Steps and procedure when upgrading ADFS to Windows Server 2016 with no outage?

EnterpriseArchitect 4,721 Reputation points
2020-06-17T06:49:04.837+00:00

Hi All,

I wonder if anyone here can suggest the steps and procedure to perform an upgrade of current OnPremise Windows Server 2012 R2 ADFS server into Windows Server 2016.

I have found this article for the upgrade: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server

However, what is the caveats and risk if I just clone the ADFS VM (single VM all in one) and then roll back when the change has impacted my SSO login in production?

Since we are a 24x7 global company hence outage or interruptions is not acceptable or must be very minimal.

Your help will be greatly appreciated.

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,189 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,455 questions
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,306 Reputation points
    2020-06-17T12:20:35.067+00:00

    Hello @EnterpriseArchitect

    Based on the document link that you have shared, I assumed that you have WID database. I would suggest you to install secondary ADFS Server on Windows Server 2016, in the same farm. Once the installation is done, you can use below command to make the new server as Primary ADFS Server:

     Set-AdfsSyncProperties -Role PrimaryComputer

    And convert the old ADFS Server to secondary by using below command:

     Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName {FQDN}

    You can then point a few computers to the new ADFS Server by making Host file entries and test if everything is working fine with the new server. Once confirmed, you can decommission the old server and assign the same IP address to the new ADFS Server. Also, raise the farm level, so that you can use the new features available with ADFS 2016.

    I don't see any impact of rolling back the VM snapshot If there is no WID replication or WAP servers are there. Rollback may impact WID replication and secure channel with WAP servers. So if you plan to ever roll back, make sure you have only one ADFS Server in place.

    Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. EnterpriseArchitect 4,721 Reputation points
    2020-07-09T05:40:57.39+00:00

    @amanpreetsingh-msft

    Thank you for the confirmation, Yes, I have already deployed the new Windows Server 2016 VM, so I assume, I can just install the ADFS role and then join it to the existing ADFS farm, this can be done during the business hours with no impact?

    Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName PrimaryADFS1-VM.domain.com

    I'm adding the third ADFS 2016 VM as another redundancy VMs.