Standing down a standalone ADFS server.

Drew Cor 116 Reputation points
2020-12-17T14:43:18.297+00:00

We had one adfs server for SSO to a couple of external resources (NOT Microsoft). We have since added Enterprise apps in AzureAD for those resources and use AAD for our SSO.

I can find many docs on retiring one server from a farm but nothing standalone. Also nothing related to non-aad SSO.

The server is no longer needed. Can I just shut it down. Delete the VM and any dns records pointing to it.
Is there a proper procedure for shutting down the last (only) adfs server? Is there anything that need to be done in, for example, adsiedit?

Thanks!

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,193 questions
0 comments
Accepted answer
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-12-17T15:09:30.927+00:00

    When you are sure you do not need the ADFS server you can just shut it down.

    I would take a last back up with the Rapid Restore PowerShell module just in case you need to restore it.

    If you want to be thorough, you can delete the DKM containers in AD:
    49241-image.png
    They are visible only if you enabel the Advanced Features in the View menu of the dsa.msc console and if you are connected with a domain admin account.

    You can also delete the DNS record. Revoke the TLS certificate (if that was dedicated to ADFS) with the statys Cease of Operation (although you might want to wait a couple of weeks in case you want to restore the farm, so you might just suspend it for now and set it to the status Certificate Hold). Disable the service account used for ADFS (then delete it). Decommision the WAP servers if any.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest