Joining new AD FS Windows Server 2019 to the old AD FS 2012 R2 farm - SPN/SOAP issues

Question

Hello,

I work with environment where I have really old setup. I tried to perform not recommended in-place upgrade, it succeed on a few common machines but it's different with AD DC... Due to complication I decided to create new DC and migrate overtime all roles from the DC01.

Machine is correctly configured and domain joined, it was promoted to DC02, replication works correctly.

At this moment there it looks like this:

1. Windows Server 2012 R2 - DC01. Primary AD FS server. It holds all FSMO roles.
2. Windows Server 2019 - DC02. Server that should take over all responsibilities of DC01.

Problem I have right now is to install and authorize AD FS on WS2019(DC02). Configuration Wizard is failing due to pre-requisites check:

• There were no SPNs set on the following service account 'domain\adfs-service-account-used-by-DC01'. Specify the service account used to configure the other Federation Servers in the farm, or set host SPN for the farm on the service account.
• SOAP security negotiation with "dc01.domain.com/adfss/services/policystoretransfer" for target "dc01.domain.com/adfss/services/policystoretransfer" failed.See inner exception for more details.
• The specified service account could not be used to securely establish a connection with the primary federation server in the farm. Ensure that you are using the same service account as the account that you specified on the primary federation server. Occurs when user configures primary instance with account X and then tries to join a machine using account Y.
• Unable to determine the Service SPN. There were no SPNs set on the following service account 'domain\adfs-service-account-used-by-DC01'. Specify the service account used to configure the other Federation Servers in the farm, or set host SPN for the farm on the service account.
• Unable to determine the current Farm Behavior Level. SOAP security negotiation [...].
• Unable to retrieve configuration from the primary server. The specified service account could not be used to securely establish a connection with the primary federation server in the farm. Ensure that you are using the same service account as the account that you specified on the primary federation server.

So far I managed to:

• confirm that I am using correct account for 100%
• SPNs are correctly configured
• certifcates are correct + winrm is configured correctly(I thought that winrm could be the reason at some point)

Could you please give me any hints, advises, what could be yet wrong?

I am doing this first time and it's really confusing especially in the old setup.

Answer 1

Hi @Shu

You should start by checking the SPN configuration set on the old service account.

Can you share with us the result of this command:

setspn -l Domain\adfs-service-account-used-by-DC0

Please don't forget to mak helpful anser as accepted*

Answer 2

You should not be putting ADFS on a DC. We have a free workshop next week on how to migrate from ADFS to Azure AD. I cannot stress enough you attend and retire that ADFS instance https://techcommunity.microsoft.com/t5/community-events-list/microsoft-workshops-how-to-successfully-migrate-away-from-ad-fs/m-p/3668480