Supported / Recommended to install ADFS & DirSync on a 2012 Domain Controller?

We currently have a member server running Windows Server 2012
Running ADFS Role.  DirSync is installed and running on that same server.
Forest & Domain Functional Level is at Windows Server 2003 so no problem to have a 2012 DC. My question surrounds the use of ADFS and DirSync on a 2012 Domain Controller.
Q:
Can we promote the 2012 Server to a domain controller with ADFS and DirSync already installed or must we remove the ADFS role and DirSync then promote it to a DC?
Q:
Can we even run ADFS & DirSync together on a Domain Controller?

Thank you for your time in advance!
K.B.
LVL 8
K BAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

NVITCommented:
Best practice, especially for a production environment, is that a DC should only be used for AD, DNS, and GC purposes.
0
NVITCommented:
It would probably work. Still, I wouldn't do it.
0
albatros99Commented:
You can run it all on the same server and I have done this in a test environment.  In a production environment I would not do this but it's supported (at least in R2, it is). With R2 you also have the federation proxy role which sits in your DMZ so there's less of an issue. You can also install another ADFS server on a a member server and join it to your existing farm (for failover purposes).
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

K BAuthor Commented:
Thank you,
What about non-R2 2012?  Is it supported?There will be only one adfs. In fact we are considering eliminating the ADFS role entirely from the environment as DirSync does password synchronization now.
0
albatros99Commented:
For smaller environments using DirSync with password sync is fine you don't need the full-blown ADFS. DirSync is supported on Domain Controllers and it can also co-exist with the ADFS role.  

I would use ADFS mainly for security reasons and because it allows for true single sign-on. DirSync just synchronizes the passwords but it's not instantaneous. If a user changes the password he will have to wait for the next sync before the change takes effect for Offic 365. With ADFS, as soon as you change the password it's effective.
0
K BAuthor Commented:
Great point. Which applications are true single sign-on In office 365? Aside from the fact that you have to wait for synchronization to occur. I am speaking about just being logged directly into the application without typing your username and password?
0
albatros99Commented:
The way ADFS works is that it presents signed tokens to the Office 365 applications. Since these tokens expire you will have to eventually authenticate again. When Microsoft speaks of SSO they don't mean 'not having to type in the password' but rather the use of the same set of credentials and a single identity provider.

Getting back to your original question, here's a link to a very good FAQ:
http://blogs.technet.com/b/askpfeplat/archive/2013/07/22/faq-on-adfs-part-1.aspx

If you want to migrate ADFS away from the current server:
- Install a second ADFS member server in the farm
- Change the primary ADFS server  
- Remove ADFS role from the existing server
0
K BAuthor Commented:
Thank you.
Can I promote the ADFS server to a domain controller without removing the ADFS role first?
0
David Johnson, CD, MVPOwnerCommented:
simple answer is yes but it is not recommended practice but sometimes local conditions don't allow for using every recommended practice.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
K BAuthor Commented:
Thanks for your reply David!
Since this is production, how hard is it to remove it and reinstall with all the same settings?  Is there a simple process to follow?
0
K BAuthor Commented:
Thoughts?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.