How to upgrade AD FS from 2012 R2 / 2016 to newer version 2016 / 2019

If you want to upgrade your AD FS Farm, you can simply add a new node with the new Windows Server Edition to the existing farm as described above.

Then you can execute the following steps:

  1. Make the new node a Primary (only necessary when using Windows Internal Database) by running the following command on the new node
    Set-AdfsSyncProperties -Role PrimaryComputer
  2. Remove the old node
    1. Only necessary when using Windows Internal Database
      Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName adfs2019.intra.domain.ch
    2. Remove old Farm node
      1. Using service account
        Remove-AdfsFarmNode -ServiceAccountCredential "domain\sa-adfs"
      2. Using Group Managed Service Account
        Remove-AdfsFarmNode -GroupServiceAccountIdentifier "DOMAIN\GMSA-Adfs$" -Credential "domain\administrator"
      3. If the server is not available anymore and you just want to remove the node from the farm without uninstalling
        Set-AdfsFarmInformation -RemoveNode adfs2016.intra.domain.ch
  3. Upgrade Farm Level (Credentials are used for SQL, if your account has permission you don’t use that)
    $Credentials = Get-Credential
Invoke-AdfsFarmBehaviorLevelRaise -Credential $Credentials
  4. With this procedure a new AdfsConfigurationV4 Database will be created, the old one can be removed.

AD FS Farm Behavior Levels (FBL)

Windows Server VersionFBLAD FS Configuration Database Name
2012 R21AdfsConfiguration
20163AdfsConfigurationV3
20194AdfsConfigurationV4

The Farm Behavior Level can only be raised, if all nodes running on the same Windows Server Version.