Home
  •  

Automatic Update Of The Trust Was Disabled

Microsoft.ActiveDirectoryFederationServices2012R2.TrustMgmtAutoUpdateSkippedWithWarningMonitor (UnitMonitor)

Knowledge Base article:

Summary

Automatic update of federation metadata (which is used to update partner trust settings in the partner organization) for one or more trusts has been disabled, while automatic trust monitoring (which is used to detect differences of metadata coming from the partner organization) has been enabled.

This monitor scans the Windows PowerShell setting ConflictWithPublishedPolicy of all the trusts and generates a Yellow state and alert if this setting is set to True.

Causes

The automatic update for the trust has been disabled, while automatic monitoring has been enabled.

Resolutions

Enable the automatic update setting for the trust by modifying the properties of the trust using the AD FS Management snap-in.

Element properties:

TargetMicrosoft.ActiveDirectoryFederationServices2012R2.TrustManagement
Parent MonitorSystem.Health.ConfigurationState
CategoryConfigurationHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.ActiveDirectoryFederationServices2012R2.TwoStateScriptMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Automatic Update Of The Trust Was Disabled
The automatic update of federation metadata for one or more trust configurations has been disabled while automatic monitoring has been enabled. Any future changes that are made in the partner organizations will no longer be committed automatically to the trust configurations on this Federation Service. Check the Alert Context tab for more details.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices2012R2.TrustMgmtAutoUpdateSkippedWithWarningMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices2012R2.TrustManagement" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Microsoft.ActiveDirectoryFederationServices2012R2.TwoStateScriptMonitorType" ConfirmDelivery="false">

  <Category>ConfigurationHealth</Category>

  <AlertSettings AlertMessage="Microsoft.ActiveDirectoryFederationServices2012R2.TrustMgmtAutoUpdateSkippedWithWarningMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>

    <OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <PowerShellPath>%windir%\system32\windowspowershell\v1.0\powershell.exe</PowerShellPath>

    <ScriptName>TrustManagementAutoUpdateSkippedWithWarningCheck.ps1</ScriptName>

    <ScriptBody><Script>

                        Import-Module adfs



                        $scomapi = new-object -comObject "MOM.ScriptAPI"

                        $scomapi.LogScriptEvent("ActiveDirectoryFederationServices", 200, 4, "Trust Mgmt PowerShell monitoring script executed")



                        $relyingParties = Get-ADFSRelyingPartyTrust

                        $conflictWithPublishedPolicy = $false



                        foreach ($rp in $relyingParties)

                        {

                        if ($rp.ConflictWithPublishedPolicy -eq $true )

                        {

                        $conflictWithPublishedPolicy = $true

                        break

                        }

                        }



                        if ( $conflictWithPublishedPolicy -ne $true )

                        {

                        $claimsProviders = Get-ADFSClaimsProviderTrust

                        foreach ($cp in $claimsProviders )

                        {

                        if ($cp.ConflictWithPublishedPolicy -eq $true)

                        {

                        $conflictWithPublishedPolicy = $true

                        break

                        }

                        }

                        }



                        $scompb = $scomapi.CreatePropertyBag()

                        $scompb.AddValue("ConflictWithPublishedPolicy", $conflictWithPublishedPolicy )

                        $scomapi.AddItem($scompb)



                        $scomapi.ReturnItems()

                    </Script></ScriptBody>

    <IntervalSeconds>900</IntervalSeconds>

    <TimeoutSeconds>120</TimeoutSeconds>

    <ErrorExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="String">Property[@Name='ConflictWithPublishedPolicy']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="String">true</Value>

        </ValueExpression>

      </SimpleExpression>

    </ErrorExpression>

    <SuccessExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="String">Property[@Name='ConflictWithPublishedPolicy']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="String">false</Value>

        </ValueExpression>

      </SimpleExpression>

    </SuccessExpression>

  </Configuration>

</UnitMonitor>