Now let's install AD first 2019.
I have a server 2019 environment created in Hyper-V and I'm on a domain joined Windows ten VM that has
the remote server manager tools installed as well as the Windows Admin Center.
I'm logged in with my domain administrator account.
So let's open up the Windows Admin Center.
This is a browser based app for managing Windows servers and other infrastructure, and it comes as
part of your Windows Server licensing.
There's already a connection to one machine in the environment, and that's the Windows ten VM that
I'm on right now.
So let's add a connection to the domain controller.
We do this by clicking AD and Windows Server.
From here we just enter the server name and then click Add.
Now let's do the same thing and add the ADF's server as a connection.
That server is called ADF 41 and let's add that as well.
Now let's connect to the domain controller by selecting it in the list.
That brings us to the overview page for the server.
Let's scroll down the list and click on PowerShell.
This creates a remote session to the server where we're authenticated with the account of the logged
in user on my local machine.
Let me just create some space and zoom in by holding down control and clicking the plus sign on my keyboard.
The reason I'm on the domain controller first is that we're going to be creating a group managed service
account to use as the identity for the ad fs service running on the ad FS server.
But before you can create a group managed service account, you need to generate a route key for the
key distribution service, and that's done on the domain controller.
You only need to do this once in your environment to make it ready for use.
The PowerShell command is at Cdw's root key, and by default, domain controllers will wait up to 10
hours before allowing the creation of group managed service accounts using the root key.
That so all the domain controllers have time to converge there and replication.
So in a test environment, in order to use this right away, we'll add the parameter effective time
and the value will be the current time using get date and we'll use the function add hours to subtract
10 hours from the current time.
So we're making this root key fully available for use right now.
We're going to let the ADF's configuration wizard create the group managed service account that ADF
will run as.
But first we're going to add a DNS entry for the ESFS service that we're about to create.
So let's open up server manager next and add the domain controller to the all servers list.
And let's do the same thing for the ADF's server.
From the tools menu, go to DNS.
You may need to retarget the interface to the domain controller unless you've already done that.
Now let's expand forward lookup zones and go to the company dot price zone.
Here are the computers that are already registered on the domain and that includes the ad FS server.
Because we're only installing a single ADF's server and not a farm.
We're going to point the ADF's service URL to that single ADF server.
So let's right click and create a new A record.
It will use the same parent domain of company dot pri.
So I just need to type that's and the IP address will be the IP address of the ad FS server.
Remember, if we had a farm, we could point this to the load balancer virtual IP address.
Now let's go back to the Windows Admin Center and let's click the dropdown for Server Manager and click
on Server Manager to return to the home page.
Now let's start configuring the ad FS server.
Let's scroll down to roles and features and in the list on the right, select Active Directory Federation
Services.
Now let's click install at the top.
I'll speed things up a bit while this installs.
Now, before we can configure ADF's on this server, we need to import the certificate we created earlier
that will be used by the ADF service.
We copied that certificate over to the ADF RFS server in the previous clip.
We'll import the certificate using PowerShell.
So scroll up to the PowerShell menu item and let's create some space on the screen and zoom in a bit
now because the private key is protected with a password.
We need to get a reference to that password as a credential.
So I'll type this command, get credential.
The username doesn't matter.
It's just the password that we need.
This prompts me for the password used to export the certificate, so I'll enter that.
Now let's run the command import certificate and the file path is the shared folder I created on the
sea drive and copied the certificate file into the search store.
Location is the local machine personal folder.
The password is the variable we just set up and the property we want to use is password and let's add
this parameter exportable so we can export the key.
Later when we do a backup of the ADF's settings using a utility, I'll show you later in this module.
Okay.
The certificate was successfully imported.
Let's go to server manager and there's a notification at the top.
There's a link here to configure the federation service on the ADF's server.
Let's click that.
Leave the default to create the first Federation server in a Federation server form and click next.
We need domain administrator permissions to perform the configuration, so lets enter the credentials
of an account that has those permissions.
Now we specify the service properties.
First, let's select the certificate we just imported to the local machine personal store, and that
fills in the Federation service name.
You can change it if you need to.
For example, if you selected a wild card certificate as the SSL certificate, now we give the service
a display name when we have forms based authentication enabled.
This name will show up on the HDFC Login page.
Now click next.
Here we can select an existing service account for the ADF's service to run under.
Or we can let the wizard create a new group managed service account for us.
Let's do that.
I'll just give the service account the name for Ansar.
And let's click next.
Here we choose whether we want to create a database on this server for storing configuration information.
ADF's can use the Windows internal database or you can specify a SQL Server somewhere on the network.
With the Windows internal database, ADF will replicate the data to each federation server in the farm.
But if you use a SQL Server, you have benefits like support for a larger number of trust relationships,
support for token replay detection and typical SQL Server features like database mirroring, failover
clustering, reporting, and the management tools.
For this test environment.
The Windows internal database is fine.
So let's click next.
Now we get a summary of the changes and we can generate a PowerShell script at this point to automate
the installation on additional servers.
Let's click next.
And there are some prerequisite checks running.
There's just this warning about the root key we just created, but that just has to do with it being
created recently.
So that's fine.
Let's go ahead and configure add FS.
I'm going to speed things up a bit because this takes about a minute to complete.
Okay.
Now let's close this.
And we need to restart the ADF's server.
Since we're already inside Server Manager, I'll click on all servers and right click on the Add First
Server and let's restart the server and I'll speed this up as well.
The next thing we need to do is to test the installation.
The easiest way to do that is to enable the ID initiated sign on page for the ad fs service.
For that, we need to run some PowerShell.
Now let's run the commands, set its properties, and the parameter we want to use is enable it initiated
sign on page and set that value to true.
There's no errors, so it completed successfully.
Now we can test the installation by navigating to the page that just got enabled and that's HTTPS.
The name of the ADF's service, which is AD Start Company Dot.
And then the path to the sign on page is slash ad slash a less slash ad initiated signature dot FTM.
Let's zoom back out a bit here and let's click sign in by default.
Windows Authentication is enabled as the default authentication method for the Internet, and we haven't
added the service URL to the Internet sites for the browser yet.
So we get this pop up to enter our Windows credentials and now it says we're signed in.
We've successfully installed a fresh copy of ADF's in this Windows Server 2019 environment.
Next, let's look at updating an existing 2016 environment.