Enabling auditing for AD FS In order to gather data and analyze, the health agent for AD FS needs the information in the AD FS Audit Logs. These logs are not enabled by default. Note This only applies to the AD FS farm, for example the ADFS1 and ADFS2 computers in our configuration. You do not need to enable auditing on WAP farm, i.e. the WAP1 and WAP2 computers in our configuration. To enable AD FS auditing and locate the AD FS audit logs, proceed with the following steps: Open a remote desktop connection on the ADFS1 computer that will be also your sync server. Follow the instructions as per section § Accessing the various machines of the test lab environment and specify in step 2 "10.0.0.201" for the ADFS1 computer. Log on as the LITWARE369 domain administrator account AzureAdmin with "Pass@word1!?" as password. Open Server Manager on the Start screen, or Server Manager in the taskbar on the Desktop. In Server Manager, click Tools, and then select Local Security Policy. An eponym window Local Security Policy opens up. Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits. On the Local Security Setting tab, verify that the AD FS service account NT SERVICE\adfssrv is listed. If it is not present, click Add User or Group and add it to the list, and then click OK. Close Local Security Policy. Open a command prompt with elevated privileges and run the following command to enable auditing: PS C:\> auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable In Server Manager, click Tools, and then select AD FS Management in order to open the AD FS Management snap-in. In the Actions pane, click Edit Federation Service Properties. In the Federation Service Properties dialog box, click the Events tab. Select the Success audits and Failure audits check boxes. Click OK. Close the AD FS Management snap-in. In Server Manager, click Tools, and then select Event Viewer. An eponym window Event Viewer opens up. Navigate to Windows Logs and select Security. On the right, click Filter Current Log... A Filter Current Log dialog opens up.
Enabling auditing for AD FS In order to gather data and analyze, the health agent for AD FS needs the information in the AD FS Audit Logs. These logs are not enabled by default. Note This only applies to the AD FS farm, for example the ADFS1 and ADFS2 computers in our configuration. You do not need to enable auditing on WAP farm, i.e. the WAP1 and WAP2 computers in our configuration. To enable AD FS auditing and locate the AD FS audit logs, proceed with the following steps: Open a remote desktop connection on the ADFS1 computer that will be also your sync server. Follow the instructions as per section § Accessing the various machines of the test lab environment and specify in step 2 "10.0.0.201" for the ADFS1 computer. Log on as the LITWARE369 domain administrator account AzureAdmin with "Pass@word1!?" as password. Open Server Manager on the Start screen, or Server Manager in the taskbar on the Desktop. In Server Manager, click Tools, and then select Local Security Policy. An eponym window Local Security Policy opens up. Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits. On the Local Security Setting tab, verify that the AD FS service account NT SERVICE\adfssrv is listed. If it is not present, click Add User or Group and add it to the list, and then click OK. Close Local Security Policy. Open a command prompt with elevated privileges and run the following command to enable auditing: PS C:\> auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable In Server Manager, click Tools, and then select AD FS Management in order to open the AD FS Management snap-in. In the Actions pane, click Edit Federation Service Properties. In the Federation Service Properties dialog box, click the Events tab. Select the Success audits and Failure audits check boxes. Click OK. Close the AD FS Management snap-in. In Server Manager, click Tools, and then select Event Viewer. An eponym window Event Viewer opens up. Navigate to Windows Logs and select Security. On the right, click Filter Current Log... A Filter Current Log dialog opens up.
AAD-Office-365-Seamless-Sign-In-Part-4.docx