Supporting very large SharePoint 2010 installations has allowed me the ability to delve deeply into something that I really wanted no part of, the User Profile Import System and FIM. Gone are the days of MOSS 2007, where you “Set it and forget it”. In large installations of SharePoint 2010, you’d better sharpen up your FIM skills.
So what’s the big deal? I mean, Microsoft has been selling FIM in several forms over the last decade, so they should be good at it, right? Right?
Here’s the rub: SharePoint guys are not FIM guys, and FIM guys are not SharePoint guys. Looking at how the FIM components are implemented in SharePoint 2010 leads you to believe that the FIM team at Microsoft were all out at a really cool beach party, and left the SharePoint guys to finish up. To quote a friend “What could possibly go wrong?”
If you are in an environment where there are a large number of AD users and AD groups, and let’s say the AD team decided to go insane and use nested groups, running a Full Sync in FIM could take anywhere from 5 days to the rest of your life. However, running incremental syncs will get you by only so long. There will come a time, probably sooner than later, where you will have to run a Full Sync to clear up issues you are seeing (like those pesky “Need-Full-Object” errors).
There is hope. I can’t tell you how, since it’s really (really really) unsupported, but if you contact Microsoft Technical Support and explain the issue, they will tell you how to run a Full Sync manually from inside of the FIM client. Running the Full manually stops the long-running issue where nested groups cause stages of the import to run forever. So, if you are the admin of a very large SharePoint system, and the AD system you are importing from is massive, and you’re seeing very long Full Sync run times, let Microsoft know. Tell them I sent you, they love that.
Oh yeah, if you’re lucky, I may just share a PowerShell script that will do this for you. Staying up for 3 days straight to execute the next step, then the next step, in a manual Full Sync is good for no one. My dog didn’t talk to me for 2 days after the last one…