Updates to Microsoft Windows enables security hardening for Microsoft Windows Server, which blocks Ticket Granting Ticket (TGT) unconstrained delegation. This behavior causes Kerberos delegation to fail. In many ways, the failure seems to be a normal delegation failure, but is caused by a new feature.

Microsoft has implemented a netdom flag to control whether TGT delegation is permitted. You can control this flag by submitting the following netdom command:

In newer updates, Microsoft causes the flag to default to No. For cross-domain trusts to work with traditional unconstrained delegation, the flag must be set to Yes.

You can use the following power-shell command to list all of the accounts with unconstrained delegation from your AD Server:

If you examine the SASLogon9.4.log file, as shown below, you will see that the authentication completes but that the TGT seems to be empty:

Also, if you view the SASServer1_1 catalina.out file, you see a successful authentication, and the Kerberos ticket is shown. However, as in the SASLogon9.4.log file, the TGT is missing. The following error message is displayed, as well:

To resolve this problem, ask your Microsoft Active Directory administrator to change the EnableTGTDelegation flag to Yes on the domain controller.

Operating System and Release Information