Troubleshooting

AD FS logon data is missing in ADAudit Plus

Symptom: No AD FS success or failure data appears in ADAudit Plus reports.

Resolution:

1. Confirm that the AD FS host is configured in the ADAudit Plus web console using the correct workflow from Configure AD FS servers in ADAudit Plus.
2. Confirm that the required Windows audit policy in Recommended audit policy settings for AD FS is applied.
3. Confirm that AD FS service auditing is enabled as described in Enable auditing on the AD FS server.
4. Confirm that AD FS events exist in Event Viewer as described in Verify AD FS events are being logged.

Audit policy status shows not configured

Symptom: The AD FS host shows missing or incorrect audit policy status.

Resolution:

1. Confirm that you edited the correct GPO:
   • Default Domain Controllers Policy for Domain Controller-hosted AD FS.
   • ADAuditPlusMSPolicy for member-server-hosted AD FS.
2. Verify that Audit Application Generated is enabled for Success and Failure.
3. Confirm that the advanced-audit-force setting in Enforce advanced audit policy settings is enabled.
4. Run Group Policy Results again after replication and policy refresh complete.

Automatic audit policy configuration does not apply

Symptom: ADAudit Plus shows the AD FS host as configured, but the required audit policy is not enabled on the host itself.

Resolution:

1. Confirm the correct onboarding path:
   • For AD FS on a Domain Controller, confirm the host is under Configuration → Data Sources → Domains and Controllers.
   • For AD FS on a Windows member server, confirm the host is under Configuration → Data Sources → Member Servers.
2. Confirm the product-managed GPO is in scope:
   • Verify that the member-server automatic configuration policy is applied to the AD FS host and has not been excluded by security filtering.
3. Force policy refresh:
   • Run gpupdate /force on the AD FS host.
   • Re-run Group Policy Results as described in Verify audit policy configuration.
4. Fall back to manual configuration:
   • If automatic configuration continues to fail, apply the manual GPO steps in Manual configuration overview instead.

AD FS events are not written to the Security log

Symptom: You perform a test sign-in, but no AD FS-related events appear in Event Viewer.

Resolution:

1. Verify the AD FS federation service Events settings in Enable auditing on the AD FS server.
2. Verify the Windows audit policy settings in Configure advanced audit policies or Configure legacy audit policies.
3. Re-run the test and review the Security log again.
4. If the host is heavily loaded, confirm that the Security log is large enough to retain the events until you can inspect them.

Claim-related fields are blank in reports

Symptom: The AD FS event appears in ADAudit Plus, but fields such as UPN, client IP, proxy, forwarded client IP, or inside-corporate-network are blank.

Resolution:

1. Review the relying party claim rules in Configure claim rules.
2. Confirm that all six required claim rules are present for the specific relying party involved in the test.
3. Repeat the test sign-in through the same relying party.
4. Verify the event details in Event Viewer before checking the ADAudit Plus report again.

Extranet lockout data is unavailable

Symptom: No AD FS lockout data appears even though external users are expected to trigger lockout conditions.

Resolution:

1. Confirm that extranet lockout is enabled using the Set-AD FSProperties command in Configure extranet lockout.
2. Confirm that the environment uses an AD FS proxy or Web Application Proxy.
3. Perform a controlled external test that is expected to generate a lockout condition.
4. Verify that the corresponding Windows Security events are present before checking the ADAudit Plus report.

Member server onboarding fails or access is denied

Symptom: The AD FS host cannot be added as a Windows member server, or ADAudit Plus cannot read its events.

Resolution:

1. Confirm the required agentless ports in Requirements summary are reachable.
2. Confirm that the configured identity has Manage auditing and security log and Event Log Readers access.
3. Review the member-server privilege guidance.
4. Re-test connectivity and then repeat the configuration workflow in Configure when AD FS is on a Windows Server.

Events exist in Event Viewer but not in ADAudit Plus

Symptom: AD FS events are visible in the Security log, but they do not appear in the ADAudit Plus reports.

Resolution:

1. Allow time for collection and processing to complete.
2. Confirm that you are viewing the correct report category and time range.
3. Filter by the exact AD FS host and username used during testing.
4. Re-check the monitored-server health and the configured credentials in the ADAudit Plus web console.

Data appears intermittently or older events disappear

Symptom: AD FS reports show gaps, or you cannot find events that were previously expected.

Resolution:

1. Increase the Security log size on the AD FS host if events are overwritten quickly.
2. Ensure temporary network interruptions are not delaying collection beyond the log-retention window.
3. Re-run verification steps after increasing retention.
4. For member-server-hosted AD FS, compare the broader event-log sizing recommendations.

Frequently Asked Questions (FAQ)

Q1. Can AD FS be audited when it is installed on a Domain Controller?

Yes. In that case, configure the domain and the hosting Domain Controller under Configuration → Data Sources → Domains and Controllers, then apply the Domain Controller audit-policy workflow in this guide.

Q2. Can AD FS be audited when it is installed on a Windows member server?

Yes. Add the host under Configuration → Data Sources → Member Servers, then apply the member-server audit-policy workflow in this guide.

Q3. Do I need to configure claim rules for every relying party?

Yes. Configure the required claim rules for each relying party that you want ADAudit Plus to audit with full user and network context.

Q4. Do I need an AD FS proxy to configure extranet lockout?

Yes. Extranet lockout applies only when an AD FS proxy or Web Application Proxy is part of the environment.

Q5. Is automatic audit policy configuration mandatory?

No. You can use manual GPO configuration if your organization does not allow ADAudit Plus to manage audit-policy settings automatically.

Q6. Are Windows Server 2019, 2022, and 2025 supported for AD FS auditing?

Yes. Windows Server 2019, 2022, and 2025 are supported for AD FS auditing, consistent with the current Windows Server guide set.

Q7. Do I need the ADAudit Plus agent for AD FS auditing?

No. Agentless collection is supported using the standard Windows log collection method. You can also use the ADAudit Plus agent if that matches your deployment model.