Configure Resource-Based Kerberos Constrained Delegation for PowerShell Remoting

Scenario

You are a systems administrator at Barrier Reef Audio, a company that focuses on generating text from speech using a range of high-quality audio equipment and machine learning.

You use Windows PowerShell to perform a range of administrative tasks, including managing file servers. Due to network security restrictions, you don’t have unrestricted access to all servers in your environment from your workstation. So instead you typically use PowerShell remoting to access an administrative server that you then use to run commands and scripts from. One of your tasks is to archive files on a file server share to a ZIP file.

When you attempt to access the file server using PowerShell remoting, you find you are denied access. This is commonly referred to as the second hop problem.

In this lab, you will complete the following tasks:

1. Test access without Kerberos delegation.
2. Configure resource-based Kerberos constrained delegation.
3. Test access with resource-based Kerberos constrained delegation.

Lab Setup

In this lab, you will connect to VMs via Remote Desktop. You won't need to access the Azure portal.

Note: To complete this lab, use one of the following Remote Desktop clients:

• Windows: Microsoft Remote Desktop on Windows 10
• MacOS: Microsoft Remote Desktop
• Linux: Remmina

If you get stuck, feel free to check out the lab objectives, solution videos, or lab guide. Good luck!