This monitor indicates that the Federation Service failed to load its token-signing, token-decrypting, and SSL certificates. If the failing certificate is the primary certificate, the AD FS Windows service will fail to start up.
If the same problem does not occur again within 15 minutes, the health state of this monitor will change back to a Green state. A corresponding alert is generated by the alert rule, and it must be resolved manually.
The following are possible causes for this event:
Active Directory objects are missing under the specified distinguished name in the diagnostic information regarding X.509 certificate private key sharing that is provided in this event.
The access control list (ACL) permissions of the Active Directory objects that are specified in the diagnostic information have changed, and the service identity of AD FS no longer has rights to read or modify those objects.
The following are possible resolutions for this event:
You may have to restore all Active Directory objects under the distinguished name that was specified in the event-included diagnostic information.
Work with your domain administrator to help restore read/write ACL permissions.
| Target | Microsoft.ActiveDirectoryFederationServices20.CertificateManagement |
| Parent Monitor | System.Health.ConfigurationState |
| Category | ConfigurationHealth |
| Enabled | True |
| Alert Generate | False |
| Alert Auto Resolve | True |
| Monitor Type | Microsoft.Windows.SingleEventLogTimer2StateMonitorType |
| Remotable | True |
| Accessibility | Public |
| RunAs | Default |
Home
ENU <UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices20.CertificateManagementAdditionalBlobCertificateLoadWarningMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices20.CertificateManagement" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogTimer2StateMonitorType" ConfirmDelivery="true">
<Category>ConfigurationHealth</Category>
<OperationalStates>
<OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Warning"/>
<OperationalState ID="TimerEventRaised" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>$Target/Host/Property[Type="Microsoft.ActiveDirectoryFederationServices20.FederationServer"]/ADFSEventLog$</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">329</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005RegularExpression</Operator>
<Pattern>(^AD FS$)|(^AD FS 2.0$)</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
<TimerWaitInSeconds>900</TimerWaitInSeconds>
</Configuration>
</UnitMonitor>