Ad Fs Deployment.docx

How to install ADFS on Windows server 2016

In this guide we will go through ADFS installation on windows server 2016. Before we install ADFS we have to obtain ADFS certificate. You can use certificate mmc to create new certificate request. You have to put all SAN entries which you are going to use in certificate and ADFS. Once you have certificate, import that ADFS server and make sure you have private key for that certificate. After certificate import follow below steps to install ADFS role on windows server 2016. Windows Server 2012 domain controllers (DC) and later versions require a root key to begin generating gMSA passwords. The domain controllers will wait up to 10 hours from the time of creation, to allow all domain controllers to converge their Active Directory replication before allowing the creation of a gMSA. The 10 hours is a safety measure to prevent password generation from occurring before all the domain controllers in the environment can answer the gMSA requests. If you try to use a gMSA too soon, the key might not have been replicated to all the Windows Server 2012 domain controllers and therefore password retrieval might fail when the gMSA host attempts to retrieve the password. gMSA password retrieval failures can also occur when using domain controllers with limited replication schedules or if there is a replication issue.

The Add-KdsRootKey cmdlet generates a new root key for the Microsoft Group Key Distribution Service (KdsSvc) within Active Directory (AD). The Microsoft Group KdsSvc generates new group keys from the new root key. If you don’t want run below:Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)

Install ADFS role:Login on Windows server 2016 and open server manager. Under server manager click on add roles and feature. Under Server roles select ADFS role. Click on next and don’t select anything on features page. Click next and Close it.

Configuring ADFS: After installation click on Configure the federation service on this server. If you are installing first ADFS server then select first option. If you are installing additional ADFS server then select second option. In second page you have to provide domain administrator account. On third page select certificate which you imported and make sure that ADFS service name is correctly showing based on certificate SAN name. Put ADFS display name (Usually it will be your company name which will show on ADFS login page to end users). On next page choose a group managed account for ADFS. On next page select database store where you want to store ADFS configuration database. It can be WID or SQL. I choose WID in this case. On next page click on configure and configuration will began. It will take some time in completion.

If you see a warning for set spn for the specified service account then run below to set spn . Here server name will be your adfs farm name. setspn -a host/<server name> <service account> For e.g setspn -a host/adfs.testlab.com gmsa_adfs

Using powershell to install ADFS:-

# # Windows PowerShell script for AD FS Deployment #

Import-Module ADFS

Install-AdfsFarm ` -CertificateThumbprint:"3C27DD6A78E2A0DC5F4366FBD0DAF8327036ED68" ` -FederationServiceDisplayName:"Testlab ADFS" ` -FederationServiceName:"ADFS.testlab.local" ` -GroupServiceAccountIdentifier:"TESTLAB\gmsa_adfs`$"

Using powershell to addd additional ADFS farm node:-

# # Windows PowerShell script for AD FS Deployment #

Import-Module ADFS

Add-AdfsFarmNode ` -CertificateThumbprint:"3C27DD6A78E2A0DC5F4366FBD0DAF8327036ED68" ` -GroupServiceAccountIdentifier:"TESTLAB\gmsa_adfs`$" ` -PrimaryComputerName:"adfs1.testlab.local"