My Notes On Setting Up ADFS 2016 Extranet Smart Lockout

# This will Add the audit settings to your existing settings

set-AdfsProperties -LogLevel ((Get-AdfsProperties).LogLevel+'SuccessAudits','FailureAudits')

# Or just add all the logging

Set-ADFSProperties -LogLevel Verbose,Errors,Warnings,Information,SuccessAudits,FailureAudits

#validate SuccessAudit and FailureAudits is set

(Get-AdfsProperties).loglevel

#Make Sure the Security Audit Policy is enabled

auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable

#validate

auditpol.exe /get /subcategory:"Application Generated"

#it will prompt for an account use an account with ADFS Administrators Rights

Update-AdfsArtifactDatabasePermission

<#Note if WINRM isn't working correctly on the ADFS Farm Nodes, it will display a message very similar to that the patch is missing.#>

#Enable Log Only First and Monitor lockout activity

Set-AdfsProperties -ExtranetLockoutMode AdfsSmartlockoutLogOnly

#restart the adfs service

restart-service adfss*

#The lockout Threshold is the number of failed password attempts that must occur from a unfamiliar location

#before the account gets locked out from the ADFS Side.

Set-AdfsProperties -ExtranetLockoutThreshold 10

(Get-AdfsProperties).ExtranetLockoutThreshold

#the observation window is the amount of time that must pass before the extranet lockout

#automatically unlocks

Set-AdfsProperties -ExtranetObservationWindow ( new-timespan -minutes 15 )

(get-AdfsProperties).ExtranetObservationWindow

#enable Extranet Lockout

Set-AdfsProperties -EnableExtranetLockout $true

#Validate

get-AdfsProperties | select *lock*,bannediplist | fl

#Check the users ADFS Account Activity

Get-ADFSAccountActivity useremailaddress/upn

Get-ADFSAccountActivity Aedan.Stokes@16lab.chadcolabs.us

#check to see if the users bad password account in AD is increasing

get-aduser samaccountname -properties badPwdCount,lockedout

get-aduser 112571 -properties badPwdCount,lockedout

The Federation Service failed to validate a new credential. See XML for failure details. 

Activity ID: b71497c7-bb2d-496b-ff1e-0080000000c8 

Additional Data 

XML: <?xml version="1.0" encoding="utf-16"?>

<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="FreshCredentialAudit">

  <AuditType>FreshCredentials</AuditType>

  <AuditResult>Failure</AuditResult>

  <FailureType>CredentialValidationError</FailureType>

  <ErrorCode>N/A</ErrorCode>

  <ContextComponents>

    <Component xsi:type="ResourceAuditComponent">

      <RelyingParty>http://sts.16lab.chadcolabs.us/adfs/services/trust</RelyingParty>

      <ClaimsProvider>N/A</ClaimsProvider>

      <UserId>Aedan.Stokes@16lab.chadcolabs.us</UserId>

    </Component>

    <Component xsi:type="AuthNAuditComponent">

      <PrimaryAuth>N/A</PrimaryAuth>

      <DeviceAuth>false</DeviceAuth>

      <DeviceId>N/A</DeviceId>

      <MfaPerformed>false</MfaPerformed>

      <MfaMethod>N/A</MfaMethod>

      <TokenBindingProvidedId>false</TokenBindingProvidedId>

      <TokenBindingReferredId>false</TokenBindingReferredId>

      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>

    </Component>

    <Component xsi:type="ProtocolAuditComponent">

      <OAuthClientId>N/A</OAuthClientId>

      <OAuthGrant>N/A</OAuthGrant>

    </Component>

    <Component xsi:type="RequestAuditComponent">

      <Server>http://sts.16lab.chadcolabs.us/adfs/services/trust</Server>

      <AuthProtocol>SAMLP</AuthProtocol>

      <NetworkLocation>Extranet</NetworkLocation>

      <IpAddress>10.10.10.25</IpAddress>

      <ForwardedIpAddress>10.10.10.25</ForwardedIpAddress>

      <ProxyIpAddress>N/A</ProxyIpAddress>

      <NetworkIpAddress>N/A</NetworkIpAddress>

      <ProxyServer>16LAB-WAP1</ProxyServer>

      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134</UserAgentString>

      <Endpoint>/adfs/ls/idpinitiatedsignon</Endpoint>

    </Component>

  </ContextComponents>

</AuditBase>

The Federation Service failed to issue a valid token. See XML for failure details. 

Activity ID: b71497c7-bb2d-496b-ff1e-0080000000c8 

Additional Data 

XML: <?xml version="1.0" encoding="utf-16"?>

<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AppTokenAudit">

  <AuditType>AppToken</AuditType>

  <AuditResult>Failure</AuditResult>

  <FailureType>GenericError</FailureType>

  <ErrorCode>N/A</ErrorCode>

  <ContextComponents>

    <Component xsi:type="ResourceAuditComponent">

      <RelyingParty>http://sts.16lab.chadcolabs.us/adfs/services/trust</RelyingParty>

      <ClaimsProvider>N/A</ClaimsProvider>

      <UserId>Aedan.Stokes@16lab.chadcolabs.us</UserId>

    </Component>

    <Component xsi:type="AuthNAuditComponent">

      <PrimaryAuth>N/A</PrimaryAuth>

      <DeviceAuth>false</DeviceAuth>

      <DeviceId>N/A</DeviceId>

      <MfaPerformed>false</MfaPerformed>

      <MfaMethod>N/A</MfaMethod>

      <TokenBindingProvidedId>false</TokenBindingProvidedId>

      <TokenBindingReferredId>false</TokenBindingReferredId>

      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>

    </Component>

    <Component xsi:type="ProtocolAuditComponent">

      <OAuthClientId>N/A</OAuthClientId>

      <OAuthGrant>N/A</OAuthGrant>

    </Component>

    <Component xsi:type="RequestAuditComponent">

      <Server>http://sts.16lab.chadcolabs.us/adfs/services/trust</Server>

      <AuthProtocol>SAMLP</AuthProtocol>

      <NetworkLocation>Extranet</NetworkLocation>

      <IpAddress>10.10.10.25</IpAddress>

      <ForwardedIpAddress>10.10.10.25</ForwardedIpAddress>

      <ProxyIpAddress>N/A</ProxyIpAddress>

      <NetworkIpAddress>N/A</NetworkIpAddress>

      <ProxyServer>16LAB-WAP1</ProxyServer>

      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134</UserAgentString>

      <Endpoint>/adfs/ls/idpinitiatedsignon</Endpoint>

    </Component>

  </ContextComponents>

</AuditBase>

An account failed to log on.

Subject:

    Security ID:        NULL SID

    Account Name:        -

    Account Domain:        -

    Logon ID:        0x0

Logon Type:            3

Account For Which Logon Failed:

    Security ID:        NULL SID

    Account Name:        ADMINISTRATOR

    Account Domain:        

Failure Information:

    Failure Reason:        Unknown user name or bad password.

    Status:            0xC000006D

    Sub Status:        0xC0000064

Process Information:

    Caller Process ID:    0x0

    Caller Process Name:    -

Network Information:

    Workstation Name:    -

    Source Network Address:    108.30.90.24

    Source Port:        0

Detailed Authentication Information:

    Logon Process:        NtLmSsp 

    Authentication Package:    NTLM

    Transited Services:    -

    Package Name (NTLM only):    -

    Key Length:        0

#after you review the logs and feel comfortable enable ADFS Smart Lockout

Set-AdfsProperties -ExtranetLockoutMode AdfsSmartLockoutEnforce

#restart adfs service can use -computername and pass each adfs node from the farm

Restart-service adfssrv

#Validate

get-AdfsProperties | select *lock*,bannediplist | fl

Get-ADFSAccountActivity Aedan.Stokes@16lab.chadcolabs.us

get-aduser 112571 -properties badPwdCount,lockedout

#view the ADFS Account Activity

Get-ADFSAccountActivity Abdiel.Conrad@16lab.chadcolabs.us

#a Familiar IP is listed

#view the ADFS Account Activity

Get-ADFSAccountActivity Abdiel.Conrad@16lab.chadcolabs.us

#note the Familiar Lockout is now set to true

get-aduser 225866 -properties badPwdCount,lockedout