This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 36%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Domain Structure --> root contoso, child domains : domain1.contoso.com & domain2.contoso.com
Current 2012 r2 adfs servers located in contoso.com but use service account from domain1.contoso.com.
Current production deployment uses SQL backend.
The service account has spn https://sso.contoso.com and http://sso.contoso.com
ADFS rapid restore tool was used to back up the current ADFS farm on windows 2012 R2. Then on a new 2012 R2 server (server3) created in contoso.com top domain, it was restored using WID option. Verified that the ADFS SSO worked in the new server by pointing the local host file for sso.contoso.com to the new server after the restore.
However, when joining 2022 server to this new 2012 server it fails the pre-requisite checks. Error cited are
SOAP security negotiation with 'http://server3.contoso.com/adfs/services/policystoretransfer' for target 'http://server3.contoso.com/adfs/services/policystoretransfer' failed.
Unable to determine the current Farm Behavior Level. SOAP security negotiation with 'http://server3.contoso.com/adfs/services/policystoretransfer' for target 'http://server3.contoso.com/adfs/services/policystoretransfer' failed.
Server3 (new restored 2012 r2) has the same msDS-SupportedEncryptionTypes as the 2012 r2 server in production and also the 2022 server that is unable to join to it. Adding RC4_HMAC_MD5 and other AES related options through security settings --> security options --> Network security: Configure encryption types allowed for kerberos, both in newly restored 2012 r2 and windows 2022 server didn't work .
Windows firewall is turned off on all the machines.
Any help is appreciated.
Wondering if I need to bring in the 2016 server into the mix first, take 2012 out. Then bring 2022 in the mix since the new 2022 server seems to want the farm behavior level info which was introduced in 2016.
Enabled Kerberos logging by adding registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Registry Value: LogLevel
Value Type: REG_DWORD
Value Data: 0x1
Some kerberos related errors showed up.
KDC_ERR_PREAUTH_REQUIRED
KRB_AP_ERR_MODIFIED
FYI windows 2016 generated the same error. But joining a new 2012 R2 server to the farm was not an issue. This has to do with something specific to configuring adfs using windows 2016 / 2019 / 2022.
A post suggested enabling a couple of Kerberos settings in account tab of the service account that adfs uses.
Added another 2012 r2 into the farm. With restore to WID only one 2012 r2 server was in place before. Adding a secondary 2012 r2 was fine. But not able to add 2016 or 2022 into the mix. Same error on both as stated above.
KRB_AP_ERR_MODIFIED suggests that you have either an SPN issue or a DNS issue.
What do you mean by that: "Verified that the ADFS SSO worked in the new server by pointing the local host file for sso.contoso.com to the new server after the restore."
Thank you for the response.
When backup was restored to a new 2012 R2 with WID option, I verified that the standalone environment works by adding an entry to my PC host file to point sso.contoso.com to the new restored 2012 R2 server.
If SPN was a factor shouldn't joining of another 2012 R2 fail as well? The SPN is set on the account per the guideline from MS. We verified that there are not duplicates.
Please note that this a parallel environment that we are trying to have the 2022 server join the farm.
Current production uses two 2012 r2 with sql backend and works fine. We are trying to move to WID based architecture. So the process followed was to back up using rapid restore tool. Then restore to a new 2012 r2. Join 2022 to this restored environment and then take out the restored 2012 r2 from the farm.
A user in a forum had mentioned that checking the two Kerberos encryption options for service account in active directory user account tab (thinking those are this account supports Kerberos AES 128 bit encryption , and AES 256 bit encryption) helped him to join 2022 to 2012 R2. We do not have these options checked for the service account (production also uses it as well as the restored parallel environment). Would this make a difference?
Did you try to enable the two Kerberos options on the account tab of the account being used for our ADFS service?
Adding "this account supports aes 128" or the 256 for keberos encryption in account tab of the service account didn't work.
Starting a new thread since this has lost visibility. Also that the thread overview shows as this having an answer doesn't help really. I would suggest community members to comment instead. If a solution works then that can be marked as an answer.
Pierre,
It was a case of SPN as hinted by you. But the errors from the pre-requisite checks didn't have any information pertaining to that. MS and other articles mentioned that the kerberos error that was seen in the logs could be ignored.
The issue was due to a duplicate spn assigned to the adfs server object in top level domain.
The error received during the pre-requisites check was misleading. Running the diagnostics as outlined in the link below pointed to a possible SPN issue.
There are three domains in the environment - contoso.com is the top level, domainA.contoso.com and domainB.contoso.com are the child domains. The adfs servers are located in the top level domain whereas the service account is located in the domainA.contoso.com.
When duplicate SPNs were checked through the generic command "setspn -X" it was run from the domainA.contoso.com and didn't find any duplicates. That misled us to believe no duplicates existed.
After the diagnostics pointed to a possible duplicate, ran the following command for every domain
setspn -T * -T contoso.com -X
setspn -T * -T domainA.contoso.com -X
setspn -T * -T domainB.contoso.com -X
Sure enough, one of the adfs servers had host/sso.contoso.com SPN assigned to it. Once that was removed 2022 server was able to join the 2012 r2 farm.
Well, I can't think of a good reason to ignore KRB_AP_ERR_MODIFIED :/
Ignore KDC_ERR_PREAUTH_REQUIRED yes, cause it's a part of the Kerberos implementation of Windows (to discover enryption types and whatnot). But KRB_AP_ERR_MODIFIED is never good sign... I am glad you sorted out the issue though. Let us know if you run into another issue!