Unable to add adfs 2022 to windows 2012 R2 farm

Tilicho 1 Reputation point

Domain Structure --> root contoso, child domains : domain1.contoso.com & domain2.contoso.com

Current 2012 r2 adfs servers located in contoso.com but use service account from domain1.contoso.com.

Current production deployment uses SQL backend.

The service account has spn https://sso.contoso.com and http://sso.contoso.com

ADFS rapid restore tool was used to back up the current ADFS farm on windows 2012 R2. Then on a new 2012 R2 server (server3) created in contoso.com top domain, it was restored using WID option. Verified that the ADFS SSO worked in the new server by pointing the local host file for sso.contoso.com to the new server after the restore.

However, when joining 2022 server to this new 2012 server it fails the pre-requisite checks. Error cited are

SOAP security negotiation with 'http://server3.contoso.com/adfs/services/policystoretransfer' for target 'http://server3.contoso.com/adfs/services/policystoretransfer' failed.

Unable to determine the current Farm Behavior Level. SOAP security negotiation with 'http://server3.contoso.com/adfs/services/policystoretransfer' for target 'http://server3.contoso.com/adfs/services/policystoretransfer' failed.

Server3 (new restored 2012 r2) has the same msDS-SupportedEncryptionTypes as the 2012 r2 server in production and also the 2022 server that is unable to join to it. Adding RC4_HMAC_MD5 and other AES related options through security settings --> security options --> Network security: Configure encryption types allowed for kerberos, both in newly restored 2012 r2 and windows 2022 server didn't work .

Windows firewall is turned off on all the machines.

Any help is appreciated.

@Pierre Audonnet - MSFT

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,083 questions
{count} votes

3 answers

Sort by: Most helpful
  1. Amit Singh 4,136 Reputation points

    Did you try to enable the two Kerberos options on the account tab of the account being used for our ADFS service?

  2. Tilicho 1 Reputation point


    0 comments No comments

  3. Tilicho 1 Reputation point

    @Pierre Audonnet - MSFT


    It was a case of SPN as hinted by you. But the errors from the pre-requisite checks didn't have any information pertaining to that. MS and other articles mentioned that the kerberos error that was seen in the logs could be ignored.

    The issue was due to a duplicate spn assigned to the adfs server object in top level domain.

    The error received during the pre-requisites check was misleading. Running the diagnostics as outlined in the link below pointed to a possible SPN issue.


    There are three domains in the environment - contoso.com is the top level, domainA.contoso.com and domainB.contoso.com are the child domains. The adfs servers are located in the top level domain whereas the service account is located in the domainA.contoso.com.

    When duplicate SPNs were checked through the generic command "setspn -X" it was run from the domainA.contoso.com and didn't find any duplicates. That misled us to believe no duplicates existed.

    After the diagnostics pointed to a possible duplicate, ran the following command for every domain

    setspn -T * -T contoso.com -X

    setspn -T * -T domainA.contoso.com -X

    setspn -T * -T domainB.contoso.com -X

    Sure enough, one of the adfs servers had host/sso.contoso.com SPN assigned to it. Once that was removed 2022 server was able to join the 2012 r2 farm.