Cross‑Domain delegation failure in same forest

Question

Hi all

A service account was set up with constrained delegation.

The target resource sits in a different domain.

The delegation attempt keeps failing repeatedly.

This happens even though both domains share one forest.

So what resource‑based constrained delegation (RBCD) configuration is required to make cross‑domain delegation succeed in this scenario ?

Answer 1

Hi Jutsi Mohanmed,

Based on your description, this is a Kerberos constrained delegation cross-domain scenario within the same forest.

For this scenario, Resource-Based Constrained Delegation (RBCD) is typically the correct configuration model because the delegation permission is configured on the back-end/target resource account, not on the front-end service account.

Microsoft documents that earlier constrained delegation required domain admin privileges and restricted the service account to a single domain. With the newer Kerberos constrained delegation model, delegation can be configured on the back-end service account, and that account can be in another domain.

Recommended Action Plan:

You can configure RBCD by running the following PowerShell commands from a Domain Controller in the target domain (Domain B), using an account with administrative privileges:

# 1. Retrieve the Front-end Service Account object from Domain A
$FrontendAccount = Get-ADUser -Identity "FrontEndAccountName" -Server "DomainA.com"
# Note: If the front-end is a computer account, use Get-ADComputer instead of Get-ADUser.
# 2. Grant the Front-end Account permission to delegate to the Target Resource in Domain B
Set-ADComputer -Identity "TargetComputerName" -Server "DomainB.com" -PrincipalsAllowedToDelegateToAccount $FrontendAccount
# Note: If the Target Resource runs under a specific service account instead of the computer account (Local System), use Set-ADUser instead of Set-ADComputer.

Once this command successfully populates the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on the target resource, the Key Distribution Center (KDC) will allow the cross-domain delegation.

=======================

I hope this helps address your query! If this works for you, please consider hitting "Accept Answer" so other users facing this issue can easily find the solution as a reference.