receive the credentials box like below as Kerberos Delegation has not been configured. Delegation of authentication allows the client to send it's identity in the form of a Kerberos ticket to the front-facing web server. The front-facing web server can then relay the ticket to "back-end" servers to authentication requests.

 

Open the web.config file for the FIM Password Registration and Reset portals which can be found at C:\inetpub\wwwroot\wss\VirtualDirectories\80, you can open the file with Notepad.

Press CTRL + F to bring up a find window and type <resourceManagementClient and click Find. This will take you to a string in the web.config file you must edit.

 

The following string of text must be added to that line of the code requireKerberos="true". Once completed the entire string should read something like;

 

<resourceManagementClient resourceManagementServiceBaseAddress=http://FIMSERVER:5725 timeoutMilliseconds=”60000” requireKerberos=”true” />

 Next open up CMD and do an iisreset.

Now when you attempt to connect to the FIM Password Registration and Reset portals you should now see the splash screens.

FIM 2010 R2 SP1: Creating Management Agents to Active Directory Forest fails with "failed-connection Error Server Down Error Code 0x51"

When you try to create a new Management Agent from Forefront Identity Manager (FIM) 2010 R2 you get the error "failed-connection Error Server Down Error Code 0x51". This error was basically stupid of me and down to name resolution between the two domains. The FIM server was in the new 2012 R2 Active Directory and it could not resolve DNS names in the forest I was trying to configure FIM to query.

 

 

The fix was to enable Zone Transfers (in this case to To Any Server), on the source Active Directory DNS server.

 

From the new Active Directory DNS server I then created a new Active Directory Secondary Zone, which I pointed to the IP of a known Domain Controller in the source AD. Because I configured Zone Transfers the Secondary Zone was immediately populated.

 

From the FIM server I flushed the DNS cache and click Next again. I could then continue creating the Management Agent.

 

FIM 2010 R2 SP1: Installing FIM Password Portal and FIM Reporting "The SharePoint 2010 Administration Service is not running. Please start it and then click "Retry". Click "Cancel" to abort setup."

After going through the massively complex installation process of Forefront Identity Manager Installation wizard for the Password Reset portal and the Reporting Services components you receive the following error "The SharePoint 2010 Administration Service is not running. Please start it and then click "Retry". Click "Cancel" to abort setup." it's pretty self-explanatory as an error. Basically the SharePoint 2010 Adaministration Service is not running on the SharePoint Server (which in this case also the FIM server).

 

 

I had forgot to reconfigure the SharePoint 2010 Administration (or SPAdminV4) service to start Automatically, I did the manually from the services.msc MMC.

 

After this I clicked Retry and the setup continued.

Forefront Identity Manager 2010 R2 SP1 (FIM): Connection to SQL Server 2008 R2 for FIM Sync Service "Connection Failed: SQL State: '08001' SQL Server Error: 5 Could Not open a Connection to SQL Server [5]. Connection Failed: SQLState: 'HYT00' SQL Server Error: 0 [Microsoft][SQL Server Native Client 10.0]Login Timeout Expired"

Recently I have been building a FIM 2010 R2 SP1 Sync Service Server using an external SQL instance running on SQL Server 2008 R2. When I was creating the ODBC Data Source using the SQL Server Native Client 10.0 I receieved the following error "Connection Failed: SQL State: '08001' SQL Server Error: 5 Could Not open a Connection to SQL Server [5]. Connection Failed: SQLState: 'HYT00' SQL Server Error: 0 [Microsoft][SQL Server Native Client 10.0]Login Timeout Expired".

 

 

The solution here was to enable TCP/IP from the SQL Server Configuration Manager to do this launch the SQL Server Configuration Manager MMC expand SQL Server Network Configuration and click Protocols for MSSQLSERVER right click and select Properties on the TCP/IP protocol. From the Properties window click IP Addresses using the Active drop downs select Yes for IP1 and IP2. Click OK.

 

For the changes to apply you must restart the SQL instance to do this click on SQL Server Services from the left hand list, right click SQL Server (MSSQLSERVER) and select Restart.

 

To finish off open the SQL Management Studio and login using Windows Authentication.

 

Right click on the top (local) database icon and select Properties.

 

Click on the Security tab and change the Server Authentication to SQL Server and Windows Authentication Mode. Click OK.

 

Again the SQL Server must be restarted. In this instance I rebooted the entire server.

 

Once this has been done you can continue with the ODBC Data Source Connector.

Forefront Identity Manager (FIM) Synchronization Service Evaluation is having trouble contacting SQL server using the provided information. Please note that Forefront Identity Manager Synchronization requires Microsoft SQL Server 2008 SP1 or better. Verify the version, server and instance names as well as firewall.

When you try to install the Forefront Identity Manager (FIM) 2010 R2 SP1 Synchronization Service to use an off-box SQL Server instance you receive the following error "Forefront Identity Manager Synchronization Service Evaluation is having trouble contacting SQL server using the provided information. Please note that Forefront Identity Manager Synchronization requires Microsoft SQL Server 2008 SP1 or better. Verify the version, server and instance names as well as firewall."

 

 

In this particular instance FIM 2010 R2 SP1 is running on Windows Server 2008 R2 and the SQL Server is Windows Server 2012 R2 with SQL 2012 Standard. As with all off-box SQL instance I had created a ODBC (64-bit) from the FIM server, to the SQL. When I tested connectivity it all came back as working.

As part of the troubleshooting I tried the following things without success

·      Connectivity and Name Resolution

o     Ping and Nslookup

·      SQL Services

o     Ensured SQL Server Browser and SQL Server Agent were set to Automatic and Running

·      Disabled the SQL Server Firewall

o     To rule out any issues with port 1433, then tried Telnet all OK

Although all of these tests came back positive the issue was not resolved. The issue was with the SQL ODBC connection from FIM to SQL. I had created the ODBC using the standard SQL Server Client build into Windows Server 2008 R2.

The fix was to install the SQL Server 2012 Native Client, which can be downloaded from Microsoft http://microsoft.com/en-gb/download/confirmation.aspx?id=29065

 

Once I recreated the ODBC connection with the SQL Server 2012 Native Client the setup then allowed me to continue, the next step was to configure the FIM security groups.