We recently had an issue with an AD FS farm using Windows Internal Databases and Microsoft Network Load Balancing. The secondary server would not synchronize with the primary one causing a lot of intermittent authentication issues. Manual inspection of the SQL databases (\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query) using SQL Server Management Studio confirmed that the policies were not being synchronized. Specifically, if you opened the ServiceStateSummary table, we would notice that the serial numbers remained at zero. Also, the event log showed that 0 objects were added/merged to the database.
The first thing I did was check to see if the primary server's DNS name was resolvable. No dice. So I fixed the DNS settings on the secondary server. Still no dice. Finally, I reran the wizard, this time with the DNS settings fixed I got another error. Something to the effect that the primary federation server appeared to be busy. I noticed that the previous admin had set the primary federation server name to the IDP federation name (external.hostname.com). I changed the primary server name setting to the actual name of the primary server (FS01), stepped through the wizard, and everything worked like a charm!
Moral of the story:
- Check your DNS settings make sure the real name of the primary federation server is resolvable.
- Rerun the wizard after changing your DNS settings and check the AD FS Admin event log in the event viewer for synchronization status. You should see the merged/added object count equal >0.
- Never use the IDP federation name for the primary server name. Use the REAL/host name of the primary federation server, instead.
- Cycling the AD FS service will always force a resync.
Good luck and hope this helps!