Home active directory ad fs iis windows server

AD FS 2.0 Uninstall: Ensure Clean IIS & Active Directory with These Steps

Updated: • 0 • min read
Table of Contents

Introduction

Uninstalling Active Directory Federation Services 2.0 (AD FS 2.0) from your system is a straightforward process facilitated by its uninstallation wizard. However, it’s crucial to understand that the wizard’s actions are limited and may not fully revert all system settings to their pre-installation state. Specifically, manual intervention is often necessary to ensure a complete and clean removal, particularly concerning Internet Information Services (IIS) and Active Directory configurations. This is especially relevant in two common scenarios: when uninstalling AD FS 2.0 from a federation server or federation server proxy, and when removing the last federation server from a farm. In these situations, the automated uninstallation process might leave behind residual configurations that can lead to complications in future deployments or system stability. Therefore, a thorough manual cleanup is highly recommended to avoid potential conflicts and ensure a clean system state.

Potential Issues After Uninstallation Without Cleanup

Failing to manually clean up IIS and Active Directory after uninstalling AD FS 2.0 can manifest in various issues, especially if you plan to reinstall AD FS 2.0 or deploy other web applications on the same server. These issues primarily arise from leftover configurations that interfere with new installations or deployments. For instance, when reinstalling AD FS 2.0 without prior cleanup, you might encounter warnings or errors during the configuration phase. These warnings often indicate the presence of existing website configurations, preventing the redeployment of default AD FS 2.0 websites. Error messages might also appear, highlighting directory conflicts and the inability to copy website files due to pre-existing directories. These symptoms are not merely cosmetic; they can represent underlying configuration conflicts that may affect the functionality and stability of AD FS 2.0 or other applications. Recognizing these potential issues underscores the importance of a meticulous cleanup process to maintain a healthy and predictable system environment.

Step-by-Step Guide to Restore IIS on Federation Server or Federation Server Proxy

When AD FS 2.0 is installed on a server configured as a federation server or federation server proxy, it intricately integrates with IIS, creating virtual directories and application pools to host its services. Specifically, the installation process typically establishes the /adfs and /adfs/ls virtual directories within the Default Web Site in IIS. Additionally, a dedicated application pool named ADFSAppPool is created to manage the AD FS 2.0 web applications. However, the AD FS 2.0 uninstallation wizard does not automatically remove these IIS components. These lingering components can cause conflicts if AD FS 2.0 is reinstalled on the same server or if other web applications are deployed that might utilize the same resources. Therefore, manually removing these components is a critical step in ensuring a clean uninstallation and preparing the server for future use.

Removing Virtual Directories and Application Pool

To manually remove the virtual directories and application pool associated with AD FS 2.0 from a decommissioned federation server or federation server proxy, adhere to the following steps:

  1. Initiate the IIS Manager by navigating through the Windows Start Menu to Administrative Tools and selecting IIS Manager.
    IIS Manager

  2. In the IIS Manager interface, expand the server name node located in the Connections pane on the left side. Subsequently, expand the Sites node and select Default Web Site. This action will display the content of the Default Web Site in the center pane.

  3. Within the Actions pane, typically located on the right side of the IIS Manager window, locate and click on View Applications. This will display a list of applications and virtual directories hosted within the Default Web Site.

  4. Carefully examine the list of applications. You should identify two virtual directories specifically associated with AD FS 2.0: /adfs and /adfs/ls. These represent the core web components of AD FS 2.0.

  5. For each of these AD FS 2.0 applications (both /adfs and /adfs/ls), right-click on the application entry and select Remove from the context menu. Confirm the removal when prompted. This action will delete the virtual directories from IIS.

  6. Next, in the Actions pane, locate and click on Application Pools. This will switch the view in the center pane to display a list of application pools configured on the IIS server.

  7. Scroll through the list of application pools and identify the application pool named ADFSAppPool. This is the dedicated application pool created for AD FS 2.0.

  8. Right-click on the ADFSAppPool entry and select Remove from the context menu. Confirm the removal when prompted. This action will delete the application pool from IIS.

Deleting the adfs Directory

After removing the virtual directories and application pool from IIS, the next step involves deleting the physical directory associated with AD FS 2.0. This directory, typically named adfs, is located within the inetpub directory, which by default resides on the system drive (usually C:\). It’s important to note that if you have made any custom modifications or stored any important data within the adfs directory, it is strongly recommended to back up this content to a separate location before proceeding with the deletion. Data loss is irreversible, so precaution is paramount.

To delete the adfs directory, follow these steps:

  1. Open File Explorer and navigate to the inetpub directory. The full path is typically %systemdrive%\inetpub, which usually resolves to C:\inetpub. You can directly type this path into the File Explorer address bar and press Enter.
    File Explorer

  2. Once inside the inetpub directory, locate the directory named Adfs. This is the directory you need to delete.

  3. Right-click on the Adfs directory and select Delete from the context menu. Confirm the deletion when prompted. The directory and its contents will be moved to the Recycle Bin. If you are certain you will not need to recover the contents, you can permanently delete it from the Recycle Bin as well.

By completing these steps, you have effectively restored IIS to a clean state after uninstalling AD FS 2.0, removing potential conflicts and ensuring a smoother system operation for future deployments or re-installations.

Step-by-Step Guide to Delete the Certificate Sharing Container in Active Directory

When AD FS 2.0 is configured to create a new federation server farm, it establishes a certificate sharing container within Active Directory. This container serves as a central repository for certificates used by all federation servers within the farm, facilitating certificate sharing and management across the farm. However, when the last federation server in a farm is uninstalled, the uninstallation process does not automatically remove this certificate sharing container from Active Directory. This orphaned container can persist in Active Directory and, in some scenarios, might cause confusion or potential issues in future AD FS deployments or Active Directory management. Therefore, it’s best practice to manually delete this container to ensure a complete and clean removal of AD FS 2.0 farm components from Active Directory.

Identifying the Certificate Sharing Container Location

Before proceeding with the removal of the certificate sharing container, it’s essential to first determine its exact location within Active Directory. This location is identified using PowerShell commands executed on an AD FS 2.0 Security Token Service (STS) server before uninstalling AD FS 2.0 from the last server in the farm. This step is crucial as it provides the necessary information to target the correct container for deletion in Active Directory.

Follow these steps to identify the container location:

  1. Open PowerShell as an administrator on an AD FS 2.0 STS server that is part of the farm you are decommissioning.

  2. Load the AD FS PowerShell snap-in by executing the following command:

    Add-PsSnapin Microsoft.Adfs.Powershell

    This command loads the necessary cmdlets for managing AD FS.

  3. Retrieve the AD FS properties, including the certificate sharing container location, by executing the following command:

    Get-AdfsProperties

    This command retrieves various properties of the AD FS configuration.

  4. Examine the output of the Get-AdfsProperties command. Locate the property named CertificateSharingContainer. The value of this property will be the distinguished name (DN) of the certificate sharing container in Active Directory. Note down this value carefully, as it will be used in the subsequent steps to locate and delete the container. The value will resemble a path within your Active Directory structure.

Deleting the Container using ADSI Edit

Once you have identified the location of the certificate sharing container using PowerShell, you can proceed to delete it using the ADSI Edit tool (ADSIEdit.msc). ADSI Edit is a Microsoft Management Console (MMC) snap-in that allows you to view and edit Active Directory objects and attributes. It provides a direct interface to the Active Directory structure, enabling the deletion of the certificate sharing container.

Follow these steps to delete the container using ADSI Edit:

  1. Log on to a server where the ADSI Edit tool (ADSIEdit.msc) is installed. This could be a domain controller or any server with the Remote Server Administration Tools (RSAT) installed.

  2. Open ADSI Edit by clicking Start, then Run, typing ADSIEdit.msc, and pressing ENTER. This will launch the ADSI Edit console.

  3. In the ADSI Edit console, you need to connect to the Default naming context of your Active Directory domain. To do this, right-click on ADSI Edit in the console tree and select Connect to….

  4. In the Connection Settings dialog box, under Connection Point, select the radio button Select a well-known Naming Context. From the dropdown list, choose Default naming context. This will connect ADSI Edit to the domain partition of your Active Directory.

  5. Click OK to establish the connection.

  6. In the ADSI Edit console, expand the following nodes in the console tree, navigating down the path based on the structure of your Active Directory and the information you obtained from the CertificateSharingContainer property in PowerShell:
    Default naming context -> {your domain partition} -> CN=Program Data -> CN=Microsoft -> CN=ADFS.
    Replace {your domain partition} with the actual domain partition name of your Active Directory.

  7. Under CN=ADFS, you will see one or more containers named CN={GUID}, where {GUID} represents a Globally Unique Identifier. Each of these containers corresponds to an AD FS 2.0 farm that has been deployed in your environment. Identify the container where the {GUID} matches the CertificateSharingContainer property value you noted down earlier from the PowerShell command output.

  8. Once you have located the correct CN={GUID} container, right-click on it and select Delete.

  9. Confirm the deletion when prompted. This action will permanently delete the certificate sharing container from Active Directory.

By completing these steps, you have successfully removed the certificate sharing container from Active Directory, ensuring a complete cleanup of AD FS 2.0 components after uninstallation and preventing potential residual configurations from affecting future Active Directory operations or deployments.

By diligently following these procedures for restoring IIS and cleaning up Active Directory, you can ensure a complete and clean uninstallation of AD FS 2.0, mitigating potential issues and paving the way for a stable and predictable system environment for future deployments or re-installations. Your proactive approach to system maintenance will contribute significantly to the overall health and reliability of your IT infrastructure.

Do you have any questions or further insights on cleaning up AD FS 2.0 environments? Share your thoughts in the comments below!

Post a Comment