Home > IT Answers > Security > Kerberos unconstrained delegation for MS SQL svc account
Calicdaj
5 pts.
 Kerberos unconstrained delegation for MS SQL svc account
Kerberos, MSSQL, SQL Server permissions, SQL Server security
Can an MS SQL service account run non-SQL services if "trust this user for delegation to any service (Kerberos only) has been enabled?

Software/Hardware used:
ASKED: June 30, 2010  2:11 AM
UPDATED: August 26, 2010  5:07 PM
RELATED QUESTIONS
Answer Wiki:
Yes. The account which runs the SQL Service is just a Windows account. It can be configured to run any service on the computer.
Last Wiki Answer Submitted:  June 30, 2010  7:07 pm  by  Denny Cherry   64,520 pts.
All Answer Wiki Contributors:  Denny Cherry   64,520 pts.
To see all answers submitted to the Answer Wiki: View Answer History.


RSS - Discussions Help
Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

 

Hello,
I’ve done this (IIS Impersonation + Constrained Kerberos Delegation) on IIS 6 and MSSQL2005. Now I’m doing a similar thing on IIS 7 and MSSQL 2008, but constrained delegation is not working (Selecting MSSqlSVC and port of the server). I tried unconstrained (Trust this computer for delegation to any service (Kerberos only)) and it does work. Does anyone have any clue?
Thanks

Sorio
 10 pts.