Failed to configure ILM, will attempt during next rerun.

Question

I am setting up a brand new SP2010 farm. The FIM service fail to start. In log I found following. May I know how can I troubleshoot it?

ILM Configuration: Setting file permissions.

ILM Configuration: Opening firewall ports.

ILM Configuration: Starting services.

UserProfileApplication.SynchronizeMIIS: Failed to configure ILM, will attempt during next rerun. Exception: System.FormatException: Index (zero based) must be greater than or equal to zero and less than the size of the argument list. at System.Text.StringBuilder.AppendFormat(IFormatProvider provider, String format, Object[] args) at System.String.Format(IFormatProvider provider, String format, Object[] args) at Microsoft.Office.Server.Administration.ProfileSynchronizationServiceInstance.IsStarted(ServiceController controller) at Microsoft.Office.Server.Administration.ProfileSynchronizationServiceInstance.WaitUntilStarted() at Microsoft.Office.Server.Administration.UserProfileApplication.SetupSynchronizationService(ProfileSynchronizationServiceInstance profileSyncInstance). 15ed543a-cc12-44fe-81ea-144eca1b2a91

I have read through harbar's site and I cannot find article related with this error.

The server do not have Internet access and following sites are blocked. crl.microsoft.com ctldl.windowsupdate.com ctldl.windowsupdate.nsatc.net www.update.microsoft.com.nsatc.net However, I have other farms also do not have Internet access but they can start FIM. Is any workaround required?

Answer 1

Check if the fim service has some dependency set 1. Check for dependency on FIM service . Go the service console> fim service > right click propeties, if there is any dependency mentioned then that is problem. Now remove it via regkey 2. Increase the service start time out

Read this for complete steps

Answer 2

As mentioned in question, our farm do not have Internet access while Microsoft always assume you have. The ILM error is caused by service try to update root cert from Microsoft server and fail (blocked by our firewall).

The problem is resolved by Option 5 in this blog post. It is to disable the automatic update of root certificates on the SharePoint Servers. Here is the steps:

1. Launch gpedit.msc as admin on the SharePoint server
2. Look for Local Computer policy > Windows Settings > Security settings > Public Key Policies
3. Open Certificate Path Validation Settings, in the Network retrieval tab check "Define the policy settings" and uncheck the option to "Automatically update certificates in the Microsoft Root Certificate Program (recommended)."
4. Run gpupdate /force