ADFS MEX Endpoint is Unreachable

Berg, Ronald van den 46 Reputation points
2021-08-04T12:24:56.42+00:00

Last week i've updated the Active Directory Federation Services 2016 and above mp to the latest version 10.0.3.1.

Since then one of our adfs servers has a flapping monitor:
Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor (UnitMonitor)

I've investigated the differences between 10.0.3.1 and 10.0.3.0 and i see that the powershell script that is ran by the monitor never worked in the previous version, so that explains why we now have an alert and previously did not.

But now, why do we get this alert? I do not have any adfs knowledge and discussed this with the adfs admin. He sais it's working fine functionally so no reason for this alert.

We extracted the script and ran it on the primary computer it always runs successfully, the variable $script:mexOK always returns true when we run it manually.

This is the error in the alert:
The WS-Metadata Exchange (MEX) endpoint 'https://<our fqdn>/adfs/services/trust/mex' that is used for authentication over SOAP and HTTP protocols is not reachable.
The uri is a load balanced address and when tested in a browser from the adfs node it also works fine.

System Center Operations Manager
System Center Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,625 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Crystal-MSFT 53,991 Reputation points Microsoft External Staff
    2021-08-05T01:22:25.243+00:00

    @Berg, Ronald van den , Research for the error and find one link mentioned, it can be caused that the AD FS Windows Service is stopped on the federation server computer. We can verify that the AD FS Windows service is started on the remote federation server computer.
    https://systemcenter.wiki/?GetElement=Microsoft.ActiveDirectoryFederationServices20.TokenIssuanceFederationServerMEXEndpointMonitor&Type=UnitMonitor&ManagementPack=Microsoft.ActiveDirectoryFederationServices.2.0&Version=7.0.8560.0
    Note: Non-Microsoft link, just for the reference.

    Hope it can help.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  2. Berg, Ronald van den 46 Reputation points
    2021-08-05T06:07:12.5+00:00

    I verified that the service is running for 3 days now without stopping, meanwhile these alerts are created regularly so that is not the cause.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.