2.2.21 (L1) Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No O

2.2.21 (L1) Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One' (Automated)

Description

This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that's granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that's trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account doesn't have the Account can't be delegated account control flag set.

UserRights Policy CSPMicrosoftLearn

OMA-URI

Recommended Setting

Settings Catalog