Install-AdfsFarm

Module:

ADFS Module

Creates the first node of a new federation server farm.

Syntax

ADFSFarmCreateLocalDatabase (Default)

Install-AdfsFarm
    -FederationServiceName <String>
    -ServiceAccountCredential <PSCredential>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ADFSFarmCreateLocalDatabaseDisableAutoCertRollover

Install-AdfsFarm
    -DecryptionCertificateThumbprint <String>
    -FederationServiceName <String>
    -ServiceAccountCredential <PSCredential>
    -SigningCertificateThumbprint <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ADFSFarmCreateSharedDatabaseDisableAutoCertRollover

Install-AdfsFarm
    -DecryptionCertificateThumbprint <String>
    -FederationServiceName <String>
    -ServiceAccountCredential <PSCredential>
    -SigningCertificateThumbprint <String>
    -SQLConnectionString <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

AdfsFarmCreateLocalDatabaseDisableAutoCertRolloverGmsa

Install-AdfsFarm
    -DecryptionCertificateThumbprint <String>
    -FederationServiceName <String>
    -GroupServiceAccountIdentifier <String>
    -SigningCertificateThumbprint <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

AdfsFarmCreateSharedDatabaseDisableAutoCertRolloverGmsa

Install-AdfsFarm
    -DecryptionCertificateThumbprint <String>
    -FederationServiceName <String>
    -GroupServiceAccountIdentifier <String>
    -SigningCertificateThumbprint <String>
    -SQLConnectionString <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

ADFSFarmCreateSharedDatabase

Install-AdfsFarm
    -FederationServiceName <String>
    -ServiceAccountCredential <PSCredential>
    -SQLConnectionString <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

AdfsFarmCreateLocalDatabaseGmsa

Install-AdfsFarm
    -FederationServiceName <String>
    -GroupServiceAccountIdentifier <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

AdfsFarmCreateSharedDatabaseGmsa

Install-AdfsFarm
    -FederationServiceName <String>
    -GroupServiceAccountIdentifier <String>
    -SQLConnectionString <String>
    [-CertificateThumbprint <String>]
    [-Credential <PSCredential>]
    [-FederationServiceDisplayName <String>]
    [-OverwriteConfiguration]
    [-SSLPort <Int32>]
    [-TlsClientPort <Int32>]
    [-AdminConfiguration <Hashtable>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

The Install-AdfsFarm cmdlet creates the first node of a new federation server farm.

Examples

Example 1: Create the first node in a federation server farm using WID on the local server

PS C:\> $fscredential = Get-Credential
PS C:\> Install-AdfsFarm -CertificateThumbprint 8169c52b4ec6e77eb2ae17f028fe5da4e35c0bed -FederationServiceName fs.corp.contoso.com -ServiceAccountCredential $fscredential

Creates the first node in a federation server farm that uses the Windows Internal Database (WID) on the local server computer.

In this example, a certificate thumbprint value is supplied for the CertificateThumbprint parameter. This certificate will be used as the SSL certificate and the service communications certificate. Automatically generated, self-signed certificates will be used for the token signing and token decryption certificates.

To specify certificates for token signing and token decryption, specify thumbprint values for the SigningCertificateThumbprint and DecryptionCertificateThumbprint parameters.

Example 2: Create the first node in a federation server farm using a group Managed Services Account

PS C:\> Install-AdfsFarm -CertificateThumbprint 8169c52b4ec6e77eb2ae17f028fe5da4e35c0bed -FederationServiceName fs.corp.contoso.com -GroupServiceAccountIdentifier CONTOSO\GroupAccount01

This example creates the first node in a federation server farm that uses a group Managed Service Account as the service account. In this example, a certificate thumbprint value is supplied for the CertificateThumbprint parameter. This certificate will be used as the SSL certificate and the service communications certificate. Automatically generated, self-signed certificates will be used for the token signing and token decryption certificates. To specify certificates for token signing and token decryption, specify thumbprint values for the SigningCertificateThumbprint and DecryptionCertificateThumbprint parameters.

Example 3: Create the first node in a federation server farm that uses SQL Server on a remote computer

PS C:\> $fscredential = Get-Credential
PS C:\> Install-AdfsFarm -CertificateThumbprint 8169c52b4ec6e77eb2ae17f028fe5da4e35c0bed -FederationServiceName fs.corp.contoso.com -ServiceAccountCredential $fscredential -SQLConnectionString "Data Source=SQLHost;Integrated Security=True"

Creates the first node in a federation server farm that uses a Microsoft SQL Server database on a remote computer named SQLHost.

In this example, a certificate thumbprint value is supplied for the CertificateThumbprint parameter. This certificate will be used as the SSL certificate and the service communications certificate. Automatically generated, self-signed certificates will be used for the token signing and token decryption certificates.

To specify certificates for token signing and token decryption, specify thumbprint values for the SigningCertificateThumbprint and DecryptionCertificateThumbprint parameters.

Example 4: Overwrite an AD FS configuration and create the first node in a federation server farm

PS C:\> $fscredential = Get-Credential
PS C:\> Install-AdfsFarm -CertificateThumbprint 8169c52b4ec6e77eb2ae17f028fe5da4e35c0bed -FederationServiceName fs.corp.contoso.com -ServiceAccountCredential $fscredential -SQLConnectionString "Data Source=SQLHost;Integrated Security=True" -OverwriteConfiguration -SigningCertificateThumbprint 8169c52b4ec6e77eb2ae17f028fe5da4e35c0bed -DecryptionCertificateThumbprint cf2e5064c521d625c8d53536bc98aa8e08f5f2ad

Overwrites an existing AD FS configuration database and creates the first node in a federation server farm that uses a Microsoft SQL server database on a remote computer named SQLHost.

In this example, certificate thumbprint values are specified for the token signing certificate and for the token encryption certificate using the SigningCertificateThumbprint and DecryptionCertificateThumbprint parameters respectively.

Parameters

-AdminConfiguration (Currently not supported)

The Install-AdfsFarm cmdlet creates the first node of a new federation server farm.

Parameter properties

Type:	Hashtable
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-CertificateThumbprint

Specifies the certificate thumbprint of a digital public key X.509 certificate of a user account that has permission to perform this action.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False
Aliases:	cf

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Credential

Specifies a PSCredential object.

Parameter properties

Type:	PSCredential
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DecryptionCertificateThumbprint

Specifies the value of the certificate thumbprint of the certificate that should be used for token decryption. If this parameter is used, the automatic certificate rollover feature will be disabled, and a token signing certificate must also be specified using the SigningCertificateThumbprint parameter. This value should match the thumbprint of a valid certificate in the Local Computer certificate store.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ADFSFarmCreateLocalDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ADFSFarmCreateSharedDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateLocalDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateSharedDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-FederationServiceDisplayName

Specifies a display name.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-FederationServiceName

Specifies a Federation Service name.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-GroupServiceAccountIdentifier

Specifies the Group Managed Service Account under which the Active Directory Federation Services (AD FS) service runs.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

AdfsFarmCreateLocalDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateSharedDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateLocalDatabaseGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateSharedDatabaseGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-OverwriteConfiguration

Overwrites an existing AD FS configuration database with a new database.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ServiceAccountCredential

Specifies the Active Directory account under which the AD FS service runs.

Parameter properties

Type:	PSCredential
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ADFSFarmCreateLocalDatabase

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ADFSFarmCreateLocalDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ADFSFarmCreateSharedDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ADFSFarmCreateSharedDatabase

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-SigningCertificateThumbprint

Specifies the value of the certificate thumbprint of the certificate that should be used for token signing. If this parameter is used, the automatic certificate rollover feature will be disabled, and a token decryption certificate must also be specified using the DecryptionCertificateThumbprint parameter. This value should match the thumbprint of a valid certificate in the Local Computer certificate store.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ADFSFarmCreateLocalDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ADFSFarmCreateSharedDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateLocalDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateSharedDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-SQLConnectionString

Specifies the SQL Server database that will store the AD FS configuration settings. If not specified, the AD FS installer uses the Windows Internal Database to store configuration settings.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ADFSFarmCreateSharedDatabaseDisableAutoCertRollover

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateSharedDatabaseDisableAutoCertRolloverGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ADFSFarmCreateSharedDatabase

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

AdfsFarmCreateSharedDatabaseGmsa

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-SSLPort

Specifies an SSL port.

Parameter properties

Type:	Int32
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TlsClientPort

Specifies a TLS client port.

Parameter properties

Type:	Int32
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Parameter properties

Type:	SwitchParameter
Default value:	False
Supports wildcards:	False
DontShow:	False
Aliases:	wi

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.