1. Objective & Real‑World Context

Every ADFS journey starts with a rock‑solid foundation. In this lab we’ll build the two most important servers:

• DC01 – Domain Controller for corp.lab plus an internal Certificate Authority.
• ADFS01 – The first Federation Server in our farm.

By the end you’ll have a functional ADFS sign‑on page and a gMSA‑secured service. This mirrors exactly what you’d do in a production environment, just virtualised.

2. Pre‑Lab Checklist

• ✅ Hyper‑V or VMware installed
• ✅ Windows Server 2022 Evaluation ISO downloaded
• ✅ Two VMs created (4 GB RAM, 2 vCPUs, 60 GB disk each)
• ✅ Both VMs connected to the same virtual switch (private/internal)

VM Inventory & IP Plan

3. Step 1 – Build the Domain Controller (DC01)

Boot the first VM, set its IP, and promote it to corp.lab.

3.1 Set Static IP & Rename Computer

Assign IP 192.168.10.10/24, gateway none, DNS 127.0.0.1. Rename the computer to DC01 and reboot.

3.2 Install AD DS Role

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

3.3 Promote to Domain Controller

Run the wizard or use PowerShell:

Install-ADDSForest `
  -DomainName "corp.lab" `
  -DomainNetbiosName "CORP" `
  -ForestMode Win2022 `
  -DomainMode Win2022 `
  -InstallDns:$true `
  -SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) `
  -Force:$true

After reboot, log in as CORP\Administrator.

4. Step 2 – Install Enterprise Certificate Authority

ADFS needs certificates for token signing and SSL. We’ll set up an internal Enterprise CA – it will automatically be trusted by all domain members.

Install-WindowsFeature ADCS-Cert-Authority -IncludeManagementTools

After installation, do not close the wizard. Click Configure Active Directory Certificate Services. Choose Certification Authority, then Enterprise CA, Root CA. Leave defaults, and complete.

Once done, you can verify the CA by opening certsrv.msc or browsing http://dc01/certsrv.

5. Step 3 – Create Group Managed Service Account (gMSA)

Best practice: run the ADFS service under a gMSA. We’ll create it on DC01 now.

# Create KDS Root Key (if not already)
Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))

# Create gMSA for ADFS
New-ADServiceAccount -Name ADFSSvc `
  -DNSHostName ADFS01.corp.lab `
  -PrincipalsAllowedToRetrieveManagedPassword "ADFS01$"

This account will be installed on ADFS01 later.

6. Step 4 – Build ADFS Server (ADFS01)

6.1 Join Domain & Set DNS

Boot the second VM. Set IP 192.168.10.20/24, DNS 192.168.10.10. Rename to ADFS01, then join the domain:

Add-Computer -DomainName corp.lab -Restart

6.2 Install ADFS Role

Log in as domain admin. Run:

Install-WindowsFeature ADFS-Federation -IncludeManagementTools

7. Step 5 – Request SSL Certificate for ADFS

ADFS uses an SSL cert bound to the federation service name (sts.corp.lab). We’ll request one from our internal CA.

1. Open certlm.msc (Local Machine certificates).
2. Right‑click Personal → All Tasks → Request New Certificate.
3. Select the Web Server template. If not visible, you may need to duplicate it on the CA first.
4. Under Certificate Properties, add a Subject Alternative Name of type DNS = sts.corp.lab. Optionally add adfs01.corp.lab.
5. Enroll and finish.

After enrollment, verify the certificate appears in the Personal store with the intended name.

7.1 Install the gMSA on ADFS01

Install-ADServiceAccount -Identity ADFSSvc
Test-ADServiceAccount ADFSSvc

Both commands should succeed without errors.

8. Step 6 – Configure the ADFS Federation Service

Now the heart of our lab.

1. Open Server Manager, click the warning flag, and select Configure the federation service on this server.
2. Choose Create the first federation server in a federation server farm.
3. On the Service Account page, specify CORP\ADFSSvc$. (The wizard will find the gMSA automatically.)
4. Select the SSL certificate you enrolled earlier (sts.corp.lab).
5. For Federation Service Name, enter sts.corp.lab.
6. Choose Windows Internal Database (WID) (perfect for lab).
7. Review and complete the wizard.

9. Step 7 – Verify and Test

On the ADFS01 server, open a browser and navigate to:

https://sts.corp.lab/adfs/ls/idpinitiatedsignon.aspx

You should see the ADFS sign‑on page. Log in with corp\administrator. After successful authentication, you’ll land on the IdP‑initiated sign‑on page showing “You are signed in”.

Congratulations – your ADFS farm is alive!

10. Troubleshooting Common Pitfalls

• Certificate not trusted? – Ensure the CA’s root is trusted (it is, by domain members). Clear browser cache.
• gMSA retrieval fails? – Verify the KDS root key was created at least 10 hours ago (we used -EffectiveTime ((Get-Date).AddHours(-10))).
• Wizard can’t find gMSA? – Use CORP\ADFSSvc$ (with dollar sign).
• ADFS event logs? – Check under Applications and Services Logs → AD FS → Admin for detailed errors.

11. Next Steps 🚀

You’ve built the core infrastructure. In Part 4 we’ll integrate Exchange OWA as a federated relying party. You’ll see the full SAML redirect flow in action and configure claim rules so that users can sign into their mailboxes with the same corporate credentials – without ever seeing OWA’s login form.

If you want a head start, spin up a new VM for Exchange 2019 and install the Mailbox role. The exact steps await you in the next post!