AuthenticationService Application DelegationKerberos

Web Application Application Servers (machine instance) Service Application Proxy Machine Instance WFE Service Instance C2WTS

Claims Bob Kerberos WFE Service App SQL Windows Claims C2WTS

UPN

Claims SAML WFEAPPSQL Bob SSRS SAML C2WTS SAML Kerb Kerberos S4U Logon AD Windows Claims

Requires Constrained DelegationAct as operating system

RBCDLarge TicketsClaimsFAST ArmoringSetSPN KDC ProxyKDC Events Operations Logs Performance Counters And More…

PowerShell Commands: Set-ADUser Set-ADComputer Set-AD-ServiceAccount Must be configured via PowerShell PrincipalsAllowedToDelegateToAccount parameter You specify this on the service you want to delegate to!

Domain Account Managed Service Account Virtual Service Account Local/Built-in Account

Normal AD User Accounts No Change in Kerberos Setup Guidance Register the SPN to the service account – Setspn -S MSSqlSvc/SQL:1433 vmlab\svcSql – Setspn -S MSSqlSvc/SQL vmlab\svcSql

Active Directory Managed – handles passwords and SPNs Requires 2008 R2 schema or greater Must create via PowerShell – Create the MSA in AD. – Associate the MSA with a computer in AD. – Install the MSA on the computer that was associated. – Configure the service(s) to use the MSA. Account Name 15 Characters or less

BISM

MySPC

Q&A