Great Kerberos Troubleshooting Tool

I have been looking into authentication issues between web servers and application servers, and the system engineer I have been working with introduced me to a great new tool called DelegConfig. This is a ASP.NET web application that you can install on the web server that you are troubleshooting, and test Kerberos delegation and authentication with databases, application servers, and domain controllers. This tool supports IIS 5, 6, 7, and 7.5. The report is easy to understand and lets you see at a glance where you problem is.

 

delegconfig

Once installed, you open a browser and hit the application and it will check the Kerberos settings for the account the application pool is using. Once you have checked and fixed any of those settings, you can test backend systems as well to make sure your "double-hop" settings are working. There are tests for access to file servers, Active Directory, SQL/SSAS/OLAP, as well as web servers.

 

Backend system Kerberos test

Leave a Reply

Name *
Email *
Website