On PAMSRV, sign in as PRIV\Administrator to be able to install MIM Service and Portal and the sample portal web application.
You must be a domain administrator; if you are not running the following commands as a domain administrator, the trust validation checks in the next step will not be completed.
If you have downloaded MIM, unpack the MIM installation archive to a new folder.
Run the Service and Portal install program.
Follow the guidelines of the installer and complete the installation.
When configuring common services and the MIM database connection, specify Create a new database.
If you install MIM Service multiple times for high availability, specify Use an existing database for all subsequent installations.
When configuring a mail server connection, set the mail server to the hostname of an Exchange or SMTP server for the CORP environment (use corpdc.contoso.local if you do not have a mail server) and uncheck the Use SSL and Mail Server is Exchange Server 2007 or Exchange Server 2010 checkboxes.
Choose to generate a new self-signed certificate.
Accept the defaults for the synchronization server hostname and specify the MIM Management Agent account as PRIV\MIMMA. A warning message will appear that the MIM synchronization service does not exist. This is OK, since the MIM synchronization service is not used in this scenario.
Set PAMSRV as MIM Service server address.
Set http://pamsrv.priv.contoso.local:82 as the SharePoint site collection URL.
Leave the registration portal URL blank.
Select the checkbox to open ports 5725 and 5726 in the firewall, and the checkbox to grant all authenticated users access to the MIM portal site.
Leave the PAM REST API hostname empty, and set 8086 as the port number.
A warning may appear that the Service Account is not secure in its current configuration. That's OK.
On the Enter Information for MIM Password Portals page, leave checkboxes empty and continue. Click Next to continue the installation.
After installation completes, the server will reboot, then verify that the MIM Portal is active and enable users to view their own object resource in MIM.
After PAMSRV reboots, sign in as PRIV\Administrator.
Launch Internet Explorer and connect to the MIM Portal on http://pamsrv.priv.contoso.local:82/identitymanagement. There may be a short delay the first time this page is located.
If necessary, sign in as PRIV\Administrator for Internet Explorer.
In Internet Explorer, open the Internet Options, change to the Security tab, and add the site to the Local intranet zone if it is not already there. Close the Internet Options dialog.
Using Internet Explorer to view MIM Portal, click on Management Policy Rules.
Search for the management policy rule User management: Users can read attributes of their own.
Select this management policy rule, uncheck Policy is disabled, click OK, and then click Submit.
The firewall should allow incoming connections to TCP port 5725, 5726, 8086 and 8090.
Launch Windows Firewall with Advanced Security (located in Administrative Tools).
Click New rule > Port > TCP, and type the specific local ports 8086 and 8090. Click through the wizard accepting the defaults, give the rule a name, and click Finish.
After completing the wizard, close the Windows Firewall application.
Under Network and Internet select View network status and tasks.
Verify that there is an active Network which is listed as being priv.contoso.local and a Domain network.
In this section you will install and configure the sample web application for the MIM PAM REST API.
From the sample web application archive, download the Identity Management samples as a zip file.
Unpack the contents of the folder identity-management-samples-master\Privileged-Access-Management-Portal\src into a new folder C:\Program Files\Microsoft Forefront Identity Manager\2010\Privileged Access Management Portal.
New-WebSite -Name "MIM Privileged Access Management Example Portal" -Port 8090   -PhysicalPath "C:\Program Files\Microsoft Forefront Identity Manager\2010\Privileged Access Management Portal\"
Configure the sample web application. Using a text editor such as Notepad, edit the file C:\Program Files\Microsoft Forefront Identity Manager\2010\Privileged Access Management Portal\js\utils.js. Set the value of pamRespApiUrl to http://pamsrv.priv.contoso.local:8086/api/pamresources/.
Restart IIS with the following command for these changes to take effect.
(Optional) Verify that the user can authenticate to the REST API. Open a web browser as the administrator on PAMSRV. Navigate to the web site URL http://pamsrv.priv.contoso.local:8086/api/pamresources/pamroles/, authenticate if needed, and ensure that a download occurs.
Install the MIM PAM requestor cmdlets on the workstation configured in Step 1.
Sign in to CORPWKSTN as an administrator.
Download the Add-ins and extensions to the CORPWKSTN computer, if not already present.
Unpack from the archive the folder Add-ins and extensions to a new folder.
On the custom setup, specify the PAM Client is to be installed, but not the MIM Add-in for Outlook or the MIM Password and Authentication Extensions.
On the PAM Server address, specify as the hostname of the PRIV MIM server pamsrv.priv.contoso.local.
After the installation completes, restart CORPWKSTN to complete the registration of the new PowerShell module.
In the next step, you will establish trust between PRIV and CORP forests.