Unable to add adfs 2022 to windows 2012 R2 farm

Question

Unable to add adfs 2022 to windows 2012 R2 farm

Tilicho 6

Domain Structure --> root contoso, child domains : domain1.contoso.com & domain2.contoso.com

Current 2012 r2 adfs servers located in contoso.com but use service account from domain1.contoso.com.

Current production deployment uses SQL backend.

The service account has spn https://sso.contoso.com and http://sso.contoso.com

ADFS rapid restore tool was used to back up the current ADFS farm on windows 2012 R2. Then on a new 2012 R2 server (server3) created in contoso.com top domain, it was restored using WID option. Verified that the ADFS SSO worked in the new server by pointing the local host file for sso.contoso.com to the new server after the restore.

However, when joining 2022 server to this new 2012 server it fails the pre-requisite checks. Error cited are

SOAP security negotiation with 'http://server3.contoso.com/adfs/services/policystoretransfer' for target 'http://server3.contoso.com/adfs/services/policystoretransfer' failed.

Unable to determine the current Farm Behavior Level. SOAP security negotiation with 'http://server3.contoso.com/adfs/services/policystoretransfer' for target 'http://server3.contoso.com/adfs/services/policystoretransfer' failed.

Server3 (new restored 2012 r2) has the same msDS-SupportedEncryptionTypes as the 2012 r2 server in production and also the 2022 server that is unable to join to it. Adding RC4_HMAC_MD5 and other AES related options through security settings --> security options --> Network security: Configure encryption types allowed for kerberos, both in newly restored 2012 r2 and windows 2022 server didn't work .

Windows firewall is turned off on all the machines.

Any help is appreciated.

@Pierre Audonnet - MSFT

Tilicho 6 Reputation points

2023-09-06T15:36:38.2266667+00:00

Wondering if I need to bring in the 2016 server into the mix first, take 2012 out. Then bring 2022 in the mix since the new 2022 server seems to want the farm behavior level info which was introduced in 2016.
Tilicho 6 Reputation points

2023-09-06T16:15:30.8633333+00:00

Enabled Kerberos logging by adding registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

Registry Value: LogLevel

Value Type: REG_DWORD

Value Data: 0x1

Some kerberos related errors showed up.

KDC_ERR_PREAUTH_REQUIRED

KRB_AP_ERR_MODIFIED
Tilicho 6 Reputation points

2023-09-07T00:59:06.5+00:00

FYI windows 2016 generated the same error. But joining a new 2012 R2 server to the farm was not an issue. This has to do with something specific to configuring adfs using windows 2016 / 2019 / 2022.

A post suggested enabling a couple of Kerberos settings in account tab of the service account that adfs uses.
Tilicho 6 Reputation points

2023-09-07T15:43:54.2766667+00:00

Added another 2012 r2 into the farm. With restore to WID only one 2012 r2 server was in place before. Adding a secondary 2012 r2 was fine. But not able to add 2016 or 2022 into the mix. Same error on both as stated above.

@Pierre Audonnet - MSFT
Pierre Audonnet - MSFT 10,201 Reputation points Microsoft Employee Moderator

2023-09-07T16:54:00.7733333+00:00

KRB_AP_ERR_MODIFIED suggests that you have either an SPN issue or a DNS issue.

What do you mean by that: "Verified that the ADFS SSO worked in the new server by pointing the local host file for sso.contoso.com to the new server after the restore."
Tilicho 6 Reputation points

2023-09-07T17:11:55.2533333+00:00

Thank you for the response.

When backup was restored to a new 2012 R2 with WID option, I verified that the standalone environment works by adding an entry to my PC host file to point sso.contoso.com to the new restored 2012 R2 server.

If SPN was a factor shouldn't joining of another 2012 R2 fail as well? The SPN is set on the account per the guideline from MS. We verified that there are not duplicates.

Please note that this a parallel environment that we are trying to have the 2022 server join the farm.

Current production uses two 2012 r2 with sql backend and works fine. We are trying to move to WID based architecture. So the process followed was to back up using rapid restore tool. Then restore to a new 2012 r2. Join 2022 to this restored environment and then take out the restored 2012 r2 from the farm.

A user in a forum had mentioned that checking the two Kerberos encryption options for service account in active directory user account tab (thinking those are this account supports Kerberos AES 128 bit encryption , and AES 256 bit encryption) helped him to join 2022 to 2012 R2. We do not have these options checked for the service account (production also uses it as well as the restored parallel environment). Would this make a difference?

@Pierre Audonnet - MSFT

3 answers

Your answer

Tilicho 6 Reputation points

2023-09-06T15:36:38.2266667+00:00

Wondering if I need to bring in the 2016 server into the mix first, take 2012 out. Then bring 2022 in the mix since the new 2022 server seems to want the farm behavior level info which was introduced in 2016.
Tilicho 6 Reputation points

2023-09-06T16:15:30.8633333+00:00

Enabled Kerberos logging by adding registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

Registry Value: LogLevel

Value Type: REG_DWORD

Value Data: 0x1

Some kerberos related errors showed up.

KDC_ERR_PREAUTH_REQUIRED

KRB_AP_ERR_MODIFIED
Tilicho 6 Reputation points

2023-09-07T00:59:06.5+00:00

FYI windows 2016 generated the same error. But joining a new 2012 R2 server to the farm was not an issue. This has to do with something specific to configuring adfs using windows 2016 / 2019 / 2022.

A post suggested enabling a couple of Kerberos settings in account tab of the service account that adfs uses.
Tilicho 6 Reputation points

2023-09-07T15:43:54.2766667+00:00

Added another 2012 r2 into the farm. With restore to WID only one 2012 r2 server was in place before. Adding a secondary 2012 r2 was fine. But not able to add 2016 or 2022 into the mix. Same error on both as stated above.

@Pierre Audonnet - MSFT
Pierre Audonnet - MSFT 10,201 Reputation points Microsoft Employee Moderator

2023-09-07T16:54:00.7733333+00:00

KRB_AP_ERR_MODIFIED suggests that you have either an SPN issue or a DNS issue.

What do you mean by that: "Verified that the ADFS SSO worked in the new server by pointing the local host file for sso.contoso.com to the new server after the restore."
Tilicho 6 Reputation points

2023-09-07T17:11:55.2533333+00:00

Thank you for the response.

When backup was restored to a new 2012 R2 with WID option, I verified that the standalone environment works by adding an entry to my PC host file to point sso.contoso.com to the new restored 2012 R2 server.

If SPN was a factor shouldn't joining of another 2012 R2 fail as well? The SPN is set on the account per the guideline from MS. We verified that there are not duplicates.

Please note that this a parallel environment that we are trying to have the 2022 server join the farm.

Current production uses two 2012 r2 with sql backend and works fine. We are trying to move to WID based architecture. So the process followed was to back up using rapid restore tool. Then restore to a new 2012 r2. Join 2022 to this restored environment and then take out the restored 2012 r2 from the farm.

A user in a forum had mentioned that checking the two Kerberos encryption options for service account in active directory user account tab (thinking those are this account supports Kerberos AES 128 bit encryption , and AES 256 bit encryption) helped him to join 2022 to 2012 R2. We do not have these options checked for the service account (production also uses it as well as the restored parallel environment). Would this make a difference?

@Pierre Audonnet - MSFT

Answer 1

@Pierre Audonnet - MSFT

Pierre,

It was a case of SPN as hinted by you. But the errors from the pre-requisite checks didn't have any information pertaining to that. MS and other articles mentioned that the kerberos error that was seen in the logs could be ignored.

The issue was due to a duplicate spn assigned to the adfs server object in top level domain.

The error received during the pre-requisites check was misleading. Running the diagnostics as outlined in the link below pointed to a possible SPN issue.

https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-diagnostics-analyzer

There are three domains in the environment - contoso.com is the top level, domainA.contoso.com and domainB.contoso.com are the child domains. The adfs servers are located in the top level domain whereas the service account is located in the domainA.contoso.com.

When duplicate SPNs were checked through the generic command "setspn -X" it was run from the domainA.contoso.com and didn't find any duplicates. That misled us to believe no duplicates existed.

After the diagnostics pointed to a possible duplicate, ran the following command for every domain

setspn -T * -T contoso.com -X

setspn -T * -T domainA.contoso.com -X

setspn -T * -T domainB.contoso.com -X

Sure enough, one of the adfs servers had host/sso.contoso.com SPN assigned to it. Once that was removed 2022 server was able to join the 2012 r2 farm.

Pierre Audonnet - MSFT 10,201 Reputation points Microsoft Employee Moderator

2023-09-21T00:47:14.2+00:00

Well, I can't think of a good reason to ignore KRB_AP_ERR_MODIFIED :/
Ignore KDC_ERR_PREAUTH_REQUIRED yes, cause it's a part of the Kerberos implementation of Windows (to discover enryption types and whatnot). But KRB_AP_ERR_MODIFIED is never good sign... I am glad you sorted out the issue though. Let us know if you run into another issue!

Answer 2

Tilicho 6

..........

Answer 3

Amit Singh 5,321

Did you try to enable the two Kerberos options on the account tab of the account being used for our ADFS service?

Tilicho 6 Reputation points

2023-09-18T14:53:16.8733333+00:00

Adding "this account supports aes 128" or the 256 for keberos encryption in account tab of the service account didn't work.
Tilicho 6 Reputation points

2023-09-19T13:44:10.8233333+00:00

Starting a new thread since this has lost visibility. Also that the thread overview shows as this having an answer doesn't help really. I would suggest community members to comment instead. If a solution works then that can be marked as an answer.

Share via

Unable to add adfs 2022 to windows 2012 R2 farm

3 answers

Your answer