[Autogenerated] in this demonstration, we'll have a look at solving the Kerberos.
Second hot problem with credit SSP and then move
into just enough administration.
I'm on a machine here, let's do a host name called VM one.
It's part of my active directory domain.
And first to verify the problem, let's take a look at my code file by the way,
all of my code files are in the exercise files,
lets enter a PowerShell remoting session with VM to and then from that context,
let's attempt to invoke a command on VM three.
Now we want that to happen using delegated credentials.
That is my tIM account but we're going to see if we
paste this in an attempt to run it.
It bombs out because there's no delegation happening by default.
So what we're going to do is enable cred SSP both for
the local computer in the client role.
And we're going to delegate VM two dot tim w dot info to handle our credentials.
Let me click exit to close my remote session.
And what we're going to do to solve this problem is on line 11.
We're going to configure the local computer with the credit SSP client
role in the delegate computer is going to be VM to that's going to be
configured as the Ws MAN cred SSP servers.
So let me right click run this and then I can verify my cred
SSP settings with get Ws man cred SSP and it's telling us here
the machine is configured to allow delegating fresh credentials
to the following target,
but it's not configured to receive credentials for a remote
computer in order to set up our second computer.
VM two is a server.
I can do this, I'm going to do let me adjust this code a little bit.
I'm going to again do and invoke command against VM to and I'm going to
specify enable Ws man cred SSP in the role of server.
So let me right click this, click run good deal.
And so now to test this out,
let's do a enter PS session and notice that I'm specifying authentication.
Credit SSP, right-click run.
This is going to provide my credentials here like that in interactively and
now that I'm on VM to I can do this invoke command again.
Let me copy this to my clipboard me clear the screen,
right click paste that in and we get results back.
So there it is.
Now, if you're wondering, oh,
what if one of my colleagues has enabled this client server cred
SSP and then you decide that you want to do constrained Kerberos
delegation in a more secure way, Can you disable or remove it?
Absolutely.
You can first let me exit my PS session.
So I don't forget to do that.
I scroll down in the script file,
you can see I've got disabled Ws man cred SSP role client
and then we could if we wanted to disable Ws MAN cred SSP
in the server role as well. Makes sense