Last week I came across a situation where a user needed to set up Microsoft SQL Server Reporting Services and was having difficulties in integrating Kerberos to it. He needed to change the options related to account delegation continuously on several user accounts and computer accounts that he was using for this purpose. Since he had no experience with Active Directory I was helping him with his queries and changing these options when needed. After some time, my schedule started to conflict with his troubleshooting. Therefore I decided to give him a quick training on Active Directory basics and delegate the necessary permissions for him so he can continue with his work at his own pace.
From a quick glance, trusting user/computer account for delegation is an option related to each user or computer account. So granting Full control to the target account for the user should work fine. But this was not the case! After the user was granted permissions, he was receiving the error message “The following Active Directory Domain Services error occurred: Access is denied.” Now this is a “super helpful” error message with a lot of information in it, that could direct us to a solution – “Thanks Microsoft”! 😀
A day passed. I tried delegating at the OU level – no success! Since my mind was telling me that there should be a solution I decided to seek help from Google! One of the interesting search results was this post and it directed me to a setting in group policy. Who would think to look that far for a simple thing like this?!!
The delegation settings for user accounts and computer accounts belong to the domain controllers, sort of. Therefore a user needs to have this permission on the domain controllers. When you go to User Rights Assignment section in the Default Domain Controllers Policy (Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment), you can find the setting Enable computer and user accounts to be trusted for delegation. By default only the Administrators are granted this permission. Since I did not want to come here and change the GPO every time a user is in need of this permission, I decided to create a security group named “Access.EnableDelegation” and added it to this GPO setting. Once the user was added to this security group, voila! he is now able to change this setting himself and I’ve got a very happy customer. 🙂
A few things to note
- Microsoft cautions on using this permission as it can impersonate clients and use their credentials to gain access to network resources. Therefore, make sure that the users are revoked of this permission once they are done using it.
Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.
- It is a best practice to perform custom changes such as this one in a separate GPO rather than in the Default Domain Controllers Policy.
- Once a user is granted this permission he has access to change delegation options for all user accounts and computer accounts. Be mindful of the scope of this permission. The only workaround for this would be to use “data hiding”. No one can change anything that is not visible to them!