ADFS Promote secondary to primary

Question

Hi,

Am planning to promote secondary ADFS to primary ADFS, as stated here I can change using PS commands https://hippidikki.wordpress.com/2016/04/19/changing-adfs-primarysecondary-federation-serverin-a-farm

But thing is will this also move the token signing certificates, Relying party trusts and Claim issuance as well?

Thanks in advance.

Regards

Answer 1

Run this PowerShell command on the Secondary AD FS server that you want to make the Primary AD FS server.

Set-AdfsSyncProperties -Role PrimaryComputer  

This will now move the Primary role to the server where the command was run. If you have two or more Secondary servers on the farm, you need to update the other Secondary servers.

Run this PowerShell command on the other Secondary AD FS server(s) so that they now sync with the new AD FS Primary server

Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName <FQDN_ADFS_Primary>  

 

Also, check this detailed MS article for more insight - https://itworldjd.wordpress.com/2014/10/22/how-to-move-a-secondary-adfs-to-primary/

Answer 2

Hello there,

The Token signing certificates will not be moved. It is common to think that a specific Enhanced Key Usage (EKU) is needed for the token-signing certificate, but this is, in fact, not correct. The only requirement for usage is that Key Usage (KU) must contain at least Digital Signature.

You can follow this article to move the certificates or create new ones

https://social.technet.microsoft.com/wiki/contents/articles/2311.ad-fs-1-0-and-1-1-how-to-replace-the-ssl-token-signing-and-federation-server-proxy-certificates.aspx

--------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 3

Yes it worked fine on one of the test machine.

In production I tried to install Federation service, I stuck in SPN account creation. I tried to setspn -Q http/einvpdssoadfs and got the results as one service user and used that in the secondary server to configure the ADFS service but got failed with SPN account.

Attaching screenshot of the same.

I tried creating SPN in primary server, but looks like it already created and not able to create new one. Any help would be much appreciated.