I'm trying to install the Azure AD Connect ADFS health agent on the primary server in an ADFS 4.0 farm running on Windows Server 2016.

The installation completes successfully but I get an error on configuration:

Register-AzureADConnectHealthADFSAgent : Could not query the MEX on http ports: 443 in hosts: localhost
At line:1 char:190
+ ... gent\PowerShell\AdHealthAdfs; Register-AzureADConnectHealthADFSAgent}
+                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Register-AzureADConnectHealthADFSAgent], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.Identity.Health.Adfs.PowerShell.Configuration

Now I've run that error through the google and it tells me that this could be a STS certificate issue so I've checked as per the article pointed at there, and there are no issues, no other unexpected or incorrect certificate thumbprint visible, and besides on ADFS 4.0 you can't change certificates on the secondary servers in an ADFS farm, so even simply trying to re-register the certs didn't help.

Running further diags as per maweeras' suggestions:

PS C:\Users\administrator.INTERNAL> $error[0] | fl * -f

PSMessageDetails      :
Exception             : System.InvalidOperationException: Could not query the MEX on http ports: 443 in hosts:
                           at Microsoft.Identity.Health.Adfs.PowerShell.ConfigurationModule.AdfsServiceExaminer.GetAdfs
                           at Microsoft.Identity.Health.Adfs.PowerShell.ConfigurationModule.AdfsServiceExaminer.Compute
                           at Microsoft.Identity.Health.Common.Clients.PowerShell.ConfigurationModule.RegisterADHealthA
                           at System.Management.Automation.CommandProcessor.ProcessRecord()
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Register-AzureADConnectHealthADFSAgent], InvalidOperationException
FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.Identity.Health.Adfs.PowerShell.ConfigurationModule.
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {}

The install/config log doesn't seem to tell us anything that isn't already here. I can browse to the MEX endpoint via its FQDN in a web browser.

  • 1
    It would be more useful if you post the output from below command immediately after command fails. $error[0] | fl * -f – maweeras Mar 13 '18 at 10:29
  • 1
    You should also have a peak at logs in %localappdata%\temp for clues as the AAD Connect Health installer writes logs there. All I can see is an apparent error to get to the /adfs/services/trust/mex endpoint. – maweeras Mar 13 '18 at 10:34
  • Does get-adfssslcertificate show a 443 binding for localhost ? – maweeras Mar 13 '18 at 13:34
  • @maweeras none of the servers in the farm have any kind of binding for localhost when I run that command. Should they have? – Rob Moir Mar 13 '18 at 13:37
  • yes it should be there – maweeras Mar 13 '18 at 13:38

Looks like localhost specific SNI binding for TLS was missing. get-adfssslcertificate should reveal a 443 binding for both hostname used for actual service and localhost.

If missing, set-adfssslcertificate is the way to fix missing bindings. This will allow the health agent install to succeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.