In my previous post, I discussed how to setup Kerberos constrained delegation and a limitation of using that method. This post will discuss how we can used resource-based Kerberos constrained delegation to do the same thing. Resource-based KCD was introduced in Windows Server 2012, and is defined as… Windows Server 2012 and later gives service administrators the ability to configure constrained delegation for their service. This model is known as resource-based KCD. With this approach, the back-end service administrator can allow or deny specific front-end services from using KCD. Kerberos Constrained Delegation Overview | Microsoft Docs Our environment will be...

Kerberos delegation is not a new concept in Active Directory; however, setting it up for Group Managed Service Accounts (gMSA) can be a bit confusing. Unlike normal domain accounts, gMSAs do not have a GUI for configuring delegation. Those configuraitons will need to be handled through PowerShell. A common use for Kerberos delegation is to solve the authentication double hop. For example, a user accesses a report which is configured to use a remote data source. That’s one hop from the user’s workstation to the webserver and then a second hop from the webserver to the data source. Our environment...

A while back I had to help a customer update their naming standard for their Managed Service Accounts, so I thought I would share some of those details. The DBAs and other administrators had a difficult time determining which service account belonged to which server and to which service. They had a corporate requirement to have separate accounts for each service; for example, one for the engine and one for the agent. Their current naming convention was just to have an incrementing number at the end. SVCSQL1$ = DB engine service SVCSQL2$ = Agent service SVCSQL3$ = Full Text service...