Question
Your network contains two Active Directory Domain Services (AD DS) forests named contoso.com and fabrikam.com. A two-way forest trust exists between the forests. Each forest contains a single domain.
The domains contain the servers shown in the following table.
You need to configure resource based constrained delegation so that the users in contoso.com can use Windows Admin Center on Server1 to connect to Server2.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
| Name | Domain | Description |
| --- | --- | --- |
| Server1 | contoso.com | Hosts a Windows Admin Center gateway |
| Server2 | fabrikam.com | Hosts resources that will be managed remotely by using Windows Admin Center on Server1 |
Explanation
Resource-based constrained delegation is configured on the resource that accepts the delegated credentials, not on the front-end service. The target node, Server2 in fabrikam.com, is therefore the object you modify with -Identity (Get-ADComputer server2.fabrikam.com). The -PrincipalsAllowedToDelegateToAccount parameter lists the accounts that are allowed to delegate to that node, which is the Windows Admin Center gateway computer, (Get-ADComputer server1.contoso.com). Delegation is granted to the gateway's computer account, not to a user group: the users' own access to Server2 still depends on their permissions there. The command is Set-ADComputer -Identity (Get-ADComputer server2.fabrikam.com) -PrincipalsAllowedToDelegateToAccount (Get-ADComputer server1.contoso.com). Resource-based constrained delegation works across domains and forests with a trust, which the two-way forest trust provides.
