ADFS Diagnostic Tool

ADFS Diagnostic Tool

  • Comments 19
  • Likes

A huge thanks to the ADFS test team for developing such a great tool. 


Here is a quick "how to"


The tool is very simple to use and provides a graphical UI. In order to perform distributed diagnosis, i.e. diagnose failures based on the configuration of multiple machines in the scenario, it’s necessary to copy the out file generated by the tool each time it’s run and use it as an input/output file when running the tool on the next machine.


For example, to debug a scenario with an FS at the account role (FS-A), an FS at the resource role (FS-R) and a Web Server (WS), first run the tool on the FS-A selecting a new file, say adfsdiag.out. After the tool is run, this file will now contain configuration information relative to the FS-A. Copy the file to the FS-R machine and run the tool there, this time selecting the existing adfsdiag.out file. The tool will detect it already contains information relative to other roles and will execute extra configuration checks, for example, a claim flow check that verifies the outgoing claims sent by the FS-A match the incoming claims expected by the FS-R. After this second run, adfsdiag.out will contain information relative to both the FS-A and FS-R. Finally, copy the out file to the WS machine and run the tool again following the same steps. When running the tool for a role for which there’s already information present in the selected file, the old data for that role will be overwritten with the new information, making it possible to fix errors on a machine and re-run the tool without having to start the whole process all over again. There’s no “right order” to run the tool, all of them should give the same output, except for some certificate checks that will only be executed at the WS in case the information from the FS-R is available beforehand


Please give this tool a try and provide any feedback to this blog.

  • PingBack from

  • It's no secret, troubleshooting ADFS can be tough. That's why a few key members from our ADFS Test Team

  • A new version of the tool is now available... This version includes SharePoint / MOSS support: the UI

  • I can't tell you how much this tool saved me, I was troubleshooting for hours and I would have never figured out the issues without this tool.  Thanks so much for writing and publishing it!

  • Is ADFS Diag supported for Windows 2008 Enterprise edition 64-bit?

  • Hi Peter,

    ADFSDiag should work on 2008 64bit...

    What error are you getting?

  • Hi Peter,

    I have put the 64bit version up on the site - this should resolve your issue

  • The updated tool can be found here . The attachment contains both 32 and 64 bit installers. A cool new

  • I used this tool before in Windows 2003 and it was very helpful.

    I have upgraded my test environment to 2008.  I am running this on the server where the federated services are install (not the proxy, though that is what I wanted to test next).

    I am getting an exception:

    Exception thrown while performing IIS Observation:

     Exception: Microsoft.Test.Product.IIS

     Message: Cannot process ssl cert -- certificate hash is null

    I don't have any problems using the certificate.

    Any thoughts on what I have done wrong?



  • Does anyone have a version that is confirmed to work on windows 2008 64bit? I have tried every URL here, but everything now points to a new "updated" version that is suppose to work with 32 and 64bit, but mine crashes on 3 different 64bit servers.  The old 64bit version that was on this site, is no longer there.

  • Sorry - Seems to be working.  I saw the 2 version and they are labeled x86 and amd64 versions.  I usually see x64 or ia64 for intel 64bit architechture and thought amd64 was for AMD procs, I installed the wrong version(x86).  The amd64 version is running fine now.

  • Bizarrely I have three W2K8R2 servers, all Build 7600; it works on one (The Resource Fed Server), but not on the Account Fed Server or the server where the ADFS Web Agent is installed against IIS. Error is "Unable to create a report for role (Account Federation Server|WebAgentClaims). The ADFS Diagnostics did not create a log file" No trace of any helpful messages anywhere, and I have checked the obvious potential issues (file permissions etc)

    Anyone got any ideas?

  • Does this diagnostic tool help troubleshoot adfs 2.0 as well?

  • If anyone find any kind of computer related issues than feel free to contact our expert at 1-800-793-7521.

  • Thanks

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment