Clean Up IIS and Active Directory After ADFS 2.0 Uninstall

The following is taken from the following KB article: http://support.microsoft.com/kb/982813.  I have had to do this so many times though I found it easier to post it here :)

The Active Directory Federation Services 2.0(AD FS 2.0) uninstallation wizard uninstalls AD FS 2.0 from your computer. However, you may still have to manually restore or cleanup settings in either of the following situations:


  • When you uninstall AD FS 2.0 from a federation server or federation server proxy computer, the uninstall wizard does not restore IIS to its original state.
  • When you uninstall AD FS 2.0 from the last added federation server in a federation server farm, the uninstall process does not delete the certificate sharing container that was created in Active Directory.
Restore IIS on a federation server or federation server proxy computer

When AD FS 2.0 is installed on a computer that is configured for the federation server or federation server proxy role, it will create the /adfs and /adfs/ls virtual directories in IIS. AD FS 2.0 will also create a new application pool named ADFSAppPool. When you uninstall AD FS 2.0 from a federation server or federation server proxy computer, these virtual directories are not removed. Additionally, the application pool is not removed. This can create problems if AD FS 2.0 is installed again on the same computer.

To manually remove these directories from the decommissioned federation server or federation server proxy computer, follow these steps:

  1. Click Start, select Administrative Tools, and then select IIS Manager.
  2. Expand the server name node, expand Sites, and then select Default Web Site.
  3. In the Actions pane, select View Applications.

    Note: You should see the following two virtual directories associated with AD FS 2.0:
    /adfs
    /adfs/ls
  4. Right-click the AD FS 2.0 application that is in each virtual directory, and then click Remove.
  5. In the Actions pane, select Application Pools.

    Note: You should see an application pool named ADFSAppPool.
  6. Right-click ADFSAppPool, and then select Remove.

    Note: The next two steps show how to remove the \adfs directory from the "inetpub" directory. If you have made custom changes to the content within this directory, we recommend that you back up this content to another location before removing the directory.
  7. In Windows Explorer, browse to the "inetpub" directory. This directory is usually located in the following path:
    %systemdrive%\inetpub
  8. Right-click the Adfs directory, and then click Delete
Delete the certificate sharing container in Active Directory

When you install AD FS 2.0 and use the Federation Server Configuration Wizard to create a new Federation Server in a new Federation Server farm, the wizard will create a certificate sharing container in Active Directory. This container is used by all the federation servers in the farm. When you uninstall AD FS 2.0 from the last added federation server in a farm, this container is not deleted from Active Directory.

To manually delete this container in Active Directory, follow these steps:

  1. Before you remove AD FS 2.0 from the last federation server in the farm, run the following PowerShell commands on the AD FS 2.0 STS to determine the location of the certificate sharing container in Active Directory:
    • Add-PsSnapin Microsoft.Adfs.Powershell
    • Get-AdfsProperties
  2. Note: the CertificateSharingContainer property in the output from the previous step.
  3. Log on to a server where the ADSIEdit tool (ADSIEdit.msc) is installed.
  4. Click Start, click Run, type ADSIEdit.msc, and then press ENTER.
  5. In the ADSIEdit tool, connect to the Default naming context by following these steps:
    1. Right-click ADSI Edit, and then click Connect to.
    2. Under Connection Point, click Select a well-known Naming Context, and then select Default naming context.
    3. Click OK.
  6. Expand the following node:
    Default naming context, {your domain partition}, CN=Program Data, CN=Microsoft, CN=ADFS
    Note: Under CN=ADFS, you see a container named CN={GUID} for each AD FS 2.0 farm that you have deployed, where {GUID} matches the CertificateSharingContainer property that you captured by using the Get-AdfsProperties PowerShell command in step 1.
  7. Right-click the appropriate {GUID} container, and then select Delete.

Comments

  1. Why did I have to make another profile?May 3, 2011 at 6:37 PM

    Do you happen to have automated cleanup powershell script?

    ReplyDelete
  2. jessicasteveNovember 28, 2020 at 1:13 PM

    You will be given various connections to these sites and each connection will have a short portrayal of what you are probably going to discover on the site. You can peruse the portrayals and decide to tap on the site that best suits you. local classifieds

    ReplyDelete
  3. MichaelJuly 17, 2021 at 11:19 AM

    Hey what a brilliant post I have come across and believe me I have been searching out for this similar kind of post for past a week and hardly came across this. Thank you very much and will look for more postings from you. Asheville Maids

    ReplyDelete
  4. StalkerJanuary 10, 2022 at 8:47 AM

    It appears to be that any individual who finds out a little with regards to site improvement gets the "first" plan to set up a site directory. https://iaupa.com/

    ReplyDelete
  5. Sterling Environmental LLCJanuary 17, 2022 at 4:54 PM

    I admire this article for the well-researched content and excellent wording. I got so involved in this material that I couldn’t stop reading. I am impressed with your work and skill. Thank you so much.Hoarder Or Collector Cleanup Services In Seattle,Wa

    ReplyDelete
  6. srut calmsFebruary 17, 2022 at 7:09 AM

    Assuming you maintain an independent venture, you probably spend a lot of your time contemplating your promoting plan. https://onohosting.com/

    ReplyDelete
  7. Shona67October 30, 2023 at 5:30 AM

    This comment has been removed by the author.

    ReplyDelete
  8. Kamla LogirOctober 30, 2023 at 5:39 AM

    Your delicate lace and embroidery will be treated with the care they deserve.
    We Wash 24 Laundry Service

    ReplyDelete

Post a Comment

Popular posts from this blog

Add User As Local Administrator On Domain Controller

I recently was settting up a new Microsoft SharePoint 2010 machine and had promoted the machine to a domain controller before creating my SharePoint admin accounts.  I needed to add several of my accounts to the local Administrators group.  Unfortunately after you promote a server to a domain controller you can no longer access the GUI for Local Users and Groups.  Instead I had to use the command line to add the users. Open a command promt using the "Run as administrator" function and then run the following command. net localgroup Administrators /add {domain}\{user} Note: do not include the {} brackets.
Read more

Calling Dataverse Web API in PowerShell using Client Credentials

Image
Connecting to Dataverse using PowerShell can be very helpful for data migrations and use within Azure DevOps. Connecting to an instance in a non-interactive way can be tricky though. This article will provide you the links you need for creation and App registration and adding the app user to your environment. You can then utilize the script provided to call Web API requests including ones you define using the new Custom API functionality now available. The script was written so that it is not dependent on any outside libraries such as the Microsoft.Xrm.Tooling connector. This is helpful in situation where involving an outside library will slow down your deployment time by having to be approved in a change control board. If utilizing an outside code library is not a concern you can create a connection to Dataverse utilizing the Microsoft.Xrm.Tooling connector Get-CrmConnection cmdlet. Create App Registration The first thing to do is create an App Registration within Azure AD for ...
Read more

Windows Server 2008R2 VMs Shut Down After 1 to 2 Hours

Image
When created a lab environment to test ADFS 2.0 I utilized the Windows 2008R2 VM baselines distributed by Microsoft.  After a few days I was told that I had to activate.  The VMs included a 180 day license for use but I didn't feel like adding another network adapter into Hyper-V to connect them to the internet.  I started having issues though where the servers would shut down every hour or so.  I though that maybe there was a memory issue and Hyper-V was shutting them down in order to free up RAM.  Turns out that if Server 2008R2 is not activated it automatically shuts down after a period of time.  After connecting the server to the internet and activating them the problem went away. Finally the madness of the unknown shut downs has ended :)
Read more