I'm on my Windows ten management VM and this time it's joined to a different environment where I have
the Windows Server 2016 domain controller and adds first running on a Windows Server 2016 VM.
There's also a Windows Server 2019 VM that's joined to this environment, but it doesn't have ad fs
installed yet.
The only additional configuration I've done is to create a file share on the 2019 server, so we'll
be able to copy the SSL certificate onto it that's used by the ADF's 2016 service.
So first let's make sure ADF's is working by logging into the ADF's test page in the 2016 environment.
The URL is exactly the same as it was in our 2019 environment because I'd use the same domain name company
dot PRI and the path to this page is the same on every ADF's version.
So I'll log in with my account because I have form based authentication enabled and I'm able to sign
in.
Okay, we're going to do some of the configuration in PowerShell and some using server manager.
I have two PowerShell windows open, and I've opened both as an administrator.
In the first window, the blue one I'm going to remote into the ADF's 2016 server.
And you can do that with the Enterprise Session Command.
Now it shows we are connected remotely so we can run PowerShell commands on that computer.
Next.
Let's do the same thing in the other PowerShell window, but this time all remote.
Enter the Windows Server 2019 computer that we're going to use for ADF's 2019.
Now let's go back to the remote session to the ADF's 2016 computer.
The first thing we need to do is to get a reference to the SSL certificate used by the ADF's service.
So I'll create this variable thumbprint and use the command get child item with the path to the local
machine, personal certificate store and pipe that into a where clause that searches for the common
name of the certificate, which I already know is that Scott Company dot PRI.
All this PowerShell is in the course downloads, by the way, so you don't need to copy it down as we
go.
Now let's see the value in that variable with the right output command.
Good.
Now we need a password variable to use when we export the certificate with its private key.
We do that with convert to secure string and I'll give it a value that's easy to remember and add these
parameters.
Now let's export the certificate.
We do that by getting a reference to the certificate with get child item.
The path to the certificate and use the thumbprint to identify the certificate.
And we'll pipe the result of that into export certificate and we'll just place this on the route of
the C drive.
So it's easy to find and I'll name the file the same as the common name, but with the extension x and
add the password we just created.
Great.
Now.
I said at the beginning of the demo, I've already created a shared folder on the ad FS 2019 server.
So let's map that to this 2016 VM using PowerShell.
Use the command new drive and the name will be the H Drive.
The PS provider is file system.
The route is the share on the 2019 server, which is called transfer.
And we need to add a credential.
So I'll use my admin account.
In the pop up, I need to supply the password.
And now that file share on the 2019 computer is mapped onto this 2016 computer.
Now let's copy the SSL certificate over to the server 2019 computer.
You do that with copy item.
And since we are scope to the root of the seed drive already, I'll use the backslash and the name of
the certificate file.
And the destination is the route of the drive, which of course is a folder on the 2019 computer.
Okay.
We're done for now on this remote session into the IDF's 2016 computer.
Let's go over to the session to the 2019 computer and import the SSL certificate.
First I'll create that password variable again with the same value we use to export the certificate.
Then let's run this command import certificate with the file path to the folder on the 2019 computer
that the file share maps to, which is this transfer folder at the root of the C drive.
The certificate store we want to install this in is the local machine personal store.
We need to use the password to import the private key and will mark the certificate as exportable from
here also.
Okay, good.
Since we're going to be adding this 2019 server to the load balancer for ADF's, let's install the Nhlbi
Windows feature along with the management tools.
Next, let's install ADF face and we could do that from server manager, but let's do it here with the
install Windows Feature Command and the service is called at Federation.
Okay.
Now we need to configure ADF face on the 2019 computer.
We could do that with PowerShell, but let's do it in the interface.
I'll go over to server manager.
I'm still on this Windows ten management VM and I've already added the two servers.
So if I refresh the interface, we get this message to configure the Federation service, and this is
coming from the 2019 computer.
So let's run this.
This is the same wizard you saw earlier, but this time we're going to add a federation server to a
federation server form.
We need to specify credentials that have domain administrator permissions.
So I'll enter mine.
And now, because we're adding this ADF's server to a farm that uses the Windows internal database,
we need to specify the name of the Primary Federation server, which can't be the server yet.
So I'll specify the RFQ dean of the ADF's 2016 server.
Next, let's select the SSL certificate that we imported using PowerShell.
On the next screen, we need to specify the service account that the ADF's service will run under.
I have a group managed service account created and the ADF's 2016 instance is already using this account.
So let's use that one.
Let's click next and we're ready to configure.
This will take a minute, so I'll speed it up.
And we need to restart the server.
So let's right click on the 2019 server in server manager and choose restart server.
I'll speed this up also.
And once that restarts, I'm going to actually remote into the ADF's 2019 server because we can't use
the ADF's console remotely.
I just want to open it up on the server and show you that it says the computer is not the primary federation
server in the farm and there are no nodes showing in the tree on the left because you can't make changes
to DFS from a secondary node.
So we're going to promote the server to be the primary server in the ADF, RFS farm.
Let's go back to the Windows ten Management VM and first let's add the 2019 server to the network load
balancer for the ad FS service.
I'll go to tools in Server Manager and Open Network Load Balancer Manager.
Right click on the root and let's connect to an existing cluster.
The host for this cluster is currently the ADF's 2016 computer.
So let's connect to that.
And this Nhlbi cluster only has one computer right now and the cluster has the virtual IP that the DNS
entry points to for the ADF's service.
This is different than the single server installation that you saw earlier.
So let's right click on this cluster name and add a host to the cluster.
Take the name of the ad FS 2019 server and connect.
There are two network interfaces on this VM, so let's choose the one that's on the internal network
and click next.
We can just click next and finish.
It can take a few minutes for the Nhlbi to update, so I'll speed this up quite a bit and the configuration
is ready.
So before we go any further, let's just open up the browser again and navigate to the ADF's sign in
page.
And let's just make sure that everything is still running.
We have to ADF's servers right now, but they're still running in ADF's 2016 mode, so we can't use
any of the new 2019 features yet because it's a mixed farm.
Now let's go to the PowerShell window with a remote session to the 2019 server.
We've been logged out because I restarted the VM.
So let's start a new remote session.
Now let's run this command.
Get at Sync Properties.
And it says this ADF's server has the role of secondary computer.
So let's change that by running the command set at sink properties and the role will be primary computer
and let's just verify that.
Now we're not done because we need to make the 2016 computer the secondary.
That doesn't happen automatically.
So let's go back to that remote session to the 2016 server and run the same command set at Sync properties.
But let's make the role secondary computer, and we need to specify a primary computer name.
So I'll enter the RFQ, the end of the ad FS 2019 computer.
Okay.
Now let's get the sync properties of this 2016 computer.
It says it's the secondary computer and we can see the 2019 computer is the primary.
Now let's remove this ADF's 2016 computer from the load balancer so it won't be receiving any more requests.
All right, click on the 2016 computer and click Delete Host.
Okay.
Let's go back to the remote session into the 2016 computer and let's uninstall the ADF's role from this
computer.
I'll use the Uninstall Windows Feature Command and I need to enter my ad in an account as the credential
and enter my password.
Now we need to restart the 2016 computer for the changes to take effect.
We're almost ready to upgrade the farm behavior level.
Back in the remote session to the ADF's 2019 computer.
Lets run the command get adds far more information.
It shows the current farm behaviour level is three, which is ADF's 2016.
It still shows to form nodes though, even though we uninstalled the service from the 2016 server.
So let's remove this node manually.
We can do that with set at farm information and the remove node parameter and specify the name of the
node we want to remove.
Now let's run get adds, form information again.
Now, before we update the farm behavior level, we can check if there are any potential issues.
Let's first get a reference to a credential that has admin permissions.
So I'll take my account information in.
Now let's run this command test.
That's farm behavior level raise with a credential variable.
It says all the checks passed successfully.
So we're ready to run the update command.
Now, it's possible to run the command from a remote session, but I strongly recommend for this one
to remote into the ad fs 2019 computer and run it from there.
Otherwise you may get this error, which probably relates to a permission issue using remote PowerShell.
Let's do that.
I'll go to the ADF's 2019 VM and first let's close the ADF's console and reopen it from server manager
just to show that we can now manage the service from this VM because it's now the primary node in the
farm.
But let's open up PowerShell and run this last command.
The command is in vulcan's form behavior level res.
You just need to confirm and ADF's is creating a new configuration database and copying the old values
over.
It says the configuration completed successfully.
Let's just run get adds form information again.
Now the current farm behavior level is four, which represents ad FS 2019.
Let's go back to our Windows ten Management VM and let's sign in again.
We're successfully signed in.
So that's upgrading your ADF's 2016 environment to ADF's 2019.
Next, let's look at some utilities for S.