Policy
Enable Delegated Managed Service Account logons
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows11
This policy setting enables or disables delegated managed service account logons for this machine. If you enable this policy setting, delegated managed service account logons will be supported by the Kerberos client. Note that this policy has certain prerequites. The prerequisites and the directions to create a new delegated managed service account can be found at https://go.microsoft.com/fwlink/?linkid=2250379. If you disable or do not configure this policy setting, delegated managed service account logons will not be supported.
Internal name
DelegatedMSAEnabled
Policy ID
ad7632f4067b
Elements
1
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
| Computer | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters Value name DelegatedMSAEnabled | REG_DWORD | HKLM 1 | HKLM 0 |
Registry location
Path
Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
Value name
DelegatedMSAEnabled
Hive
HKLM
Enabled value
1
Disabled value
0
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
| Computer | Realms: ID DmsaRealmsList | list | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters Value name DmsaRealms Type REG_MULTI_SZ | None |
Realms:
Registry mapping
Path
Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters
Value name
DmsaRealms
Type
REG_MULTI_SZ
DetailsNone