The AD FS service account must be a member of the PhoneFactor Admins group on this computer. Membership in this group is ...