Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Working with a client to configure ADFS, just got this in an e-mail:

"We are using Server 2008 Enterprise with AD, GP, DNS and DHCP running on the same box."

And now he indicates he wants to also install ADFS on the same box as well. I am not even sure if ADFS and AD can be on the same server, but if it can be I also wonder if it is a good idea or not.

share|improve this question
up vote 3 down vote accepted

It should be fine to install on your Domain controllers. As long as sane lookup caches (for DNS) and leases (for DHCP) are had, and you have a proper amount of DCs for your environment (the answer is never "one DC"), ADFS should not present a huge amount of load.

share|improve this answer
But you are installing IIS and exposing the box to the Internet, which I would not recommend doing on a DC for security purposes. – Andy Schneider Jan 15 '13 at 23:00

Yes its a supported configuration to have AD and ADFS on the same box so no problems there. But as the general preference is to have AD roles on dedicated servers, its not an encouraged configuration.

When you upgrade the AD in the future, you'd have to do in place upgrades of this server instead of demote/promote new DCs.

If you are also planning this server to be internet accessible, then its also not a good configuration from a security perspective unless you plan to have ADFS proxies too.

So if this is a very small environment where they have no other servers or means of even using virtualization to host roles on different OS guests, then yes you can do it.

share|improve this answer
As of 4/21/2015 it is actually recommended on TechNet to install ADFS on the DCs for less than 1000 users. ref: – user319862 Apr 21 '15 at 14:11
Although the point about upgrading in place versus demote/promote is definitely something to consider – user319862 Apr 21 '15 at 14:13

I'm fairly certain you will need to specify LDAP ports other than default in this scenario. Otherwise, it should function fine.

share|improve this answer
I believe you are thinking of AD LDS. In which case you would need to specify other ports for the LDS instance. – HostBits Sep 8 '11 at 16:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.