Enable Delegated Managed Service Account logons
This policy setting enables or disables delegated managed service account logons for this machine. If you enable this policy setting, delegated managed service account logons will be supported by the Kerberos client. Note that this policy has certain prerequites. The prerequisites and the directions to create a new delegated managed service account can be found at https://go.microsoft.com/fwlink/?linkid=2250379. If you disable or do not configure this policy setting, delegated managed service account logons will not be supported.
Policy Details
- Policy Name
- DelegatedMSAEnabled
- Registry Key
- Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
- Value Name
- DelegatedMSAEnabled
- Supported On
- At least Windows 11 Version 24H2
- Policy State Values
- Enabled: 1Disabled: 0
- Available Languages
- en-us
Configuration Elements
Syntax:
Enter a list of realms where DMSAs might exist.
Enter both the Fully Qualified Domain Name (FQDN) and the short name.
Enter one realm per line.
Details:
The Kerberos client will attempt to find a DMSA capable Domain Controller for the listed realms.
If no realms are specified, the Kerberos client will attempt to find a DMSA capable Domain Controller for all realms.
Realms:
Type: multiText