Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I already posted this question on SO, but the nature of it is between programming and server configuration, so I'll re-post it here as well.

I'm trying to write a proof-of-concept application that performs Kerberos delegation. I've written all the code, and it seems to working (I'm authenticating fine), but the resulting security context doesn't have the ISC_REQ_DELEGATE flag set.

So I'm thinking that maybe one of the endpoints (client or server) is forbidden to delegate. However I'm not authenticating against an SPN. Just one domain user against another domain user. As the SPN for InitializeSecurityContext() I'm passing "someuser@mydomain.lan" (which is the user account under which the server application is running). As I understand, domain users have delegation enabled by default. Anyway, I asked the admin to check, and the "account is sensitive and cannot be delegated" checkbox is off.

I know that if my server was running as a NETWORK SERVICE and I used an SPN to connect to it, then I'd need the computer account in AD to have the "Trust computer for delegation" checkbox checked (off by default), but... this is not the case, right? Or is it?

Also - when the checkbox in the computer account is set, do the changes take place immediately, or must I reboot the server PC or wait for a while?

share|improve this question
User accounts DO NOT have delegation enabled by default. You must enable it, Allow a user to be trusted for delegation – Ryan Fisher Jan 5 '12 at 1:51
up vote 3 down vote accepted

In my experience working with applications and Kerberos delegation the service account (executing the application) requires an SPN configured for the service you want to perform delegation from, and it must be set to trusted for delegation (either all SPNs or just specific ones, otherwise known as constrained delegation).

share|improve this answer
I assume that helped :) – commandbreak Mar 18 '10 at 10:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.