You can set up ADF's in a farm configuration with multiple servers for redundancy and either use the
Windows internal database to store the ADF's data or configure ADF first to use SQL Server or a SQL
Server farm.
Some organisations want a simpler deployment though with only a single ADF's server.
But they still want some assurance that the service could be restored quickly if there is any kind of
problem.
The ADF's Rapid Restore Tool provides a way to back up your ADF's data and restore this state of the
server all using PowerShell commands.
You can back up the data to a folder on the computer or on the network, or there is built in support
to send the data to a blob storage container in an Azure storage account.
This lets you restore your HDFC after a problem onto another server or even the same server.
Or you can use the tool to create a copy of your production ADF's server and deploy it to another environment
for testing.
You can also use the tool to migrate from using the Windows internal database to using SQL Server and
vice versa.
The tool backs up the ad fs configuration database.
All configuration files.
The SSL certificate used by the service as well as any externally enrolled certificates like those used
for token signing, decryption and communication with another ADF service.
The automatically generated token signing and decrypting certificates and private keys that are stored
in the container in Active Directory.
And it also backs up the list of custom authentication provider's attribute stores and local claims
provider trusts that are installed in order to run the PowerShell commands.
The user needs to be at least a local admin on the ADF's server.
If you plan to back up the dkim container in Active Directory that stores the token encrypting and signing
certificates, you need to be a domain admin or pass in the ad fs service account credentials.
If the ad FS service account is using a group managed service account as we are in our deployment,
then the user needs to be a domain admin.
Now let's see how to do this.
I'm on the ADF's server and I've created a local folder here to store the backup.
You should store the backup on a network share though, in case the server goes down.
Or even better, store them in an Azure storage account.
We'll just put them here for the demo.
Let's open up a browser and download the tool.
We can get it by going to the ADF's help website at ADF Shell Dot Microsoft.com.
Let's open up offline tools and scroll down to the bottom.
Click on ADF's Rapid Restore Tool and that brings us to the documentation.
A little further down, there is a link to download the tool that brings us to the download center.
Let's click download and get the Messi file.
Once that downloads, I'll run it.
And this is a standard click next to install.
So we'll just go through this quickly.
Okay, let's close this and let's go down to the start menu and open up PowerShell and I'll open it
as an administrator.
And let's just create some space here.
Now, the first thing we need to do is import the module in the delta that was installed.
So let's run import module in the path to the delta is in the program files x86 folder, ADF's Rapid
Recreation tool, and the Delta has the same name as the folder.
Now let's run the command back up the FS.
The storage type will be file system, but we could back this up to Azure.
The storage path will be the local folder I created.
The encryption password is just a string, so I'll just use this and you can add a backup comment and
I'll show you how that's used shortly.
And finally there is an optional switch to back up the DXM.
This is a container and Active Directory I mentioned that contains the token signing and decrypting
certificates generated during ad fs install.
Because I'm running this for the first time.
PowerShell is installing the ad tools on this computer, and then the backup command is running.
It says successfully backed up ad fs node.
Let's just go over to the local folder and here is the backup that was created.
You can see it has a date and time stamp in the folder name.
There are XML documents.
The live file is the Active Directory container and the service certificate is backed up also.
Now let's actually run this command again to create another backup and let's just change the backup
comment.
The configuration is backed up again and let's go back to the folder and navigate up.
So now there are two folders created.
Next, let's restore one of these configurations that's done with the command, restore the FS.
The storage type is file system.
The path is the master folder that contains all our backups.
Notice that we don't have to scope this to a particular backup.
We need to enter a decryption password, so I'll make sure that's the same password we used to encrypt
the contents and we want to restore the dkim container in Active Directory.
And now we get the option to choose a backup.
This is where the backup comments are really helpful.
You can choose your backup based on some description rather than just a date.
So I'll choose the initial install by typing the ID number.
I'm actually going to slow this down so you can see what's happening.
It says validating backed up files and decrypting them, then copying over relevant certificates.
Next, it's adding the ADF's role to the server.
But we already have that installed on the server.
Now it's installing and configuring the ADF's firm, importing data into the ADF's database.
Copying over configuration file and finally going over some minor details.
And the message says we've successfully restored the ADF's node.
Let's go to server manager and up to tools and open up the ADF's management console and the service
is running.
In this module you've got an overview of ADF, PFS and learned about the new features in ADF's 2019.
I went through the configuration of my lab environment and then you learned about the different certificates
used by ADF's.
Next we installed ADF's into a fresh Windows Server 2019 environment and then you learned how to upgrade
from earlier versions of ADF's and you saw that in the demo.
Next we talked about the ADF's Help website and the tools and utilities there.
And then you saw the Diagnostics Analyzer tool and the Ad FS Rapid Restore Tool.
In the next module, we're going to dig into claims based authentication and how the claims engine in
ad fs works.