Discussion between maweeras and Rob Moir - 2018-03-13

last day (15 days later) »

1:41 PM

1

Q: Issue installing Azure AD Connect ADFS Health Agent

I'm trying to install the Azure AD Connect ADFS health agent on the primary server in an ADFS 4.0 farm running on Windows Server 2016. The installation completes successfully but I get an error on configuration: Register-AzureADConnectHealthADFSAgent : Could not query the MEX on http ports: 443...

windows-server-2016 adfs azure-active-directory

It would be more useful if you post the output from below command immediately after command fails. $error[0] | fl * -f

You should also have a peak at logs in %localappdata%\temp for clues as the AAD Connect Health installer writes logs there. All I can see is an apparent error to get to the /adfs/services/trust/mex endpoint.

Does get-adfssslcertificate show a 443 binding for localhost ?

@maweeras none of the servers in the farm have any kind of binding for localhost when I run that command. Should they have?

yes it should be there

Ah, that sounds like the issue. I just need to figure out how to add that binding then I should be ok hopefully. I'll let you know, if it works so you can post an answer for the free internet points

Is this farm using certauth as a name it listens on out of interest?

1:41 PM

pardon my ignorance but how do I check? I don't believe it's configured for device auth (iirc that's certauth?)

No its different. Based on SAN values on cert. See docs.microsoft.com/en-us/windows-server/identity/ad-fs/…

ah

That's right. I remember not configuring device auth.

but other than that, as I say, please excuse my ignorance!

It shouldnt matter if you use certauth. I am just curious why its missing. SSL bindings should be only modified via powershell and never directly through netsh

i.e. set-adfssslcertificate is the way to update bindings

I'm not sure either. This was a 2.1 -> 4.0 migration when 2016 was new but other than the UI bug you (? i think) helped me with just after deployment, its actually been rock solid

I think set-adfssslcertificate affects the farm doesn't it, where netsh would just be local to server

no set-adfssslcertificate is per server

it has to be as bindings are local to each server

1:48 PM

ah ok

set-adfscertificate is farm wide

thank you, by the way, I'm learning here!

Snippet from my server

SSL Certificate bindings:
-------------------------

Hostname:port : sts.maweeras.info:443
Certificate Hash : c470d57903b76a35b2d1d191457271669fdef651
Application ID : {5d89a20c-beab-4389-9447-324788eb944a}
Certificate Store Name : MY
Verify Client Certificate Revocation : Enabled
Verify Revocation Using Cached Client Certificate Only : Disabled
Usage Check : Enabled
Revocation Freshness Time : 0
URL Retrieval Timeout : 0

so I could run set-adfssslcertificate with the correct certificate thumbprint and it would re-do all bindings?

there is more but you have an idea of what it looks like

1:50 PM

yes

yes i would re-run set-adfssslcertificate

if it doesnt then time to add manually using mine as example via netsh

I have similar output to you, by the way, when I run netsh http show sslcert, except no localhost

which is not as easy but perfectly doable

thanks again, I will give that a go

try set-adfssslcertificate first

make sure that doesnt fix before you go down netsh route

1:51 PM

I will, no need to make the job harder than it needs to be!

wonderful, running that on the primary has re-mapped localhost on all the farm members

really?

that was unexpected. I expected you to do it on all

yes. I tried running on a secondary first and it told me it could only be run on the primary, so running it on the primary did it for the farm

interesting. Cant say I have been in this situation

i normally use it to update certs from old to new

than put something missing

can see it when i run netsh http show sslcert on secondaries now

cool. I'll post answer. We can end this chat now me thinks

1:55 PM

I have to say I've never been in this situation either, but then I am mostly management these days.

:)

Thank you once again, now lets see if it fixes the health connector, sure it will

yes that got it

last day (15 days later) »

Transcript for

Mar '1813

Discussion between maweeras and Rob Moir

Imported from a comment discussion on serverfault.com/question...

adfs azure-active-directory windows-server-2016

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile