Kerberos Delegation, CredSSP, and Windows PowerShell
summary
Demonstrates using CredSSP and Kerberos delegation with PowerShell to solve the “second hop” problem: enabling enable-WSManCredSSP for client/server roles, creating run-as endpoints, and configuring unconstrained, constrained, and resource-based delegation via Set-ADComputer and AD attributes. Shows pitfalls: must use FQDNs not IPs, restart services or purge tickets after changes, domain controllers are unconstrained by default, and the AD cmdlet doesn’t clear msDS-AllowedToDelegateTo so scripts must clear that attribute first. Some live demos fail intermittently.
AI-written summary · about
chapters (4)
- 0:00Start
- 17:51Active Directory User Accounts and Computer Accounts Attributes
- 19:56Get Delegation Property
- 22:09Install Remote Server Administration Tools
related talks
50mBeyond the Mcse: Active Directory for the Security Professional
01h 34mPowerShell remoting - Installing and troubleshooting in a...
50mMSAL Authentication: Auth ain't... (But it isn't easy either)
50mHybrid Active Directory Attacks: Anatomy and Defenses
37mPowerShell Web Access
35mWalking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities
37mThreat Hunting in Active Directory Environment
40mExploiting Windows Hello for Business