Fields

Message

The Federation Service started successfully. The following service hosts have been added: 
%1

Fields

Fields

Message

There was an error in enabling endpoints of Federation Service. Fix configuration errors using PowerShell cmdlets and restart the Federation Service. 

Additional Data 
Exception details: 
%1

Fields

Message

The Federation Service stopped successfully.

Message

The artifact resolution service is not running. The service must be running to perform token replay detection. 

User Action 
Make sure that the artifact resolution service is configured properly. Or disable token replay detection by using the Set-ADFSProperties cmdlet with the PreventTokenReplays parameter in Windows PowerShell for AD FS.

Fields

Message

An error occurred loading an authentication provider. Fix configuration errors using PowerShell cmdlets and restart the Federation Service. 
Identifier: %1 
Context: %2 

Additional Data 
Exception details: 
%3

Fields

Fields

Message

An authentication provider was successfully loaded: Identifier: '%1', Context: '%2'

Fields

Fields

Message

The Federation Service encountered an error while processing the WS-Trust request. 
Request type: %1 

Additional Data 
Exception details: 
%2

Fields

Fields

Message

During processing of the Federation Service  configuration, the element '%1' was found to have invalid data. The configured value '%2' could not be parsed as type '%3'. 
Element: %1 
Value: %2 
Type: %3 

The Federation Service will not be able to start until this configuration element is corrected. 

User Action 
Correct the specified configuration element to conform to the given type.

Fields

Fields

Message

During processing of the Federation Service configuration, the required element '%1' was missing. 
Element: %1 

The Federation Service will not be able to start until this configuration element is configured. 

User Action 
Configure the specified configuration element using the AD FS Management snap-in.

Fields

Fields

Message

During processing of the Federation Service configuration, the element '%1' was found to have invalid data. The private key for the certificate that was configured could not be accessed. The following are the values of the certificate: 
Element: %1 
Subject: %2 
Thumbprint: %3 
storeName: %4 
storeLocation: %5 
Federation Service identity: %6 

The Federation Service will not be able to start until this configuration element is corrected. 

This condition can occur when the certificate is found in the specified store but there is a problem accessing the certificate's private key. Common causes for this condition include the following: 
(1) The certificate was installed from a source that did not include the private key, such as a .cer or .p7b file. 
(2) The certificate's private key was imported (for example, from a .pfx file) into a store that is different from the store specified above. 
(3) The certificate was generated as part of a certificate request that did not specify the "Machine Key" option. 
(4) The Federation Service identity '%6' has not been granted read access to the certificate's private key. 

User Action 
If the certificate was imported from a source with no private key, choose a certificate that does have a private key, or import the certificate again from a source that includes the private key (for example, a .pfx file). 

If the certificate was imported in a user context, verify that the store specified above matches the store the certificate was imported into. 

If the certificate was generated by a certificate request that did not specify the "Machine Key" option and the key is marked as exportable, export the certificate with a private key from the user store to a .pfx file and import it again directly into the store specified in the configuration file. If the key is not marked as exportable, request a new certificate using the "Machine Key" option. 

If the Federation Service identity has not been granted read access to the certificate's private key, correct this condition using the Certificates  snap-in.

Fields

Fields

Message

During processing of the Federation Service configuration, the element '%1' was found to have invalid data. The certificate that was identified by the findValue '%2' could not be found. 
Element: %1 
storeName: %3 
storeLocation: %4 
x509FindType: %5 
findValue: %2 

The Federation Service will not be able to start until this configuration element is corrected. 

This condition occurs when the findValue that is specified does not match any certificate in the specified store. Common causes for this condition include the following: 
(1) The certificate with the specified findValue is from a store that is different from the configured store. 
(2) The certificate was deleted from the store after configuration. 

User Action 
If the certificate exists in a different store, find the location using the certificates snap-in and correct the configuration appropriately. 

If the certificate has been deleted, configure a different certificate.

Fields

Fields

Message

During processing of the Federation Service configuration, the element '%1' was found to have invalid data. The certificate that was identified by the findValue '%2' was not unique. 
Element: %1 
storeName: %3 
storeLocation: %4 
x509FindType: %5 
findValue: %2 

The Federation Service will not be able to start until this configuration element is corrected. 

This condition can occur when the certificate is found in the specified store but there is more than one certificate that matches the findValue. 

User Action 
If the certificate was identified by name and there are multiple certificates of the same name, configure the certificate using the certificate thumbprint.

Fields

Fields

Message

During processing of the Federation Service configuration, the Federation Service encountered a configuration error. 

%1 

Additional Data 
%2 

The Federation Service will not be able to start until this error has been corrected. 

User Action 
Correct the specified configuration error using the AD FS Management snap-in.

Fields

Fields

Message

The Federation Service was unable to create the federation metadata document as a result of an error. 
Document Path: %1 

Additional Data 

Exception details: 
%2

Fields

Fields

Message

The Federation Service Proxy blocked an illegitimate request made by a client, as there was no matching  endpoint registered at the proxy. This could point to a DNS misconfiguration, a partially configured application  published through the proxy, or a malicious request. 
Url Path: %1

Fields

Fields

Message

A token was received from a claims provider identified by the key '%1', but the token could not be validated because the key does not identify any known claims provider trust. 
Key: %1 

This request failed. 

User Action 
If this key represents the certificate thumbprint of a claims provider trust, verify that it  matches the signing certificate of the claims provider trust in the AD FS configuration database.

Fields

Fields

Message

During processing of the Federation Service configuration, the attribute store '%1' could not be loaded.  
Attribute store type: %2 

User Action 
If you are using a custom attribute store, verify that the custom attribute store is configured using AD FS Management snap-in. 

Additional Data 
%3

Fields

Fields

Message

The Federation Service was unable to listen at '%1' for metadata document requests due to an unexpected error. 

Additional Data 

Exception details: 
%2

Fields

Message

Trust monitoring cycle initiated.

Message

Trust monitoring cycle completed.

Fields

Message

The Federation Service encountered an error while writing to the following object in the configuration database. 

Object Type: 
%1 

Name: 
%2 

Metadata document URL: 
%3 

Additional Data 

Exception details: 
%4 

Additional details: 
%5

Fields

Fields

Message

An error occurred during initialization of trust monitoring. Trust monitoring against the published partner configuration will be disabled for the lifetime of this service. 

Additional Data 

Exception details: 
%1 

User Action 
If you want to try to start the trust monitoring service again, restart the Federation Service.

Fields

Fields

Message

An error occurred during a read operation from the configuration database. Trust monitoring was shut down and will be tried again after an amount of time that corresponds to the trust monitoring interval. 

Additional Data 

Exception details: 
%1 

Additional details: 
%2

Fields

Fields

Message

An error occurred during trust monitoring. The trust monitoring cycle was shut down. 

Additional Data 

Exception details: 
%1 

Additional details: 
%2

Fields

Fields

Message

Trust monitoring service encountered an error while parsing the metadata document from '%1'. Trust monitoring failed for: 

Object Type: 
%2 

Name: 
%3 

Additional Data 

Exception details: 
%4 

Additional details: 
%5

Fields

Fields

Message

Trust monitoring service encountered an error while applying the data in the metadata document from '%1'. Trust monitoring failed for: 

Object Type: 
%2 

Name: 
%3 

Additional Data 

Exception details: 
%4 

Additional details: 
%5

Fields

Fields

Message

The Federation Service encountered an error while retrieving the federation metadata document from '%1'. The monitoring for the following trusts failed: 

Claims providers: 
%2 

Relying parties: 
%3 

Additional Data 

Exception details: 
%4 

Additional details: 
%5 

User Action 
Make sure federation metadata URL is accessible. 
Verify your proxy server setting. For more information about how to verify your proxy server setting, see the AD FS Troubleshooting Guide (http://go.microsoft.com/fwlink/?LinkId=182180).

Fields

Fields

Message

The trust monitoring service automatically updated the trust of '%1' successfully with the partner's published changes.

Fields

Fields

Message

The trust monitoring service automatically updated the trust of '%1' successfully with the partner's published changes. 

Additional Data 
Warnings: 
%2

Fields

Fields

Message

Trust monitoring service detected changes in policy of '%1', but did not automatically apply the changes on the trust partner. 

Additional Data 
Warnings: 
%2

Fields

Fields

Message

An error occurred while upgrading FarmBehaviorLevel '%1' from Minor Version '%2' to Minor Version '%3'. 

Additional Data 
Exception details: 
%4

Fields

Message

AD FS could not enable the new KDFv2 feature automatically because of missing Windows Updates on one or more nodes of the farm. Please make sure that all the farm nodes are patched with the latest Windows Updates. AD FS checks regularly for the required updates to enable the new KDFv2 feature. An event 182 will be logged when a check is successful. For more information on this, please see https://go.microsoft.com/fwlink/?linkid=2153807.

Message

AD FS enabled the new KDFv2 feature successfully. For more information on this, please see https://go.microsoft.com/fwlink/?linkid=2153807.

Message

KDFv2 feature is disabled on AD FS farm. Please make sure that all the farm nodes are patched with latest Windows Updates and the KDFv2 feature is enabled to enhance the security of the farm. For more information on this, please see https://go.microsoft.com/fwlink/?linkid=2153807.

Fields

Message

A token request was received for a relying party identified by the key '%1', but the request could not be fulfilled because the key does not identify any known relying party trust. 
Key: %1 

This request failed. 

User Action 
If this key represents a URI for which a token should be issued, verify that its prefix matches the relying party trust that is configured in the AD FS configuration database.

Fields

Fields

Message

The Federation Service could not fulfill the token-issuance request. More than  one claim based on SamlNameIdentifierClaimResource was produced after the issuance  transform rules were applies for relying party '%2'. See event 500 with the same Instance ID for claims after application of issuance transform rules. 

Additional Data 
Instance ID: %1 

User Action 
Ensure that the issuance transform rules that are configured for the relying party do not result in multiple claims based on SamlNameIdentifierClaimResource.

Fields

Fields

Message

AD FS server received a JWT token without nonce in the assertion and it was accepted based on the current configuration setting of EnforceNonceInJWT. However, it indicates a potential replay of the JWT token by a malicious client or the possibility that the client is not patched with latest Windows Updates. Please make sure to update the EnforceNonceInJWT setting to reject all such JWT tokens after patching the clients with latest Windows Updates. 
For more information on this, please see https://go.microsoft.com/fwlink/?linkid=2238156. 

Additional Data 
    Client IP: %1 
    User Agent: %2

Fields

Message

AD FS server is not configured to reject JWT tokens that did not have nonce in the assertion. The corresponding setting (EnforceNonceInJWT) should be enabled for security reasons after making sure that all the clients are patched with the latest Windows Updates. 
The event 187 indicates the instances where AD FS received such tokens and accepted due to the current setting of EnforceNonceInJWT. 
For more information on this, please see https://go.microsoft.com/fwlink/?linkid=2238156.

Fields

Message

AD FS server received an OAuth authorization request in the device code flow without a Cross Site Request Forgery (CSRF) protection code in the UserCode cookie. This indicates that the AD FS server that issued the UserCode cookie has not  been patched with the latest Windows security updates. It is recommended to install the latest Windows security updates  on all the AD FS servers of the farm in order to be protected from CSRF attacks. Your environment is currently vulnerable  to the CSRF attacks in OAuth device code flow due to one or more unpatched AD FS servers. 

Additional Data 
    Usercode: %1 
    Client IP: %2 
    User Agent: %3

Fields

Fields

Message

The Federation Service could not satisfy a token request because the relying party requested an unknown authentication type. 
Comparison type: %1 
Desired authentication type(s): %2 
Relying party: %3 

This request failed. 

User Action 
Use the AD FS PowerShell commands to configure the authentication context order property. 
Ensure that the relying party is configured to request the correct authentication type.

Fields

Fields

Message

The Federation Service could not satisfy a token request because the accompanying credentials do not meet the authentication type requirement of '%2' for the relying party '%3'. 
Authentication type: %1 
Desired authentication type(s): %2 
Relying party: %3 

This request failed.

Fields

Message

The federation server proxy started successfully.

Fields

Message

The federation server proxy could not be started. 
Reason: %1 

Additional Data 
Exception details: 
%2

Fields

Message

The federation server proxy stopped successfully.

Fields

Message

The Federation Service %1 encountered an Access Denied error while trying to register one or more endpoint URLs. This condition typically occurs when the ACL for the endpoint URL is missing or the HTTP namespace in the ACL is not a prefix match of the endpoint URL. 

 The %1 could not be opened. 

User Action 
Ensure that a valid ACL for each of the URLs has been configured on this computer. 

Additional Data 
Exception details: 
%2

Fields

Fields

Message

The Federation Service %1 could not be opened. 

Additional Data 
Exception details: 
%2

Fields

Fields

Message

The Federation Service %1 could not be shut down properly. 

Additional Data 
Exception details: 
%2

Fields

Fields

Message

The Federation Service %1 could not be closed. 

Additional Data 
Exception details: 
%2

Fields

Fields

Message

The Federation Service could not fulfill the token-issuance request because the relying party '%1' is missing a WS-Federation Passive endpoint address. 
Relying party: %1 

This request failed. 

User Action 
Use the AD FS Management snap-in to configure a WS-Federation Passive endpoint on this relying party.

Fields

Fields

Message

An attempt to write to the Security event log failed. 

Additional Data 
Windows error code: %1 
Exception details: 
%2

Fields

Message

An error occurred during an attempt to register the event source for the Security log.  

User Action 
Ensure that the Federation Service has the correct permissions to write to the Security log.

Fields

Message

The Security log event source for the Federation Service could not be registered. 

Additional Data 
Windows error code: %1 
Exception details: 
%2

Fields

Fields

Message

The Federation Service at '%1' did not return any WS-Trust endpoints to be published by the federation server proxy. 

User Action 
If you want to publish WS-Trust endpoints to the federation server proxy, make sure that the endpoints are enabled for proxy use on the federation server.

Fields

Fields

Message

A WS-Trust endpoint that was configured could not be opened. 

Additional Data 
Address: %1 
Mode:    %2 

Error: 
%3

Fields

Fields

Message

The federation server proxy received error code '%2' while making a request to the Federation Service at '%1'. This could mean that the Federation Service is not started on the remote host. 

User Action 
Verify that the Federation Service is running on the remote host.

Fields

Fields

Message

The Federation Service configuration could not be loaded correctly from the AD FS configuration database. 

Additional Data 
Error:  
%1

Fields

Fields

Message

A change to the token service configuration was detected, but there was an error reloading the changes to configuration. 

Additional Data 
Error:  
%1

Fields

Fields

Message

The federation server proxy was unable to complete a request to the Federation Service at address '%1' because of a time-out. This might mean that the Federation Service is currently unavailable. 

User Action 
Verify that the Federation Service is running.

Fields

Fields

Message

Claim description could not be loaded correctly from the database. 

Additional Data 
Error:  
%1

Fields

Fields

Message

The federation server proxy configuration could not be updated with the latest configuration on the federation service. 

Additional Data 
Error:  
%1

Fields

Fields

Message

A change to the service configuration was detected, but there was an error reloading the changes to %1. 

Additional Data 
Error:  
%2

Fields

Fields

Message

The federation server proxy has detected congestion, caused by high latency response times, on the Federation Service. The load might be above the Federation Service operating capacity, or there might be network connectivity issues. Request throttling has been enforced to limit the number of concurrent requests to the following size: %1. 

User Action 
Verify that the Federation Service is operating within its operating capacity. 
Verify that the Federation Service is not experiencing network outages.

Fields

Fields

Message

The Federation Service failed to find a domain controller for the domain %1. 

Additional Data 
Domain Name: %1 
Error: %2 

User Action 
Use Nltest to determine why DC locator is failing. Nltest is part of the Windows Support Tools.

Fields

Fields

Message

The Federation Service was unable to listen at '%1' for WS-MetadataExchange requests due to an unexpected error. 

Additional Data 

Exception details: 
%2

Fields

Fields

Message

The federation server proxy successfully retrieved and updated its configuration from the Federation Service '%1'.

Fields

Fields

Message

The Federation Service encountered an error during an attempt to connect to a LDAP server at %1. 

Additional Data 
Domain Name: %1 
LDAP server hostname (if available): %2 
Authentication type: %3 
SSL mode: %4 
Username (if available): %5 
Error code (if available): %6 
Error from LDAP server (if available): %7 
Exception Details: 
 %8 

User Action 
 Check the network connectivity to the LDAP server. Also, check whether the LDAP server is configured properly.

Fields

Fields

Message

The Federation Service encountered an error while connecting to a global catalog server at %1. 

Additional Data 
Domain Name: %1 
Global Catalog hostname (if available): %2 
Authentication type: %3 
SSL mode: %4 
Username (if available): %5 
Error code (if available): %6 
Error from server (if available): %7 
Exception Details: 
 
 %8 

User Action 
Troubleshoot the network connectivity to the global catalog server. Also, verify that the global catalog server is configured properly.

Fields

Fields

Message

The federation server proxy was not able to retrieve the list of endpoints from the Federation Service at %1. The error message is '%2'. 

User Action 
Make sure that the Federation Service is running. Troubleshoot network connectivity. If the trust between the federation server proxy and the Federation Service is lost, run the Federation Server Proxy Configuration Wizard again.

Fields

Fields

Message

The certificate identified by thumbprint '%1' could not be found in the certificate store.  In certificate rollover scenarios, this can potentially cause a failure when the Federation Service is signing or decrypting using this certificate. 

User Action 
Ensure that the certificate that is identified by thumbprint '%1' has been added to the Localmachine "My" store and that it is accessible by the service account of the Federation Service.

Fields

Fields

Message

Expiration of the artifact failed. 

Additional Data 
Exception message: 
%1 

User Action 
Ensure that the artifact storage server is configured properly. Troubleshoot network connectivity to the artifact storage server.

Fields

Fields

Message

Attribute store '%1' is loaded successfully.

Fields

Fields

Message

The AD FS proxy service made changes to the endpoints it is listening on based on the configuration it retrieved from the Federation Service. 

Endpoints added: 
%1 

Endpoints removed: 
%2

Fields

Fields

Message

AD FS proxy service failed to start a listener for the endpoint '%1' 
Exceptiondetails: 
%2 

User action: Ensure that no conflicting SSL bindings are configured for the specified endpoint.

Fields

Fields

Message

The relying party '%1' is not configured with SAML Assertion Consumer Services. 
Relying party: %1 

This request failed. 

User Action 
Use the AD FS Management snap-in to configure one or more Assertion Consumer Services for this relying party.

Fields

Fields

Message

The request specified an Assertion Consumer Service index '%1' that is not  configured on the relying party '%2'. 
Assertion Consumer Service index: %1 
Relying party: %2 

This request failed. 

User Action 
Use the AD FS Management snap-in to configure an Assertion Consumer Service with the specified index for this relying party.

Fields

Fields

Message

The request specified an Assertion Consumer Service protocol binding '%1' that is not  configured on the relying party '%2'. 
Assertion Consumer Service protocol binding: %1 
Relying party: %2 

This request failed. 

User Action 
Use the AD FS Management snap-in to configure an Assertion Consumer Service with the specified protocol binding for this relying party.

Fields

Fields

Message

The request specified an Assertion Consumer Service URL '%1' that is not  configured on the relying party '%2'. 
Assertion Consumer Service URL: %1 
Relying party: %2 

This request failed. 

User Action 
Use the AD FS Management snap-in to configure an Assertion Consumer Service with the specified URL for this relying party.

Fields

Fields

Message

The artifact resolution request failed. 

Additional Data 
Exception message: 
%1

Fields

Fields

Message

The request specified an assertion consumer service  that is not  configured or not supported on the relying party '%4'. 
Request parameters: '%1', '%2', '%3' 
Relying party: %4 

This request failed. 

User Action 
Use the AD FS Management snap-in to configure an assertion consumer service with the specified parameters for this relying party. Also, check whether the artifact resolution service is enabled if the SAML artifact is requested.

Fields

Fields

Message

The federation server proxy encountered an error while trying to listen on one of the proxy endpoints.  The federation server proxy will not be able to start until it can listen on all required proxy endpoints. 
Proxy Endpoints: 
 
%1 

User Action 
Ensure that the permissions on the URLs of the proxy endpoints allow the federation server proxy security account (the default is Network Service) to listen on them.

Fields

Fields

Message

The federation server proxy could not establish a trust relationship for the SSL secure channel with the Federation Service %1. 
Error Message: 
%2 

User Action 
Ensure that the SSL certificate for Federation Service '%1' is valid and trusted by the federation server proxy.

Fields

Fields