服务器 Gind.cn
  1. 服务器 Gind.cn
  3. AADSTS90019尝试自动Azure AD注册join域的Windows 10设备时
Intereting Posts
nginx – php7.0-fpm – HTTP状态502 禁用ActiveMQ演示组件 Ubuntu – 当cd进入某个目录时显示红色的错误信息 是否有可能指定一个子域的后备Alogging否则不占？ 在活动目录中设置打印机 Nginx在端口443上侦听，防火墙closures仍然无法连接 重命名Mac上的文件（扩展名）而不更改创builddate？ 远程端口转发不起作用 远程linux安装 HAProxy只发送stream量到一个节点 大量的JetDirect固件更新 – 他们解决了什么问题？ 连接到Server 2008共享失败 远程桌面授权接pipe了我的基本RDPfunction Windows – 如何为其他用户设置环境variables TCP缓冲区大小和以太网绑定

AADSTS90019尝试自动Azure AD注册join域的Windows 10设备时

我正在尝试为Windows 10设置自动AAD连接，如下所述： https ： //azure.microsoft.com/en-gb/documentation/articles/active-directory-conditional-access-automatic-device-registration-setup/

我们有两个内部ADFS 3.0服务器（Server 2012R2）。 它们使用Azure AD Connect在四个UPN上与Office 365联合进行configuration：

  • ad.dom1.com – 这是森林名称，我们只有一个森林
  • dom1.com – 大多数用户都在这个域下
  • dom2.com
  • dom3.com

ADFS服务器使用https：//adfs.ad.dom1.dom上的TCP级负载均衡器进行公开 ，并使用由公共CA签名的证书。 ADFS服务器没有运行DRS，因为我们打算使用Azure AD来执行此操作。

对于使用任何这些UPN后缀创build的用户，使用Office 365的联合身份validation成功，但只有在修改了https://blogs.technet.microsoft.com/abizerh/2013/02/05/supportmultipledomain中所述的第三条规则之后-switch -当-pipe理-SSO-到办公室-365 /

Azure文章中的所有先决条件步骤均已执行：

  • 设置服务连接点
  • 执行Initialize-ADSyncDomainJoinedComputerSync
  • 确保文章中的前三条联邦规则存在（它们是由Azure AD Connect自动创build的）
  • 确保Auth方法声明规则存在并执行Set-AdfsRelyingPartyTrust
  • 创build了组策略

另外，这些领域：

  • enterpriseregistration.dom1.com
  • enterpriseregistration.ad.dom1.com
  • enterpriseregistration.dom2.com
  • enterpriseregistration.dom3.com

是所有Cregs for enterpriseregistration.windows.net

但是，尽pipe所有其他身份validation似乎都正常，但在所有现有的Windows 10 Enterprise域join的客户端计算机上，自动AADJ进程都会失败。 Microsoft / Windows /用户设备注册事件日志中存在以下错误：

事件ID 305 

Automatic registration failed at authentication phase. Unable to acquire access token. Exit code: Unspecified error. Server error: AdalMessage: GetStatus returned failure AdalError: invalid_request AdalErrorDesc: AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z AdalErrorCode: 0xcaa90006 AdalCorrelationId: <uuid> AdalLog: HRESULT: 0xcaa90006 AdalLog: HRESULT: 0xcaa20002 AdalLog: Webrequest returns error code:invalid_request and error description:AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z ; HRESULT: 0x0 AdalLog: Token response is not successfull. Status:400 ResponseText:{"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: <uuid>\r\nCorrelation ID: <uuid>\r\nTimestamp: 2016-11-14 12:30:28Z","error_codes":[90019],"timestamp":"2016-11-14 12:30:28Z","trace_id":"<uuid>","correlation_id":<uuid>"} ; HRESULT: 0x0 AdalLog: WebRequest Status:400 ; HRESULT: 0x0 AdalLog: Webrequest has valid state ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: Webrequest opening connection ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth- received realm info ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth w Tenant ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- returns false ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- refresh token is not available ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken get refresh token info ; HRESULT: 0x0 AdalLog: Authority validation is completed ; HRESULT: 0x0 AdalLog: Authority validation is enabled ; HRESULT: 0x0 AdalLog: Token is not available in the cache ; HRESULT: 0x0 . Tenant Type: dom1.com

事件ID 304 

 Automatic registration failed at join phase. Exit code: Unknown HResult Error code: 0xcaa1000e. Server error: empty. Debug Output:\r\n joinMode: Join drsInstance: azure registrationType: fed tenantType: fed tenantId: <uuid> configLocation: undefined errorPhase: auth adalCorrelationId: <uuid> adalLog: AdalLog: HRESULT: 0xcaa1000e AdalLog: HRESULT: 0xcaa90006 AdalLog: HRESULT: 0xcaa20002 AdalLog: Webrequest returns error code:invalid_request and error description:AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z ; HRESULT: 0x0 AdalLog: Token response is not successfull. Status:400 ResponseText:{"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: <uuid>\r\nCorrelation ID: <uuid>\r\nTimestamp: 2016-11-14 12:30:28Z","error_codes":[90019],"timestamp":"2016-11-14 12:30:28Z","trace_id":"<uuid>","correlation_id":"<uuid>"} ; HRESULT: 0x0 AdalLog: WebRequest Status:400 ; HRESULT: 0x0 AdalLog: Webrequest has valid state ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: Webrequest opening connection ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth- received realm info ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth w Tenant ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- returns false ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- refresh token is not available ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken get refresh token info ; HRESULT: 0x0 AdalLog: Authority validation is completed ; HRESULT: 0x0 AdalLog: Authority validation is enabled ; HRESULT: 0x0 AdalLog: Token is not available in the cache ; HRESULT: 0x0 adalLog: AdalLog: HRESULT: 0xcaa1000e AdalLog: HRESULT: 0xcaa90006 AdalLog: HRESULT: 0xcaa20002 AdalLog: Webrequest returns error code:invalid_request and error description:AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z ; HRESULT: 0x0 AdalLog: Token response is not successfull. Status:400 ResponseText:{"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: <uuid>\r\nCorrelation ID: <uuid>\r\nTimestamp: 2016-11-14 12:30:28Z","error_codes":[90019],"timestamp":"2016-11-14 12:30:28Z","trace_id":"<uuid>","correlation_id":"<uuid>"} ; HRESULT: 0x0 AdalLog: WebRequest Status:400 ; HRESULT: 0x0 AdalLog: Webrequest has valid state ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: Webrequest opening connection ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth- received realm info ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth w Tenant ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- returns false ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- refresh token is not available ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken get refresh token info ; HRESULT: 0x0 AdalLog: Authority validation is completed ; HRESULT: 0x0 AdalLog: Authority validation is enabled ; HRESULT: 0x0 AdalLog: Token is not available in the cache ; HRESULT: 0x0 adalResponseCode: 0xcaa1000e .

dsregcmd.exe

如果我尝试从SYSTEM命令提示符运行C：\ windows \ system32 \ dsregcmd.exe / debug，则会出现类似的错误： 

 dsregcmd::wmain logging initialized.DsrCmdAccountMgr::IsDomainControllerAvailable DsGetDcName success { domain:ad.dom1.com forest:ad.dom1.com domainController:\\ldndc01.ad.dom1.com isDcAvailable:true } PreJoinChecks Complete. preCheckResult: Join isPrivateKeyFound: undefined isJoined: undefined isDcAvailable: YES isSystem: YES keyProvider: undefined keyContainer: undefined dsrInstance: undefined elapsedSeconds: 1 resultCode: 0x0 Automatic device join pre-check tasks completed.TenantInfo::Discover: tenant type detection, validating https://adfs.ad.dom1.com/adfs/ls/ TenantInfo::Discover: tenant type detection, checking match against https://login.microsoftonline.com TenantInfo::Discover: tenant type detection, checking match against https://login.windows-ppe.net TenantInfo::Discover: Join Info TenantType:Federated AutoJoinEnabled:1 TenandID:<uuid> TenantName:dom1.com DsrCmdSettings::GetSetting: The key was not found, so returning FALSE. Key: SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ AdalLog: Token is not available in the cache ; HRESULT: 0x0 AdalLog: Authority validation is enabled ; HRESULT: 0x0 AdalLog: Authority validation is completed ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken get refresh token info ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- refresh token is not available ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- returns false ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth w Tenant ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth- received realm info ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: Webrequest opening connection ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: Webrequest has valid state ; HRESULT: 0x0 AdalLog: WebRequest Status:400 ; HRESULT: 0x0 AdalLog: Token response is not successfull. Status:400 ResponseText:{"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: <uuid>\r\nCorrelation ID: <uuid>\r\nTimestamp: 2016-11-14 12:30:28Z","error_codes":[90019],"timestamp":"2016-11-14 12:30:28Z","trace _id":"<uuid>","correlation_id":"<uuid>"} ; HRESULT: 0x0 AdalLog: Webrequest returns error code:invalid_request and error description:AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z ; HRESULT: 0x0 AdalLog: HRESULT: 0xcaa20002 AdalLog: HRESULT: 0xcaa90006 AdalMessage: GetStatus returned failure AdalError: invalid_request AdalErrorDesc: AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z AdalErrorCode: 0xcaa90006 AdalCorrelationId: {39AEBF80-8679-4A5A-86D3-409CB1A8D8EF} AdalLog: HRESULT: 0xcaa90006 AdalLog: HRESULT: 0xcaa20002 AdalLog: Webrequest returns error code:invalid_request and error description:AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials. Trace ID: <uuid> Correlation ID: <uuid> Timestamp: 2016-11-14 12:30:28Z ; HRESULT: 0x0 AdalLog: Token response is not successfull. Status:400 ResponseText:{"error":"invalid_request","error_description":"AADSTS90019: No tenant-identifying information found in either the request or implied by any provided credentials.\r\nTrace ID: <uuid>\r\nCorrelation ID: <uuid>\r\nTimestamp: 2016-11-14 12:30:28Z","error_codes":[90019],"timestamp":"2016-11-14 12:30:28Z","trace _id":"<uuid>","correlation_id":"<uuid>"} ; HRESULT: 0x0 AdalLog: WebRequest Status:400 ; HRESULT: 0x0 AdalLog: Webrequest has valid state ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: Webrequest opening connection ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth- received realm info ; HRESULT: 0x0 AdalLog: HRESULT: 0x4aa90010 AdalLog: AggregatedTokenRequest::UseWindowsIntegratedAuth w Tenant ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- returns false ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken- refresh token is not available ; HRESULT: 0x0 AdalLog: AggregatedTokenRequest::AcquireToken get refresh token info ; HRESULT: 0x0 AdalLog: Authority validation is completed ; HRESULT: 0x0 AdalLog: Authority validation is enabled ; HRESULT: 0x0 AdalLog: Token is not available in the cache ; HRESULT: 0x0 AdalLog: HRESULT: 0xcaa1000e wmain: Unable to retrieve access token 0x80004005. DSREGCMD_END_STATUS AzureAdJoined : NO EnterpriseJoined : NO

首先请注意，这个过程被称为自动AAD注册或自动工作场所join，而不是自动AADjoin。 AADjoin与AAD注册不同，这是仅适用于Win10（专业版或企业版）的function。

我已经在我的实验室里testing过了，并且通过MSI包和GPO成功完成了我的Server2012 R2和Win10机器到AAD的自动注册。 在第一种情况下（通过MSI软件包），当通过AAD连接同步到AAD的用户帐户login时，将触发日程安排任务。 任务完成后，您会发现设备已注册到AAD并与该用户关联。

在这里输入图像说明 在这里输入图像说明 在这里输入图像说明

在第二种情况下，通过GPO，事件日志显示自动注册已完成，同时我也可以看到Azure AD门户中的计算机。 在这里输入图像说明 在这里输入图像说明

对于您的问题，我认为您可以尝试在ADFS服务器上重新添加声明规则（$ rule1〜$ rule3），尽pipe它们已经存在。 另请确保您环境中的ADFS服务器已configuration并正常工作。

我明白你对此的失望。 我花了大约20个小时来解决自动AADjoin问题。 我正在运行最新版本的AD Connect，并在Server 2016上运行ADFS服务器场。我没有让AD Connectconfiguration我的ADFS服务器。

我有完全相同的错误。 这个问题是一个缺lessImmutableID索赔。 此链接被certificate是build立azure AD连接的最佳资源： https ： //docs.microsoft.com/en-gb/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup

列出了一个脚本来自动添加必要的声明规则。 现在我实际上理解了整个过程，我可以说这个脚本实际上工作并且增加了正确的声明规则。

但是，误导性的是如何在脚本中configuration几个variables。 所以，我想我会根据自己的学习来澄清，希望有时候会救人。

  • $MultipleVerifiedDomainNames ：描述和名称是错误的和错误的。 只有在Office 365租户中有多个联合域时才将其设置为$ TRUE。
  • $immutableIDAlreadyIssuedforUsers ：如果您的AD Connect同步的不可变ID（源锚点）不使用objectGUID，则将其设置为$ TRUE。
  • $oneOfVerifiedDomainNames ：如果将$ MultipleVerifiedDomainNames设置为$ true，则将其设置为希望设备注册到的Office 365validation的域名。

不要更改脚本的任何其他组件，并确保只运行一次。 如果您需要再次运行，则需要手动从RP信任中删除所添加的索赔发放规则，否则将被复制。

在Windows 10上进行故障排除时，另一个非常有用的信息是使用DSREGCMD。 它必须作为系统运行，所以你需要像PSEXEC。

psexec -i -s cmd.exe

dsregcmd /debug

这将迫使立即注册到Azure，并报告有关失败的详细信息。 在我的testing中，Windows 7工作正常，但Windows 10不会ADjoin。 如果ImmutableID出现问题，您将看到错误信息：AADSTS90019：在请求中找不到任何提供租户标识的信息，或者提供的任何凭证默认都没有。

如果您包含已validation的域名，但是您不应该有错误，则会看到：AADSTS50107：请求的联合身份对象your specified domain不存在。