AZ-800 · Question #199
You have an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. You sign in to Server1 by using a domain…
The correct answer is A. Configure Kerberos constrained delegation. This is the classic Kerberos 'double-hop' problem. When you connect from Server1 to Server2 via PowerShell remoting, your Kerberos ticket is presented to Server2 but cannot be forwarded onward to Server3 by default, because Kerberos tickets are non-forwardable unless delegation…
Question
You have an Active Directory Domain Services (AD DS) domain. The domain contains three servers named Server1, Server2, and Server3 that run Windows Server. You sign in to Server1 by using a domain account and start a remote PowerShell session to Server2. From the remote PowerShell session, you attempt to access a resource on Server3, but access to the resource is denied. You need to ensure that your credentials are passed from Server1 to Server3. The solution must minimize administrative effort. What should you do?
Options
- AConfigure Kerberos constrained delegation.
- BConfigure Just Enough Administration (JEA).
- CConfigure selective authentication for the domain.
- DDisable the Enforce user logon restrictions policy setting for the domain.
How the community answered
(26 responses)- A81% (21)
- B4% (1)
- C4% (1)
- D12% (3)
Explanation
This is the classic Kerberos 'double-hop' problem. When you connect from Server1 to Server2 via PowerShell remoting, your Kerberos ticket is presented to Server2 but cannot be forwarded onward to Server3 by default, because Kerberos tickets are non-forwardable unless delegation is configured. Kerberos Constrained Delegation (KCD) solves this by allowing Server2 to request service tickets on your behalf for specific services on Server3. JEA restricts which commands can be run, it does not solve credential forwarding. Selective authentication applies to cross-forest trusts. Disabling 'Enforce user logon restrictions' changes ticket validation behavior but does not enable delegation.
Topics
Community Discussion
No community discussion yet for this question.