Forum Discussion
ADFS migration issue from 2016 OS to 2025 OS.
The SPN error does not, by itself, establish that your Windows Server 2016-to-2025 farm expansion is unsupported. Microsoft’s current WID upgrade guidance applies to Server 2025 and allows a newer federation server to join a lower-FBL farm temporarily in mixed mode. AD FS also supports gMSAs. First confirm whether your configuration database is WID or SQL, because the join parameters differ. For a gMSA, check that Add-AdfsFarmNode uses GroupServiceAccountIdentifier for the existing farm account, rather than ordinary service-account credentials. Verify the new server can retrieve that gMSA’s password using Test-ADServiceAccount, and inspect the exact account’s SPNs from the new node. Do not delete or recreate SPNs simply because setup reports them missing. Keep the existing farm operational and collect the command, verbose output, and AD FS event details for Microsoft support. I cannot confirm an officially documented 2025 gMSA defect matching this error.