Changing ADFS 3.0 service account (Server 2012 R2)

Max V 1 Reputation point
2020-03-31T14:18:15.857+00:00

There are many post on how to change the service account by using the following script:

ADFS3.xChangeSvcAcct.ps1

https://gallery.technet.microsoft.com/scriptcenter/Active-Directory-ddb67df0#content

However, what I do not think is clear is how to proceed when you have an ADFS Web Proxy.

The script talks about primary and secondaries. If I understand correctly, you first update on the secondary servers,

and then you move to the primary.

But does the ADFS Proxy is considered a secondary? If not, once I run the script on the primary server, how do I update

the service account on the Proxy?

Has anybody gone through this scenario?

Thanks

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,189 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-03-31T14:35:02.773+00:00

    The Web Application Proxy (aka WAP, that's how we call the ADFS Proxy since Windows Server 2012 R2) does not leverage the ADFS service account at all.
    As a matter of fact, WAP don't even need to be domain joined. WAPs authenticate with the ADFS farm using TLS authentication (certificates are generated when you join the WAP to the farm and then roll-over on a regular basis).

    In other words, there is no action required on the WAPs when you change the service account of the ADFS farm.