I'm trying to clean up a UPA which has thousands of unncesseary objects (like shared mailboxes, resources, etc). It really makes the People search experience unplesant as so much junk gets returned. I have a few filters like "Disabled Users" (bit on equal = 2) and msExchHideFromAddressList = true, to help but there is still heaps of rubbish. Everything has been classed in AD as "users" unfortunately, but what I found I can do it just pick the 100 or so OUs called "users" (which actually just contains real people) in the connection section of UPA and just "include" them in the Container and exclude everything else. Trying to do this 100 times in the container section of "edit connection filters" is painfully slow. So I have exported the XML from FIM via "Export Management Agent" (miisclient.exe). I ran an AD query to just return my OUs (Distinguished Name) with "User" and copy/pasted that back into the export file, but I did it to save me about a day in clicking and waiting. Import the xml file back in, refresh the scheme and done. The only disconcerting part is this warning, and we all know not to muck around with UPA and FIM too much, so I'm justified in my apprehension.
<!--WARNING>
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!
!! The contents of this file should not be edited.
!! Any such modifications to this file may result in errors during import.
!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
</WARNING-->
So my question is, ..has anyone had any negative experiences with Updating the Management Agent in FIM 2010? So far I have successfully run an incremental sync but I just want to be sure this is OK and supported by MS (you would think it would be give they give us the option there).
One other question I have is, ...is there any reason one would want to sync in anything other than users into the UPA? I was under the impression all security groups were not sourced via FIM and the fact that I am now not bring in anything but users might compromise selecting groups for permission for lists etc. However there is that setting in "Configure Synchronisation Settings" ... "Synchronisation Entities".."Users and Groups" - is it this setting that is handling the importation of my AD security groups?
Cheers.
