Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab. I have found 2 guides:

Doc1 starts with creating a gSMA account, however Doc2 says "The ADFS configuration wizard will automatically configure the correct Service Principal Names (SPN) on this service account so don’t worry about this configuring the SPN."

Which path should I take? If you think I should create the gSMA account, can you help me understand what values I should provide in my lab? They are using

New-ADServiceAccount FsGmsa -DNSHostName -ServicePrincipalNames http/

My server is called server1.mydomain.local. Should my new gSMA command look like this?:

New-ADServiceAccount FsGmsa -DNSHostName server1.mydomain.local -ServicePrincipalNames http/server1.mydomain.local

I am specifically asking about the "ServicePrincipalNames" attribute because doc2 says to "Ensure that the physical computer name of any of the ADFS servers in the farm don’t match the ADFS service name"

share|improve this question
Could you clarify this? I'm not sure what the question is. Either let the wizard create an SPN for you, or make one yourself, but either way, you have to make sure that the SPN is different from any computer hostname. (Is that the answer you're looking for?) – HopelessN00b Mar 16 '14 at 22:15
Can I run the wizard without creating a user\SPN\gSMA in advance? I am not an IT guy, I'm a developer so I don't know the consequences... – itaysk Mar 17 '14 at 19:22
You can - worst that happens is that authentication won't work until you register an SPN, and under other circumstances that can be a bitch to troubleshoot, but since you already know what to look at, there should be no problem with registering the SPN manually after the fact, if you want. – HopelessN00b Mar 17 '14 at 22:38

You can either let the ADFS wizard make necessary configuration for gMSA account


you can pre-create your gMSA account with correct SPN (which is your adfs Service name). Same name needs to be also at certificate subject and SAN fields.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.