Welcome to Management Pack Wiki! Your documentation pro for SCOM Management Packs
0 comment(s) Post a comment

AD FS Windows Service Failed to Start Because of Configuration Load Error Monitor

  • ID:  Microsoft.ActiveDirectoryFederationServices.10.0.FederationServerServiceConfigurationInitializationErrorMonitor
  • Description:  AD FS Windows Service Failed to Start Because of Configuration Load Error
  • Target:  Federation Server
  • Enabled:  Yes

Operational States

Name State Description
FirstEventRaised Error FirstEventRaised
SecondEventRaised Success SecondEventRaised

Alert Details

Monitor State Message Priority Severity Auto Resolution
FirstEventRaised (Error) AD FS Windows Service Failed to Start Because of Configuration Load Error Medium Critical Yes

Run As Profiles

Name
Default

Monitor Knowledgebase

Summary

The AD FS Windows service failed to start because the AD FS configuration database could not be loaded correctly.

If the AD FS Windows service is started successfully, the monitor will change to a Green state and the original critical alert will be resolved automatically.

Causes

The following are possible causes for this event:

Cause

Resolution

The remote computer that is hosting the SQL Server database is not reachable.

Use Ping.exe to verify that the remote computer can be reached from the federation server.

The computer that is running SQL Server and that is configured for storing AD FS configuration data is not started.

Start the SQL Server instance that hosts the AdfsConfiguration database.

Verify that the service is running the "sc query mssqlserver" on the computer that hosts SQL Server, and ensure that STATE = RUNNING. This assumes that the default instance of SQL Server is being used. Each SQL Server database instance has its own services, and you can check their names by looking at the Services node in Server Manager. When you locate the corresponding named instance, start the service by using "net start mssqlserver" on the remote computer that is running SQL Server.

The Windows Internal Database (WID) that is configured for storing AD FS configuration data is not started.

Start the WID instance that hosts the AdfsConfiguration database.

Verify that the service is running the sc query mssql$microsoft##ssee on the computer that hosts the Federation Service, and ensure that STATE = RUNNING. Note that this is the name of the default WID instance that is being used. Start the service by using net start mssql$microsoft##ssee on the federation server computer.

The AD FS Windows service identity cannot log on to SQL Server.

Ensure that SQL Server is running under a built-in account, such as NetworkService or LocalSystem. If SQL Server is running under a domain account, verify that the service principal name (SPN) for that account has been registered correctly.

To verify the SPN, use the following syntax with the SetSpn.exe command:

SetSpn -L <serviceaccount>

The output of this command should have MSSQLSvc/<SQL server name>.

Another possible resolution for this error includes connecting to SQL Server using SQL Management Studio, and verifying the following settings:

  • Confirm that the AD FS Windows service identity is present under the Security->Logins node in the SQL console.

  • Confirm that the AD FS Windows service identity is present under Databases->AdfsConfiguration->Security->Users, and that it owns the IdentityServerPolicy schema.

The AD FS Windows service identity can log on to SQL Server, but it does not have access to the AdfsConfiguration database.

Using SQL Server Management Studio, make the AD FS Windows service identity the owner of the IdentityServerPolicy schema (see the previous resolution).

SQL Server is timing out.

The following are possible resolutions for this error:

  • Determine the query load on the SQL Server installation by looking at other databases that are hosted on the computer.

  • Consider hosting AdfsConfiguration on a dedicated server.

  • Restart SQL Server.

AD FS endpoints do not have ACL permissions set correctly.

Run the AD FS Federation Server Configuration Wizard again to repair ACL permissions for the specified endpoints.

Resolutions

See above.

External References
This monitor does not contain any external references.

See Also for Active Directory Federation Services Management Pack


Downloads for Active Directory Federation Services Management Pack

Post a comment