ADFS/IFS - Error 1297 - Requires "Generate security audits" privilege. Need to back off privilege.

Our vendor is installing ADFS on our on premise system and when we try to start the "Active Directory Federation Services", we get this error:

"Error 1297: A privilege that the service requires to function properly does not exist in the service account configuration. You may use the Services Microsoft Management Console (MMC) snap-in (services.msc) and the Local Security Settings MMC snap-in (secpol.msc) to view the service configuration and the account configuration."

We gave the service account the temporary privilege "Generate security audits" and the service account was able to start the "Active Directory Federation Services".

Our Corporate Security Team is requesting us to back off this privilege once configured. We unchecked all the events on the Federation Service Properties screen, removed the privilege "Generate security audits" for the service account, rebooted the server, and tried to start the "Active Directory Federation Services" and it gave us the error 1297 again.

Why would ADFS require the privilege "Generate security audits" when the auditing events are all turned off?

Is there away to start this service without having the privilege "Generate security audits"?

Find more posts tagged with

Infor Lawson Technology Group - Discussion

Comments

unknown

It appears it's POSSIBLE to disable it - at the expense of ADFS not collecting the audit information in the logs.

Here is MS article that talks about it:

docs.microsoft.com/.../ad-fs-tshoot-logging

In other words, if you disable this, you may have hard time troubleshooting ADFS issues later.

Alex.

unknown

You might want to mention to your Security Team that part of security is tracking. Failure to track activity would be considered a defect in your security when an outside security audit is conducted. (Lawson has steadily added auditing features over the years, and we have turned a lot of them on, precisely because of outside audits and the questions asked.) Caveat: This is just my opinion. I am just responsible for Lawson security, I am not part of our IT security team.

lmerrill

We have created a new AD account and granted full privileges and used that account to install ADFS. Once we were done with installation we revoked the full privileges and kept just the minimum.

Copyright © 2025 Infor. All rights reserved.