Windows 10: ADFS Extranet Smart Lockout

We're looking to enable ESL in ADFS on Windows 2019 and based on the overview https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-lockout-protection, it references the PowerShell command Update-AdfsArtifactDatabasePermission.On entering the command, we're getting:Update-AdfsArtifactDatabasePermission : The term 'Update-AdfsArtifactDatabasePermission' is not recognized as the name of a cmdlet, function, script file, or operable program.We've checked our 2019 server and it's installed all the updates and our domain level is 2012 R2.Is

:)

 

ADFS Extranet logon Issue

I have a single ADFS server setup in my domain to provide SSO for our internal applications and (internally) this is working very well.

The issue is when we try to access one of these applications from outside the domain.

I was expecting ADFS to present its own login page but what we see is just the grey dialog window asking for a user id and password for the ADFS server. These credentials are never accepted and after 3 attempts the dialog window is not shown again.

I think the ADFS server is seeing these (non domain) requests as intranet requests rather than extranet

The reason I say this is because I if I remove the windows authentication from the ADFS intranet authentication methods and set it to be forms then I see the ADFS login page in my (non domain) browser. Set it back to windows authentication or windows authentication
and forms and the grey dialog window is displayed.

Any help/pointers would be most appreciated

Thanks

Ian

 

Recommendation: Load balancer for ADFS environment?

We want to put in ADFS for our current network to support about 30K authenticated users, currently to start off just for sharepoint application, but potentially will support other application/ users as well.

Looking for recommendation on whether we should go with virtual or hardware based Load Balancer, and
which vendor of LB that people tend to adopt for their ADFS and WAP servers? Imagine we'll need to get the LB that can support Layer 7

Here is how we are currently spec'ed out so far:

• 2 WAP servers (Win2016) sit behind a LB and all on DMZ
• 2 ADFS servers (Win2016) sit behind another LB and all on Internal network
• DC server is on Internal network as well

----

Can anyone explain how the traffic/federation process goes (step by step) when user access the website from the internet (please include how request is being passed/redirect between webserver, WAP, ADFS, and DC servers)

Thanks!

 

ADFS to Azure

What is best practice and steps to move ADFS\MFA from on premise Windows Server 2012 R2 to Azure for HA?