Question
Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains three servers named SRV1, SRV2, and SRV3 that run Windows Server. The domain contains a user named User1.
You plan to perform the following tasks:
• Sign in to SRV1 as User1.
• Establish a PowerShell remoting session from SRV1 to SRV2.
• From the remoting session, invoke a command that targets SRV3 and runs the command in the security context of User1.
You need to configure resource-based Kerberos constrained delegation to support the planned tasks.
How should you complete the PowerShell script? To answer, select the appropriate options in the answer area.
```powershell
$SRV1 = $env:COMPUTERNAME
$SRV2 = Get-ADComputer -Identity SRV2
$SRV3 = Get-ADComputer -Identity SRV3
Set-ADComputer -Identity [1] -PrincipalsAllowedToDelegateToAccount [2]
```
NOTE: Each correct selection is worth one point.
Explanation
Set-ADComputer -Identity: $SRV3 — Resource-based Kerberos constrained delegation is configured on the *resource* (target) computer account, not on the front-end or middle-tier server, so the object being modified is SRV3, the machine that finally receives the command and must accept a delegated ticket for User1. Choosing $SRV1 or $SRV2 would set the attribute on the client or the intermediary, which has no effect on whether SRV3 honours the forwarded identity.
-PrincipalsAllowedToDelegateToAccount: $SRV2 — This parameter writes the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on SRV3, naming the account permitted to obtain a service ticket to SRV3 on behalf of another user; that account is SRV2, the middle-tier server hosting the PowerShell remoting session that must impersonate User1 when it reaches out to SRV3. $SRV1 is only the originating client and never requests the second-hop ticket itself, and $SRV3 cannot be its own delegating principal.
