Where can i see the setting in domain , if i enable "unconstrained Delegation" by using below command?
netdom.exe trust fabrikam.com /domain:contoso.com /EnableTGTDelegation:Yes
Where can i see the setting in domain , if i enable "unconstrained Delegation" by using below command?
netdom.exe trust fabrikam.com /domain:contoso.com /EnableTGTDelegation:Yes
PowerShell module for Active Directory.
Get-ADTrust -Filter *
Direction : BiDirectional
DisallowTransivity : False
DistinguishedName : CN=litware.com,CN=System,DC=contoso,DC=com
ForestTransitive : False
IntraForest : True
IsTreeParent : False
IsTreeRoot : False
Name : litware.com
ObjectClass : trustedDomain
ObjectGUID : 10233929-969d-453f-aaea-1a73f7659e74
SelectiveAuthentication : False
SIDFilteringForestAware : False
SIDFilteringQuarantined : False
Source : DC=contoso,DC=com
Target : litware.com
TGTDelegation : True
TrustAttributes : 32
TrustedPolicy :
TrustingPolicy :
TrustType : Uplevel
UplevelOnly : False
UsesAESKeys : False
UsesRC4Encryption : False
I don't have enough reputation to make a comment, so I'm going to post this as an answer:
When you enable TGT delegation via netdom trust x /domain:y /EnableTgtDelegation:Yes
(which is unsafe) then Get-ADTrust
shows TGTDelegation : True
.
When you disable TGT delegation via netdom trust x /domain:y /EnableTgtDelegation:No
(which is safe) then Get-ADTrust
shows TGTDelegation : False
.
This is on Windows Server 2019 Version 1809 (OS Build 17763.2061) with WSUS updates applied as of July 2021.
This disagrees with the comment @Darktux made on the other answer.