MFA Error - Must be executed with ADFS Administration rights granted part 2

[Maurice-AxiansNL]

Hi guys, I tried all suggestions about this issue but can't solve it.

I followed these steps:

Alle steps are on a fresh ADFS 2019 server:

1. Before the setup I added a Active directory security group (ADFS Delegation) to the local administrator group on the ADFS server and added the group in the "ADFS Federation Service properties" in the "Enable delegation for service for administation" part

2. After added the groups I rebooted the server
3. After the reboot I started adfsmfa.3.1.2202.1 and followed the steps
4. After the installation I checked if the system.db already exists (not true)
5. Open Powershell as administrator -> Register-MFASystem

After registering I've got a strange warning / error:

6. Check if the system.db exists -> True
7. Tried some other powershell cmdlets but all return with the same strange Unhandled exception warning / error.
8. Reboot server
9. Start MFA MMC -> Returns with error "Must be executed with ADFS administration rights granted"

I'm lost, can someone point me in de right direction? As you can see I followed the instructions from the installation part and the suggestions from another thread but still no solution.

[redhook62]

Hi

The points indicated from 1 to 5 are correct, but why reboot the server?
You have a big problem when trust relationships are requested "AccessViolationException - Memory may be corrupted!"

At any rate. you can delete the System.db, config.db, and blob.db files on each server.
Then run restart-service mfanotifhub.
You should see, if all the prerequisites are respected (such as the opening of the firewall rules) these files, on all the servers.
Config.db - MFA configuration cache
System.db - ACL cache for service access (MMC, PS)
Blob.db - MDS file from fido alliance (downloaded).

The account used must have the privileges to browse the different ADDS trust relationships
You can specify this account in the Security tab

Your users using MMC or Powershell must be local/domain administrators to manage all features

See

https://github.com/neos-sdi/adfsmfa/wiki/01-Installation#prerequisites
https://github.com/neos-sdi/adfsmfa/wiki/01-Installation#configure-windows-firewall-rules

regards

[redhook62]

Confirm that when the mfa is disabled (in the ADFS console), you can log in with:

• A domain admin account of the domain
• A domain user account
• A Domain Admin account from a remote forest (Trust RelationShip)
• A User Account from a remote forest

The problem is related to your trust relationships between your differents forests/domains

Application: Microsoft.IdentityServer.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException
at System.Runtime.InteropServices.Marshal.CopyToManaged(IntPtr, System.Object, Int32, Int32)
at System.DirectoryServices.ActiveDirectory.ForestTrustRelationshipInformation.GetForestTrustInfoHelper() <-- Here
at System.DirectoryServices.ActiveDirectory.ForestTrustRelationshipInformation.get_TopLevelNames()
at Neos.IdentityServer.MultiFactor.Data.ADDSUtils.LoadForests(System.String, System.String, System.String, Boolean, Boolean)
at Neos.IdentityServer.MultiFactor.AuthenticationProvider.OnAuthenticationPipelineLoad(Microsoft.IdentityServer.Web.Authentication.External.IAuthenticationMethodConfigData)

Check and validate all your trust relationships at the level of your ADDS infrastructure

have you integrated the "Runtime" tag indicated above into the configuration file. ?

regards

[Maurice-AxiansNL]

Hi,

I restored a snapshot of the machine and tried the runtime parameter. Now both services will start. I can start the MFA console now :)

[redhook62]

Have you some traces in eventlog ?
This runtime parameter should not be set, it' only for debugging.

[Maurice-AxiansNL]

Event 5100 ADFS MFA DataServices: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

[redhook62]

putting the runtime tag in the configuration file simply prevents the ADFS service from crashing, however the Framework does generate an AccesViolationException error, so MFA cannot detect TopLevelNames and ADDS trust relationships.
This is an internal Framework error.
The account executing this code (ADFS account), does not have the necessary rights to access and browse remote forests. and Microsoft unmanaged code crashes miserably.

The idea is to remove the tag.
Can you in the console, in the security tab, indicate an ADDS access account (local forest and remote forests) with read/write/traverse rights on all forests.
On the other hand, try with this account (Super User) to connect to all forests with a tool like LDAPAdmin

regards

[redhook62]

Hi @mrblwd-058

Yes, it's a Microsoft update problem.

If you patched your domain controllers with KB5011495, the other servers accessing .domain controllers and requesting trust relationships with .Net framework, fail miserably and crash as indicated in your post.

The Framework of the machines concerned (your ADFS servers or other) must apply a patch that is not published by Windows Update. K5011257 (FW 4.8) or KB5011259 (FW 4.7.2).

Microsoft thought it was considered a minor issue. not offering an immediate fix rolled out to everyone.
This KB 5011495 has messed up everywhere.

Thanks again Mr MS....

Regards