Second Hop Remoting in PowerShell lets an administrator manage a server that is reachable only through an intermediate remote session. Without special setup, credentials used in the first session cannot be forwarded to the next machine, so the second hop fails. To solve this, you can choose CredSSP (Credential Security Support Provider) or Kerberos constrained delegation. CredSSP is simpler to enable but passes full credentials to the intermediate server, which raises the risk of credential theft. Kerberos constrained delegation gives you finer control and better security by limiting which services can act on the user’s behalf. The choice depends on your security requirements and whether the environment supports Kerberos authentication across the hybrid network of on-premises and Azure servers.
To implement Kerberos constrained delegation, three configuration steps are required. First, Service Principal Names (SPNs) must be registered correctly for each service that receives delegated credentials. Without a valid SPN, the delegation cannot be authenticated. Second, delegate permissions are set in Active Directory by specifying which accounts or computer objects are trusted to forward credentials and to which destination services. Third, firewall rules must allow the required traffic between the first-hop server, the intermediate server, and the target server, including both on-premises and Azure resources. These steps must be applied in the order listed: register SPNs, assign delegation permissions, then open the network ports.
After configuring delegation, you must verify that the setup works in practice. Start a PowerShell remote session, then attempt a command that reaches a third server (the second hop). If authentication succeeds and the command returns data, connectivity is confirmed. For ongoing assurance, monitor authentication logs on the Active Directory domain controllers and the intermediate servers to catch failed delegation attempts early. Regular validation helps you confirm that credentials are passed only where intended and that the firewall rules remain in place across the hybrid environment.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
Second hop remoting in PowerShell allows an administrator to manage a server that is reachable only through an intermediate remote session. Without special setup, credentials used in the first session cannot be forwarded to the next machine, so the second hop fails.
CredSSP is simpler to enable but passes full credentials to the intermediate server, raising the risk of credential theft. Kerberos constrained delegation gives finer control and better security by limiting which services can act on the user's behalf, and the choice depends on security requirements and whether Kerberos authentication is supported across the hybrid network.
First, Service Principal Names (SPNs) must be registered correctly for each service that receives delegated credentials. Second, delegate permissions are set in Active Directory by specifying which accounts or computer objects are trusted to forward credentials and to which destination services. Third, firewall rules must allow the required traffic between the first-hop server, the intermediate server, and the target server, including both on-premises and Azure resources.
Start a PowerShell remote session, then attempt a command that reaches a third server (the second hop). If authentication succeeds and the command returns data, connectivity is confirmed. For ongoing assurance, monitor authentication logs on the Active Directory domain controllers and the intermediate servers to catch failed delegation attempts early.
StudyCerts
StudyCerts