Installing ADFS on Active directory-DC it self Is OK ?

I integrated our Lync Server 2010 on Premise with Office 365 which requires installing ADFS and Dirsync, I read a recommendation from Microsoft that Dirsync should be installed on a separate server since it requires SQL and SQL can't be installed on Domain
Controller(AD). however I didn't read any recommendation if installing ADFS on AD would be ok or not?
It seems to be working fine but i'm worried from security wise! since ADFS requires that you install IIS and publish the authentication page for AD users permission.
I would appreciate any input on this.
Thanks
Mohammed JH

Then virtualize. It is patently unwise to run web services on domain controllers. Install ADFS on a separate platform.
David Shaw [MSFT]
As I stated in my original post, I know what best practice is. I am not looking for advice on following best practices I want to know what is technically possible. This is virtualized, it's running at my house. I have only a single hyper-v host which is
already stretched for resources. I am trying to avoid placing any more servers on it if possible. The LAB sits on a totally isolated network, it contains NO data what-so-ever. Security is not a concerned at all.
As you can see my server is overcommitted as is. All of these VM's are running on a single Dell 2950 with 350GB of disk space and 32 GB of RAM. If someone wants to donate a server to me I'd gladly use it. :-)
John Marcum | http://myitforum.com/myitforumwp/author/johnmarcum/

Similar Messages

Cannot install Windows Azure Active Directory Sync tool on Server 2012 w/ SQL Server 2012

I went to change a user password on the server today and after changing the password I logged into the SQL server to run “Import-module dirsync” & “Start-onlinecoexistencesync” in powershell in order to sync the new password with Exchange Online. After
waiting ten minutes I tried setting up the email on the user’s PC but the new password was not being accepted. I logged into Office 365 and I got the following warning.
"Warning: Last synced more than 3 days ago | Troubleshoot"
So I pressed troubleshoot and the site installed a tool on the server to try and find out what the issue was. After the tool ran it told me that the version of dirsync.exe was out of date and that I should download the new one and install it. So I downloaded
the new dirsync.exe (version 7020 I believe) and tried installing it. I kept getting error after error, different ones to boot.
First it told me I wasn’t part of the FIMSyncAdmins group (so I added myself), then it told me that it could not connect to MIIS server, so I tried starting it and windows said that there was a problem with the sign on used by the service so I had
to reset the password for the local user named “AAD_bfd1d6f0cef7” which was being used by that service. The service started successfully and when I went to install it told me I could not and if the problem persisted I should uninstall the old version and reinstall.
Looking in the log file, before I even install the software I see the following Information...
Level: Information
Date: 2015-03-24 12:49:17 PM
Source: Directory Synchronization
Event ID: 0
Task Category: None
"The current configuration of the Windows Azure Active Directory Sync tool is invalid. Please reinstall the Windows Azure Active Directory Sync tool."
So I tried to reinstall (i even manually uninstalled the old version and removed the folder in C:\Program Files\ called "Windows Azure Active Directory Sync") and on reinstall I get as far as "Installing Components" and then after a little
while it errors out with the error "The install was unable to setup a required component. Check the event logs for more information. Please try the installation again and if the error persists, contact Technical Support. "
Looking at the log file there are a bunch of new entries, created by the installer. There's over 300 new entries and I can not post them all here due to character count restriction. you can find the log file here...
www.clarkfreightways.com/wp-content/uploads/2015/03/dirsync_log.txt
Can anyone tell me what is going on, I've been looking through the log files and I can see errors but I'm not sure what to do to fix it.

Greetings!
Wanted to know if you've hosted the DirSync tool (latest version) on a VM? Also, if this is deployed in a Production or Lab environment? If it's a lab setup, you may
try installing the DirSync on a new VM / Server (suspecting that it could be some machine related issues).
Here's a Support KB helping with different errors:
http://support.microsoft.com/en-us/kb/2684395
If its a production environment, would suggest to raise a
Technical Support Ticket for assisting further with break-fix.
Thank you,
Arvind

Install Domain Controller, Active Directory, RemoteApps on Single Server?

Have a server that I want to experiment with RemoteApps. Documentation I have read state you need to have a Domain Controller setup with AD on one server, and have a second server to install all the RemoteApps requirements. Is this true or can
this all be done on one server.
If I need a separate server for the Domain Controller and Active Directory, can I assume that a low end server would be sufficient? Or would using Hyper-V with a single hardware server and create two virtual machines: one as the DC/AD, and the other
to run Remote Apps be a possible solution. Any advice?

it really depends to be honest. I'd probably go something like this though:
One Small physical server to act as a domain controller - you could put DHCP on this too
One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined.
Then for your VM's create the following:
1 x additional domain controller
For remote desktop services:
1 x Remote Desktop Session Host
1 x Connection Broker
1 x Gateway and web server
For additional services
1 or 2 x Exchange
1 x sharepoint
1 x IIS
but it really depends what you want to achieve.
The benefit from Virtual machines is that you can keep separate virtual servers for separate applications.
If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance.
Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:

ADF with Active Directory

I want to use ADF security using my active directory
I successfully do the following stps
1- configured new Security Realms to get users from my AD
2- build ADF application with users added into jazn-data.xml
I don't know how to replace the user in jazn-data.xml with users from my new realm

Nope. In Java EE the application does not care about specific users in the standard application setup. It just cares about roles (aka groups) for example by using the method isUserInRole(). You have to add them with your Active Directory tools.
Having said that, some servers provide additional functionality by setting stuff up in server specific deployment descriptors. In OC4J you can do this for file based authentication by providing a jazn-data.xml if you use an EAR file.
HTH,
--olaf

Windows Azure Active Directory Sync Setup

Hi,
Currently trying to install Windows Azure Active Directory Sync tool for use with Office 365.
After five attempts to install the Sync Tool, I finally had some luck, now I am configuring the Sync tool and have been given the following error "A constraint violation occurred"
In looking at the event logs this is the information I get:
System.Management.Automation.CmdletInvocationException: A constraint violation occurred. ---> System.DirectoryServices.DirectoryServicesCOMException: A constraint violation occurred. at System.DirectoryServices.DirectoryEntry.CommitChanges() at Microsoft.Online.DirSync.Common.DirectoryServicesAdapter.DirectoryEntry.CommitChanges()
at Microsoft.Online.Coexistence.PS.Config.EnableMSOnlineRichCoexistence.GrantWritePropertyPermission(SecurityIdentifier securityIdentifier, String groupDn) at Microsoft.Online.Coexistence.PS.Config.MSOnlineRichCoexistenceBase.GrantPermission(Action`2 grantPermissionAction)
at Microsoft.Online.Coexistence.PS.Config.EnableMSOnlineRichCoexistence.InternalBeginProcessing() at Microsoft.Online.Coexistence.PS.Config.MSOnlineConfigCmdlet.BeginProcessing() at System.Management.Automation.Cmdlet.DoBeginProcessing() at System.Management.Automation.CommandProcessorBase.DoBegin()
--- End of inner exception stack trace --- at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input) at Microsoft.Online.DirSync.PowerShellAdapter.PowerShellCommand.ExecuteCommand(Command command, Boolean refreshPath)
Suggestions?
Thanks

Hi,
According to your description, it seems that you have installed Azure Active Directory Sync tool successfully, right? What configuration have you done when you got that error message?
Firstly, I recommend you to check the event logs for more detailed information about this issue.
In general, it is recommended to install the Directory Sync tool on a member server rather than a Domain Controller. If you installed Azure Active Directory Sync Tool on a Domain Controller, please uncheck “Start Configuration Wizard now”
checkbox and then log off and log in again to configure the Azure Active Directory Sync Tool Configuration Wizard. If you forget to follow the above process, the Configuration Wizard will return an error "Constraint Violation Error".
Besides, please also check the permission of the system account. You can add it into the built-in Administrators group in your on-premise domain to see if the issue persists.
More information:
HowTo: Install the Windows Azure Active Directory Sync Tool
Best regards,
Susie

LDAP bindError: Active Directory Password Filter is not working

Hi,
I have setup the OID Server in SSL mode by following the instruction given in OIM Admin
Guide.
I am able to bind the OID using ldapbind from OID server and ldapbindssl from system on which AD is install.
but in the logs of Password Filter where AD is present following Error logs.
"LDAP bindError"
Server Unavailable
OR
Unable to connect to OID
I am using OID 10.1.2 on which Portal is install and using Active Directory 2003.
I also tried with Active Diectory 2000.but getting same message.
Regards,
RB

Hi,
run the AD Pwd filter installer again, and make sure you provide the correct full hostname of the OID server, and also "cn=orcladmin" as the OID user and the password.
It happens sometimes that the installer does not write the correct values to the windows registry and so the PWD Filter does not get the correct information.
If ldapbindssl is working then the pwd filter will work also, if the correct information is in the registry.
The values are stored in the registry on:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\orclidmpwf
Best regards,
Octavian

Monitoring Microsoft Windows 2008 Active Directory by a remoted Agent

Oracle documentation (E14542-01) said that for remote Agent monitoring with default settings, Grid Control can monitor only the Active Directory associated with the primary domain controller.
But for Microsoft Windows 2008 Active Directory primary domain doesn't exist anymore, can we use a remote Agent to monitor Microsoft Windows 2008 Active Directory ?
Thanks
Dominik

Dominik wrote:
Oracle documentation (E14542-01) said that for remote Agent monitoring with default settings, Grid Control can monitor only the Active Directory associated with the primary domain controller.
But for Microsoft Windows 2008 Active Directory primary domain doesn't exist anymore, can we use a remote Agent to monitor Microsoft Windows 2008 Active Directory ?I think , you can monitor it . Please check :
Oracle Enterprise Manager Grid Control Certification Checker [ID 412431.1]
How to Install the Microsoft Active Directory Plugin for Grid Control R2 [ID 359621.1]
Regards
Rajesh

Can I run active directory 2012r2 and 2008r2 mixed with ADFS 3.0?

We have 8 DCs in our school district, and I'm looking at installing ADFS. I'm under the impression that I will need to use 2012 R2in order to get ADFS 3.0, and that requires active directory at 2012R2 level for GMSA accounts, is that right?
If I upgrade three of our DCs right now to 2012R2, I won't be able to promote 2012R2 functionality until they are all 2012R2 - but will I be able to create GMSA accounts and use ADFS 3.0 on 2012R2 if there are 2012R2 Active Directory DCs online, but not promoted
to that level of AD service?
Thanks!

Hi,
As I have replied to the other post of yours, yes you are right that if there is one (or more) Windows 2012 R2 Domain Controller online, you can use ADFS 3.0 and create GMSA (without upgrading all Domain Controllers and
raising the functional level to Windows Server 2012 R2).
Regards,
Amy

Active Directory Schema Extension for Directory Synchronization - ADFS 3.0, Office 365

Hi Team,
We are in a situation with extending the schema for one customer so that these additional exchange attributes may be utilized. They have a single data center where the Primary Domain Controller resides and have multiple remote sites each of which have Additional
Domain Controllers installed.
As recommended by Microsoft, I am going to extend the Active Directory Schema with Exchange Setup so that I can leverage targetaddress attribute from Local AD to set primary email address when directory synchronization happens.
My Query: Do I have to extend the AD Schema with Exchange from each of these ADC's? Or the changes I make on any of them will replicate over the others also?
Note: The customer will be using ADFS 3.0 'Single Sign On' with Office 365 and does NOT have any On-Premise Exchange deployment.

My Query: Do I have to extend the AD Schema with Exchange from each of these
ADC's? Or the changes I make on any of them will replicate over the others also?
Schema extension is done against the Schema Master. Once done, it gets replicated to other DCs with the AD forest.
For more details about Schema Extension by Exchange, you can refer to that: http://www.resdevops.com/2013/02/13/extend-ad-schema-to-allow-greater-office-365-management/
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

How to install Small Business Server 2008 in an existing Active Directory domain

It is shown on this page:
http://support.microsoft.com/kb/884453, "How to install Small Business Server 2003 in an existing Active Directory domain".
Is it possible to do this with SBS2008 ?
If "YES", are there any published information about the procedure ?

Yes, it is. Thank you very much.
But there is something that confuses me - I want to migrate from Win2003Std to SBS2008. And also, I want to keep the existing Win2003Std as a second DC for a long time.
But it is written in the shown article:
... After the migration is finished, you must remove the Source Server from the network within 21 days. ...
Is this rule mandatory for the scenarios where the Source Server is Std, not SBS ? As I know, I can have more than one DC(Win2003Std/Win2008Std) together with SBS2003. But what about SBS2008 ?

Dynamics CRM 2015 Install requires Active Directory on VM Windows 2012 R2 Server

Hello,
I'm trying to install Dynamics CRM 2015 on a standalone VM not connected to a domain (it's running under WIndows 8.1 Professional). The VM was configured using WIndows Server 2012 R2. I'm getting an error message shortly into the install process stating
it needs to access Active Directory.
How can I get around this issue - I just want to Install this CRM on the VM without getting into complicate network/AD issues.
Can you please advise ?
SO many thanks,
John

CRM requires AD no way around that so the most likely solution is to install it on that server or on a VM not connected to your other networks
Jason Lattimer
My Blog - Follow me on Twitter - LinkedIn

OIM Integration with Active Directory Federation Services (ADFS)

Hello friends
I have a question about the integration of Oracle Identity Manager with Active Directory which is federated with another external directory for ADFS. My question is:
What considerations should be to contemplate if I have an active directory federated environment when carrying out the integration with Identity Manager?
I use version 9.1.0.2 of Oracle Identity Manager with Microsoft Active Directory Connector User Management 9.1.1.7
Thanks for the support.

First consideration is that the OIM's target ADFS - in the federated scenario, will that participate as a Service provider or identity provider. I would think identity provider.
Next consideration: What all attributes are required to be played in the SAML assertion to the other end-point? All these attributes must be present and should be provisioned to the AD in this case.
So, OIM should be set up (UDF etc) to provision all those attributes needed in the SAML.
Next consideration: What all scenario to support? IdP initiated or SP initiated? If SP initiated, then process will hv to be defined if a user id does not exist in the AD of the OIM target. Will the request be failed or a in-time provisioning should happen.
Hope this helps.

Failed to install Active directory domain services

Hi,
I've installed the AD Domain Services on Windows2008R2 by following this guide http://technet.microsoft.com/en-gb/library/cc755059%28WS.10%29.aspx. After click 'Install', step 6, it showed failed to install but there is no clue why it was failed, at all.
Here is a log I copied from C:\Windows\logs\ServerManager.log
2204: 2011-01-05 12:57:54.333 [InstallationProgressPage] Loading progress page...
2204: 2011-01-05 12:57:54.411 [InstallationProgressPage] Begining Sync operation...
2204: 2011-01-05 12:57:54.458 [Sync]
Sync Graph of changed nodes
==========
name     : Active Directory Domain Services
state    : Changed
rank     : 1
sync tech: CBS
guest[1] : Active Directory Domain Controller
guest[2] : Identity Management for UNIX
ant.     : empty
pred.    : empty
provider : null
name     : Active Directory Domain Controller
state    : Changed
rank     : 4
sync tech: CBS
ant.     : .NET Framework 3.5.1
pred.    : Active Directory Domain Services, .NET Framework 3.5.1
provider : Provider
2204: 2011-01-05 12:57:54.458 [Sync]                      Calling sync provider of Active Directory Domain Controller ...
2204: 2011-01-05 12:57:54.473 [Provider]                  Sync:: guest: 'Active Directory Domain Controller', guest deleted?: False
2204: 2011-01-05 12:57:54.473 [Provider]                  Begin installation of 'Active Directory Domain Controller'...
2204: 2011-01-05 12:57:54.473 [Provider]                  Install: Guest: 'Active Directory Domain Controller', updateElement: 'DirectoryServices-DomainController'
2204: 2011-01-05 12:57:54.473 [Provider]                  Installation queued for 'Active Directory Domain Controller'.
2204: 2011-01-05 12:57:54.473 [CBS]                       installing 'DirectoryServices-DomainController ' ...
2204: 2011-01-05 12:57:55.020 [CBS]                       ...parents that will be auto-installed: 'NetFx3 '
2204: 2011-01-05 12:57:55.020 [CBS]                       ...default children to turn-off: '<none>'
2204: 2011-01-05 12:57:55.036 [CBS]                       ...current state of 'DirectoryServices-DomainController': p: Staged, a: Staged, s: UninstallRequested
2204: 2011-01-05 12:57:55.036 [CBS]                       ...setting state of 'DirectoryServices-DomainController' to 'InstallRequested'
2204: 2011-01-05 12:57:55.051 [CBS]                       ...current state of 'NetFx3': p: Installed, a: Installed, s: InstallRequested
2204: 2011-01-05 12:57:55.051 [CBS]                       ...skipping 'NetFx3' because it is already in the desired state.
2204: 2011-01-05 12:57:55.098 [CBS]                       ...'DirectoryServices-DomainController' : applicability: Applicable
2204: 2011-01-05 12:57:55.114 [CBS]                       ...'NetFx3' : applicability: Applicable
2204: 2011-01-05 12:57:55.770 [CbsUIHandler]              Initiate:
2204: 2011-01-05 12:57:55.770 [InstallationProgressPage] Installing...
2204: 2011-01-05 12:58:49.176 [CbsUIHandler]              Error: -2147021879 :
2204: 2011-01-05 12:58:49.176 [CbsUIHandler]              Terminate:
2204: 2011-01-05 12:58:49.254 [InstallationProgressPage] Verifying installation...
2204: 2011-01-05 12:58:49.270 [CBS]                       ...done installing 'DirectoryServices-DomainController '. Status: -2147021879 (80070bc9)
2204: 2011-01-05 12:58:49.270 [Provider]                  Skipped configuration of 'Active Directory Domain Controller' because install operation failed.
2204: 2011-01-05 12:58:49.270 [Provider]
[STAT] ---- CBS Session Consolidation -----
[STAT] For
          'Active Directory Domain Controller'[STAT] installation(s) took '54.7870005' second(s) total.
[STAT] Configuration(s) took '0.0003053' second(s) total.
[STAT] Total time: '54.7873058' second(s).
2204: 2011-01-05 12:58:49.270 [Provider] Error (Id=0) Sync Result - Success: False, RebootRequired: True, Id: 110
2204: 2011-01-05 12:58:49.286 [Provider] Error (Id=0) Sync Message - OperationKind: Install, MessageType: Error, MessageCode: -2147021879, Message: <null>, AdditionalMessage: The requested operation failed. A system reboot is required to roll back changes
made
2204: 2011-01-05 12:58:49.286 [InstallationProgressPage] Sync operation completed
2204: 2011-01-05 12:58:49.286 [InstallationProgressPage] Performing post install/uninstall discovery...
2204: 2011-01-05 12:58:49.286 [Provider]                  C:\Windows\system32\ServerManager\Cache\CbsUpdateState.bin does not exist.
2204: 2011-01-05 12:58:49.286 [CBS]                       IsCacheStillGood: False.
2204: 2011-01-05 12:58:49.786 [CBS]                       >>>GetUpdateInfo--------------------------------------------------
2204: 2011-01-05 12:59:46.520 [CBS] Error (Id=0) Function: 'ReadUpdateInfo()->Update_GetInstallState' failed: 80070bc9 (-2147021879)
2204: 2011-01-05 12:59:46.520 [CBS]                       <<<GetUpdateInfo--------------------------------------------------
2204: 2011-01-05 12:59:46.598 [DISCOVERY]                 hr: -2147021879 -> reboot required.
2204: 2011-01-05 12:59:46.739 [InstallationProgressPage] About to load finish page...
2204: 2011-01-05 12:59:46.739 [InstallationFinishPage]    Loading finish page
2204: 2011-01-05 12:59:46.801 [InstallationFinishPage]    Finish page loaded
I also checked the event viewer, here are the event properties occurred during the installation:
Initiating changes to turn on update DirectoryServices-DomainController of package DirectoryServices-DomainController-Package. Client id: RMT
Update Directoryservices-DomainController of package DirectoryServices-DomainController-Package failed to be turned on. Status: 0x80070bc9
Installation failed. A restart is required.
Roles:
Active Directory Domain Services
Error: The server needs to be restarted to undo the changes
Please help.
Thanks,
balrogz

Another thing to check is to ensure the server service is up and running.
http://blogs.dirteam.com/blogs/paulbergson/archive/2014/04/29/can-t-add-the-role-quot-active-directory-domain-services-quot-to-my-2008-r2-server.aspx
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

I have windows server 2012 R2 and install active directory

My question is I install active directory in windows server 2012 R2 and create Group Policy. ( These set-up is only for test)
Have not registered domain only install active directory to test.
So the problem is when I created Group policy for my user and put software restriction policy but its affected to my administrator accounts too, No when I open VMware (install Virtual Machine windows XP) and start os then its shows you can not user this
software as you restricted from installing software (Something like that don't know exact Error). I could not start installed Virtual Machine.
Please give me a solution for this.
This is the setup for a test use only so their not big environment connect with my pc.
Thanks in advance.
Regards,
Krunal

Hi,
The following article is talking about creating and managing Group Policy on a Windows Server 2012:
http://www.thomas-krenn.com/en/wiki/Creating_and_managing_a_Group_Policy_on_a_Windows_2012_Server
As Darren Blanchard mentioned, if you want to apply the GPO, you could link it to an OU that contain the computer or user.
Group Policy Overview
http://technet.microsoft.com/en-us/library/hh831791.aspx
Please feel free to let us know if you need further assistance.
Regards.
Vivian Wang

Cannot install Active Directory Domain Services on Server 2012 R2

Hi all,
I'm having some trouble installing the AD DS role onto my virtual server. I keep getting "The request to add or remove features on the specified server failed. The operation cannot be completed because the server that you specified requires a restart."
After the install fails the DFS Namespace service stops and I cannot refresh the server manager.
This server is currently dishing out DHCP and also has VIPRE anti virus on it.
I did a ton of research on the problem but can not find anything specific to this issue.
Any help would be greatly appreciated. Thanks!

Hi Dave,
I ran the DISM.EXE/Online/Cleanup-image/Restorehealth command and Windows did not find any corruption.
I then attempted to install active directory and was greeted with the same errors as I expressed in my first post.
I ran the DISM.EXE/Online/Cleanup-image/Restorehealth command again and windows found corruption and fixed the corruption.
I tried to install active directory again (was able to refresh the server manager at this point and did not need to reboot the server to attempt another install, maybe that is the corruption windows fixed?) but it failed.... with the same errors I always
get.
The active directory install always freezes on 64% and then bombs out.
I shutdown the VM and rebooted... before the login screen Windows attempts to configure updates but fails. Could this be the cause?
Thank you,
-Matt

Installing ADFS on Active directory-DC it self Is OK ?

Similar Messages

Maybe you are looking for