amazon-web-servicesactive-directoryadfswindows-server-2019aws-directory-services

How to set up AD FS on AWS Directory Service without Domain Administrator account?


I have created a AWS Managed Microsoft AD, and I have a Windows Server 2019 EC2 instance where I am trying to enable AD FS. I have joined the EC2 instance to the domain, installed AD tools, and am able to perform basic AD tasks using the default AD Admin user. So far so good.

However when I try to configure AD FS, I get stuck with this error

"The credential provided is not a domain administrator. Provide a credential that is a member of the Domain Admins group and try again."

enter image description here


Taking a look at the AWS docs, I found this.

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.html

To perform operational management of your directory, AWS has exclusive control of accounts with Enterprise Administrator and Domain Administrator privileges. This includes exclusive control of the AD administrator account.

So..... how could I possibly enable AD FS unless I had access to the AD administrator account?


Solution

  • You can't.

    When you install ADFS it searches for available DC and writes a number of entries to AD.

    To do this, it needs domain admin.

    You don't need domain admin. to run ADFS. It can use a service account.