Question
Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a user named User1 and the servers shown in the following table.
| Name | Operating system |
|------|------------------|
| Server1 | Windows Server 2016 |
| Server2 | Windows Server 2022 |
| Backup1 | Windows Server 2019 |
User1 is a member of the Protected Users security group.
User1 performs the following actions:
• From Server1, establishes a remote PowerShell session on Server2
• From the PowerShell session on Server2, attempts to access a resource on Backup1
The request to access the resource on Backup1 is denied.
You need to ensure that User1 can access the resources on Backup1 by using the PowerShell session on Server2. The solution must follow the principle of least privilege and minimize administrative effort.
What should you configure?
- A. Kerberos delegation (unconstrained)
- B. CredSSP
- C. PSSessionConfiguration by using RunAs Correct
- D. resource-based Kerberos constrained delegation
Explanation
User1 is a member of Protected Users, and accounts in that group cannot be delegated with unconstrained or constrained delegation (resource-based constrained delegation included), and CredSSP does not work for them, so options A, B and D all fail for this user. A PowerShell session configuration registered on Server2 with a RunAs credential (Register-PSSessionConfiguration -RunAsCredential) runs the commands in User1's session under a separate account, so Server2 reaches Backup1 with that account's own credentials and no delegation of User1's credentials is needed. Give the RunAs account access only to the required resource on Backup1 and allow only User1 to use the endpoint, which follows least privilege and is configured on one server.
