Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web app that uses some backend servers (UNC, HTTP and SQL). To get this working I need to configure ServicePrincipalNames for the account running the IIS AppPool and then allow kerberos delegation to the backend services.

I know how to configure this through the "Delegation" tab of the AD Users and Computers tool.

However, the application is going to be deployed to a number of Active Directory environments. Configuring delegation manually has proved to be error prone and debugging the issues misconfiguration causes is time consuming. I'd like to create an installation script or program that can do this for me.

Does anyone know how to script or programmatically set constrained delegation within AD?

Failing that how can I script reading the allowed services for a user to validate that it has been setup correctly?

share|improve this question
up vote 0 down vote accepted

OK, after much digging on the internet and some testing, I've worked it out.

I didn't find a utility that could do this for me from a batch script. I did however find out which properties are required within the underlying LDAP. So I had to write my own utility to do it for me.

The following C# code can set or check constrained delegation:

DirectoryEntry de = new DirectoryEntry("LDAP://"+usersDN);

if (!de.Properties["msDS-AllowedToDelegateTo"].Contains(backendSpnString))

If the user has had non-constrained delegation enabled, you may need to turn this off before enabling constrained - but I didn't fully test this scenario.

The code above is C# as that is what the webapp is written in and was therefore to hand. I expect anyone following this could transcribe into another language if so desired.

share|improve this answer

The joeware "admod" utility does this nicely too.

admod -b "full DN to user" "msDS-AllowedToDelegateTo:+:Service/"

the :+: means "add", :-: would be delete, see the help pages for all of the details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.