Questions tagged [delegation]
The delegation tag has no usage guidance.
40
questions with no upvoted or accepted answers
4
votes
0
answers
2k
views
Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account
I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account.
I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
- 329
4
votes
2
answers
925
views
DNS delegation on same server with DDNS and second slave server
I have two servers running BIND, the first is setup as the master of two zones and the second as a slave for those zones. The zones are example.com and ddns.example.com. I have DDNS running and ...
- 41
3
votes
0
answers
347
views
IIS 7.5 connect to a web site using IIS Manager using the current user credentials
I am trying to use IIS Manager to connect to a site or an application but would like to pass through or use the current authenticated user's credentials. There is only a username and password option ...
- 131
2
votes
0
answers
806
views
Constrained Delegation between IIS, SQL Server, SSRS and File System
First of all, not sure which site is best suited for this question be it SO, SF or SU so please feel free to suggest migration!
I have a requirement to constrain delegation between several machines ...
- 735
2
votes
1
answer
259
views
Azure - Is it possible for global administrators to enforce per-subscription resource limits?
My company is moving all its internal production and development servers to Azure, and needs a way to delegate administration while at the same time keeping track of resource usage; thus, we are going ...
- 71.3k
2
votes
0
answers
710
views
Delegate rights to AD security group to Add UNIX Attributes
We have several Linux servers that are AD integrated, all our DC's are Server 2008R2 running at 2003 DFL and FFL with MSSFU installed. I wish to delegate the population of the UNIX Attributes tab to ...
- 465
1
vote
0
answers
447
views
Kerberos delegation is failing to work with Java application
I have a Java web application running on Tomcat and Linux.
This application uses Kerberos authentication for clients, so workstations are able to connect to the site and their windows credentials will ...
- 933
1
vote
1
answer
3k
views
How to properly set-up ou DNS Zone delegation for the "_acme-challenge" subdomain?
We have hard times setting up a DNS Zone Delegation for one of our subdomains.
We have one DNS record "_acme-challenge" that will change frequently, and this DNS record is defined directly on our ...
- 208
1
vote
0
answers
934
views
Active Directory User Group Delegate Reset Password
I want to enable users to reset their AD passwords on our Windows Server 2012 through our Jira server. In order to make this happen, I added an AD user group with delegated control from the top-level ...
- 21
1
vote
1
answer
1k
views
How to configure delegation in an ASP.Net Core 2.0 app on windows with users authenticated via Azure AD
The Setup:
I have a web app written in ASP.NET Core 2.0 that authenticates against Azure AD using OpenID Connect. It is running on a machine that is part of an Azure AD domain. The app does have an ...
- 111
1
vote
0
answers
30
views
Delegated Hyper-V Management
I have a small, clustered Hyper-V infrastructure and one of my clients has 7 VMs with me currently. Their IT person would like to get console access to the instances, so if something freezes (as an ...
- 297
1
vote
1
answer
330
views
is it possible to delegate file srv and print srv managing to other users in windows 2008 R2 without giving them full admin rights?
we have some field service guys that work locally for some of our customers, we want to transfer the tasks of managing file servers and print servers to them. first we Thought about giving them local ...
- 11
1
vote
0
answers
1k
views
Account Operators built in group and "User Cannot Change Password" property
I have a question about configuring of "User Cannot Change Password" property. Does default "Account Operators" domain group has ability to change this property? If not can it be delegated via AD ...
- 1,315
1
vote
1
answer
635
views
Delete entry from Exchange calendar when delegate denies meeting request
I created a Room-Mailbox in Exchange.
This Mailbox will be used to manage vacation Days.
I delegated control to a user to deny and accept vacation requests.
The requestee is informed correctly about ...
- 107
1
vote
0
answers
144
views
bind9, Resolve example.com but forward *.example.com to a forwarder possible?
is it possible in bind to resolve example.com with a zone but resolve all subdomains of example.com with a forwarder?
If somebody knows how this can work or has some simple sample configurations i ...
- 53
1
vote
0
answers
229
views
Kerberos: connection from win app running from IIS to SQL failed
I have an IIS web-application with Windows authentication and impersonation.
This application connects to SQL server.
In this case Kerberos works fine.
But there is a problem.
Web-application runs ...
1
vote
0
answers
2k
views
How to fix "SignTool Error: IStore2::Load returned error: 0x80090345"
I have a Jenkins job running the signtool utility on a remote node, the console log looks like so:
Started by user anonymous
Building remotely on vm-builder
[VE] $ cmd /c call "C:\Documents and ...
- 755
0
votes
0
answers
46
views
Grant permission to user on AD for installing only drivers
I need to grant permission to one user to install only drivers.
Is there such an option? Or another option to grant permission?
0
votes
0
answers
646
views
'account is sensitive and cannot be delegated'
This setting is part of the 'account' dialog on an active directory domain account. This setting is recommended for privileged accounts.
I dont know much about this setting but running into an issue ...
- 1
0
votes
0
answers
575
views
How to add delegation to existing subnet in azure bicep?
I am trying to create azure app function which should be accessible to postgres in private vnet.
But, it seems the network is showing error as already delegated so can't add that.
So I tried adding ...
- 1
0
votes
0
answers
2k
views
matrix-synapse delegation fails due to "No such file or directory" error on delegating server
I am setting up delegation on a synapse server. I follow the official docs and seem to have everything in place. I get the following error on example.com nginx logs when I enter the homeserver "...
- 69
0
votes
1
answer
899
views
On which OU should we delegate permissions for adding computer to a domain - clarify microsoft docs
Following principle of Least-Privilege Administrative Model I'm making custom group for managing domain, that would be less privileged than Domain Administrator. For starters it should have permission ...
- 151
0
votes
1
answer
3k
views
Exchange (2016) many mailbox delegations and throttling policies
At a customers site with 20+ employees per team I get an outlook warning message roughly translated to "The amount of elements opened at once has been limited by the server administrator".
...
- 51
0
votes
1
answer
368
views
Can I send a mail through Exchange Online with a different reply name and reply address than what I am authenticating with?
Just switched to Exchange Online, and ran into an issue. We have an application that lets an employee email a customer. With our previous mail provider, we would authenticate to the SMTP server using ...
- 387
0
votes
1
answer
99
views
Strange behavior: Exchange 2010, delegation, OWA, duplicate sent items
Please help me understand this strange (to me) behavior
Goal
Allow delegated users to send-on-behalf-of other mailbox using OWA and iOS/Android apps.
Sent items should appear only once in the ...
- 392
0
votes
1
answer
112
views
Can gsuite admins define email delegates?
All of Google's documentation details how to enable delegation for an organization, however I want to know if there's a way for an administrator to define delegates for an account.
My org has a ...
- 103
0
votes
0
answers
562
views
In DNS, how do I delegate just the zone apex to a different nameserver?
I have a domain with two completely distinct backends, as follows:
The zone apex (example.com) serves a CloudFront distribution
All other subdomains (*.example.com) point to a load balancer with an ...
- 209
0
votes
0
answers
2k
views
Kerberos Double Hop Delegation from IIS to SQL server (using django)
I need to pass the credentials (Integrated Windows Authentication) from a django website on IIS onto a backend SQL server so that it runs under the proper user context.
This is how my setup looks so ...
- 41
0
votes
1
answer
135
views
Trouble with domain delegation
I suspect I have a problem with domain delegation.
Notes:
Following addresses and names are examples
I have two public static IPs and own a domain name
I'm using Debian 9 and Bind 9
I want ...
0
votes
1
answer
776
views
Issues with delegating subdomain to AD server
I have a working authorative BIND 9.8.4-P2 server on freebsd on domain domain.com with IP 192.168.0.3 and name ns.domain.com that I did not set up on my own. It is a hidden server from which a subset ...
- 171
0
votes
0
answers
1k
views
Kerberos constrained delegation
There is a small problem with the setting Kerberos constrained delegation in Active Directory.
The scheme works as follows:
1. Client workstation.
2. Web server with Windows 2008 Ent installed IIS (...
- 11
0
votes
0
answers
55
views
Enabling constrained delegation on DC computer account
Is it necessary to have constrained delegation enabled on Microsoft AD domain controller computer account? If yes then why and what are consequences of disabling it?
I'm mainly interested in current ...
- 1,315
0
votes
0
answers
490
views
Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server
We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers.
We have 2 x Windows 2012 Servers running
IIS Server
SQL ...
- 3,198
0
votes
3
answers
540
views
create dns delegation where new nameserver are to be in the delegation on windows 2008 os
We have a domain "muzzard.com" which has nameservers ns0 and ns1
I'd like to add a delegation aws.muzzard.com and have the nameservers for that delegation in there e.g. ns0.aws.muzzard.com etc.
...
- 141
0
votes
1
answer
155
views
Sorting out delegation
I'm trying to sort out Windows Auth delegation for an IIS box talking to a SQL box, which should be passing through the users credentials. I've detailed the configuration of this double-hop scenario ...
- 101
0
votes
1
answer
315
views
How do I get a list of users in AD who have the ability to reset another user's password?
I need to provide a list of all the users who can reset other users' passwords. e.g. Service Desk Staff, Domain Admins etc.
This might have been delegated at a specific OU or at domain level. Is ...
- 1
0
votes
1
answer
713
views
Cross Forest Delegation
Is it possible to do delegation in a cross forest scenario with only a one way trust?
I have 2 domains which are in different forests, and there is a one way trust from the resourcedomain to the ...
user59052
0
votes
1
answer
1k
views
Quest PowerShell: Export AD permissions and apply them at a later stage
I'm trying to standardise our AD permissions for our 4 support groups. I've already applied permissions for 2 standard groups (Global support) and I'm now facing a painful clean-up for site based ...
- 105
-1
votes
2
answers
232
views
why are multiple Kerberos TGTs visible thru klist?
I just started trying to understand kerberos and stumbled across the two TGTs on my system too - then I found the post multiple LDAP and krbtgt tickets generated.
I read into Kerberos delegation, but ...
- 1
-2
votes
2
answers
261
views
DNS subdomain delegation for different servers, but same domain
could someone explain to me what i am doing wrong, or it is just impossible to do. Just for learning, and understading how subdomain delegation works.
I have 1 domain eg.: server.com and 3 VPS servers,...
- 3