JSI Tip 7359. How do I configure accounts so that they are trusted for delegation in a Windows Server 2003 Enterprise Edition environment?

NOTE: The text in the following Microsoft Knowledge Base article is provided so that the site search can find this page. Please click the Knowledge Base link to insure that you are reading the most current information.

Microsoft Knowledge Base article Q325894 contains:

IN THIS TASK

SUMMARY

This article describes how to configure accounts so that they are trusted for delegation in a Windows Server 2003 Enterprise Edition environment. A security setting determines which users can set the Trusted for Delegation settings on a user or computer object.

The user or object that is granted the Trusted for Delegation user right must have Write access to the account control flags on the user object or the computer object. A server process that is running on a computer (or under a user context) that is trusted for delegation can access resources on another computer by using a client computer's delegated credentials. A server process can access these resources only if the client's account does not have the Account cannot be delegated account control flag set.

The Trusted for Delegation user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

CAUTION: If you do not use the Trusted for Delegation user right or the Trusted for Delegation settings correctly, you can make the network vulnerable to sophisticated attacks that use Trojan horse programs to impersonate incoming clients and use their credentials to gain access to network resources. By default, the Trusted for Delegation right is assigned to the Administrator account on a domain controller.

back to the top

How to Configure a Computer Account So That It Is Trusted for Delegation

In a Windows Server 2003 Enterprise Edition Domain

In a Microsoft Windows 2000 Native Domain

NOTE: For security reasons, do not allow servers on the enterprise network to perform delegation at will on behalf of any network connection.

back to the top

How to Configure a User Account So That It Is Trusted for Delegation

In a Windows Server 2003 Enterprise Edition Domain

In a Microsoft Windows 2000 Native Domain

NOTE: For security reasons, do not allow servers on the enterprise network to perform delegation at will on behalf of any network connection.

If the Delegation tab does not appear, you must first register a Service Principal Name (SPN) for the account by using the Setspn utility that is included in the Support Tools pack, which is located on your CD-ROM or on the Resource Kit. Delegation is only intended to be used by a service account, which does not have a registered SPN, instead of a regular user account, which typically does not have an SPN.

back to the top

How to Assign User Rights for the Local Computer

back to the top

Understanding Delegation

Delegation is the act of allowing a service to impersonate a user account or a computer account to access resources throughout the network. In an N-tier program, the user authenticates to a middle-tier service. The middle-tier service authenticates to a back-end data server on behalf of the user.

Delegation depends on the middle-tier service that is being trusted for delegation. If the server is set to Trusted for delegation, the service can impersonate a user to use other network services. For example, a user runs a Web program and that Web program uses several different SQL databases that exist on different servers. When the user authenticates to a server (the front-end server) that is trusted for delegation, the server can access the SQL database on the other servers as the user. Because the server that is trusted for delegation has the user's ticket-granting ticket (TGT), it can authenticate to any service on the network. In Windows Server 2003, you can control the services that can impersonate the user by using constrained delegation.

back to the top