ADFS Farm, how to install MFA?

[kkimmo]

Hello,

I have had one ADFS 2019 server and Neos SDI installed and configured, all working fine for a year. Using only TOTP codes and AD as a storage. ADFS is installed into RODC
Added second ADFS server, also RODC, and created farm. ADFS looks ok but how to add Neos SDI into second server?
Installed msi (3.1.2306.0). If I try to run MFA MMC, I get "Must be executed with ADFS Administrator rights granted...".
Should I run Register-MFASystem or how installation should be done to farm?

[redhook62]

Hi @kkimmo

I have a question, how can you use ADDS storage while working with RODC controllers?

To add a new server you must install the component on this new server then use the cmdlet: Register-MFAComputer as indicated in the wiki: Add an ADFS Server. then restart the MFA service.

regards

[kkimmo]

Well, I don't know how ADDS storage should behave in RODC but it seems to work.

Register-MFAComputer did not work from the new server:

Register-MFAComputer : PS0033: This Cmdlet cannot be executed from a secondary server !
At line:1 char:1

• Register-MFAComputer

•   + CategoryInfo          : NotSpecified: (:) [Register-MFAComputer], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,MFA.RegisterMFAComputer
  
  
  

[redhook62]

If you are using an RODC with ADDS configuration.
It will not be possible to write to the required attributes. is that clear ?

If you have followed the Wiki correctly, your account should belong to certain domain groups.
And in any case, if your secondary server tells you that you do not have the rights to use a cmdlet when you think you have the correct rights, restart the MFA service (in Windows services) and check that a system.db file is successfully created in the Program File\MFA\Config directory