In the lifecycle of any production environment, change is inevitable. Scaling down, hardware retirement, traffic pattern shifts, or security overhauls often necessitate the removal of a node from a cluster. While adding resources is exciting, removing a Web Application Proxy (WAP) server from a cluster is a delicate surgical procedure. Done incorrectly, it can orphan authentication requests, break Single Sign-On (SSO), and leave your external users staring at a cryptic 503 error.
# Uninstall the Web Application Proxy role Uninstall-WindowsFeature Web-Application-Proxy Wait for completion. This removes the configuration but does not clean the ADFS side. remove web application proxy server from cluster
# View current WAP endpoints Get-WebApplicationProxyEndpoint Remove-WebApplicationProxyEndpoint -TargetProxyFQDN "wap-node-01.contoso.com" In the lifecycle of any production environment, change
If you removed the WAP without uninstalling first, the proxy remains in the ADFS configuration. Force remove it: # Keep this server 10.0.0.11:80 down
- name: Clean ADFS trust (run on ADFS server) win_shell: | Remove-WebApplicationProxyEndpoint -TargetProxyFQDN " ansible_fqdn " delegate_to: adfs_internal_server Removing a web application proxy server from a cluster is not merely a matter of turning off a switch. It is a process of quiescing, disconnecting, cleaning, and validating . The difference between a professional team and an amateur one is visible in the post-removal state.
- name: Gracefully remove WAP node from cluster hosts: wap_removal_target become: yes tasks: - name: Stop web application proxy service service: name: W3SVC state: stopped ignore_errors: yes - name: Remove server from load balancer pool via API (F5 example) uri: url: "https://lb-manager/mgmt/tm/ltm/pool/wap_pool/members" method: DELETE body: '"name":" ansible_default_ipv4.address :443"' headers: Authorization: "Bearer f5_token " delegate_to: localhost
# Temporarily mark the server as down in the upstream block upstream backend_wan server 10.0.0.10:80; # Keep this server 10.0.0.11:80 down; # Mark removal node as down