Today i have a customer that got an Bad Request Error 400, when he try to logon to ADFS from inside their own network, with domain connected computers.
The error is only showing up in Internet Explorer, witch lead me to it might be a kerberos thing.

The service account that run the ADFS services, is “ita_service_admin”.

So looking at that account with setspn i can see witch SPN is register to ita_service_admin account.

setspn -l XXX\ita_service_admin

The where no SPN for the account. The ADFS url is: https://fs.YYY.dk so i added the following SPN to ita_service_Admin account:

setspn -S HOST/FS.YYY.DK XXX\ITA_SERVICE_ADMIN
setspn -S HTTP/FS.YYY.DK XXX\ITA_SERVICE_ADMIN

But I got an error saying that HOST/FS.YYY.DK already exist. So i look for the SPN in the domain

This Code, will show all SPN in use in you Active Directory

cls
$search = New-Object DirectoryServices.DirectorySearcher([ADSI]“”)
$search.filter = “(servicePrincipalName=*)”
$results = $search.Findall()

#list results
foreach($result in $results)
{
$userEntry = $result.GetDirectoryEntry()
Write-host “Object Name = “ $userEntry.name -backgroundcolor “yellow” -foregroundcolor “black”
Write-host “DN      =      “  $userEntry.distinguishedName
Write-host “Object Cat. = “  $userEntry.objectCategory
Write-host “servicePrincipalNames”        $i=1

foreach($SPN in $userEntry.servicePrincipalName)
{
  Write-host “SPN(“ $i “)   =      “ $SPN       $i+=1
  }
Write-host “”

}

Find the SPN, and delete it from the account, i find the account under Administrator, so it looks like someone have change the service account for ADFS service from Administrator to ITA_SERVICE_ADMIN account in the past, without moving the SPN.

So delete the SPN from administrator account

setspn -D HOST/FS.YYY.DK XXX\administrator

Then try to add it again to ITA_Service_Admin account.

setspn -S HOST/FS.YYY.DK XXX\ITA_SERVICE_ADMIN

Restart the ADFS service, and the ADFS is working again also from Internet Explorer.