1

I'm facing a problem after I have installed and configured the User Profile Service.

When I create the synch everything work fine but now the system floods active directory with wrong credential (I suppose) and this make AD lock the account...

Any suggestion? I remember I can see the AD folders so I think credentials are right..

Improve this question

2 Answers 2

Reset to default
2

Two things are absolutely critical with UPS... permissions, and doing the configuration in the right order. Spence Harbar has the 'gold standard' guide on how to setup UPS... follow it to the letter.

Remember that when FIM is provisioned, it does so under the farm account, but the service should execute as another identity, and the synchronization as a dedicated synchronization identity. If the service account is changed (via Central Admin -> Configure Service Accounts) at any time after FIM has been configured and setup, you likely will need to reconfigure/reprovision UPS (it's just not very forgiving).

If you're seeing a flood of hits that result in the account being locked, it's entirely possible that the service running FIM has the wrong credentials (that's a managed account, so you can reset the password via CA). It's also entirely possible that the physical sync account (not a managed account) has either the wrong credentials, or not the correct delegated authority to Active Directory.

Are you doing one way sync, or bi-directional sync?

You can also run the FIM management console on the box running the UPS service, and review the FIM logs to see where it's blowing up.

Improve this answer
4
  • Thank you very much! Now I try to follow the guide.. I think I need only one way.. I'm a real newbye in config services!
    – Ziba Leah
    Jun 14, 2012 at 13:53
  • 1
    Follow Spence's guide to the letter and you won't have any issues :-)
    – webdes03
    Jun 14, 2012 at 13:58
  • Mmm I'm facing a problem: I created all, services are running but even if I see users from people picker and from "configure synch" when I search with Manage User Profile it tells me I have 0 account even if I do a full synch! Any suggestion?
    – Ziba Leah
    Jun 14, 2012 at 14:49
  • 1
    Seeing users in the people picker is completely unrelated to UPS Sync. Have you selected containers on the configure profile connections page? If it's running a full sync and not pulling users in, it is likely blowing up during the connection to AD... check AD delegation of the Sync account.
    – webdes03
    Jun 14, 2012 at 15:54
1

It is most likely the account you chose at the time of Sync Connection. The page does not validate the password, it just checks that the two boxes are the same.

M

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.