The AD FS Web Agent Internet Server Application Programming Interface (ISAPI) Extension was unable to obtain a Windows NT ...

The AD FS Web Agent Internet Server Application Programming Interface (ISAPI) Extension was unable to obtain a Windows NT token from the authentication service. 

An anonymous token will be generated for this request. 

User Action 
Ensure that this application is configured as a Windows NT token-based application in the Federation Service trust policy. 

If the user comes from an account partner where Windows Trust may be applicable, ensure that Windows Trust is enabled for the account partner and that the account partner has enabled Windows Trust for this resource partner. 

If you are using shadow accounts: 
 - Ensure that a shadow account exists for this user. 
 - Ensure that user principal name (UPN) claims or e-mail claims are enabled for this application. 
 - Ensure that UPN claims or e-mail claims are being produced for this user by the account store or the account partner. 

Additional Data 
Look for additional events in the security log that may contain more details. Consider enabling failure auditing on this Web server if auditing is not already enabled.